@mmnto/totem 1.114.0 → 1.115.0

package/dist/selection-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection-manifest.d.ts","sourceRoot":"","sources":["../src/selection-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;CAGvB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,0DAA2D,CAAC;AAC3F,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAInE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;IAEjC;;;;;;OAMG;;IAEH,uEAAuE;;IAEvE;;;;;OAKG;;IAKH,2EAA2E;;IAE3E,6DAA6D;;IAE7D;;;OAGG;;IAEH;;;OAGG;;IAEH,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoCpE,CAAC;AAEL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,qLAkBzB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAY1E,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B;;IAGnC,+CAA+C;;;IAG/C,gFAAgF;;IAEhF,wFAAwF;;IAExF,yEAAyE;;;IAGzE;;;;OAIG;;;;;;;;;;;;IAQH;;;OAGG;;;;;;;;;;;;;;;QA/IH;;;;;;WAMG;;QAEH,uEAAuE;;QAEvE;;;;;WAKG;;QAKH,2EAA2E;;QAE3E,6DAA6D;;QAE7D;;;WAGG;;QAEH;;;WAGG;;QAEH,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuHpE,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGlE,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAI9E;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEnE;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB,CAGA;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,WAAW,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG;IAAE,SAAS,EAAE,kBAAkB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CA4BtD;AAID,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA4BD,mEAAmE;AACnE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,oBAAoB,CAuB7F;AAID;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,CAoC9F;AAsBD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,sBAAsB,EAC7B,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC7B,uBAAuB,CAYzB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC7B,oBAAoB,EAAE,CAmCxB"}

package/dist/selection-manifest.js

@@ -0,0 +1,444 @@
+/**
+ * Per-seat selection manifests — the Prop 308 / strategy#467 M1 instrument
+ * (mmnto-ai/totem#2468).
+ *
+ * A selection manifest is a read-only record of one selection event: which
+ * candidates a consumer (session-start hook, `search_knowledge`, `totem
+ * orient`) considered on a seat's behalf, which it selected or excluded, what
+ * each cost, and the policy's own stated reason. It is a record of what each
+ * policy did — never a ranker, and it never adjudicates between policies.
+ *
+ * ## Contract (binding, from the Prop 308 round + the armed #467 pre-registration)
+ *
+ * - **No shared relevance score, no common weights** (Prop 308 F1, unanimous;
+ *   lc-codex refute condition). Both schema levels are `.strict()` so a shared
+ *   score field cannot be added without failing parse of existing rows — the
+ *   guard is structural, not a promise. Per-candidate `reason` strings carry
+ *   each policy's OWN words (a floor value in a search reason is that policy's
+ *   stated reason, not a common weight).
+ * - **Senses, never gates** (Tenet 13). Emission must never block, filter, or
+ *   alter a selection. Command call sites use {@link senseSelectionManifest};
+ *   the throwing writer exists so the contract is testable and a programming
+ *   error is never silent (the `qbd/record.ts` posture, mirrored).
+ * - **Named cost basis** (#467 outcome 3's naming requirement): every figure
+ *   names its aggregation — {@link SELECTION_COST_BASIS} is a fixed literal
+ *   stamped on every row. What the manifest emits is a PAYLOAD-BYTE census
+ *   with a declared token approximation; it is NOT the ruled `<total>` basis
+ *   (measured cache-aware consumption), and whether it may substitute for a
+ *   `<total>` surface is the pre-registration's call via versioned revision
+ *   (#467 §9), never this module's claim.
+ * - **No fabricated measurement:** a manifest records only what the policy
+ *   observed. Candidates the policy never read (recency-excluded journals,
+ *   first-match-losing proposals) are recorded id-only — no fingerprint, no
+ *   bytes. Emitters never over-fetch to manufacture exclusions, which would
+ *   alter the thing being measured.
+ * - **Recorded absence, never silent skip** (the #2466 clause): the
+ *   denominator lives in `events.ndjson` rows (`session_start`, `mcp_call`,
+ *   `derive_action`) that ship independently of this instrument. A denominator
+ *   row with no matching manifest row IS the recorded absence; a failed write
+ *   additionally warns on the emitter's accounting channel.
+ */
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { z } from 'zod';
+import { TotemError } from './errors.js';
+import { resolveQbdAgentSource } from './qbd/record.js';
+import { readSessionId } from './session-id.js';
+// ─── Constants ──────────────────────────────────────────
+const LEDGER_DIR = 'ledger';
+/**
+ * Sidecar file, NOT rows in `events.ndjson` (ruled 2026-08-10, #2468 OQ1):
+ * per-candidate arrays are bulky, and the event stream's existing consumers
+ * (QBD scanner, stats) keep their scan economics. Same directory, same
+ * append-only + gitignored conventions; growth is bounded the same way
+ * `events.ndjson` is (janitorial rotation is a separate, pre-existing class).
+ */
+export const SELECTION_MANIFESTS_FILE = 'selection-manifests.ndjson';
+/**
+ * The named aggregation stamped on every row (#467 outcome-3 requirement:
+ * a measure without its basis reports NOT OBSERVED — so the basis rides the
+ * data). `bytes` is the UTF-8 byte length of the exact content the policy
+ * considered; `approxTokens` is declared as the chars/4 approximation, never
+ * presented as a measured token count.
+ */
+export const SELECTION_COST_BASIS = {
+    bytes: 'utf8-length',
+    approxTokens: 'ceil(bytes/4) approximation',
+};
+/** Emitting consumers — the three selection surfaces named by #2468. */
+export const SELECTION_EMITTERS = ['session-start', 'search_knowledge', 'orient'];
+// ─── Schema ─────────────────────────────────────────────
+/**
+ * One candidate the policy observed. `.strict()` — see the module contract:
+ * no field can be added silently, which is the structural half of the Prop 308
+ * refute-condition guard.
+ */
+export const SelectionCandidateSchema = z
+    .object({
+    /**
+     * Candidate identity: repo-relative path or logical id. The coarse join
+     * key for the overlap number — a whole-file fingerprint and a chunk
+     * fingerprint of the same source will not collide, so cross-emitter joins
+     * anchor on `id` first and use `fingerprint` for exactness. Join policy
+     * belongs to the measurement pass, declared here rather than solved.
+     */
+    id: z.string().trim().min(1),
+    /** Linked-repo origin for federated hits; absent for primary/local. */
+    sourceRepo: z.string().trim().min(1).optional(),
+    /**
+     * sha256 hex, first 16 chars, over the EXACT bytes the policy considered.
+     * Absent when the policy never read the content (id-only exclusion) or
+     * when hashing failed (which also appends to `warnings` — an absent
+     * fingerprint is honest, a fabricated one never is).
+     */
+    fingerprint: z
+        .string()
+        .regex(/^[0-9a-f]{16}$/)
+        .optional(),
+    /** UTF-8 byte length of the considered content. Absent on id-only rows. */
+    bytes: z.number().int().nonnegative().optional(),
+    /** ceil(bytes/4), under the declared approximation basis. */
+    approxTokens: z.number().int().nonnegative().optional(),
+    /**
+     * What the policy did with this candidate. `truncated` = selected but
+     * partially delivered (`deliveredBytes` carries what actually shipped).
+     */
+    disposition: z.enum(['selected', 'truncated', 'excluded']),
+    /**
+     * The policy's own stated reason — the why-selected / why-excluded half
+     * that is invisible today. Free text owned by the emitting policy.
+     */
+    reason: z.string().trim().min(1),
+    /** For `truncated` rows: bytes actually delivered after the cut. */
+    deliveredBytes: z.number().int().nonnegative().optional(),
+})
+    .strict()
+    // Measured-candidate invariants (PR #2625 CR round): the builders produce
+    // exactly two shapes — id-only (nothing measured) or fully measured — so
+    // the schema refuses the partial states in between, and `deliveredBytes`
+    // is meaningful only on a truncated row and can never exceed the full
+    // measurement it was cut from.
+    .superRefine((c, ctx) => {
+    const measuredPresent = [c.fingerprint, c.bytes, c.approxTokens].filter((v) => v !== undefined).length;
+    if (measuredPresent !== 0 && measuredPresent !== 3) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'measured fields (fingerprint, bytes, approxTokens) travel together — a candidate is id-only or fully measured, never partial',
+        });
+    }
+    if (c.deliveredBytes !== undefined) {
+        if (c.disposition !== 'truncated') {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ['deliveredBytes'],
+                message: 'deliveredBytes is only meaningful on a truncated candidate',
+            });
+        }
+        if (c.bytes !== undefined && c.deliveredBytes > c.bytes) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ['deliveredBytes'],
+                message: 'deliveredBytes cannot exceed the full measured bytes',
+            });
+        }
+    }
+});
+/**
+ * The CLOSED set of per-emitter context keys. Closing the key space is the
+ * context-layer half of the Prop 308 refute-condition guard (PR #2625 CR
+ * round): with an open record, `context.sharedRelevanceScore` would have
+ * parsed cleanly and the "no shared score without a schema change" claim held
+ * only at the row/candidate layers. Adding a context key is now a deliberate
+ * schema change, exactly like adding a field.
+ */
+export const SELECTION_CONTEXT_KEYS = [
+    // search_knowledge
+    'query',
+    'boundary',
+    'typeFilter',
+    'floor',
+    'finalLimit',
+    'method',
+    'status',
+    'storesFailed',
+    'storesUnavailable',
+    // orient
+    'render',
+    // session-start (V2 hook + published templates)
+    'branch',
+    'ticket',
+    'selfAgent',
+    'template',
+];
+/**
+ * Per-emitter context: a FLAT scalar map over the closed key set. Flat by
+ * design — a nested structure is where a shared relevance model would grow,
+ * and the schema refuses it room; closed-keyed so it cannot grow one either.
+ */
+const SelectionContextSchema = z.record(z.enum(SELECTION_CONTEXT_KEYS), z.union([z.string(), z.number(), z.boolean(), z.null()]));
+/** One selection event — one NDJSON row in `selection-manifests.ndjson`. */
+export const SelectionManifestRowSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    /** ISO 8601 instant of the selection event. */
+    timestamp: z.string().datetime(),
+    emitter: z.enum(SELECTION_EMITTERS),
+    /** Session UUID from `.totem/ledger/.session-id` — the denominator join key. */
+    session_id: z.string().uuid().optional(),
+    /** Seat id from TOTEM_SELF_AGENT (ADR-078). Absent = stamped absence, never guessed. */
+    agent_source: z.string().trim().min(1).optional(),
+    /** Emitting package version, when the emitter can resolve it cheaply. */
+    cli_version: z.string().trim().min(1).optional(),
+    context: SelectionContextSchema,
+    /**
+     * Names the observable candidate pool (e.g. `store-returned-pool
+     * perStoreLimit=5`) — the honest boundary: exclusions are recorded only
+     * over candidates the emitter actually saw.
+     */
+    universe: z.string().trim().min(1),
+    costBasis: z
+        .object({
+        bytes: z.literal(SELECTION_COST_BASIS.bytes),
+        approxTokens: z.literal(SELECTION_COST_BASIS.approxTokens),
+    })
+        .strict(),
+    /**
+     * The session-start hook's global char slice — string-level, so its cut
+     * is NOT attributed per-candidate (declared limitation, not a gap).
+     */
+    finalTruncation: z
+        .object({
+        cap: z.number().int().positive(),
+        totalChars: z.number().int().nonnegative(),
+        applied: z.boolean(),
+    })
+        .strict()
+        .optional(),
+    candidates: z.array(SelectionCandidateSchema),
+    /** Per-row accounting: every non-fatal degradation names itself here. */
+    warnings: z.array(z.string()),
+})
+    .strict();
+// ─── Measurement helpers ────────────────────────────────
+/**
+ * Fingerprint the exact bytes a policy considered: sha256 hex, first 16.
+ * 64 bits of collision resistance is ample for a per-workspace corpus join
+ * key; the full digest would double every row's bulk for no analytical gain.
+ */
+export function fingerprintContent(content) {
+    return createHash('sha256').update(content).digest('hex').slice(0, 16);
+}
+/** Cost of a considered candidate under {@link SELECTION_COST_BASIS}. */
+export function measureCandidateCost(content) {
+    const bytes = typeof content === 'string' ? Buffer.byteLength(content, 'utf-8') : content.length;
+    return { bytes, approxTokens: Math.ceil(bytes / 4) };
+}
+/**
+ * Build a fully-measured candidate from content the policy actually read.
+ *
+ * TOTAL over its input space (leg round 1, H-7): a non-string/non-Buffer
+ * `content` (a store row whose unchecked cast lied) or a hash failure
+ * degrades to an ID-ONLY row with the failure named on the returned warning —
+ * it never throws into the emitting command, and it never persists a
+ * fabricated or NaN measurement.
+ */
+export function buildMeasuredCandidate(input) {
+    const idOnly = {
+        id: input.id,
+        disposition: input.disposition,
+        reason: input.reason,
+        ...(input.sourceRepo !== undefined && { sourceRepo: input.sourceRepo }),
+        ...(input.deliveredBytes !== undefined && { deliveredBytes: input.deliveredBytes }),
+    };
+    const content = input.content;
+    if (typeof content !== 'string' && !Buffer.isBuffer(content)) {
+        return {
+            candidate: idOnly,
+            warning: `selection-manifest: unmeasurable content for ${input.id} (got ${typeof content}) — recorded id-only`,
+        };
+    }
+    try {
+        const { bytes, approxTokens } = measureCandidateCost(content);
+        return {
+            candidate: { ...idOnly, bytes, approxTokens, fingerprint: fingerprintContent(content) },
+        };
+        // totem-context: intentional degradation — a measurement/hash failure records the candidate ID-ONLY and names the failure on the accounting channel; fabricating or dropping the row would both lie (Tenet 13).
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            candidate: idOnly,
+            warning: `selection-manifest: measurement failed for ${input.id}: ${msg} — recorded id-only`,
+        };
+    }
+}
+/**
+ * Is this an instrumented project at all? Same convention as
+ * `qbd/record.ts`: an absent `.totem` (ENOENT, or ENOTDIR — a path component
+ * being a file, the cross-platform divergence `session-id.ts` documents) is
+ * the honest "nothing here to instrument" state — skip silently rather than
+ * materialising a stray `.totem/ledger/` in whatever cwd an instrumented
+ * command ran from. Every OTHER errno (EACCES, I/O) is a real probe failure
+ * that must not masquerade as not-a-project (PR #2625 CR round): it returns a
+ * named warning so the skip lands on the accounting channel.
+ */
+function probeInstrumentedProject(totemDir) {
+    try {
+        return { instrumented: fs.statSync(totemDir).isDirectory() };
+        // totem-context: intentional degradation — a missing `.totem` is the honest "not a Totem project" state; any OTHER errno is reported via the returned warning (the accounting channel), never swallowed.
+    }
+    catch (err) {
+        const code = typeof err === 'object' && err !== null ? err.code : undefined;
+        if (code === 'ENOENT' || code === 'ENOTDIR')
+            return { instrumented: false };
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            instrumented: false,
+            warning: `selection-manifest: .totem probe failed (${msg}) — not recording`,
+        };
+    }
+}
+/** Stamp attribution + basis onto an emitter's assembled input. */
+export function buildSelectionManifestRow(input) {
+    const env = input.env ?? process.env;
+    const nowMs = input.nowMs ?? Date.now();
+    // An emitter that MINTED the session id this event belongs to passes it
+    // directly (the session-start hooks) — immune to the shared-pointer being
+    // rotated by a concurrent session between mint and emission (PR #2625 CR
+    // round, partial). Everyone else joins via the pointer.
+    const sessionId = input.sessionId ?? readSessionId(input.totemDir);
+    const agentSource = resolveQbdAgentSource(env);
+    return {
+        schemaVersion: 1,
+        timestamp: new Date(nowMs).toISOString(),
+        emitter: input.emitter,
+        ...(sessionId !== undefined && { session_id: sessionId }),
+        ...(agentSource !== undefined && { agent_source: agentSource }),
+        ...(input.cliVersion !== undefined && { cli_version: input.cliVersion }),
+        context: input.context,
+        universe: input.universe,
+        costBasis: { ...SELECTION_COST_BASIS },
+        ...(input.finalTruncation !== undefined && { finalTruncation: input.finalTruncation }),
+        candidates: input.candidates,
+        warnings: input.warnings ?? [],
+    };
+}
+// ─── Writers ────────────────────────────────────────────
+/**
+ * Validate and append one manifest row.
+ *
+ * Throws `SELECTION_MANIFEST_CONTRACT` on a schema-invalid row — that is a
+ * programming error in an emitter, and persisting it would hand the
+ * measurement pass a row `readSelectionManifests` silently skips (data loss
+ * dressed as data). I/O failures do not throw; they report through the
+ * returned `warnings` (the accounting channel).
+ */
+export function appendSelectionManifest(input) {
+    const warnings = [...(input.warnings ?? [])];
+    const probe = probeInstrumentedProject(input.totemDir);
+    if (!probe.instrumented) {
+        if (probe.warning !== undefined)
+            warnings.push(probe.warning);
+        return { written: false, skipped: true, warnings };
+    }
+    const row = buildSelectionManifestRow({ ...input, warnings });
+    const parsed = SelectionManifestRowSchema.safeParse(row);
+    if (!parsed.success) {
+        const detail = parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ');
+        throw new TotemError('SELECTION_MANIFEST_CONTRACT', `Refusing to write a selection-manifest row that violates the schema: ${detail}`, 'This is an emitter programming error — the manifest schema is strict by contract (Prop 308 F1 refute-condition guard); fix the emitter rather than widening the schema.');
+    }
+    let written = true;
+    try {
+        const ledgerDir = path.join(input.totemDir, LEDGER_DIR);
+        fs.mkdirSync(ledgerDir, { recursive: true });
+        fs.appendFileSync(path.join(ledgerDir, SELECTION_MANIFESTS_FILE), JSON.stringify(parsed.data) + '\n', 'utf-8');
+        // totem-context: intentional degradation — the manifest is telemetry; an I/O failure is recorded on the `warnings` accounting channel and the absence stays detectable via the denominator ledger rows (never a silent skip).
+    }
+    catch (err) {
+        written = false;
+        const msg = err instanceof Error ? err.message : String(err);
+        warnings.push(`selection-manifest: append failed: ${msg}`);
+    }
+    return { written, warnings };
+}
+/**
+ * Sensor-safe `appendSelectionManifest` — command call sites use this.
+ * Every degradation, including a thrown contract breach, surfaces through
+ * `onWarn`; there is no path that discards a failure silently, and no path
+ * that fails the instrumented command (Tenet 13).
+ */
+/**
+ * Deliver a warning to the caller's sink without letting the sink's own
+ * failure escape — an accounting-channel exception altering the instrumented
+ * command would invert Tenet 13 at the last step (PR #2625 CR round).
+ */
+function safeWarn(onWarn, msg) {
+    try {
+        onWarn?.(msg);
+        // totem-context: intentional swallow — a throwing warning SINK must not fail the instrumented command; the warning also remains in the returned `warnings` array, so nothing is lost.
+    }
+    catch (err) {
+        void err;
+    }
+}
+export function senseSelectionManifest(input, onWarn) {
+    try {
+        const result = appendSelectionManifest(input);
+        for (const warning of result.warnings)
+            safeWarn(onWarn, warning);
+        return result;
+        // totem-context: instrumentation is a sensor — a telemetry failure must never fail the instrumented command (Tenet 13); the failure is reported through onWarn, never discarded.
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        const warning = `selection-manifest sensor failed: ${msg}`;
+        safeWarn(onWarn, warning);
+        return { written: false, warnings: [warning] };
+    }
+}
+/**
+ * Read all manifest rows, skipping schema-invalid lines (the generic-consumer
+ * convention shared with `readLedgerEvents`; a measurement pass that must
+ * count rejects reads the file raw — same division of labor as QBD's
+ * compliance scanner).
+ */
+export function readSelectionManifests(totemDir, onWarn) {
+    const filePath = path.join(totemDir, LEDGER_DIR, SELECTION_MANIFESTS_FILE);
+    let content;
+    try {
+        content = fs.readFileSync(filePath, 'utf-8');
+        // totem-context: intentional degradation — ENOENT is the normal no-manifests-yet state; every other read failure is REPORTED through onWarn (the accounting channel), never swallowed, and the reader degrades to empty rather than failing its caller (Tenet 13 sensor posture, mirroring readLedgerEvents).
+    }
+    catch (err) {
+        const code = typeof err === 'object' && err !== null ? err.code : undefined;
+        if (code === 'ENOENT')
+            return [];
+        const msg = err instanceof Error ? err.message : String(err);
+        onWarn?.(`selection-manifest read failed: ${msg}`);
+        return [];
+    }
+    const rows = [];
+    let malformed = 0;
+    for (const line of content.split('\n')) {
+        if (line.trim().length === 0)
+            continue;
+        try {
+            const parsed = SelectionManifestRowSchema.safeParse(JSON.parse(line));
+            if (parsed.success)
+                rows.push(parsed.data);
+            // totem-context: intentional skip of malformed lines — generic consumers mirror readLedgerEvents; the AGGREGATE count is reported through onWarn below, and reject-counting consumers read the file raw by contract.
+        }
+        catch (err) {
+            void err;
+            malformed += 1;
+        }
+    }
+    // One aggregate line, not one per row — a torn or hand-edited file must not
+    // turn the accounting channel into a firehose (PR #2625 CR round).
+    if (malformed > 0) {
+        onWarn?.(`selection-manifest: skipped ${malformed} malformed line(s) — reject-counting consumers read the file raw`);
+    }
+    return rows;
+}
+//# sourceMappingURL=selection-manifest.js.map

package/dist/selection-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection-manifest.js","sourceRoot":"","sources":["../src/selection-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,2DAA2D;AAE3D,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,KAAK,EAAE,aAAa;IACpB,YAAY,EAAE,6BAA6B;CACnC,CAAC;AAEX,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,eAAe,EAAE,kBAAkB,EAAE,QAAQ,CAAU,CAAC;AAG3F,2DAA2D;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN;;;;;;OAMG;IACH,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;;OAKG;IACH,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,CAAC;SACvB,QAAQ,EAAE;IACb,2EAA2E;IAC3E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAChD,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1D;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,oEAAoE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE;IACT,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,+BAA+B;KAC9B,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,CACrE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CACvB,CAAC,MAAM,CAAC;IACT,IAAI,eAAe,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,8HAA8H;SACjI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,gBAAgB,CAAC;gBACxB,OAAO,EAAE,4DAA4D;aACtE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,gBAAgB,CAAC;gBACxB,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAIL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,mBAAmB;IACnB,OAAO;IACP,UAAU;IACV,YAAY;IACZ,OAAO;IACP,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,mBAAmB;IACnB,SAAS;IACT,QAAQ;IACR,gDAAgD;IAChD,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,UAAU;CACF,CAAC;AAIX;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CACrC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACzD,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,+CAA+C;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACnC,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACxC,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,yEAAyE;IACzE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,sBAAsB;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC;QAC5C,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC;KAC3D,CAAC;SACD,MAAM,EAAE;IACX;;;OAGG;IACH,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;KACrB,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC7C,yEAAyE;IACzE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,2DAA2D;AAE3D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAAC,OAAwB;IAI3D,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjG,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAOtC;IACC,MAAM,MAAM,GAAuB;QACjC,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;KACpF,CAAC;IACF,MAAM,OAAO,GAAY,KAAK,CAAC,OAAO,CAAC;IACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,gDAAgD,KAAK,CAAC,EAAE,SAAS,OAAO,OAAO,sBAAsB;SAC/G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO;YACL,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE;SACxF,CAAC;QACF,gNAAgN;IAClN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,8CAA8C,KAAK,CAAC,EAAE,KAAK,GAAG,qBAAqB;SAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAqCD;;;;;;;;;GASG;AACH,SAAS,wBAAwB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,yMAAyM;IAC3M,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,YAAY,EAAE,KAAK;YACnB,OAAO,EAAE,4CAA4C,GAAG,mBAAmB;SAC5E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,yBAAyB,CAAC,KAA6B;IACrE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACzD,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,EAAE,GAAG,oBAAoB,EAAE;QACtC,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;QACtF,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED,2DAA2D;AAE3D;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA6B;IACnE,MAAM,QAAQ,GAAa,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,yBAAyB,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,IAAI,UAAU,CAClB,6BAA6B,EAC7B,wEAAwE,MAAM,EAAE,EAChF,yKAAyK,CAC1K,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,EAAE,CAAC,cAAc,CACf,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAClC,OAAO,CACR,CAAC;QACF,8NAA8N;IAChO,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,KAAK,CAAC;QAChB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,SAAS,QAAQ,CAAC,MAA2C,EAAE,GAAW;IACxE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACd,sLAAsL;IACxL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,GAAG,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAA6B,EAC7B,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC9C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;QACd,iLAAiL;IACnL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,qCAAqC,GAAG,EAAE,CAAC;QAC3D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,MAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC;IAC3E,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,8SAA8S;IAChT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,qNAAqN;QACvN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,GAAG,CAAC;YACT,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,EAAE,CACN,+BAA+B,SAAS,kEAAkE,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/selection-manifest.test.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Writer + schema tests for the selection-manifest instrument
+ * (mmnto-ai/totem#2468 — the Prop 308 / strategy#467 M1 emitter substrate).
+ *
+ * The invariants under test come verbatim from the design doc
+ * (.totem/specs/2468-selection-manifests.md):
+ *
+ *  - the schema is strict at BOTH levels — the structural refute-condition
+ *    guard (Prop 308 F1: no shared score field can appear silently);
+ *  - a fingerprint covers exactly the considered bytes: stable on identical
+ *    content, changed on changed content, ABSENT (with a named warning) on
+ *    hash failure — never fabricated;
+ *  - attribution is stamped absence: no env/seat/session → fields absent,
+ *    never guessed;
+ *  - emission is a pure sensor: a failed append leaves the caller unbroken
+ *    and the failure named on the accounting channel; a schema-invalid row
+ *    THROWS from the writer (emitter programming error) and is converted to
+ *    a warning by the sense wrapper;
+ *  - a `.totem`-less cwd is a silent normal-state skip that materialises no
+ *    directory.
+ *
+ * The EACCES induced-failure uses vi.spyOn on `node:fs` (accounting-branch
+ * coverage, same scoping rationale as qbd/record.test.ts documents).
+ */
+export {};
+//# sourceMappingURL=selection-manifest.test.d.ts.map

package/dist/selection-manifest.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection-manifest.test.d.ts","sourceRoot":"","sources":["../src/selection-manifest.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG"}