@mmnto/totem 1.122.0 → 1.124.0

package/dist/artifacts/legs.js

@@ -0,0 +1,577 @@
+/**
+ * Leg-deposit contract — the machine-readable record a falsification leg
+ * leaves behind after it READ a diff (mmnto-ai/totem#2698, ruled 2026-09-03).
+ *
+ * The gate's question is deliberately narrow: *was THIS head read by a leg?*
+ * So the store is keyed by the READ sha — `<totemDir>/artifacts/legs/<diffSha>.json`
+ * — and NOT content-addressed like the verdict/admission/run families. Two
+ * legs that read the same head are the same answer to that question; a rerun
+ * on the same head supersedes by INTENT, which is why the writer is
+ * create-exclusive and a `replace` discloses the `readAt` it overwrote rather
+ * than silently deduping (the content-addressed stores' EEXIST-is-dedup rule
+ * would be a lie here — the second read is a different observation).
+ *
+ * Store mechanics still mirror the sibling families where the semantics agree:
+ * validate-on-write so a writer bug never poisons the store, a
+ * tolerant-within-major reader whose newer-major refusal is NAMED (an older
+ * CLI meeting a newer deposit reports "upgrade", never "corrupt"), unknown
+ * keys tolerated (forward-minor additive fields), and `0o600` bytes.
+ *
+ * Two properties are specific to this family:
+ *
+ * 1. **The loader never throws.** A deposit is a hand-editable JSON file that
+ *    a pre-push hook reads on every push; one bad file must never take the
+ *    gate down or hide a valid sibling. Every per-file failure — unreadable,
+ *    non-JSON, schema-invalid, wrong major, or a filename that disagrees with
+ *    the stored `diffSha` — becomes a one-line `corrupt` row the caller
+ *    prints (Tenet 4: loud, never silent).
+ * 2. **Every stored string that reaches stdout is control-byte free at the
+ *    SCHEMA boundary**, at write and at read alike. `verdict`, `claim`,
+ *    `counterexample` and `file` land inside a hook's `[Totem] …` line; a
+ *    newline in any of them would forge a second line, so the schema refuses
+ *    C0 (0-31) and DEL/C1 (127-159) outright. "Single-line" needs no separate
+ *    rule: LF and CR are inside that band.
+ *
+ * Core never shells out. Ancestry is supplied by the CLI through the injected
+ * {@link LegGitAdapter}, so every resolution rule here is unit-testable
+ * without a git fixture.
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { z } from 'zod';
+import { TotemError } from '../errors.js';
+import { writeFileAtomicSync } from '../fs-atomic.js';
+// ─── Schema version (mirrors the RunArtifact / panel F1 policy) ─────────────
+/** The leg-deposit schemaVersion WRITTEN by this code. Readers accept any 1.x. */
+export const LEG_DEPOSIT_SCHEMA_VERSION = '1.0.0';
+/** The major this reader understands; another major needs a migration entry. */
+export const LEG_DEPOSIT_KNOWN_MAJOR = 1;
+/** Major-1 semver literal — keep in sync with {@link LEG_DEPOSIT_KNOWN_MAJOR}. */
+const LEG_SCHEMA_VERSION_RE = /^1\.\d+\.\d+$/;
+/**
+ * Accept any 1.x version; refuse another major with a NAMED reason (the panel
+ * precedent). Zod `.regex()` is the validation boundary — not a bare
+ * `RegExp.test` — so the ZodError carries the offending value, and the
+ * refusal reads the same at write and at read.
+ */
+const legSchemaVersionField = z.string().regex(LEG_SCHEMA_VERSION_RE, {
+    message: `unsupported leg-deposit schemaVersion — this reader understands major ${LEG_DEPOSIT_KNOWN_MAJOR}.x; a newer major needs a newer @mmnto/cli`,
+});
+/** The read sha: a full 40-char lowercase git object name, never abbreviated. */
+const DIFF_SHA_RE = /^[0-9a-f]{40}$/;
+/** Finding ids are filename-safe and short — they are echoed and cross-referenced. */
+const LEG_FINDING_ID_RE = /^[A-Za-z0-9_-]{1,32}$/;
+// ─── Control-byte discipline ────────────────────────────────────────────────
+/**
+ * True when `text` carries any C0 (0-31) or DEL/C1 (127-159) code point.
+ *
+ * Written as a `charCodeAt` loop on purpose, mirroring the pre-commit hook's
+ * `safe()` (`install-hooks.ts`): the equivalent regex character class would
+ * have to be authored with `\u`/`\x` escapes, and this repo has a banked
+ * incident where an editing tool decoded such an escape into a RAW control
+ * byte in the source. The loop states the same rule with no escape to decode.
+ * U+0085 (NEL) is inside the band because it breaks a line on some terminals.
+ */
+function hasControlByte(text) {
+    for (let i = 0; i < text.length; i++) {
+        const code = text.charCodeAt(i);
+        if (code < 32 || (code >= 127 && code <= 159))
+            return true;
+    }
+    return false;
+}
+/** Replace every control byte with `?` — used for the one-line `corrupt` reasons. */
+function toSingleLine(text) {
+    let out = '';
+    for (let i = 0; i < text.length; i++) {
+        const code = text.charCodeAt(i);
+        const control = code < 32 || (code >= 127 && code <= 159);
+        out = out + (control ? '?' : text.charAt(i));
+    }
+    return out;
+}
+/** A string field that reaches a hook's stdout: no C0/C1 bytes, hence single-line. */
+function controlFreeText(label) {
+    return z.string().refine((value) => !hasControlByte(value), {
+        message: `${label} must be a single line free of control characters (C0 0-31, DEL/C1 127-159) — the value is echoed on the gate's stdout`,
+    });
+}
+/** Same, but also non-empty. */
+function requiredControlFreeText(label) {
+    return z
+        .string()
+        .min(1, `${label} must not be empty`)
+        .refine((value) => !hasControlByte(value), {
+        message: `${label} must be a single line free of control characters (C0 0-31, DEL/C1 127-159) — the value is echoed on the gate's stdout`,
+    });
+}
+// ─── Findings ───────────────────────────────────────────────────────────────
+/**
+ * The leg's severity vocabulary. Deliberately NOT the verdict family's
+ * CRITICAL/WARN/INFO: a leg deposit answers "what did the leg find", and the
+ * doctrine spelling for that is BLOCKING (the fold must land) / MATERIAL (the
+ * seat rules) / MINOR (disclosed). Order here is documentation order; the
+ * value is data. One spelling — {@link LegFindingSeveritySchema} is built
+ * from this array, never a second literal list.
+ */
+export const LEG_FINDING_SEVERITIES = ['BLOCKING', 'MATERIAL', 'MINOR'];
+export const LegFindingSeveritySchema = z.enum(LEG_FINDING_SEVERITIES);
+/** The finding id — required, so `folded` can NAME a finding rather than index it. */
+export const LegFindingIdSchema = z
+    .string()
+    .regex(LEG_FINDING_ID_RE, 'a finding id must be 1-32 characters of [A-Za-z0-9_-]');
+/**
+ * One typed finding. `id` is required (mmnto-ai/totem#2698 OQ1, ruled): the
+ * contract JSON had none, and without one `folded` cannot reference a finding
+ * — positional indexes are fragile under reordering, and a bare count cannot
+ * be checked against anything.
+ */
+export const LegFindingSchema = z.object({
+    /** Unique within the deposit; the referent of every `folded` entry. */
+    id: LegFindingIdSchema,
+    severity: LegFindingSeveritySchema,
+    /** Repo-relative path the finding is about (free-form: core never resolves it). */
+    file: requiredControlFreeText('finding.file'),
+    /** 0 means "the file, no particular line" — never a sentinel like -1. */
+    line: z.number().int().nonnegative(),
+    /** The falsifiable claim, one line. */
+    claim: requiredControlFreeText('finding.claim'),
+    /** The evidence. MAY be empty — a claim with no counterexample is still disclosed. */
+    counterexample: controlFreeText('finding.counterexample'),
+});
+// ─── Deposit ────────────────────────────────────────────────────────────────
+/**
+ * The deposit itself. Every field is required; the arrays may be empty (a leg
+ * that found nothing still deposits — that IS the evidence the gate wants).
+ *
+ * Unknown keys are TOLERATED, not refused (the run-artifact precedent): a
+ * forward-minor writer may add a field this reader strips, and a deposit is
+ * evidence a newer leg wrote, not a contract this reader gets to narrow.
+ */
+export const LegDepositSchema = z
+    .object({
+    /** Writer version; readers tolerate any 1.x, refuse another major by name. */
+    schemaVersion: legSchemaVersionField,
+    /** The head the leg READ — a full 40-hex commit, and the file's own name. */
+    diffSha: z.string().regex(DIFF_SHA_RE, 'diffSha must be a 40-character lowercase hex sha'),
+    /** The leg's own instant, ISO-8601. Ties are broken on it, so it is contract. */
+    readAt: z.string().datetime(),
+    findings: z.array(LegFindingSchema),
+    /** Ids of findings the seat FOLDED — a subset of `findings[].id` (superRefine). */
+    folded: z.array(LegFindingIdSchema),
+    /** The leg's one-line disposition; echoed verbatim on the gate's evidence line. */
+    verdict: requiredControlFreeText('verdict'),
+})
+    .superRefine((deposit, ctx) => {
+    const seen = new Set();
+    for (const [index, finding] of deposit.findings.entries()) {
+        if (seen.has(finding.id)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ['findings', index, 'id'],
+                message: `duplicate finding id "${finding.id}" — ids must be unique within a deposit (folded names them)`,
+            });
+        }
+        seen.add(finding.id);
+    }
+    for (const [index, id] of deposit.folded.entries()) {
+        if (!seen.has(id)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ['folded', index],
+                message: `folded names "${id}", which is not a finding id in this deposit`,
+            });
+        }
+    }
+});
+// ─── Paths ──────────────────────────────────────────────────────────────────
+/** Storage layout segments under the totem dir (mirrors `runsDir`'s idiom). */
+const LEGS_DIR_SEGMENTS = ['artifacts', 'legs'];
+/** Absolute legs directory for a given absolute totem dir. */
+export function legsDir(totemDirAbs) {
+    return path.join(totemDirAbs, ...LEGS_DIR_SEGMENTS);
+}
+/** Absolute path of the deposit for `diffSha` — the sha IS the filename stem. */
+export function legDepositPath(totemDirAbs, diffSha) {
+    return path.join(legsDir(totemDirAbs), `${diffSha}.json`);
+}
+// ─── Save ───────────────────────────────────────────────────────────────────
+/**
+ * Refusal to overwrite an existing deposit without `replace`. Typed so the
+ * CLI can print the incumbent's `readAt` and the one-flag cure rather than
+ * re-deriving either. `existingReadAt` is `undefined` when the incumbent
+ * itself is unreadable/corrupt — the refusal still stands (the seat decides
+ * whether to replace it), and the honest report is that its instant could not
+ * be read.
+ */
+export class LegDepositExistsError extends TotemError {
+    diffSha;
+    existingReadAt;
+    depositPath;
+    constructor(diffSha, existingReadAt, depositPath) {
+        super('LEG_DEPOSIT_EXISTS', `A leg deposit already exists for ${diffSha} (read ${existingReadAt ?? 'at an unreadable instant'}) at ${depositPath}.`, 'Pass --replace to overwrite it (the replaced readAt is reported), or deposit against the current head.');
+        this.name = 'LegDepositExistsError';
+        this.diffSha = diffSha;
+        this.existingReadAt = existingReadAt;
+        this.depositPath = depositPath;
+    }
+}
+/** Best-effort read of an incumbent's `readAt` — for disclosure only, never a gate. */
+function peekReadAt(filePath) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        if (typeof raw !== 'object' || raw === null)
+            return undefined;
+        const readAt = raw['readAt'];
+        return typeof readAt === 'string' ? toSingleLine(readAt) : undefined;
+        // totem-context: intentional best-effort — the incumbent's instant is DISCLOSURE beside a refusal that happens either way; a corrupt incumbent must not turn "already deposited" into a read error
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Persist a deposit at `<legsDir>/<diffSha>.json`, create-exclusive by default.
+ *
+ * Ordering is contract: the deposit is VALIDATED before the filesystem is
+ * touched at all, and the occupancy check precedes the write — so a refused
+ * write (schema-invalid, or occupied without `replace`) leaves no file and no
+ * temp behind. The bytes go through the shared atomic helper (temp in the same
+ * directory, fsync), so a reader never observes a torn deposit.
+ *
+ * The PUBLISH is exclusive, not merely checked (Greptile P1 on PR
+ * mmnto-ai/totem#2745). `existsSync` then rename is check-then-act: two
+ * no-replace writers for one sha both see "absent" and the later rename wins
+ * silently, overwriting one leg's read with another's. Without `replace` the
+ * final name is therefore created by `fs.linkSync`, which is atomic and fails
+ * `EEXIST` if the name is taken — the loser refuses exactly as the pre-check
+ * does, and the incumbent's bytes are never touched. `replace: true` keeps the
+ * rename path, because overwriting is what it asks for.
+ *
+ * The file's name is DERIVED from `deposit.diffSha`, which is how the store's
+ * "the name is the read sha" invariant holds by construction; the loader
+ * re-checks it on the way back in, since the name comes off a filesystem a
+ * human can rename.
+ */
+export function saveLegDeposit(totemDirAbs, deposit, options = {}) {
+    // Validate on the way OUT (the run/admission/verdict precedent): a writer bug
+    // must never poison a store whose reader would then report it as corrupt.
+    const validated = LegDepositSchema.parse(deposit);
+    const filePath = legDepositPath(totemDirAbs, validated.diffSha);
+    let replaced;
+    // The cheap early refusal — it answers the common case without writing a
+    // byte. It is NOT the guarantee: two writers can both pass it (the exclusive
+    // publish below is what actually decides). Greptile P1 on PR
+    // mmnto-ai/totem#2745.
+    if (fs.existsSync(filePath)) {
+        const existingReadAt = peekReadAt(filePath);
+        if (options.replace !== true) {
+            throw new LegDepositExistsError(validated.diffSha, existingReadAt, filePath);
+        }
+        replaced = { readAt: existingReadAt };
+    }
+    fs.mkdirSync(legsDir(totemDirAbs), { recursive: true });
+    const body = JSON.stringify(validated, null, 2);
+    if (options.replace === true) {
+        // `replace` is ALLOWED to overwrite, so the rename path is correct here:
+        // the incumbent's `readAt` is already captured above and reported.
+        writeFileAtomicSync(filePath, body, { mode: 0o600 });
+        // `replaced` stays absent when `--replace` was passed with nothing to
+        // replace: reporting a replacement that did not happen would be a lie the
+        // writer's own success line then prints.
+        return replaced === undefined ? { path: filePath } : { path: filePath, replaced };
+    }
+    // Create-exclusive for real. `existsSync` then rename is check-then-act: two
+    // no-replace writers for one sha both see "absent", both rename, and the
+    // later one silently wins — one leg's read overwritten by another's with no
+    // refusal and no disclosure, in a store whose whole contract is that a
+    // second read at a head is a different observation.
+    //
+    // `link` is the exclusive primitive: it creates the final name atomically
+    // and fails EEXIST if anything already holds it. Measured on NTFS as well as
+    // POSIX for this fix — the loser gets EEXIST, the incumbent's bytes are
+    // untouched, and the loser's temp survives to be cleaned up here.
+    const tempPath = `${filePath}.${process.pid}-${randomSuffix()}.tmp`;
+    try {
+        writeFileAtomicSync(tempPath, body, { mode: 0o600 });
+        fs.linkSync(tempPath, filePath);
+    }
+    catch (err) {
+        if (err.code === 'EEXIST') {
+            // Someone published between the pre-check and here. Same refusal the
+            // pre-check raises, carrying the incumbent's instant — read AFTER the
+            // loss, so it names the deposit that actually won.
+            const existingReadAt = peekReadAt(filePath);
+            removeQuietly(tempPath);
+            throw new LegDepositExistsError(validated.diffSha, existingReadAt, filePath);
+        }
+        removeQuietly(tempPath);
+        throw err;
+    }
+    // The link succeeded, so `filePath` and `tempPath` name the same inode; the
+    // temp is just the second name and goes away.
+    removeQuietly(tempPath);
+    return { path: filePath };
+}
+/** Entropy for the publish temp's name — the `writeFileAtomicSync` idiom. */
+function randomSuffix() {
+    return crypto.randomUUID().slice(0, 8);
+}
+/** Best-effort unlink of a publish temp. */
+function removeQuietly(target) {
+    try {
+        fs.rmSync(target, { force: true });
+        // totem-context: intentional cleanup — a failed temp unlink must not mask the publish's own outcome, and the file it leaves behind is a `.tmp` sibling the loader already ignores (it is not `.json`)
+    }
+    catch {
+        /* best-effort: the temp is a `.tmp` sibling the loader never reads */
+    }
+}
+/** Best-effort major extraction from a raw parsed payload; undefined when absent/garbled. */
+function readMajor(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const version = raw['schemaVersion'];
+    if (typeof version !== 'string')
+        return undefined;
+    const major = Number.parseInt(version.split('.')[0] ?? '', 10);
+    return Number.isNaN(major) ? undefined : major;
+}
+/** Flatten a ZodError into one echo-safe line. */
+function oneLineZodReason(zodError) {
+    return toSingleLine(zodError.issues
+        .map((issue) => {
+        const at = issue.path.length > 0 ? issue.path.join('.') : '<root>';
+        return `${at}: ${issue.message}`;
+    })
+        .join('; '));
+}
+/**
+ * Read every deposit in the store, TOLERANTLY.
+ *
+ * Never throws: a missing directory is an empty store, a non-`.json` entry is
+ * not a deposit at all (ignored silently — the directory is not the store's
+ * inventory), and every other per-file failure is a `corrupt` row carrying a
+ * one-line reason. The reading is JSON-AWARE through the schema, so a file
+ * that merely *mentions* `diffSha` or `findings` in some other shape — a
+ * review artifact copied in, say — is corrupt, never a deposit.
+ *
+ * The filename is re-checked against the stored `diffSha`: the name is the
+ * store's address, a human can rename a file, and a deposit resolved under
+ * someone else's sha would answer the gate's question about the wrong head.
+ */
+export function loadLegDeposits(totemDirAbs) {
+    const dir = legsDir(totemDirAbs);
+    const deposits = [];
+    const corrupt = [];
+    let entries;
+    try {
+        entries = fs.readdirSync(dir);
+        // totem-context: intentional — a missing/unreadable store dir IS the "no deposit" state the gate already has a loud arm for; the loader's contract is that it never throws
+    }
+    catch {
+        return { deposits, corrupt };
+    }
+    for (const entry of [...entries].sort()) {
+        if (!entry.endsWith('.json'))
+            continue;
+        const filePath = path.join(dir, entry);
+        const stem = entry.slice(0, -'.json'.length);
+        let raw;
+        try {
+            raw = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+            // totem-context: intentional — an unreadable or non-JSON file becomes a NAMED corrupt row (reason carried, control bytes collapsed) and never a throw; the loader's contract is tolerant-per-file so one bad deposit can never mask a valid sibling
+        }
+        catch (err) {
+            corrupt.push({
+                file: entry,
+                reason: toSingleLine(`unreadable or not JSON: ${err instanceof Error ? err.message : String(err)}`),
+            });
+            continue;
+        }
+        const major = readMajor(raw);
+        if (major !== undefined && major > LEG_DEPOSIT_KNOWN_MAJOR) {
+            corrupt.push({
+                file: entry,
+                reason: `written by a newer totem (schemaVersion major ${major}; this reader understands ${LEG_DEPOSIT_KNOWN_MAJOR}.x) — upgrade @mmnto/cli to read it, the deposit is valid`,
+            });
+            continue;
+        }
+        const parsed = LegDepositSchema.safeParse(raw);
+        if (!parsed.success) {
+            corrupt.push({ file: entry, reason: `schema-invalid: ${oneLineZodReason(parsed.error)}` });
+            continue;
+        }
+        if (parsed.data.diffSha !== stem) {
+            corrupt.push({
+                file: entry,
+                reason: `filename does not match its stored diffSha ${parsed.data.diffSha} — the name is this store's address`,
+            });
+            continue;
+        }
+        deposits.push({ deposit: parsed.data, path: filePath, diffSha: parsed.data.diffSha });
+    }
+    return { deposits, corrupt };
+}
+/**
+ * Resolve which deposit (if any) answers for `headSha`.
+ *
+ * A deposit read at X answers for every DESCENDANT of X — the contract's
+ * ancestor-or-equal rule — so the ranking is: `exact` first, then the NEAREST
+ * ancestor (fewest commits since the read), ties to the LATEST `readAt`. The
+ * winner carries its `distance` so the caller can print "+N commits since the
+ * leg read" rather than pass a stale read off as a fresh one.
+ *
+ * Since mmnto-ai/totem#2698 fold 3 ancestry is only HALF the question. When a
+ * `coverage` query is supplied, each ancestor candidate is also measured on
+ * what it could have READ — the branch diff up to its own head, intersected
+ * with the owed paths — and a candidate covering NONE of them is stale, not a
+ * winner: it satisfies ancestor-or-equal while its leg saw nothing this push
+ * proposes (the merge-base deposit that produced the ruling). An EXACT match
+ * covers everything by construction and costs no git call.
+ *
+ * Ranking is unchanged: along one lineage a nearer ancestor's diff is a
+ * superset of a farther one's, so nearest-first already orders by coverage.
+ *
+ * Nothing here decides POLICY beyond that floor: partial coverage still
+ * resolves, and a distance of 200 still resolves. Whether either is evidence
+ * enough is the gate's disclosure to make and doctrine's re-arm to rule.
+ */
+export function findLegDepositForHead(totemDirAbs, headSha, git, coverage) {
+    const { deposits, corrupt } = loadLegDeposits(totemDirAbs);
+    const stale = [];
+    const candidates = [];
+    // Deduplicated here as well as by the caller: `owed` is PRINTED as the
+    // denominator of `covers K/N`, and one file matching three globs must not
+    // inflate N into a number no reader can reconcile with the basis.
+    const owedFiles = coverage === undefined ? [] : [...new Set(coverage.owedFiles)];
+    const fullCoverage = () => ({
+        covered: owedFiles.length,
+        owed: owedFiles.length,
+        missing: [],
+    });
+    for (const found of deposits) {
+        if (found.diffSha === headSha) {
+            // An exact match read THIS head: every owed path is inside the diff it
+            // saw, by construction. No git call — and an adapter that would throw on
+            // one is never reached, which is the property the test pins.
+            candidates.push({
+                ...found,
+                rank: 'exact',
+                distance: 0,
+                ...(coverage === undefined ? {} : { coverage: fullCoverage() }),
+            });
+            continue;
+        }
+        if (!git.isCommit(found.diffSha)) {
+            stale.push({
+                diffSha: found.diffSha,
+                readAt: found.deposit.readAt,
+                reason: 'unknown-commit',
+            });
+            continue;
+        }
+        if (!git.isAncestor(found.diffSha, headSha)) {
+            stale.push({ diffSha: found.diffSha, readAt: found.deposit.readAt, reason: 'not-ancestor' });
+            continue;
+        }
+        let measured;
+        if (coverage !== undefined && owedFiles.length === 0) {
+            // Nothing owed: the intersection is empty whatever the candidate reached,
+            // so the probe would be a git call whose result cannot change the answer
+            // (mmnto-ai/totem#2698 fold 5, Q3). `0/0` is vacuously covered.
+            measured = fullCoverage();
+        }
+        else if (coverage !== undefined) {
+            const reachable = new Set(git.changedFiles(coverage.base, found.diffSha));
+            const missing = owedFiles.filter((file) => !reachable.has(file));
+            measured = { covered: owedFiles.length - missing.length, owed: owedFiles.length, missing };
+            // Reached only with a non-empty owed set (the empty case returned above),
+            // so covering none of it is a real coverage failure.
+            if (measured.covered === 0) {
+                stale.push({
+                    diffSha: found.diffSha,
+                    readAt: found.deposit.readAt,
+                    reason: 'no-coverage',
+                });
+                continue;
+            }
+        }
+        candidates.push({
+            ...found,
+            rank: 'ancestor',
+            // Measured AFTER coverage, so a candidate that is already stale costs no
+            // second git call.
+            distance: git.distance(found.diffSha, headSha),
+            ...(measured === undefined ? {} : { coverage: measured }),
+        });
+    }
+    candidates.sort((a, b) => {
+        if (a.rank !== b.rank)
+            return a.rank === 'exact' ? -1 : 1;
+        if (a.distance !== b.distance)
+            return a.distance - b.distance;
+        // Equal reach: the LATEST read wins — the later leg saw everything the
+        // earlier one did, at the same head.
+        return Date.parse(b.deposit.readAt) - Date.parse(a.deposit.readAt);
+    });
+    const [winner, ...rest] = candidates;
+    return {
+        ...(winner === undefined ? {} : { winner }),
+        superseded: rest.map((candidate) => ({
+            diffSha: candidate.diffSha,
+            readAt: candidate.deposit.readAt,
+            rank: candidate.rank,
+            distance: candidate.distance,
+            ...(candidate.coverage === undefined ? {} : { coverage: candidate.coverage }),
+        })),
+        stale,
+        corrupt,
+    };
+}
+/**
+ * Count a deposit's findings by severity, plus how many were folded.
+ *
+ * A folded finding is still a finding: it is counted in its severity bucket
+ * AND in `folded`. The covariate prints both, so a reader can see "3 blocking,
+ * 3 folded" (all addressed) apart from "3 blocking, 0 folded" (none were).
+ */
+export function countLegFindings(deposit) {
+    let blocking = 0;
+    let material = 0;
+    let minor = 0;
+    for (const finding of deposit.findings) {
+        if (finding.severity === 'BLOCKING')
+            blocking++;
+        else if (finding.severity === 'MATERIAL')
+            material++;
+        else
+            minor++;
+    }
+    return { blocking, material, minor, folded: deposit.folded.length };
+}
+/**
+ * Render the covariate line's format-v1.2 `leg:` field — the ONE spelling of
+ * this text, exactly:
+ *
+ *   `leg: <sha8> blocking=N material=N folded=N`   (a deposit resolved)
+ *   `leg: none`                                    (none did)
+ *
+ * The field is COMPOSED BESIDE {@link renderCovariateLine} / `renderAdmissionLine`,
+ * never inside them: the v1 shapes stay byte-identical, and a consumer keeps
+ * discriminating on the second token. The text is contract — the pilot ledger
+ * greps this line — so it is spelled here and nowhere else.
+ *
+ * `minor` is deliberately absent from the field: the round rules on blocking
+ * and material, and `folded` is what says whether they were addressed. The
+ * full counts stay available via {@link countLegFindings}.
+ */
+export function renderLegField(deposit) {
+    if (deposit === undefined)
+        return 'leg: none';
+    const counts = countLegFindings(deposit);
+    const sha8 = deposit.diffSha.slice(0, 8);
+    return `leg: ${sha8} blocking=${counts.blocking} material=${counts.material} folded=${counts.folded}`;
+}
+//# sourceMappingURL=legs.js.map

package/dist/artifacts/legs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legs.js","sourceRoot":"","sources":["../../src/artifacts/legs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,+EAA+E;AAE/E,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAElD,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC,kFAAkF;AAClF,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE;IACpE,OAAO,EAAE,yEAAyE,uBAAuB,4CAA4C;CACtJ,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAElD,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;QAC1D,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE;QAC1D,OAAO,EAAE,GAAG,KAAK,wHAAwH;KAC1I,CAAC,CAAC;AACL,CAAC;AAED,gCAAgC;AAChC,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,oBAAoB,CAAC;SACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE;QACzC,OAAO,EAAE,GAAG,KAAK,wHAAwH;KAC1I,CAAC,CAAC;AACP,CAAC;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAIjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAEvE,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,EAAE,uDAAuD,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,uEAAuE;IACvE,EAAE,EAAE,kBAAkB;IACtB,QAAQ,EAAE,wBAAwB;IAClC,mFAAmF;IACnF,IAAI,EAAE,uBAAuB,CAAC,cAAc,CAAC;IAC7C,yEAAyE;IACzE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpC,uCAAuC;IACvC,KAAK,EAAE,uBAAuB,CAAC,eAAe,CAAC;IAC/C,sFAAsF;IACtF,cAAc,EAAE,eAAe,CAAC,wBAAwB,CAAC;CAC1D,CAAC,CAAC;AAIH,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,8EAA8E;IAC9E,aAAa,EAAE,qBAAqB;IACpC,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,kDAAkD,CAAC;IAC1F,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACnC,mFAAmF;IACnF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACnC,mFAAmF;IACnF,OAAO,EAAE,uBAAuB,CAAC,SAAS,CAAC;CAC5C,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC;gBAC/B,OAAO,EAAE,yBAAyB,OAAO,CAAC,EAAE,6DAA6D;aAC1G,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;gBACvB,OAAO,EAAE,iBAAiB,EAAE,8CAA8C;aAC3E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAaL,+EAA+E;AAE/E,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,MAAM,CAAU,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,WAAmB;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,iBAAiB,CAAC,CAAC;AACtD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,OAAe;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,OAAO,CAAS;IAChB,cAAc,CAAqB;IACnC,WAAW,CAAS;IAE7B,YAAY,OAAe,EAAE,cAAkC,EAAE,WAAmB;QAClF,KAAK,CACH,oBAAoB,EACpB,oCAAoC,OAAO,UAAU,cAAc,IAAI,0BAA0B,QAAQ,WAAW,GAAG,EACvH,wGAAwG,CACzG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAkBD,uFAAuF;AACvF,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC9D,MAAM,MAAM,GAAI,GAA+B,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,mMAAmM;IACrM,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,cAAc,CAC5B,WAAmB,EACnB,OAAmB,EACnB,UAAiC,EAAE;IAEnC,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IAEhE,IAAI,QAAoD,CAAC;IACzD,yEAAyE;IACzE,6EAA6E;IAC7E,6DAA6D;IAC7D,uBAAuB;IACvB,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;QACD,QAAQ,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACxC,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,yEAAyE;QACzE,mEAAmE;QACnE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,sEAAsE;QACtE,0EAA0E;QAC1E,yCAAyC;QACzC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACpF,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,oDAAoD;IACpD,EAAE;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,YAAY,EAAE,MAAM,CAAC;IACpE,IAAI,CAAC;QACH,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,qEAAqE;YACrE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5C,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;QACD,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4EAA4E;IAC5E,8CAA8C;IAC9C,aAAa,CAAC,QAAQ,CAAC,CAAC;IAExB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY;IACnB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,4CAA4C;AAC5C,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,sMAAsM;IACxM,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAiBD,6FAA6F;AAC7F,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,OAAO,GAAI,GAA+B,CAAC,eAAe,CAAC,CAAC;IAClE,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,kDAAkD;AAClD,SAAS,gBAAgB,CAAC,QAAoB;IAC5C,OAAO,YAAY,CACjB,QAAQ,CAAC,MAAM;SACZ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnE,OAAO,GAAG,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAA6B,EAAE,CAAC;IAE7C,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,2KAA2K;IAC7K,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACrD,oPAAoP;QACtP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,YAAY,CAClB,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,uBAAuB,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,iDAAiD,KAAK,6BAA6B,uBAAuB,2DAA2D;aAC9K,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,8CAA8C,MAAM,CAAC,IAAI,CAAC,OAAO,qCAAqC;aAC/G,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAkGD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAmB,EACnB,OAAe,EACf,GAAkB,EAClB,QAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,uEAAuE;IACvE,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjF,MAAM,YAAY,GAAG,GAAuB,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,SAAS,CAAC,MAAM;QACzB,IAAI,EAAE,SAAS,CAAC,MAAM;QACtB,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;IAEH,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC9B,uEAAuE;YACvE,yEAAyE;YACzE,6DAA6D;YAC7D,UAAU,CAAC,IAAI,CAAC;gBACd,GAAG,KAAK;gBACR,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,CAAC;gBACX,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC;aAChE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;gBAC5B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,QAAwC,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,0EAA0E;YAC1E,yEAAyE;YACzE,gEAAgE;YAChE,QAAQ,GAAG,YAAY,EAAE,CAAC;QAC5B,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,QAAQ,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3F,0EAA0E;YAC1E,qDAAqD;YACrD,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;oBAC5B,MAAM,EAAE,aAAa;iBACtB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,KAAK;YACR,IAAI,EAAE,UAAU;YAChB,yEAAyE;YACzE,mBAAmB;YACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC9D,uEAAuE;QACvE,qCAAqC;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC;IACrC,OAAO;QACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM;YAChC,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAmB;IAClD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;YAAE,QAAQ,EAAE,CAAC;aAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;YAAE,QAAQ,EAAE,CAAC;;YAChD,KAAK,EAAE,CAAC;IACf,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,OAA+B;IAC5D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,OAAO,QAAQ,IAAI,aAAa,MAAM,CAAC,QAAQ,aAAa,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC;AACxG,CAAC"}

package/dist/artifacts/legs.test.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Leg-deposit store tests (mmnto-ai/totem#2698).
+ *
+ * These lock the core-owned half of the design's "invariants to lock in via
+ * tests": the store is read JSON-AWARE through the schema (a file that merely
+ * quotes `diffSha`/`findings` in some other shape is not a deposit), ancestry
+ * ranking is exact > nearest ancestor > latest read, a corrupt file is
+ * disclosed by name and reason and never hides a valid sibling,
+ * `unknown-commit` and `not-ancestor` are DISTINCT stale reasons, the schema
+ * refuses control bytes and a non-subset `folded` at write and at read alike,
+ * and the writer is create-exclusive with a disclosed replacement.
+ *
+ * Every hostile string is built with `String.fromCharCode` on purpose: a
+ * literal `\u`/`\x` escape authored through an editing tool has landed as a
+ * RAW control byte in this repo before, which would make the test assert
+ * something other than what it reads as.
+ */
+export {};
+//# sourceMappingURL=legs.test.d.ts.map

package/dist/artifacts/legs.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legs.test.d.ts","sourceRoot":"","sources":["../../src/artifacts/legs.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}