@real-life/trust-protocol 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,142 @@
 # Changelog
 
+## 0.6.0
+
+Takes up Delivery Contract 0.83: the holder keeps custody of what waits
+for transport, and only an open, resumed opening hands anything over.
+
+- **Custody** (RLTP-DEL-6120 to 6135): `pendingTransport(when)` names
+  what the holder keeps for transport, after this opening's first
+  completed resume (else `{ok: false, code: 'not-resumed'}`): every
+  outbox document neither terminal nor accepted, the ones the adapter
+  reported `awaiting-transport` included, and every unsent ack, each with
+  its envelope, recipient, `since` (first submission), `notAfter` (the
+  horizon or the type's sender lifetime, whichever first), `held` and
+  `nextAttemptAt`; none past its deadline, whether or not a resume has
+  recorded the give-up. Entries are deep-frozen and issued to the
+  opening. `handOver(entry, when, start)` re-reads the store and, for an
+  entry this opening issued that is still pending, unchanged and before
+  its deadline, calls `start` inside the holder's queue: the check and the
+  start of the deposit are one step. `mayHandOver(entry, when)` is the
+  check alone, and authorizes nothing afterwards. Both read at
+  max(when, lastWhen): the holder's time never runs back. A resume that throws, the settling of an earlier commit
+  included, withdraws the opening's authority until one completes. One
+  opening per store at a time is the app's to keep: two openings are not
+  serialized with each other.
+- **A duplicate's answer** (RLTP-DEL-6330): a duplicate makes an answer
+  due, stored with the ack (`answers`, `answerDue`) and so kept across a
+  lock; `pendingTransport` offers it as a `resend` entry numbered by it,
+  beside the ack's retries and independent of their state, with the
+  effect's retention as deadline. The begun hand-over ends it (a commit);
+  a duplicate arriving while one is due is answered by it (the same
+  bytes), the next one after it makes the next due. A duplicate therefore
+  commits that answer (else, as before, lastWhen only).
+- **The opening ends**: `await close()` (a lock, the end of a process),
+  resolved once the operation running at the call has finished; only then
+  may the next opening start. Every
+  later call rejects with `InfraError('closed')` (a new code),
+  `mayHandOver` answers false, `closed` says so. The next opening is a new
+  `createHolder` over the same store.
+- **Acks** (RLTP-DEL-6330, 6335): an `awaiting-transport` report on an
+  ack no longer marks it sent; it records `held`, resume stops re-offering
+  it and `pendingTransport` keeps it. `accepted` or `delivered` marks it
+  sent (`sentBy: 'accepted'`), `failed` gives it up (`'failed'`), the
+  horizon ends its retries (`'horizon'`). Sent or not, it stays with its
+  effect until the effect's retention; a duplicate re-sends it once
+  without new retries.
+- **Codec 3, a clean cut**: `StoredAck.sentBy` is `accepted | failed |
+  horizon`, present exactly when sent, `held` only while unsent, and the
+  answers (`answers`, `answerDue`). Codec 3 replaces codecs 1 and 2
+  without a migration: neither ever held a rolled-out app's state, so a
+  state of either is refused as `codec-unknown`. Removed: the migrations
+  1 → 2 and 2 → 3 (`MIGRATIONS` is empty), the codec-1 and codec-2
+  validators, `schemas/holder-state-v1.schema.json`,
+  `schemas/holder-state-v2.schema.json`, the types `HolderStateV1` and
+  `HolderStateV2`, and their fixtures and generators. New:
+  `schemas/holder-state-v3.schema.json`, `HolderStateV3`, fixtures
+  `state-v3*.json` (generated, reproduced in `npm test`).
+- **`./adapters/vti-mediator`**: `reconcile(view, gate, now)` replaces
+  `submitOutbound`. It files the entries of the view not yet filed and
+  withdraws every submission before the trias whose digest the view no
+  longer names; each deposit starts inside `gate.handOver` (the holder),
+  after the adapter's own re-check (retired, withdrawn, past the trias,
+  past the entry's deadline or its horizon): the holder's no withdraws,
+  an error skips the attempt. Its give-up horizon counts from the entry's
+  `since`; an entry taken over past it is given up at once, never
+  attempted. A `resend` entry is a submission of its own. One adapter
+  serves one opening: bound to the holder of its first reconcile, it
+  refuses another, and the next opening gets a new adapter. It keeps no
+  custody of its own.
+- Tests: the custody scenarios (`test/transport-custody.test.mjs`, among
+  them the open counter-probes of the store-launch reviews) and seeded
+  interleavings of locks, the end of a process, hand-overs and acks with
+  every cell reached (`test/transport-interleavings.test.mjs`).
+
+## 0.5.0
+
+Takes up Message Tasks 0.1, Delivery Contract 0.82 and Membership Tasks
+0.20.
+
+- **Messages** (Message Tasks 0.1): `sendMessage(contactId, text,
+  {when, actId, replyTo?})` sends a `message@1` on a ready, unblocked
+  relationship (refused as `not-ready`, `blocked` or `message-invalid`;
+  event `message.sent` with the mid and the document digest). Reception
+  runs the stages of Delivery 6.2: the MAC under `k_msg`, the age bound
+  (`failed(stale-issuance)`) and the future bound on the holder's time
+  mark, the completion record per tuple (no new effect for a known body,
+  equivocation refused), the inbox entry committed with the cache entry
+  and the acknowledgement. `inbox()` lists the messages not yet taken
+  over, in display order; `takeMessages(ids, {when})` takes them over.
+  `ContactView.canMessage`. The pure forms (`messageKeyOf`,
+  `messageMac`, `messageProblem`, `MESSAGE_TYPE`, …) are exported from the
+  root.
+- **The block** (Message Tasks 6): `block(contactId)` and
+  `unblock(contactId)`, chain-level state of every relationship of the
+  entry, kept through chaining, merge and split; event `contact.blocked`,
+  `ContactView.blocked`. Under a block messages are discarded and
+  invitations declined into the register of declined invitations,
+  silently and acknowledged; the holder's own messages, invitations and
+  introduction acts toward a blocked relationship are refused. The
+  treatment of the Trust Layer's types waits for that layer's next
+  casting.
+- **Invitations** (Membership Tasks 0.20 §3.1): attributed to the
+  relationship of their prelude binding, or to none; at most 20 new
+  credential digests per relationship and day; one surfacing per
+  credential digest, decided with the register and the permanent record
+  of surfaced invitations.
+- **The prelude** (Membership §3.5): the registered types
+  `membership-prelude-request/0.1` and `membership-prelude-reply/0.1` with
+  the binding `membership-inviter@1`, kept per relationship for its life;
+  genesis digests compared by their bytes. **Breaking:** a holder of 0.4.0
+  sends `x-membership-prelude-*`, which 0.5.0 refuses as `unknown-type`.
+- The inviter admits without a human act only before
+  `validUntil + membership-skew + P90D` (Membership 3282).
+- **Delivery 0.82**: the transient disposition `failed(rate-limited)`
+  (nothing committed, no ack, no cache entry, evaluated afresh when
+  delivered again); an outbound may carry its type's sender lifetime,
+  after which resume moves it to `failed(task-expired)` and never hands it
+  out again — for a message `sentAt + P179D`, after any retry horizon
+  (at most P90D), so an undelivered message fails as
+  `failed(expired-by-adapter-policy)` first.
+- `./adapters/vti-mediator`: `conclude(collection, now, {keep})` leaves
+  transient items unconcluded and offers them again; `concludable(result)`.
+- **State codec 2**, with a pure migration from codec 1 (no block, no
+  rate, no record, no inbox; the ready tuples read from the state; every
+  received invitation counted as surfaced), its non-normative schema
+  `schemas/holder-state-v2.schema.json` and the type `HolderStateV2`, and
+  golden fixtures reproduced in `npm test`. The codec 1 fixtures are
+  frozen as 0.4.0 wrote them and migrated in the tests.
+- Closed unions grown: `ActError` (`blocked`, `not-ready`,
+  `message-invalid`), `ReceiveFailure` (`rate-limited`), `HolderEvent`
+  (`contact.blocked`, `message.sent`, `message.received`), the outbox's
+  failure reasons (`task-expired`), the entropy purposes (`message.mid`).
+- Engine (for modules): `keepKeys(state, when)` gets the tick's time; the
+  module hook `accepted` runs in the stage-9 transaction of every unique
+  document.
+- Tests: the scenario set of Message Tasks §10.2, the race of #103 on two
+  engines over one store, and a seeded interleaving generator over
+  messages, the block, take-over and the record's retention.
+
 ## 0.4.0
 
 - `createHolder`: one person's device state behind typed human acts

package/README.md

@@ -49,6 +49,53 @@ const { outbound, nextDueAt } = await holder.resume(Date.now())
 holder.subscribe(async () => render(await holder.contacts(), await holder.prompts()))
 ```
 
+**Custody and the lock** (Delivery 0.83, RLTP-DEL-6120 to 6135). The
+holder keeps every outbound document until a service takes it or the
+holder gives it up, across a lock and the end of a process; a transport
+takes what it hands over from the holder, never from a store of its own.
+One `createHolder` is one opening of the store:
+
+```ts
+await holder.resume(Date.now())                      // the opening's first resume comes first
+const view = await holder.pendingTransport(Date.now())
+if (view.ok) for (const entry of view.entries) {
+  // entry: digest, kind ('document' | 'ack'), envelope, recipient,
+  // since (first submission), notAfter (deadline), held?, nextAttemptAt?, resend?
+  // the check and the start of the send are one step of the holder
+  await holder.handOver(entry, Date.now(), () => { transport.send(entry); return true })
+}
+// a lock or the end of the process: nothing issued before authorizes anything;
+// it resolves once the operation running at the call has finished
+await holder.close()
+```
+
+`pendingTransport` answers `{ok: false, code: 'not-resumed'}` until a
+resume of this opening has completed (a resume that throws withdraws it
+again). It names every outbox document neither terminal nor accepted
+(held ones included) and every unsent ack, none past its deadline.
+`handOver(entry, when, start)` checks an entry and calls `start` inside
+the holder's queue, so nothing of this holder runs between the check and
+the start of the send; it says yes only for an entry this opening issued
+that is still pending, unchanged and before its deadline (`mayHandOver`
+is the check alone). A document missing from the view is not to be sent.
+A duplicate makes an answer due, stored with the ack and kept across a
+lock: a `resend` entry beside the ack's retries, independent of their
+state, ended by the begun hand-over; a duplicate while one is due is
+answered by it (the same bytes). The check is the opening's:
+two openings over one store at once are not serialized with each other,
+so an app keeps one opening per store (its writer lock), and releases
+that lock, or starts the next opening, only after `await holder.close()`:
+until then the operation running at the close may still commit. After `close()` every call rejects with
+`InfraError('closed')` and `mayHandOver` answers false; the next opening
+is a new `createHolder` over the same store. An ack is sent once a
+service took it (`accepted`/`delivered` report), the adapter reports it
+failed, or its horizon passes; an `awaiting-transport` report records
+that the adapter holds it and ends nothing (RLTP-DEL-6330), and it stays
+retained with its effect for a duplicate (6335).
+`./adapters/vti-mediator` reconciles from the view
+(`reconcile(view, holder, now)`); one adapter serves one opening, so the
+next opening creates a new one.
+
 **The timer.** Every act, receive and resume may name `nextDueAt`: the
 earliest time something is due, delivery work (retries, duties, acks)
 and expiry work (a prompt's expiry, an act's timeout or lifetime, an aging
@@ -67,10 +114,12 @@ The human acts: `show`, `scan`, `captureSentCard`, `counter` (the encounter),
 `decide` (a prompt: confirm an encounter, accept an invitation, take up or
 consent to an introduction), `trust`, `untrust`, `pauseTrust`, `setClass`,
 `setGroupClass`, `merge`, `depart`, `setProfile`, `foundGroup`, `invite`,
-`vouchFor`, `introduce`, `rotateAnchor`, `addDevice`, `revokeDevice`. Not
-human: `receive`, `report`, `resume`, `tick`, `recover`. Reads: `contacts`,
-`contact`, `groups`, `profile`, `prompts`, `deliveryStatus`, `deviceKey`,
-`snapshot`, `subscribe`.
+`vouchFor`, `introduce`, `sendMessage`, `block`, `unblock`, `rotateAnchor`,
+`addDevice`, `revokeDevice`. Not
+human: `receive`, `report`, `resume`, `tick`, `recover`, `takeMessages`.
+Reads: `contacts`, `contact`, `groups`, `profile`, `prompts`, `inbox`,
+`deliveryStatus`, `deviceKey`, `snapshot`, `subscribe`. Custody:
+`pendingTransport`, `handOver`, `mayHandOver`, `close`, `closed`.
 
 ## What the root exports
 
@@ -80,14 +129,17 @@ human: `receive`, `report`, `resume`, `tick`, `recover`. Reads: `contacts`,
   `RetryPolicy`, `DeliveryReport`, `Outbound`; `seedKeys(seed)` is the
   default KeyProvider, `randomEntropy` the default Entropy.
 - The views: `ContactView`, `GroupView`, `PromptView`, `ProfileView`,
-  `DeliveryStatusView` and their parts.
+  `InboxMessageView`, `DeliveryStatusView` and their parts.
 - The results and events: `ActResult`, `ReceiveResult`, `ResumeResult`,
   `InfraError`, `CryptoUnavailableError`, `HolderEvent`.
 - The state as an opaque type (`HolderState`), `decodeState`, `CODEC`,
   `StateCodecError`, and `storeContract`, the suite a Store adapter passes.
 - The pure wire builders and verifiers of every layer (`core`, `crypto`,
-  `identity`, `profile`, `encounter`, `membership`, `introduction`,
-  `delivery`, `carrier-identity`, `carrier`, `carrier-holder`), and two
+  `identity`, `profile`, `encounter`, `membership`, `message` —
+  `MESSAGE_TYPE`, `messageKeyOf`, `messageMac`, `messageProblem`,
+  `messageShapeOk` and the constants of Message Tasks 0.1 —,
+  `introduction`, `delivery`, `carrier-identity`, `carrier`,
+  `carrier-holder`), and two
   namespaces of pure forms: `visibility` (anchor, star, group star,
   continuity, acks) and `ceremony` (the encounter's, the group's and the
   introduction's forms).
@@ -98,7 +150,7 @@ Other entry points:
 |---|---|
 | `./testing` | `InMemoryStore`, `memoryLog`, `scriptedEntropy`, `storeContract`, `emptyState`, `stateBuilder`, `freezeDeep`, `sampleState`, `openPromptModule`, the invariant checks, `forgeMapping` (deniability, Trust 6.1), `SCHEMAS` and the generated `wire` types. For tests, vectors and adapter authors; not for production holders. |
 | `./internal` | The structural `HolderState`, `encodeState` and the codec chain, the engine's module types, the pure view functions, the modules' factories and pure reads. For the library's own modules and tests; not an app contract. |
-| `./adapters/vti-mediator` | The VTI mediator as a carrier adapter: its submission states as `DeliveryReport`, collection and ack handling. |
+| `./adapters/vti-mediator` | The VTI mediator as a carrier adapter: its submission states as `DeliveryReport`, collection and ack handling, the selective conclusion of a collection (`conclude(c, now, {keep})`, `concludable(result)`: a `failed(rate-limited)` item stays with the carrier). |
 
 ## The modules and the rules they implement
 
@@ -117,9 +169,10 @@ Bare four-digit numbers are RLTP-TRU rules; the other layers name theirs.
 | `trust/continuity` | Trust §6a | `continuity-probe@1` and `continuity-mapping@1`, chaining a re-encounter into the existing relationship (6a.4) |
 | `trust/profile`, `profile` | Trust §6b | `profile@1`: the one revision counter (6450), delivery on the class gates (6455), reception and the image bounds (6475) |
 | `trust/duties` | Trust 2850, 6370, 6455, 6595, 6596 | the duties a commit leaves: class on, re-issue after a rotation, the lag rule |
-| `membership`, `membership/holder` | Membership Tasks 0.19 on Access 0.57 | founding (Access 3.4.1), the prelude, invite, accept, admission and welcome, evidence relay and `vouch@2` (Access 5.3), an in-library Access over the holder's groups |
+| `membership`, `membership/holder` | Membership Tasks 0.20 on Access 0.57 | founding (Access 3.4.1), the prelude (3.5: `membership-prelude-request/0.1`, `membership-prelude-reply/0.1`, the binding per relationship), invite, accept, admission within the bound of 3282 and welcome, evidence relay and `vouch@2` (Access 5.3), an in-library Access over the holder's groups |
+| `message`, `message/holder` | Message Tasks 0.1 | `message@1`, `k_msg` and its MAC (3); sending on a ready, unblocked relationship with the sender lifetime (5); reception through the stages with the age and future bounds on the time mark, the completion record, the inbox taken over by the app, the rates and the inbox bound as `failed(rate-limited)` (4); the block of a relationship (6010–6030, 6510), its discard of messages and its treatment of invitations and prelude replies (Membership 3115, 3975), the holder's own offers refused (6410) |
 | `introduction`, `introduction/holder` | Trust §8 on Delivery §4.4 | the Introduction Act in its three roles: request, forward, reply, the mediator's one ack at its declared delay, the vouchers; the requester's timeout at the act's expiry (8340; A20, spec follow-up 18: no ack timeout of 8690) |
-| `receive`, `engine` | Delivery 0.81 §5, §6.1, §6.2 | the sealed envelope, stages 1–9 once per envelope, the task register by full task URI, the completed-effect cache with stored acks, the outbox with the status trias, retry by backoff, give-up at the horizon, the act journal |
+| `receive`, `engine` | Delivery 0.83 §5, §6.1, §6.2 | the sealed envelope and the two key classes, stages 1–9 once per envelope with the dispositions `discarded` and the transient `failed(rate-limited)`, the task register by full task URI, the completed-effect cache with stored acks, the outbox with the status trias, retry by backoff, give-up at the horizon, custody before the trias and the hand-over gate (`pendingTransport`, `mayHandOver`, `close`), ack retries apart from ack retention, the act journal |
 | `carrier-identity`, `carrier`, `carrier-holder` | Identity §7a, Delivery §4.4, §5a, Identity §9.3 | the carrier-relationship principal, the carrier port's state machine, proofs, verdicts and recovery |
 | `views`, `prompts` | — | the read model: contacts by entry (2120, 2140), groups, prompts, the delivery status |
 
@@ -144,23 +197,36 @@ A holder's state is pure JSON under a codec version. The Store port takes
 the state as opaque JSON and gives it back; the library decodes it
 (`decodeState`), the adapter never migrates.
 
-- **Codec 1** is the format of 0.4.0, the first stable one. Its golden
-  fixtures (`test/fixtures/state-v1*.json`, deterministic runs of
-  `test/fixtures/gen-state-v1.mjs`, reproduced in `npm test`) cover a
-  settled holder, one with work open (prompts, a joining invite, duties, a
-  rotation at step 2) and one with a tombstone, a revoked device and
-  carrier entries; each decodes and re-encodes byte for byte. A later codec brings its validator, a pure migration from the
-  one before, and its own fixture with a migration test.
+- **Codec 3** is the format of 0.6.0 and the only one this library
+  reads. It holds the state of Message Tasks 0.1 (`messages`: the block,
+  the rates, the ready tuples, the completion record, the inbox), an
+  outbox item's sender lifetime (`expiresAt`) and `failed(task-expired)`,
+  the record of surfaced and the register of declined invitations, and
+  per stored ack (Delivery 0.83) why it counts as sent (`sentBy`:
+  `accepted`, `failed`, `horizon`, present exactly when `sent`), whether
+  the adapter holds it (`held`), and the duplicates' answers (`answers`,
+  `answerDue`). Its fixtures (`test/fixtures/state-v3*.json`,
+  deterministic runs of `test/fixtures/gen-state-v3.mjs`, reproduced in
+  `npm test`) cover a settled holder, one with work open (prompts, a
+  joining invite, duties, a rotation at step 2, a block and a declined
+  invitation), one with a tombstone, a revoked device and carrier entries,
+  and one with transport in custody (acks held, accepted, failed and
+  unsent, an answer due and one handed over, an own document held); each
+  decodes and re-encodes byte for byte.
+- Codecs 1 and 2 (lib 0.4.0, 0.5.0) never held a rolled-out app's state:
+  they are read no more, a state of either is `codec-unknown`. A later
+  codec that must read codec 3 brings its validator, a pure migration from
+  it, and its own fixture with a migration test.
 - A newer codec is refused as `codec-newer`, a codec without a validator
   as `codec-unknown`; nothing is read best-effort.
-- `schemas/holder-state-v1.schema.json` describes codec 1 as a
+- `schemas/holder-state-v3.schema.json` describes the codec as a
   non-normative JSON Schema (published with the package). The type
-  `HolderStateV1` (`./internal`) is generated from it
+  `HolderStateV3` (`./internal`) is generated from it
   (`scripts/build-holder-state-types.mjs`); the build holds it against the
   library's `HolderState`, and the tests hold the schema against the
-  codec's validator on the fixtures and on mutations of them. Two rules
-  only the codec states: a record's id equals its key, and an envelope's
-  `rkid` equals its recipient's `keyAgreement`.
+  codec's validator on the fixtures and on mutations of them. Rules only
+  the codec states: a record's id equals its key, an envelope's `rkid`
+  equals its recipient's `keyAgreement`, and a set of strings is sorted.
 
 **Writing a Store adapter.** Implement `read(): Promise<{state, version}>`
 (a deep, independent copy; `null` state and version for an empty store) and
@@ -201,9 +267,10 @@ This package uses its own semver; the specification uses castings.
 | identity | Identity 0.54 | recovery derivation (§5.3), service identities (§7) |
 | encounter | Encounter 0.31, cards 0.25, credentials 0.26 | — |
 | trust | Trust Layer 0.31 | — |
-| membership | Membership Tasks 0.19, Access 0.57 | the Access envelope (Membership 3.3: `access-operation/0.1` with `member.add` and the sealed welcome; this library sends its own `x-membership-welcome/0.1`, and the prelude as `x-membership-prelude-*`); roster replication: a holder knows the members it admitted and the roster its welcome carried |
+| membership | Membership Tasks 0.20, Access 0.57 | the Access envelope (Membership 3.3: `access-operation/0.1` with `member.add` and the sealed welcome; this library sends its own `x-membership-welcome/0.1`); an admission prompt after the bound of RLTP-MT-3282; roster replication: a holder knows the members it admitted and the roster its welcome carried |
 | introduction | Trust 0.31 §8 | how a requester learns the mediator's designator (8.3): this library's mediator sends `x-introduction-offer/0.1` |
-| delivery | Delivery 0.81 | transport adapters beyond `./adapters/vti-mediator` |
+| delivery | Delivery 0.83 | transport adapters beyond `./adapters/vti-mediator`; the block of the Trust Layer's types (Message Tasks 6240: their treatments wait for the next casting of the Trust Layer) |
+| message | Message Tasks 0.1 | holding a message unsent until its tuple is ready (5020): `sendMessage` answers `not-ready` and the app keeps the message; checking `replyTo` against the relationship's history (5120), which is the app's; multi-device (§9); `failed(task-expired)` for a message: reachable only with a retry horizon beyond P179D, which the engine does not admit (at most P90D), so an undelivered message ends as `failed(expired-by-adapter-policy)` |
 | devices | Identity §5.5 | multi-device production: one writer per holder |
 
 ## The contract: the vectors

package/dist/adapters/vti-mediator.d.ts

@@ -1,14 +1,16 @@
 import type { CarrierPrincipal, CarrierScopedIdentity } from '../carrier-identity.js';
-import type { DeliveryReport, Outbound, ReceiverRefusalCode, SubmissionRef } from '../ports.js';
+import type { DeliveryReport, ReceiverRefusalCode, SubmissionRef } from '../ports.js';
+import type { TransportEntry, TransportView } from '../engine.js';
+import type { ReceiveResult } from '../results.js';
 export type { ReceiverRefusalCode } from '../ports.js';
-export declare const DECLARED: {
+export declare const DECLARED: Readonly<{
     readonly giveUpHorizonMs: number;
     readonly statusHorizonMs: 60000;
     readonly queueFloorCount: 64;
     readonly queueFloorBytes: 1048576;
     readonly maxQueueBytes: 16777216;
     readonly duplicateWindowMs: number;
-};
+}>;
 export type WireErrorKind = 'unreachable' | 'refused-retriable' | 'refused-admission' | 'oversize';
 export declare class WireError extends Error {
     kind: WireErrorKind;
@@ -57,6 +59,12 @@ export type SubmissionState = {
 /** The ports' DeliveryReport for a document `digest` in adapter state `st`
  *  (Delivery §6.1): one-to-one, `late` and the refusal code carried over. */
 export declare function deliveryReportOf(digest: string, st: SubmissionState): DeliveryReport;
+/** Whether a receive outcome is terminal and its item may be concluded
+ *  (Delivery 5a.8): every disposition but `failed(rate-limited)`, the one
+ *  failure that is transient (RLTP-DEL-5820). An InfraError of the
+ *  holder's store is transient as well (RLTP-DEL-5810): an item whose
+ *  receive threw is kept, too. */
+export declare function concludable(r: ReceiveResult): boolean;
 export interface CollectedItem {
     bytes: Uint8Array;
     queueId: string;
@@ -75,6 +83,14 @@ export interface AckState {
     }>;
     pending: string[];
 }
+/** The holder's side of a hand-over (lib 0.6.0): the holder itself.
+ *  handOver checks the entry and calls `start` inside the holder's queue;
+ *  `start` re-checks the adapter's own state, starts the deposit
+ *  synchronously and says whether it did. `closed` is read in `start`. */
+export interface TransportGate {
+    handOver(entry: TransportEntry, when: number, start: () => boolean): Promise<boolean>;
+    readonly closed?: boolean;
+}
 export declare class MediatorCarrierAdapter {
     #private;
     get principal(): string;
@@ -96,10 +112,14 @@ export declare class MediatorCarrierAdapter {
      *  honest report exists, status() returns null — §6.1's own
      *  pre-report window, represented as absence, not as a value. */
     submit(envelopeBytes: Uint8Array, rawNow: number): string;
-    /** Files an Outbound (its envelope as JCS bytes) and returns the
-     *  SubmissionRef the holder's reports are keyed by: submission id ↔
-     *  document digest (note §4.3). */
-    submitOutbound(outbound: Pick<Outbound, 'digest' | 'envelope'>, rawNow: number): SubmissionRef;
+    /** Takes the holder's custody set (holder.pendingTransport, after a
+     *  resume of this opening) and the holder as the gate: files every entry
+     *  not yet filed under its digest (its envelope as JCS bytes; the give-up
+     *  horizon from entry.since) and returns their SubmissionRefs; withdraws
+     *  every filed submission still before the trias (no report, or
+     *  awaiting-transport) whose digest the view does not name. Accepted and
+     *  terminal submissions stay for their reports. */
+    reconcile(view: TransportView, gate: TransportGate, rawNow: number): SubmissionRef[];
     /** The current state as the ports' DeliveryReport for holder.report(),
      *  or null while no honest report exists (and for an unknown id). A
      *  submission filed without a digest (submit) has no report form. */
@@ -137,9 +157,17 @@ export declare class MediatorCarrierAdapter {
         to: 'delivered';
     }>;
     collect(rawNow: number): Collection;
+    /** Concludes a collection (profile §4, Delivery 5a.8): its items'
+     *  digests become ack intent. `keep` names the items whose disposition
+     *  is transient (Delivery RLTP-DEL-5810, 5820: `failed(rate-limited)`,
+     *  or a transaction that could not commit, see `concludable`): they are
+     *  not concluded and not acknowledged, they go back to the buffer and the
+     *  next collect offers them again, and the mediator keeps its copy. */
     conclude(collection: {
         id: string;
-    }, rawNow: number): void;
+    }, rawNow: number, opts?: {
+        keep?: readonly string[];
+    }): void;
     ackState(): AckState;
     advance(rawNow: number): void;
     /** §5a.10 lifecycle boundary: after close, every state port is

package/dist/adapters/vti-mediator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vti-mediator.d.ts","sourceRoot":"","sources":["../../src/adapters/vti-mediator.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC/F,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAGtD,eAAO,MAAM,QAAQ;;;;;;;CAOX,CAAA;AAGV,MAAM,MAAM,aAAa,GACrB,aAAa,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,UAAU,CAAA;AAE1E,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,aAAa,CAAA;gBACN,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9E,YAAY,CAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAI/F,OAAO,CAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjD,aAAa,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,OAAO,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,WAAW,CAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,SAAS,CAAE,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1D,mEAAmE;IACnE,OAAO,CAAC,IAAK,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AASD,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,uBAAuB,GAAG,2BAA2B,CAAA;CAAE,GAC1G;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,2BAA2B,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAElF;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,cAAc,CASrF;AAED,MAAM,WAAW,aAAa;IAAG,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACrE,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE;AAElE;;kCAEkC;AAClC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAmBD,qBAAa,sBAAsB;;IAOjC,IAAI,SAAS,IAAK,MAAM,CAA2B;IACnD,IAAI,aAAa,IAAK,MAAM,CAA+B;IAC3D,IAAI,SAAS,IAAK,MAAM,CAA2B;IA2BnD;;;;kDAI8C;WACjC,MAAM,CACjB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EACvD,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,GAC3D,OAAO,CAAC,sBAAsB,CAAC;gBAahC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,gBAAgB,EAC3B,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,YAAY,EAClB,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,MAAM;IAqIrB;;+BAE2B;IAC3B,QAAQ,CAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQhD,IAAI,aAAa,IAAK,OAAO,CAG5B;IAyBD;;qEAEiE;IACjE,MAAM,CAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAiB1D;;uCAEmC;IACnC,cAAc,CAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa;IAQ/F;;yEAEqE;IACrE,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAQ1C,GAAG,CAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAuCzB;;;;0DAIsD;IAChD,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IAI9B;;;;;;;;;;;+DAW2D;IAC3D,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAe3C,YAAY,CAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAU/B;;;;;iEAK6D;IAC7D,eAAe,CAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAgB7D,gBAAgB,IAAK,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,WAAW,CAAA;KAAE,CAAC;IAM3D,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,UAAU;IAapC,QAAQ,CAAE,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAc3D,QAAQ,IAAK,QAAQ;IAkErB,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IA8C9B;;;;mBAIe;IACf,KAAK,IAAK,IAAI;IAEd,IAAI,MAAM,IAAK,OAAO,CAAwB;CAC/C;AAED,eAAO,MAAM,SAAS,GAAU,OAAO,UAAU,KAAG,OAAO,CAAC,MAAM,CAA0B,CAAA"}
+{"version":3,"file":"vti-mediator.d.ts","sourceRoot":"","sources":["../../src/adapters/vti-mediator.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,eAAO,MAAM,QAAQ;;;;;;;EAOV,CAAA;AAGX,MAAM,MAAM,aAAa,GACrB,aAAa,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,UAAU,CAAA;AAE1E,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,aAAa,CAAA;gBACN,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9E,YAAY,CAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAI/F,OAAO,CAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjD,aAAa,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,OAAO,CAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,WAAW,CAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,SAAS,CAAE,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC1D,mEAAmE;IACnE,OAAO,CAAC,IAAK,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AASD,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,uBAAuB,GAAG,2BAA2B,CAAA;CAAE,GAC1G;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,2BAA2B,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAElF;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,cAAc,CASrF;AAED;;;;kCAIkC;AAClC,wBAAgB,WAAW,CAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAEtD;AAKD,MAAM,WAAW,aAAa;IAAG,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACrE,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE;AAElE;;kCAEkC;AAClC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;0EAG0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAuBD,qBAAa,sBAAsB;;IAOjC,IAAI,SAAS,IAAK,MAAM,CAA2B;IACnD,IAAI,aAAa,IAAK,MAAM,CAA+B;IAC3D,IAAI,SAAS,IAAK,MAAM,CAA2B;IA6BnD;;;;kDAI8C;WACjC,MAAM,CACjB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EACvD,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,GAC3D,OAAO,CAAC,sBAAsB,CAAC;gBAahC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,gBAAgB,EAC3B,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,YAAY,EAClB,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,MAAM;IAsIrB;;+BAE2B;IAC3B,QAAQ,CAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQhD,IAAI,aAAa,IAAK,OAAO,CAG5B;IAyBD;;qEAEiE;IACjE,MAAM,CAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAmB1D;;;;;;uDAMmD;IACnD,SAAS,CAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAmDrF;;yEAEqE;IACrE,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAQ1C,GAAG,CAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAwEzB;;;;0DAIsD;IAChD,MAAM,IAAK,OAAO,CAAC,IAAI,CAAC;IAI9B;;;;;;;;;;;+DAW2D;IAC3D,MAAM,CAAE,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAe3C,YAAY,CAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAU/B;;;;;iEAK6D;IAC7D,eAAe,CAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAgB7D,gBAAgB,IAAK,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,WAAW,CAAA;KAAE,CAAC;IAM3D,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,UAAU;IAepC;;;;;2EAKuE;IACvE,QAAQ,CAAE,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,IAAI;IAsBpG,QAAQ,IAAK,QAAQ;IAmErB,OAAO,CAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IA8C9B;;;;mBAIe;IACf,KAAK,IAAK,IAAI;IAEd,IAAI,MAAM,IAAK,OAAO,CAAwB;CAC/C;AAED,eAAO,MAAM,SAAS,GAAU,OAAO,UAAU,KAAG,OAAO,CAAC,MAAM,CAA0B,CAAA"}