@holmes-lab/holmes-kit 0.19.6 → 0.20.1

package/dist/holmes/spec/entity-renumber-transaction.js

@@ -0,0 +1,711 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entitySourcePublicationOwner = void 0;
+exports.withEntitySourceInspection = withEntitySourceInspection;
+exports.withRecoveredSourcePublication = withRecoveredSourcePublication;
+exports.entityRenumberTarget = entityRenumberTarget;
+exports.prepareEntityRenumberPlan = prepareEntityRenumberPlan;
+exports.validateEntityRenumberPlan = validateEntityRenumberPlan;
+exports.entityRenumberRecoveryTarget = entityRenumberRecoveryTarget;
+exports.validateEntityRenumberRecoveryPlan = validateEntityRenumberRecoveryPlan;
+exports.planEntityRenumberRecovery = planEntityRenumberRecovery;
+exports.abandonEntityRenumber = abandonEntityRenumber;
+exports.recoverEntityRenumber = recoverEntityRenumber;
+exports.applyEntityRenumber = applyEntityRenumber;
+// @implements A-SPEC-629, A-SPEC-628
+// @implements A-SPEC-641
+// @implements A-SPEC-640
+// @implements A-SPEC-639
+// @implements A-SPEC-634
+const path = __importStar(require("node:path"));
+const fs = __importStar(require("node:fs"));
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const entity_store_1 = require("./entity-store");
+const entity_renumber_1 = require("./entity-renumber");
+const renumber_1 = require("./renumber");
+const spec_parser_1 = require("./spec-parser");
+const transition_policy_1 = require("./transition-policy");
+const entity_transaction_1 = require("./entity-transaction");
+const workspace_identity_1 = require("../project/workspace-identity");
+// A reserved coordination namespace, independent of every configured spec store (A-SPEC-634: the value lives in entity-transaction).
+const sourcePublication = entity_transaction_1.SOURCE_PUBLICATION_LOCATOR;
+const entitySourcePublicationOwner = (root) => (0, entity_transaction_1.entityLockOwner)(root, sourcePublication);
+exports.entitySourcePublicationOwner = entitySourcePublicationOwner;
+/** Caller holds the destination store first; inspection shares the existing publication namespace. */
+async function withEntitySourceInspection(root, act) {
+    return (0, entity_transaction_1.withEntityStoreLockAsync)(root, sourcePublication, async () => {
+        assertSourceReservation(root, '');
+        const owner = (0, entity_transaction_1.entityLockOwner)(root, sourcePublication);
+        const result = await act();
+        if (!owner || !(0, node_util_1.isDeepStrictEqual)((0, entity_transaction_1.entityLockOwner)(root, sourcePublication), owner))
+            throw new entity_transaction_1.EntityStoreError('unknown-owner', 'Source inspection ownership changed.');
+        assertSourceReservation(root, '');
+        return result;
+    });
+}
+const isRenumberJournal = (schema) => schema === 'holmes-entity-renumber-journal/1' || schema === 'holmes-entity-renumber-journal/2';
+/** Store ownership is acquired first. Publication callbacks are synchronous. */
+function sourceOwnershipReceipt(operationId, journalVersion, owner) {
+    return JSON.stringify({ schema: 'holmes-renumber-source-owner/1', operationId, journalVersion, owner });
+}
+function sourceOwnershipPath(journalFile, owner) {
+    return path.posix.dirname(journalFile) + '/source-owners/' + owner.token + '.json';
+}
+function assertSourceOwnershipReceipt(root, receipt) {
+    if (receipt && !safeRead(root, receipt.file)?.equals(receipt.bytes))
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'Resumed source ownership receipt changed before publication.');
+}
+function withRecoveredSourcePublication(root, operationId, expected, act, journal) {
+    const publish = () => { assertSourceReservation(root, operationId); return act(); };
+    const owner = (0, entity_transaction_1.entityLockOwner)(root, sourcePublication);
+    if (!owner) {
+        // A completed retry only verifies bytes and audit. It creates no new source obligation.
+        if (!journal)
+            return publish();
+        return (0, entity_transaction_1.withEntityStoreLock)(root, sourcePublication, () => {
+            assertSourceReservation(root, operationId);
+            if (version(safeRead(root, journal.file)) !== journal.version)
+                throw new entity_transaction_1.EntityStoreError('plan-changed', 'Source ownership cannot bind a changed journal.');
+            const acquired = (0, entity_transaction_1.entityLockOwner)(root, sourcePublication);
+            if (!acquired)
+                throw new entity_transaction_1.EntityStoreError('unknown-owner', 'Resumed publication requires source ownership.');
+            (0, entity_transaction_1.publishEntityRecord)(root, sourceOwnershipPath(journal.file, acquired), sourceOwnershipReceipt(operationId, journal.version, acquired));
+            return act();
+        });
+    }
+    if (!expected || !(0, node_util_1.isDeepStrictEqual)(owner, expected))
+        throw new entity_transaction_1.EntityStoreError('store-busy', 'Shared source publication belongs to another or unbound operation.');
+    return (0, entity_transaction_1.withEntityRecoveryLock)(root, sourcePublication, () => {
+        if (!(0, node_util_1.isDeepStrictEqual)((0, entity_transaction_1.entityLockOwner)(root, sourcePublication), expected))
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'Source publication ownership changed before recovery.');
+        return publish();
+    });
+}
+/** Exceptions release physical locks, but the durable operation still reserves publication. */
+function assertSourceReservation(root, operationId) {
+    const pending = (0, entity_transaction_1.entityDirectory)(root, '.ax/state/entity-transactions');
+    if (!fs.existsSync(pending))
+        return;
+    for (const operation of fs.readdirSync(pending).sort()) {
+        const bytes = safeRead(root, '.ax/state/entity-transactions/' + operation + '/journal.json');
+        if (!bytes)
+            throw new entity_transaction_1.EntityStoreError('store-busy', 'Pending publication changed or has no journal; inspect before retrying.');
+        let journal;
+        try {
+            journal = JSON.parse(bytes.toString('utf8'));
+        }
+        catch {
+            throw new entity_transaction_1.EntityStoreError('invalid-plan', 'An unreadable pending journal prevents source publication.');
+        }
+        if ((isRenumberJournal(journal?.schema) || journal?.schema === 'holmes-entity-integration-journal/1') && operation !== operationId)
+            throw new entity_transaction_1.EntityStoreError('store-busy', 'Another pending operation reserves shared source publication; recover that operation first.');
+    }
+}
+const encoded = (text) => Buffer.from(text).toString('base64');
+const version = (bytes) => bytes ? (0, entity_transaction_1.entityContentVersion)(bytes) : null;
+function safeRead(root, file) {
+    if (!file || /[\\:\x00]/.test(file) || file.split('/').some(p => !p || p === '.' || p === '..'))
+        throw new entity_transaction_1.EntityStoreError('unsafe-path', 'Renumber input is not a canonical workspace locator.');
+    return (0, entity_transaction_1.readEntityBytes)(path.join((0, entity_transaction_1.entityDirectory)(root, path.posix.dirname(file)), path.posix.basename(file)));
+}
+function entityRenumberTarget(plan) {
+    return 'entity-store:renumber:' + (0, entity_transaction_1.entityContentVersion)(JSON.stringify(plan));
+}
+/** Build candidates through the same transition policy as the ordinary official tools. No writes. */
+function prepareEntityRenumberPlan(root, snapshot, changes, sources, operationId = (0, node_crypto_1.randomUUID)(), originalSources = new Map()) {
+    const proposal = (0, entity_renumber_1.planEntityRenumber)(snapshot.entries, changes);
+    if (!proposal.ok)
+        throw new entity_transaction_1.EntityStoreError('plan-conflict', proposal.conflicts.join('\n'));
+    if (sources.diagnostics.length)
+        throw new entity_transaction_1.EntityStoreError('source-coverage', 'Resolve source discovery diagnostics before application.');
+    for (const file of sources.files)
+        for (const id of file.anchorIds) {
+            if (snapshot.referenceNamespaces.some(r => r.displayId === id && r.storeId !== snapshot.storeId))
+                throw new entity_transaction_1.EntityStoreError('ambiguous-reference', 'An anchor names multiple activated stores: ' + id);
+        }
+    const texts = new Map(snapshot.entries.map(e => [e.entityId, e.text]));
+    const documents = new Map(snapshot.entries.map(e => [snapshot.storeLocator + '/' + e.documentLocator, encoded(e.text)]));
+    const steps = [], policyFiles = new Map(), approvalTargets = new Set();
+    const specs = () => [...texts.values()].map(spec_parser_1.parseSpec);
+    const add = (phase, locator, before, after, specId) => {
+        if (before !== after)
+            steps.push({ phase, ...(specId ? { specId } : {}), change: { locator, before, after } });
+    };
+    for (const id of proposal.unsealOrder) {
+        const entry = proposal.entries.find(e => e.oldId === id), before = texts.get(entry.entityId);
+        const prepared = (0, transition_policy_1.prepareLifecycleSpec)((0, spec_parser_1.parseSpec)(before), specs(), 'unseal');
+        if (!prepared.ok)
+            throw new entity_transaction_1.EntityStoreError('spec-policy-refused', prepared.reason);
+        const after = (0, entity_renumber_1.replaceFrontmatter)(before, prepared.candidate), locator = snapshot.storeLocator + '/' + entry.documentLocator;
+        add('unseal', locator, encoded(before), encoded(after), id);
+        texts.set(entry.entityId, after);
+        documents.set(locator, encoded(after));
+        approvalTargets.add(id);
+    }
+    const desired = new Map();
+    for (const entry of proposal.entries) {
+        const before = texts.get(entry.entityId), prior = (0, spec_parser_1.parseSpec)(before), transformed = (0, spec_parser_1.parseSpec)(entry.after);
+        const candidate = { ...prior, id: transformed.id, dependsOn: transformed.dependsOn };
+        const after = candidate.id !== prior.id || !(0, node_util_1.isDeepStrictEqual)(candidate.dependsOn, prior.dependsOn) ? (0, entity_renumber_1.replaceFrontmatter)(before, candidate) : before;
+        texts.set(entry.entityId, after);
+        desired.set(snapshot.storeLocator + '/' + entry.newDocumentLocator, encoded(after));
+        if (prior.status === 'approved' && entry.oldId !== entry.newId) {
+            approvalTargets.add(entry.oldId);
+            approvalTargets.add(entry.newId);
+        }
+    }
+    // Derive all destinations from the original UUID map, including simultaneous swaps.
+    for (const locator of [...new Set([...documents.keys(), ...desired.keys()])].sort())
+        add('document', locator, documents.get(locator) ?? null, desired.get(locator) ?? null);
+    for (const entry of proposal.entries) {
+        const original = snapshot.entries.find(e => e.entityId === entry.entityId);
+        const mapping = JSON.parse(original.mapping);
+        if (entry.oldId !== entry.newId || entry.documentLocator !== entry.newDocumentLocator) {
+            add('mapping', '.ax/entities/records/' + entry.entityId + '.json', encoded(original.mapping), encoded(JSON.stringify({ ...mapping, displayId: entry.newId, documentLocator: entry.newDocumentLocator })));
+        }
+    }
+    for (const source of sources.files)
+        add('source', source.file, encoded(source.before), encoded(source.after));
+    for (const id of proposal.approveOrder) {
+        const entry = proposal.entries.find(e => e.newId === id), before = texts.get(entry.entityId);
+        const prepared = (0, transition_policy_1.prepareApprovedSpec)((0, spec_parser_1.parseSpec)(before), specs(), all => parent => all.find(s => s.id === parent) ?? null, file => {
+            const bytes = originalSources.has(file) ? Buffer.from(originalSources.get(file)) : safeRead(root, file);
+            policyFiles.set(file, version(bytes));
+            return sources.files.find(source => source.file === file)?.after ?? bytes?.toString('utf8') ?? null;
+        });
+        // A-SPEC-641: a multi-document act names the document it refuses on.
+        if (!prepared.ok)
+            throw new entity_transaction_1.EntityStoreError('spec-policy-refused', id + ': ' + prepared.reason);
+        const after = (0, entity_renumber_1.replaceFrontmatter)(before, prepared.candidate);
+        add('approve', snapshot.storeLocator + '/' + entry.newDocumentLocator, encoded(before), encoded(after), id);
+        texts.set(entry.entityId, after);
+        approvalTargets.add(id);
+    }
+    return { schema: 'holmes-entity-renumber/1', operationId, snapshot, changes: changes.map(c => ({ ...c })), sources,
+        policyFiles: [...policyFiles].sort(([a], [b]) => a.localeCompare(b)).map(([file, version]) => ({ file, version })), approvalTargets: [...approvalTargets].sort(), steps };
+}
+function inputVersions(plan) {
+    const expected = new Map();
+    const bind = (file, digest) => {
+        if (expected.has(file) && expected.get(file) !== digest)
+            throw new entity_transaction_1.EntityStoreError('plan-conflict', 'Different inputs name the same path: ' + file);
+        expected.set(file, digest);
+    };
+    const s = plan.snapshot;
+    bind('.ax/entities/stores/' + s.storeId + '.json', s.registrationVersion);
+    for (const entry of s.entries) {
+        bind(s.storeLocator + '/' + entry.documentLocator, (0, entity_transaction_1.entityContentVersion)(entry.text));
+        bind('.ax/entities/records/' + entry.entityId + '.json', entry.mappingVersion);
+    }
+    for (const source of plan.sources.inventory)
+        bind(source.file, source.version);
+    bind('.gitignore', plan.sources.ignoreVersion);
+    for (const file of plan.policyFiles)
+        bind(file.file, file.version);
+    for (const step of plan.steps)
+        if (!expected.has(step.change.locator))
+            bind(step.change.locator, step.change.before === null ? null : (0, entity_transaction_1.entityContentVersion)(Buffer.from(step.change.before, 'base64')));
+    return expected;
+}
+function assertVersions(root, expected) {
+    for (const [file, digest] of expected)
+        if (version(safeRead(root, file)) !== digest)
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'Renumber input changed: ' + file);
+}
+function assertMembership(root, plan, expected) {
+    const actualDocuments = [];
+    const walk = (relative) => {
+        const dir = (0, entity_transaction_1.entityDirectory)(root, relative);
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const file = relative + '/' + entry.name;
+            if (entry.isSymbolicLink())
+                throw new entity_transaction_1.EntityStoreError('unsafe-path', 'A symlink appeared in the specification inventory.');
+            if (entry.isDirectory())
+                walk(file);
+            else if (entry.name.endsWith('.md')) {
+                safeRead(root, file);
+                actualDocuments.push(file);
+            }
+        }
+    };
+    walk(plan.snapshot.storeLocator);
+    const documents = [...expected].filter(([file, digest]) => digest !== null && file.startsWith(plan.snapshot.storeLocator + '/') && file.endsWith('.md')).map(([file]) => file).sort();
+    if (!(0, node_util_1.isDeepStrictEqual)(actualDocuments.sort(), documents))
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'The document inventory changed outside the renumber operation.');
+    const records = (0, entity_transaction_1.entityDirectory)(root, '.ax/entities/records');
+    const names = fs.readdirSync(records).filter(name => name.endsWith('.json')).sort();
+    const expectedNames = plan.snapshot.referenceNamespaces.map(r => r.entityId + '.json').sort();
+    if (names.length !== expectedNames.length || names.some((name, i) => name !== expectedNames[i]))
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'The entity namespace inventory changed.');
+    for (const ref of plan.snapshot.referenceNamespaces.filter(r => r.storeId !== plan.snapshot.storeId)) {
+        const bytes = safeRead(root, '.ax/entities/records/' + ref.entityId + '.json');
+        let current;
+        try {
+            current = JSON.parse(bytes?.toString('utf8') ?? 'null');
+        }
+        catch {
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'An entity namespace record is unreadable.');
+        }
+        if (!current || Object.entries(ref).some(([key, value]) => current[key] !== value))
+            throw new entity_transaction_1.EntityStoreError('ambiguous-reference', 'Another store changed the reference namespace.');
+    }
+}
+function validateEntityRenumberPlan(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Provide the exact inspected renumber plan.');
+    const plan = value;
+    const keys = ['schema', 'operationId', 'snapshot', 'changes', 'sources', 'policyFiles', 'approvalTargets', 'steps'];
+    if (Object.keys(plan).length !== keys.length || keys.some(k => !Object.prototype.hasOwnProperty.call(plan, k)) || plan.schema !== 'holmes-entity-renumber/1' || typeof plan.operationId !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(plan.operationId) || !Array.isArray(plan.changes) || plan.changes.some(c => !c || typeof c.entityId !== 'string' || typeof c.newDisplayId !== 'string'))
+        throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Unsupported renumber plan fields.');
+    const object = (v, fields) => {
+        if (!v || typeof v !== 'object' || Array.isArray(v) || Object.keys(v).length !== fields.length || fields.some(k => !Object.prototype.hasOwnProperty.call(v, k)))
+            throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Unsupported nested renumber plan fields.');
+    };
+    const uuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(v);
+    const digest = (v) => typeof v === 'string' && /^sha256:[0-9a-f]{64}$/.test(v);
+    const locator = (v) => typeof v === 'string' && !!v && !/[\\:\x00]/.test(v) && v.split('/').every(p => !!p && p !== '.' && p !== '..');
+    const fail = () => { throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Invalid renumber snapshot or source inventory.'); };
+    for (const change of plan.changes)
+        object(change, ['entityId', 'newDisplayId']);
+    object(plan.snapshot, ['workspaceId', 'storeId', 'storeLocator', 'registrationVersion', 'entries', 'referenceNamespaces']);
+    const s = plan.snapshot;
+    if (!uuid(s.workspaceId) || !uuid(s.storeId) || !locator(s.storeLocator) || !digest(s.registrationVersion) || !Array.isArray(s.entries) || !Array.isArray(s.referenceNamespaces))
+        fail();
+    for (const entry of s.entries) {
+        object(entry, ['entityId', 'documentLocator', 'text', 'mapping', 'mappingVersion']);
+        if (!uuid(entry.entityId) || !locator(entry.documentLocator) || typeof entry.text !== 'string' || typeof entry.mapping !== 'string' || (0, entity_transaction_1.entityContentVersion)(entry.mapping) !== entry.mappingVersion)
+            fail();
+        let mapping;
+        try {
+            mapping = JSON.parse(entry.mapping);
+        }
+        catch {
+            fail();
+        }
+        object(mapping, ['schema', 'workspaceId', 'storeId', 'entityId', 'displayId', 'documentLocator', 'origin']);
+        object(mapping.origin, ['kind', 'operationId']);
+        if (mapping.schema !== 'holmes-entity/1' || mapping.entityId !== entry.entityId || mapping.workspaceId !== s.workspaceId || mapping.storeId !== s.storeId || mapping.documentLocator !== entry.documentLocator || mapping.displayId !== (0, spec_parser_1.parseSpec)(entry.text).id || !uuid(mapping.origin.operationId) || !['adopted', 'created'].includes(mapping.origin.kind))
+            fail();
+    }
+    const seen = new Set();
+    for (const ref of s.referenceNamespaces) {
+        object(ref, ['entityId', 'displayId', 'storeId', 'workspaceId']);
+        if (!uuid(ref.entityId) || !uuid(ref.storeId) || !uuid(ref.workspaceId) || typeof ref.displayId !== 'string' || seen.has(ref.entityId))
+            fail();
+        seen.add(ref.entityId);
+    }
+    if (s.entries.some(e => !s.referenceNamespaces.some(r => r.entityId === e.entityId && r.storeId === s.storeId && r.workspaceId === s.workspaceId && r.displayId === (0, spec_parser_1.parseSpec)(e.text).id)) || s.referenceNamespaces.filter(r => r.storeId === s.storeId).length !== s.entries.length)
+        fail();
+    object(plan.sources, ['files', 'inventory', 'diagnostics', 'proseCandidates', 'ignoreVersion']);
+    if (!Array.isArray(plan.sources.files) || !Array.isArray(plan.sources.inventory) || !Array.isArray(plan.sources.diagnostics) || !Array.isArray(plan.sources.proseCandidates) || (plan.sources.ignoreVersion !== null && !digest(plan.sources.ignoreVersion)) || !Array.isArray(plan.policyFiles) || !Array.isArray(plan.approvalTargets) || !Array.isArray(plan.steps))
+        fail();
+    for (const source of plan.sources.files) {
+        object(source, ['file', 'before', 'after', 'version', 'anchorIds']);
+        if (!locator(source.file) || typeof source.before !== 'string' || typeof source.after !== 'string' || source.version !== (0, entity_transaction_1.entityContentVersion)(source.before) || !Array.isArray(source.anchorIds) || source.anchorIds.some(id => typeof id !== 'string'))
+            fail();
+    }
+    for (const file of [...plan.sources.inventory, ...plan.policyFiles]) {
+        object(file, ['file', 'version']);
+        if (!locator(file.file) || (file.version !== null && !digest(file.version)))
+            fail();
+    }
+    for (const step of plan.steps) {
+        if (!step || typeof step !== 'object' || Array.isArray(step))
+            fail();
+        object(step, ['phase', 'change', ...(step.specId === undefined ? [] : ['specId'])]);
+        object(step.change, ['locator', 'before', 'after']);
+        if (!['unseal', 'document', 'mapping', 'source', 'approve'].includes(step.phase) || !locator(step.change.locator))
+            fail();
+        for (const bytes of [step.change.before, step.change.after])
+            if (bytes !== null && (typeof bytes !== 'string' || Buffer.from(bytes, 'base64').toString('base64') !== bytes))
+                fail();
+    }
+    // Neither application nor recovery trusts after bytes: both regenerate the complete program.
+    return JSON.parse(JSON.stringify(plan));
+}
+function entityRenumberRecoveryTarget(plan) {
+    return 'entity-store:renumber-recover:' + (0, entity_transaction_1.entityContentVersion)(JSON.stringify(plan));
+}
+function validateEntityRenumberRecoveryPlan(value) {
+    const keys = ['schema', 'workspaceId', 'storeLocator', 'operationId', 'journalVersion', 'lockOwner', 'appliedSteps', 'state'];
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length !== keys.length || keys.some(k => !Object.prototype.hasOwnProperty.call(value, k)))
+        throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Provide the exact inspected recovery plan.');
+    const p = value;
+    const uuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(v);
+    const digest = (v) => typeof v === 'string' && /^sha256:[0-9a-f]{64}$/.test(v);
+    if (p.schema !== 'holmes-entity-renumber-recovery/1' || !uuid(p.workspaceId) || !uuid(p.operationId) || !digest(p.journalVersion) || typeof p.storeLocator !== 'string' || !p.storeLocator || /[\\:\x00]/.test(p.storeLocator) || p.storeLocator.split('/').some(part => !part || part === '.' || part === '..') || !Number.isSafeInteger(p.appliedSteps) || p.appliedSteps < -1 || !['pending', 'applied', 'conflict'].includes(p.state))
+        throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Invalid recovery identifiers or state.');
+    if (p.lockOwner !== null && (!p.lockOwner || typeof p.lockOwner !== 'object' || Object.keys(p.lockOwner).length !== 2 || !uuid(p.lockOwner.token) || !digest(p.lockOwner.version)))
+        throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Invalid recovery ownership binding.');
+    return JSON.parse(JSON.stringify(p));
+}
+async function retryCompletedRenumber(storeRoot, request, authorize, audit) {
+    const bound = (0, entity_store_1.entityStoreBinding)(storeRoot), directory = '.ax/state/entity-completed/' + request.operationId;
+    const receiptBytes = safeRead(bound.root, directory + '/completion.json'), journalBytes = safeRead(bound.root, directory + '/journal.json');
+    if (!receiptBytes && !journalBytes)
+        return undefined;
+    if (!receiptBytes || !journalBytes)
+        throw new entity_transaction_1.EntityStoreError('completion-conflict', 'Completion requires both the original receipt and journal.');
+    authorize();
+    const owner = (0, entity_transaction_1.entityLockOwner)(bound.root, bound.locator);
+    const prepare = async () => {
+        const assertReceipt = () => {
+            if (!safeRead(bound.root, directory + '/completion.json')?.equals(receiptBytes) || !safeRead(bound.root, directory + '/journal.json')?.equals(journalBytes) || safeRead(bound.root, '.ax/state/entity-transactions/' + request.operationId + '/journal.json'))
+                throw new entity_transaction_1.EntityStoreError('completion-conflict', 'Completion evidence changed or has a conflicting pending copy.');
+        };
+        assertReceipt();
+        let receipt;
+        try {
+            receipt = JSON.parse(receiptBytes.toString('utf8'));
+        }
+        catch {
+            throw new entity_transaction_1.EntityStoreError('completion-conflict', 'Malformed completion receipt.');
+        }
+        const fields = ['schema', 'operationId', 'storeLocator', 'lockOwner', 'journalVersion'];
+        if (!receipt || Object.keys(receipt).length !== fields.length || fields.some(k => !Object.prototype.hasOwnProperty.call(receipt, k)) || receipt.schema !== 'holmes-entity-completion/1' || receipt.operationId !== request.operationId || receipt.storeLocator !== bound.locator || receipt.journalVersion !== (0, entity_transaction_1.entityContentVersion)(journalBytes))
+            throw new entity_transaction_1.EntityStoreError('completion-conflict', 'Completion does not bind this operation and journal.');
+        // Reuse the closed owner/schema validator, without treating the former owner as current authority.
+        validateEntityRenumberRecoveryPlan({ schema: 'holmes-entity-renumber-recovery/1', workspaceId: request.schema === 'holmes-entity-renumber/1' ? request.snapshot.workspaceId : request.workspaceId, storeLocator: bound.locator,
+            operationId: request.operationId, journalVersion: receipt.journalVersion, lockOwner: receipt.lockOwner, appliedSteps: 0, state: 'pending' });
+        if (!receipt.lockOwner)
+            throw new entity_transaction_1.EntityStoreError('completion-conflict', 'Completion has no owned publication receipt.');
+        if (owner && !(0, node_util_1.isDeepStrictEqual)(owner, receipt.lockOwner))
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'The current lock belongs to a different operation.');
+        const { plan, sourceOwner, ownershipReceipt } = readRenumberJournal(storeRoot, request.operationId, true);
+        if (request.schema === 'holmes-entity-renumber/1') {
+            if (!(0, node_util_1.isDeepStrictEqual)(request, plan))
+                throw new entity_transaction_1.EntityStoreError('plan-changed', 'The requested plan differs from the completed operation.');
+        }
+        else if (request.workspaceId !== plan.snapshot.workspaceId || request.storeLocator !== bound.locator || request.journalVersion !== receipt.journalVersion || request.appliedSteps > plan.steps.length || (request.lockOwner && !(0, node_util_1.isDeepStrictEqual)(request.lockOwner, receipt.lockOwner)))
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'The recovery request differs from the completed operation.');
+        if (appliedPrefix(bound.root, plan) !== plan.steps.length)
+            throw new entity_transaction_1.EntityStoreError('external-change', 'The completed operation no longer matches current files.');
+        const proposal = (0, entity_renumber_1.planEntityRenumber)(plan.snapshot.entries, plan.changes);
+        if (!proposal.ok)
+            throw new entity_transaction_1.EntityStoreError('invalid-plan', proposal.conflicts.join('\n'));
+        const originals = new Map(plan.sources.files.map(source => [source.file, source.before]));
+        const sources = await (0, renumber_1.planSourceRenumber)(bound.root, proposal.entries.filter(e => e.oldId !== e.newId).map(e => ({ oldId: e.oldId, newId: e.newId })), path.relative(bound.root, bound.store).split(path.sep).join('/'), originals);
+        const canonical = prepareEntityRenumberPlan(bound.root, plan.snapshot, plan.changes, sources, plan.operationId, originals);
+        if (!(0, node_util_1.isDeepStrictEqual)(canonical, plan))
+            throw new entity_transaction_1.EntityStoreError('spec-policy-refused', 'Completed journal differs from canonical source or specification transitions.');
+        const expected = inputVersions(canonical);
+        for (const step of canonical.steps)
+            expected.set(step.change.locator, step.change.after === null ? null : (0, entity_transaction_1.entityContentVersion)(Buffer.from(step.change.after, 'base64')));
+        return () => withRecoveredSourcePublication(bound.root, plan.operationId, sourceOwner, () => {
+            assertSourceOwnershipReceipt(bound.root, ownershipReceipt);
+            if (owner && !(0, node_util_1.isDeepStrictEqual)((0, entity_transaction_1.entityLockOwner)(bound.root, bound.locator), owner))
+                throw new entity_transaction_1.EntityStoreError('plan-changed', 'Completion ownership changed while preparing recovery.');
+            assertReceipt();
+            assertVersions(bound.root, expected);
+            assertMembership(bound.root, canonical, expected);
+            authorize();
+            audit(canonical, true);
+            assertSourceOwnershipReceipt(bound.root, ownershipReceipt);
+            assertReceipt();
+            assertVersions(bound.root, expected);
+            return { ok: true, state: 'completed', operationId: canonical.operationId };
+        });
+    };
+    if (!owner)
+        return (0, entity_transaction_1.withEntityStoreLockAsync)(bound.root, bound.locator, async () => (await prepare())());
+    const finish = await prepare();
+    if (!(0, node_util_1.isDeepStrictEqual)((0, entity_transaction_1.entityLockOwner)(bound.root, bound.locator), owner))
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'Completion ownership changed before recovery claim.');
+    return (0, entity_transaction_1.withEntityRecoveryLock)(bound.root, bound.locator, () => {
+        return finish();
+    });
+}
+function readRenumberJournal(storeRoot, operationId, completed = false) {
+    const bound = (0, entity_store_1.entityStoreBinding)(storeRoot);
+    const file = '.ax/state/' + (completed ? 'entity-completed/' : 'entity-transactions/') + operationId + '/journal.json', bytes = safeRead(bound.root, file);
+    if (!bytes)
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'The pending renumber journal disappeared.');
+    let journal;
+    try {
+        journal = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Malformed renumber journal.');
+    }
+    if (!journal || !isRenumberJournal(journal.schema) || Object.keys(journal).length !== (journal.schema === 'holmes-entity-renumber-journal/2' ? 3 : 2) || !journal.plan)
+        throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Unsupported renumber journal fields.');
+    const plan = validateEntityRenumberPlan(journal.plan), identity = (0, workspace_identity_1.workspaceIdentity)(bound.root);
+    let sourceOwner = journal.schema === 'holmes-entity-renumber-journal/2' ? journal.sourceOwner : null;
+    if (journal.schema === 'holmes-entity-renumber-journal/2') {
+        if (!sourceOwner)
+            throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Source publication requires a journal ownership binding.');
+        validateEntityRenumberRecoveryPlan({ schema: 'holmes-entity-renumber-recovery/1', workspaceId: plan.snapshot.workspaceId,
+            storeLocator: bound.locator, operationId, journalVersion: (0, entity_transaction_1.entityContentVersion)(bytes), lockOwner: sourceOwner, appliedSteps: 0, state: 'pending' });
+    }
+    if (plan.operationId !== operationId || plan.snapshot.storeLocator !== bound.locator || identity.state !== 'registered' || identity.workspaceId !== plan.snapshot.workspaceId)
+        throw new entity_transaction_1.EntityStoreError('foreign-workspace', 'Journal identity differs from this workspace and store.');
+    let registration;
+    try {
+        registration = JSON.parse(safeRead(bound.root, '.ax/entities/stores/' + plan.snapshot.storeId + '.json')?.toString('utf8') ?? 'null');
+    }
+    catch {
+        throw new entity_transaction_1.EntityStoreError('invalid-plan', 'The registered store is unreadable.');
+    }
+    if (!registration || registration.schema !== 'holmes-entity-store/1' || registration.workspaceId !== plan.snapshot.workspaceId || registration.storeId !== plan.snapshot.storeId || registration.storeLocator !== bound.locator)
+        throw new entity_transaction_1.EntityStoreError('foreign-workspace', 'The journal does not identify the configured registered store.');
+    const currentSourceOwner = (0, entity_transaction_1.entityLockOwner)(bound.root, sourcePublication);
+    let ownershipReceipt;
+    if (currentSourceOwner && !(0, node_util_1.isDeepStrictEqual)(currentSourceOwner, sourceOwner)) {
+        const receiptFile = sourceOwnershipPath(file, currentSourceOwner), receiptBytes = safeRead(bound.root, receiptFile);
+        if (receiptBytes) {
+            if (receiptBytes.toString('utf8') !== sourceOwnershipReceipt(operationId, (0, entity_transaction_1.entityContentVersion)(bytes), currentSourceOwner))
+                throw new entity_transaction_1.EntityStoreError('plan-changed', 'Resumed source ownership receipt differs from this operation, journal or current owner.');
+            sourceOwner = currentSourceOwner;
+            ownershipReceipt = { file: receiptFile, bytes: receiptBytes };
+        }
+    }
+    return { bound, file, bytes, plan, sourceOwner, ownershipReceipt };
+}
+function appliedPrefix(root, plan) {
+    // @implements A-SPEC-640 — a lone aside beside an absent target is read as the target.
+    const expected = inputVersions(plan), actual = new Map([...expected].map(([file]) => [file, version((0, entity_transaction_1.observeEntityTarget)(root, file).bytes)]));
+    const matches = () => [...expected].every(([file, digest]) => actual.get(file) === digest);
+    let applied = matches() ? 0 : -1;
+    plan.steps.forEach((step, i) => {
+        expected.set(step.change.locator, step.change.after === null ? null : (0, entity_transaction_1.entityContentVersion)(Buffer.from(step.change.after, 'base64')));
+        if (matches())
+            applied = i + 1;
+    });
+    return applied;
+}
+function planEntityRenumberRecovery(storeRoot) {
+    const bound = (0, entity_store_1.entityStoreBinding)(storeRoot), pending = (0, entity_transaction_1.entityDirectory)(bound.root, '.ax/state/entity-transactions');
+    const lockOwner = (0, entity_transaction_1.entityLockOwner)(bound.root, bound.locator);
+    const sourceOwner = (0, entity_transaction_1.entityLockOwner)(bound.root, sourcePublication);
+    const candidates = [];
+    if (fs.existsSync(pending))
+        for (const operation of fs.readdirSync(pending).sort()) {
+            const bytes = safeRead(bound.root, '.ax/state/entity-transactions/' + operation + '/journal.json');
+            if (!bytes)
+                throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Pending operation has no readable journal.');
+            let raw;
+            try {
+                raw = JSON.parse(bytes.toString('utf8'));
+            }
+            catch {
+                throw new entity_transaction_1.EntityStoreError('invalid-plan', 'Malformed pending journal.');
+            }
+            if (isRenumberJournal(raw?.schema) && raw.plan?.snapshot?.storeLocator === bound.locator)
+                candidates.push({ operation, completed: false });
+        }
+    const completed = (0, entity_transaction_1.entityDirectory)(bound.root, '.ax/state/entity-completed');
+    if ((lockOwner || sourceOwner) && fs.existsSync(completed))
+        for (const operation of fs.readdirSync(completed).sort()) {
+            const receiptBytes = safeRead(bound.root, '.ax/state/entity-completed/' + operation + '/completion.json');
+            if (!receiptBytes)
+                continue;
+            let receipt;
+            try {
+                receipt = JSON.parse(receiptBytes.toString('utf8'));
+            }
+            catch {
+                throw new entity_transaction_1.EntityStoreError('completion-conflict', 'Unreadable completed operation receipt.');
+            }
+            if (receipt?.schema !== 'holmes-entity-completion/1' || receipt.storeLocator !== bound.locator)
+                continue;
+            if (lockOwner && !(0, node_util_1.isDeepStrictEqual)(receipt.lockOwner, lockOwner))
+                continue;
+            const journalBytes = safeRead(bound.root, '.ax/state/entity-completed/' + operation + '/journal.json');
+            if (!journalBytes || receipt.operationId !== operation || receipt.journalVersion !== (0, entity_transaction_1.entityContentVersion)(journalBytes))
+                throw new entity_transaction_1.EntityStoreError('completion-conflict', 'Completed journal differs from its owned receipt.');
+            let raw;
+            try {
+                raw = JSON.parse(journalBytes.toString('utf8'));
+            }
+            catch {
+                throw new entity_transaction_1.EntityStoreError('completion-conflict', 'Unreadable completed journal.');
+            }
+            if (isRenumberJournal(raw?.schema) && (lockOwner || (sourceOwner && (0, node_util_1.isDeepStrictEqual)(readRenumberJournal(storeRoot, operation, true).sourceOwner, sourceOwner))))
+                candidates.push({ operation, completed: true });
+        }
+    if (candidates.length !== 1)
+        throw new entity_transaction_1.EntityStoreError('recovery-selection', 'Recovery requires one pending renumber or completed operation retaining this lock.');
+    const { bytes, plan } = readRenumberJournal(storeRoot, candidates[0].operation, candidates[0].completed), appliedSteps = appliedPrefix(bound.root, plan);
+    if (!(0, node_util_1.isDeepStrictEqual)((0, entity_transaction_1.entityLockOwner)(bound.root, bound.locator), lockOwner))
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'Recovery ownership changed during inspection.');
+    if (!(0, node_util_1.isDeepStrictEqual)((0, entity_transaction_1.entityLockOwner)(bound.root, sourcePublication), sourceOwner))
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'Source ownership changed during inspection.');
+    return { schema: 'holmes-entity-renumber-recovery/1', workspaceId: plan.snapshot.workspaceId, storeLocator: bound.locator,
+        operationId: plan.operationId, journalVersion: (0, entity_transaction_1.entityContentVersion)(bytes), lockOwner,
+        appliedSteps, state: appliedSteps < 0 ? 'conflict' : appliedSteps === plan.steps.length ? 'applied' : 'pending' };
+}
+/** No publication until current source semantics and official transition candidates match the journal. */
+/**
+ * @implements A-SPEC-639 — abandon a pending renumber a third state blocked: revert the operation's
+ * own publications, preserve foreign bytes, audit and retire it as abandoned under both ownerships.
+ */
+async function abandonEntityRenumber(storeRoot, inspected, authorize, audit) {
+    const request = validateEntityRenumberRecoveryPlan(inspected);
+    const bound = (0, entity_store_1.entityStoreBinding)(storeRoot);
+    if (request.state === 'applied' || safeRead(bound.root, '.ax/state/entity-completed/' + request.operationId + '/completion.json'))
+        throw new entity_transaction_1.EntityStoreError('unsupported-recovery', 'Only a pending renumber can be abandoned; a completed operation is already retired.');
+    const observed = planEntityRenumberRecovery(storeRoot);
+    if (!(0, node_util_1.isDeepStrictEqual)(observed, request))
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'Inspect the current recovery plan before authorizing its abandonment.');
+    const { file, bytes, plan, sourceOwner, ownershipReceipt } = readRenumberJournal(storeRoot, observed.operationId);
+    authorize();
+    return (0, entity_transaction_1.withEntityRecoveryLock)(bound.root, bound.locator, () => withRecoveredSourcePublication(bound.root, plan.operationId, sourceOwner, () => {
+        if (!safeRead(bound.root, file)?.equals(bytes))
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'Recovery journal changed.');
+        assertSourceOwnershipReceipt(bound.root, ownershipReceipt);
+        if (observed.lockOwner && !(0, node_util_1.isDeepStrictEqual)((0, entity_transaction_1.entityLockOwner)(bound.root, bound.locator), observed.lockOwner))
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'Initial ownership changed before abandonment.');
+        authorize();
+        (0, entity_transaction_1.settleEntityTransients)(bound.root, plan.steps.map(step => step.change)); // @implements A-SPEC-640
+        const outcome = (0, entity_transaction_1.abandonPublishedSteps)(bound.root, plan.steps.map(step => step.change));
+        audit(plan, outcome);
+        (0, entity_transaction_1.abandonEntityOperation)(bound.root, plan.operationId, bound.locator, (0, entity_transaction_1.entityContentVersion)(bytes), outcome);
+        return { ok: true, state: 'abandoned', operationId: plan.operationId, ...outcome };
+    }, { file, version: (0, entity_transaction_1.entityContentVersion)(bytes) }));
+}
+async function recoverEntityRenumber(storeRoot, inspected, authorize, audit, beforePublish) {
+    const request = validateEntityRenumberRecoveryPlan(inspected);
+    const completed = await retryCompletedRenumber(storeRoot, request, authorize, audit);
+    if (completed)
+        return completed;
+    const observed = planEntityRenumberRecovery(storeRoot);
+    if (!(0, node_util_1.isDeepStrictEqual)(observed, inspected))
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'Inspect the current recovery plan before authorizing it.');
+    if (observed.appliedSteps < 0)
+        throw new entity_transaction_1.EntityStoreError('external-change', 'Files match no valid renumber stage; preserve external edits.');
+    const { bound, file, bytes, plan, sourceOwner, ownershipReceipt } = readRenumberJournal(storeRoot, observed.operationId);
+    authorize();
+    const proposal = (0, entity_renumber_1.planEntityRenumber)(plan.snapshot.entries, plan.changes);
+    if (!proposal.ok)
+        throw new entity_transaction_1.EntityStoreError('invalid-plan', proposal.conflicts.join('\n'));
+    const originals = new Map(plan.sources.files.map(source => [source.file, source.before]));
+    const sources = await (0, renumber_1.planSourceRenumber)(bound.root, proposal.entries.filter(e => e.oldId !== e.newId).map(e => ({ oldId: e.oldId, newId: e.newId })), path.relative(bound.root, bound.store).split(path.sep).join('/'), originals);
+    const canonical = prepareEntityRenumberPlan(bound.root, plan.snapshot, plan.changes, sources, plan.operationId, originals);
+    if (!(0, node_util_1.isDeepStrictEqual)(canonical, plan))
+        throw new entity_transaction_1.EntityStoreError('spec-policy-refused', 'Journal differs from canonical source or official specification transitions.');
+    if (!(0, node_util_1.isDeepStrictEqual)(planEntityRenumberRecovery(storeRoot), observed))
+        throw new entity_transaction_1.EntityStoreError('plan-changed', 'Recovery inputs changed while computing candidates.');
+    return (0, entity_transaction_1.withEntityRecoveryLock)(bound.root, bound.locator, () => withRecoveredSourcePublication(bound.root, plan.operationId, sourceOwner, () => {
+        const assertJournal = () => {
+            if (!safeRead(bound.root, file)?.equals(bytes))
+                throw new entity_transaction_1.EntityStoreError('plan-changed', 'Recovery journal changed.');
+            assertSourceOwnershipReceipt(bound.root, ownershipReceipt);
+        };
+        assertJournal();
+        if (observed.lockOwner && !(0, node_util_1.isDeepStrictEqual)((0, entity_transaction_1.entityLockOwner)(bound.root, bound.locator), observed.lockOwner))
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'Initial ownership changed before recovery.');
+        const prefix = appliedPrefix(bound.root, canonical);
+        if (prefix !== observed.appliedSteps)
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'The inspected renumber stage changed.');
+        const expected = inputVersions(canonical);
+        for (const step of canonical.steps.slice(0, prefix))
+            expected.set(step.change.locator, step.change.after === null ? null : (0, entity_transaction_1.entityContentVersion)(Buffer.from(step.change.after, 'base64')));
+        for (const id of canonical.approvalTargets)
+            authorize(id);
+        (0, entity_transaction_1.settleEntityTransients)(bound.root, canonical.steps.map(step => step.change)); // @implements A-SPEC-640 — after every refusal point, before the replay
+        for (const step of canonical.steps.slice(prefix)) {
+            assertJournal();
+            assertVersions(bound.root, expected);
+            assertMembership(bound.root, canonical, expected);
+            authorize();
+            for (const id of canonical.approvalTargets)
+                authorize(id);
+            beforePublish?.(canonical);
+            (0, entity_transaction_1.applyEntityByteChange)(bound.root, step.change);
+            expected.set(step.change.locator, step.change.after === null ? null : (0, entity_transaction_1.entityContentVersion)(Buffer.from(step.change.after, 'base64')));
+        }
+        assertJournal();
+        assertVersions(bound.root, expected);
+        assertMembership(bound.root, canonical, expected);
+        authorize();
+        audit(canonical);
+        assertJournal();
+        assertVersions(bound.root, expected);
+        (0, entity_transaction_1.retireEntityOperation)(bound.root, canonical.operationId, bound.locator, (0, entity_transaction_1.entityContentVersion)(bytes));
+        return { ok: true, state: 'completed', operationId: canonical.operationId };
+    }, { file, version: (0, entity_transaction_1.entityContentVersion)(bytes) }));
+}
+async function applyEntityRenumber(storeRoot, plan, authorize, audit, beforePublish) {
+    const completed = await retryCompletedRenumber(storeRoot, plan, authorize, (_plan, verifyOnly) => audit(verifyOnly));
+    if (completed)
+        return completed;
+    const bound = (0, entity_store_1.entityStoreBinding)(storeRoot);
+    return (0, entity_store_1.withEntityRenumberSnapshot)(storeRoot, async (snapshot, assertCurrent) => {
+        if (!(0, node_util_1.isDeepStrictEqual)(snapshot, plan.snapshot))
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'The activated document or identity inventory changed.');
+        const proposal = (0, entity_renumber_1.planEntityRenumber)(snapshot.entries, plan.changes);
+        if (!proposal.ok)
+            throw new entity_transaction_1.EntityStoreError('plan-conflict', proposal.conflicts.join('\n'));
+        const sources = await (0, renumber_1.planSourceRenumber)(bound.root, proposal.entries.filter(e => e.oldId !== e.newId).map(e => ({ oldId: e.oldId, newId: e.newId })), path.relative(bound.root, bound.store).split(path.sep).join('/'));
+        const fresh = prepareEntityRenumberPlan(bound.root, snapshot, plan.changes, sources, plan.operationId);
+        if (!(0, node_util_1.isDeepStrictEqual)(fresh, plan))
+            throw new entity_transaction_1.EntityStoreError('plan-changed', 'The plan differs from current canonical inputs and transition policy.');
+        const expected = inputVersions(fresh);
+        return (0, entity_transaction_1.withEntityStoreLock)(bound.root, sourcePublication, () => {
+            assertSourceReservation(bound.root, fresh.operationId);
+            assertCurrent();
+            assertVersions(bound.root, expected);
+            authorize();
+            for (const id of fresh.approvalTargets)
+                authorize(id);
+            const journal = JSON.stringify({ schema: 'holmes-entity-renumber-journal/2', plan: fresh, sourceOwner: (0, entity_transaction_1.entityLockOwner)(bound.root, sourcePublication) });
+            const journalLocator = '.ax/state/entity-transactions/' + fresh.operationId + '/journal.json';
+            (0, entity_transaction_1.publishEntityRecord)(bound.root, journalLocator, journal);
+            for (const step of fresh.steps) {
+                if (safeRead(bound.root, journalLocator)?.toString('utf8') !== journal)
+                    throw new entity_transaction_1.EntityStoreError('plan-changed', 'Renumber journal changed during publication.');
+                assertVersions(bound.root, expected);
+                assertMembership(bound.root, fresh, expected);
+                authorize();
+                for (const id of fresh.approvalTargets)
+                    authorize(id);
+                if (step.specId)
+                    authorize(step.specId);
+                beforePublish?.(fresh);
+                (0, entity_transaction_1.applyEntityByteChange)(bound.root, step.change);
+                expected.set(step.change.locator, step.change.after === null ? null : (0, entity_transaction_1.entityContentVersion)(Buffer.from(step.change.after, 'base64')));
+            }
+            assertVersions(bound.root, expected);
+            assertMembership(bound.root, fresh, expected);
+            authorize();
+            audit();
+            assertVersions(bound.root, expected);
+            (0, entity_transaction_1.retireEntityOperation)(bound.root, fresh.operationId, bound.locator, (0, entity_transaction_1.entityContentVersion)(journal));
+            return { ok: true, state: 'completed', operationId: fresh.operationId };
+        });
+    });
+}