@remnic/core 9.69.19 → 9.69.21

package/dist/{chunk-JIM4BIOC.js.map → chunk-PAAJWQH5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/reconcile/plan.ts"],"sourcesContent":["import { CENSUS_MAX_MTIME_MS, isCensusMtimeMs, isSha256Hex } from \"../census-validation.js\";\nimport { normalizeNamespaceIdentity } from \"../namespaces/identity.js\";\nimport { validateArchiveRelativePath } from \"../transfer/fs-utils.js\";\nimport type { OfflineSyncFileState } from \"../offline-sync.js\";\nimport { CONVERGE_CONFLICT_POLICIES, DEFAULT_CONVERGE_CONFLICT_POLICY } from \"../converge-config.js\";\nimport type { ConvergeConflictPolicy } from \"../types.js\";\nexport type ReconcileConflictPolicy = ConvergeConflictPolicy;\n\n/**\n * Bootstrap reconciliation planner for two peer daemons whose corpora have\n * already diverged (issue #2150).\n *\n * The offline-sync protocol assumes a satellite that shares a common base with\n * one daemon: every path it does not know about is a pull, and a conflict is\n * rare. Two long-lived daemons are the opposite case — each side holds months\n * of history the other never saw, both sides are authoritative, and there is\n * NO common base on the first run. That is a different decision problem, so it\n * gets its own planner rather than another mode flag inside `applyOfflineSync*`.\n *\n * This module is deliberately pure: it takes two file censuses and returns what\n * to do. No I/O, no transport, no clock. Everything that makes reconciliation\n * risky — which side wins, what counts as converged, what is reported — is\n * decided here where it can be exhaustively tested, and the transport layer is\n * left to carry out an already-settled plan.\n */\n\n/** Which way a path must move for the two corpora to agree. */\nexport type ReconcileAction = \"pull\" | \"push\" | \"identical\" | \"conflict\" | \"suppress\";\n\n/**\n * What the planner decided for a conflicting path.\n * `supersede-link` records that both revisions need durable preservation when\n * timestamps cannot safely select a winner. Apply must stop until transport\n * can assign distinct durable identities to both revisions.\n */\nexport type ReconcileResolution = \"local-wins\" | \"peer-wins\" | \"supersede-link\" | \"unresolved\";\n\nexport interface ReconcileSemanticFileState {\n  path: string;\n  sha256: string;\n}\n\nexport interface ReconcileSemanticAgreement {\n  local: ReconcileSemanticFileState;\n  peer: ReconcileSemanticFileState;\n}\n\nexport type ReconcileSemanticChange = \"unchanged\" | \"local_changed\" | \"peer_changed\" | \"both_modified\";\n\nexport interface ReconcilePlanEntry {\n  path: string;\n  namespace: string;\n  action: ReconcileAction;\n  /** Stable machine-readable cause, safe to assert on and to aggregate. */\n  reason: ReconcileReason;\n  localSha256?: string;\n  peerSha256?: string;\n  /** Present only when a prior converged run left a cursor covering this path. */\n  baseSha256?: string;\n  /** Set only when `action` is `conflict`. */\n  resolution?: ReconcileResolution;\n  /** Original revision time when conflict resolution propagates a deletion. */\n  deletionMtimeMs?: number;\n  /**\n   * Which side holds the retracted revision. Set only when `action` is\n   * `suppress`: with different digests on each side and only one retracted,\n   * the entry would otherwise be identical either way and transport could\n   * delete the live copy instead of the retracted one.\n   */\n  suppressSide?: \"local\" | \"peer\" | \"both\";\n  /**\n   * Real per-side identities for a cross-path semantic agreement. Synthetic\n   * rows omit the top-level side digests because `path` cannot name both files.\n   */\n  semanticAgreement?: ReconcileSemanticAgreement;\n  /** Each side's current digest compared with its own prior semantic digest. */\n  semanticChange?: ReconcileSemanticChange;\n}\n\nexport type ReconcileReason =\n  | \"peer_only\"\n  | \"local_only\"\n  /** Cursor showed only that side moved since agreement; both still hold the path. */\n  | \"peer_changed\"\n  | \"local_changed\"\n  | \"same_content\"\n  | \"semantic_duplicate\"\n  | \"both_modified\"\n  | \"peer_deleted\"\n  | \"local_deleted\"\n  /** Peer deleted it while this side edited it — the offline-sync delete/modify pair. */\n  | \"local_modified_peer_deleted\"\n  | \"local_deleted_peer_modified\"\n  | \"tombstoned\";\n\nexport interface ReconcileNamespaceReport {\n  namespace: string;\n  pull: number;\n  push: number;\n  identical: number;\n  conflict: number;\n  /** Local retractions the peer must be told about before the pair agrees. */\n  suppress: number;\n  /**\n   * Conflicts still needing an operator: those the policy declined to settle,\n   * plus supersede links whose direction could not be determined.\n   */\n  unresolved: number;\n}\n\nexport interface ReconcilePlan {\n  entries: ReconcilePlanEntry[];\n  byNamespace: ReconcileNamespaceReport[];\n  /**\n   * True when the two corpora already agree — every shared path matches and\n   * neither side holds a path the other lacks.\n   *\n   * This is the idempotency contract from #2150: running reconciliation against\n   * an already-converged peer must be a no-op, and a caller can skip the whole\n   * transfer phase on this flag alone.\n   */\n  converged: boolean;\n}\n\n/** Minimal shape the planner needs; `OfflineSyncFileState` satisfies it. */\nexport type ReconcileFileState = Pick<OfflineSyncFileState, \"path\" | \"sha256\"> &\n  Partial<Pick<OfflineSyncFileState, \"mtimeMs\" | \"bytes\">>;\n\nexport interface ReconcileNamespaceInput {\n  namespace: string;\n  local: Iterable<ReconcileFileState>;\n  peer: Iterable<ReconcileFileState>;\n  /**\n   * File states agreed at the end of the last converged run with THIS peer.\n   * Absent on a bootstrap merge, which is why a path missing from one side is\n   * read as \"never seen\" rather than \"deleted\".\n   */\n  base?: Iterable<ReconcileFileState>;\n  /**\n   * Revision timestamps for paths deleted locally since the base cursor.\n   * A deletion is a revision and must carry a comparable time for\n   * `newest-wins`; absence alone has no timestamp.\n   */\n  localDeletionMtimeMs?: ReadonlyMap<string, number>;\n  /** Revision timestamps for paths deleted by the peer since the base cursor. */\n  peerDeletionMtimeMs?: ReadonlyMap<string, number>;\n  /**\n   * Digests of FILES this side has retracted, in the same form as\n   * `ReconcileFileState.sha256` — a hash of the serialized file.\n   *\n   * Deliberately NOT `TombstoneEntry.contentHash`, which hashes the canonical\n   * raw fact text and therefore never equals a file digest (§13: one content\n   * form, everywhere). Mapping retracted fact hashes onto the file digests that\n   * carry them is the caller's job, because only the caller can read its own\n   * corpus; handing this the wrong form would silently plan `pull` and\n   * resurrect every retracted fact, so the parameter name states the form.\n   */\n  tombstonedFileSha256?: Iterable<string>;\n  /**\n   * Digests the PEER has retracted, same form.\n   *\n   * Without this a bootstrap merge cannot tell \"the peer never had it\" from\n   * \"the peer deliberately retracted it\": the peer census simply omits both,\n   * so a file we still hold is planned `push` and the peer's retraction is\n   * undone. Reconciliation is symmetric, so retraction has to be too.\n   *\n   * SCOPE: these sets decide what happens to files that still EXIST on one\n   * side. Sharing the retraction records themselves is not modelled here -\n   * tombstones are corpus files (`state/tombstones.jsonl`), so they reconcile\n   * as ordinary paths through this same plan. A digest both censuses have\n   * already dropped therefore produces no entry, by design: there is no file\n   * left to act on, and synthesizing a path-less entry would hand transport\n   * something it cannot apply.\n   */\n  peerTombstonedFileSha256?: Iterable<string>;\n}\n\nexport interface ReconcileOptions {\n  conflictPolicy?: ConvergeConflictPolicy;\n  /**\n   * Platform whose filesystem constraints the portability gates enforce\n   * (trailing dot/space, Windows-invalid characters, reserved device names).\n   * Defaults to the local platform: a POSIX planner may reason about\n   * POSIX-origin paths that carry characters Windows cannot store, because\n   * that plan will never be applied on a Windows participant. Injectable so\n   * the Windows branches stay testable from any platform.\n   */\n  localPlatform?: NodeJS.Platform;\n  /**\n   * Platform of the PEER participant when known (advertised via the\n   * offline-sync capabilities route). Push entries materialize on the peer,\n   * so Windows path hazards apply when EITHER participant is win32.\n   */\n  peerPlatform?: string;\n}\n\n/**\n * A census the planner refuses to reason about.\n *\n * Dropping a malformed or contradictory record would let the planner return\n * `converged: true` for a corpus it could not actually read, and transport is\n * invited to skip everything on that flag — so bad input fails loudly instead\n * (§1/§39).\n */\nexport class ReconcilePlanInputError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ReconcilePlanInputError\";\n  }\n}\n\n/** Shared with offline-sync's census validation (issue #2477): one acceptance set. */\n\n/**\n * Validate a census record's identity fields.\n *\n * The digest matters as much as the path: two records that both omit `sha256`\n * compare `undefined === undefined` and plan as `identical`, converging a\n * corpus the planner never actually read.\n */\nfunction assertCensusRecord(\n  file: ReconcileFileState | undefined,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): ReconcileFileState {\n  const path = file?.path;\n  if (typeof path !== \"string\" || path.length === 0) {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${side} census for namespace ${namespace} contains a record with no path`\n    );\n  }\n  // Same boundary offline-sync applies to this field: a peer census is\n  // untrusted input, and an absolute or traversal path would otherwise become\n  // a transfer instruction pointing outside the corpus root.\n  try {\n    validateArchiveRelativePath(path, `reconcile: ${side} census for namespace ${namespace}`);\n  } catch (err) {\n    throw new ReconcilePlanInputError(err instanceof Error ? err.message : String(err));\n  }\n  assertPortablePathSegments(path, side, namespace, platforms);\n  return {\n    ...file,\n    path,\n    sha256: assertDigest(file?.sha256, `${side} census for namespace ${namespace} entry ${path}`),\n    ...(file?.mtimeMs === undefined\n      ? {}\n      : { mtimeMs: assertMtimeMs(file.mtimeMs, `${side} census for namespace ${namespace} entry ${path}`) }),\n  };\n}\n\n/**\n * `newest-wins` decides which corpus keeps its history from this number, so a\n * NaN, an Infinity or a value past the Date range must not pick the winner.\n *\n * Fractional values ARE valid: `fs.stat()` reports sub-millisecond mtimes on\n * common filesystems and offline-sync forwards them unrounded, so this matches\n * its `assertOfflineSyncMtimeMs` — non-negative finite within Date range — and\n * deliberately does not require an integer.\n */\nfunction assertMtimeMs(value: unknown, context: string): number {\n  if (!isCensusMtimeMs(value)) {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${context} has an out-of-range mtimeMs; expected a finite value between 0 and ${CENSUS_MAX_MTIME_MS}`\n    );\n  }\n  return value;\n}\n\n/**\n * Digests are canonicalized to lowercase, exactly as offline-sync's\n * `assertSha256` does. Keeping the caller's spelling would make two forms of\n * one digest compare unequal, so identical files would plan `both_modified`\n * and tombstone lookups would silently miss.\n */\nfunction assertDigest(value: unknown, context: string): string {\n  if (!isSha256Hex(value)) {\n    throw new ReconcilePlanInputError(`reconcile: ${context} must carry a 64-character sha256 hex digest`);\n  }\n  return value.toLowerCase();\n}\n\nfunction isPlainObject(value: unknown): boolean {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const proto: unknown = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n\nfunction assertNamespace(namespace: unknown): string {\n  if (typeof namespace !== \"string\" || namespace.length === 0) {\n    throw new ReconcilePlanInputError(\"reconcile: every namespace input needs a non-empty namespace\");\n  }\n  // `team` and ` team ` are one namespace to the rest of core, so accepting\n  // both here would slip two inputs past the duplicate check and let them plan\n  // contradictory actions for the same path. Rejected rather than silently\n  // rewritten, so the namespace on every entry is the caller's own string.\n  if (LONE_SURROGATE.test(namespace)) {\n    // `namespaceIdentityToken()` encodes through TextEncoder, so a lone\n    // surrogate and a literal U+FFFD collapse to ONE storage identity while\n    // comparing as two here - slipping both past the duplicate-namespace guard.\n    throw new ReconcilePlanInputError(\n      \"reconcile: namespace contains an unpaired surrogate; it would collide with another namespace on disk\"\n    );\n  }\n  if (normalizeNamespaceIdentity(namespace) !== namespace) {\n    throw new ReconcilePlanInputError(\n      `reconcile: namespace ${JSON.stringify(namespace)} is not canonical; pass ${JSON.stringify(normalizeNamespaceIdentity(namespace))}`\n    );\n  }\n  return namespace;\n}\n\nfunction assertIterable(value: unknown, side: string, namespace: string): Iterable<ReconcileFileState> {\n  if (\n    value === null ||\n    typeof value !== \"object\" ||\n    typeof (value as Iterable<ReconcileFileState>)[Symbol.iterator] !== \"function\"\n  ) {\n    throw new ReconcilePlanInputError(`reconcile: ${side} census for namespace ${namespace} must be iterable`);\n  }\n  return value as Iterable<ReconcileFileState>;\n}\n\n/**\n * Two paths that a participant's filesystem resolves to ONE file must not draw\n * separate push/pull work, or application order decides which revision\n * survives. Remnic is explicitly multi-platform, so all three aliasing rules\n * are folded together and a collision is rejected rather than raced:\n * case (macOS, Windows), Unicode normalization (macOS stores decomposed and\n * compares canonically), and Win32 trailing dots/spaces, which the Windows API\n * strips before touching disk.\n */\n// eslint-disable-next-line no-control-regex -- control characters are exactly what this rejects\nconst WIN32_INVALID_CHARS = /[<>:\"|?*\\u0000-\\u001f]/;\n// Windows treats the superscripts as their digits in COM/LPT device names.\nconst LONE_SURROGATE = /[\\ud800-\\udbff](?![\\udc00-\\udfff])|(?<![\\ud800-\\udbff])[\\udc00-\\udfff]/;\nconst WIN32_RESERVED_NAMES = /^(con|prn|aux|nul|(com|lpt)[1-9\\u00b9\\u00b2\\u00b3])$/i;\n\nfunction assertPortablePathSegments(\n  path: string,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): void {\n  // Windows-only hazards (trailing dot/space stripping, invalid characters\n  // like `:`, reserved device names) only constrain a plan whose LOCAL\n  // participant would materialize those paths on Windows. POSIX-origin\n  // corpora legitimately contain `:` (e.g. sqlite sidecar names), so the\n  // gates are skipped for non-win32 planners. The lone-surrogate check is\n  // UNCONDITIONAL: Node mangles unpaired surrogates identically everywhere,\n  // which corrupts cross-platform path comparison itself.\n  const isWindows = platforms.some((candidate) => candidate === \"win32\");\n  for (const segment of path.split(\"/\")) {\n    if (segment.length === 0) continue;\n    if (isWindows && (segment.endsWith(\".\") || segment.endsWith(\" \"))) {\n      throw new ReconcilePlanInputError(\n        `reconcile: ${side} census for namespace ${namespace} path ${path} has a segment ending in a dot or space; ` +\n          \"Windows strips those and would alias it onto another file\"\n      );\n    }\n    // `:` opens an alternate data stream, the rest cannot be created at all,\n    // and a reserved device name resolves to hardware. A plan containing any of\n    // them cannot be applied on a Windows participant.\n    if (LONE_SURROGATE.test(segment)) {\n      // Node encodes an unpaired surrogate as U+FFFD, so this path and a\n      // literal U+FFFD path are one file on disk while comparing as distinct.\n      throw new ReconcilePlanInputError(\n        `reconcile: ${side} census for namespace ${namespace} path ${path} contains an unpaired surrogate`\n      );\n    }\n    if (isWindows && WIN32_INVALID_CHARS.test(segment)) {\n      throw new ReconcilePlanInputError(\n        `reconcile: ${side} census for namespace ${namespace} path ${path} contains a character Windows cannot store`\n      );\n    }\n    if (isWindows && WIN32_RESERVED_NAMES.test(segment.split(\".\")[0] ?? \"\")) {\n      throw new ReconcilePlanInputError(\n        `reconcile: ${side} census for namespace ${namespace} path ${path} uses a reserved Windows device name`\n      );\n    }\n  }\n}\n\nfunction assertNoPathAlias(seen: Map<string, string>, path: string, namespace: string): void {\n  // NFC first: macOS stores decomposed names and compares canonically, so\n  // `é` (U+00E9) and `é` (e + U+0301) are ONE file there. Then a FULL caseless\n  // fold - upper-then-lower, which collapses forms a bare toLowerCase() keeps\n  // apart, such as final sigma `ς` against `σ`. Lowercasing alone would leave\n  // those distinct and the planner would emit both a push and a pull.\n  // `ß` upper-folds to `ss` while `ẞ` folds to `ß`, so one more pass equalizes\n  // the pair that a single upper-then-lower still leaves apart.\n  const folded = path\n    .normalize(\"NFC\")\n    .toUpperCase()\n    .toLowerCase()\n    .replace(/\\u00df/g, \"ss\");\n  const existing = seen.get(folded);\n  if (existing !== undefined && existing !== path) {\n    throw new ReconcilePlanInputError(\n      `reconcile: namespace ${namespace} has aliasing paths (${existing}, ${path}); ` +\n        \"they resolve to one file on a case-insensitive or Unicode-normalizing peer\"\n    );\n  }\n  seen.set(folded, path);\n}\n\n/**\n * Duplicate paths are accepted only when they agree. Two digests for one path\n * make the plan depend on which record arrived last, which would break the\n * byte-stable ordering the convergence report relies on.\n */\nfunction rejectConflictingDuplicate(\n  existing: { sha256: string; mtimeMs?: number } | undefined,\n  incoming: { sha256: string; mtimeMs?: number },\n  path: string,\n  side: string,\n  namespace: string\n): boolean {\n  if (!existing) return false;\n  if (existing.sha256 !== incoming.sha256) {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${side} census for namespace ${namespace} lists ${path} twice with different digests`\n    );\n  }\n  // Same bytes but a different mtime is still ambiguous: `newest-wins` reads\n  // that timestamp, so accepting the first arrival would let input order decide\n  // the winner.\n  if (existing.mtimeMs !== incoming.mtimeMs) {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${side} census for namespace ${namespace} lists ${path} twice with different mtimeMs`\n    );\n  }\n  return true;\n}\n\nfunction indexByPath(\n  files: Iterable<ReconcileFileState>,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): Map<string, ReconcileFileState> {\n  const index = new Map<string, ReconcileFileState>();\n  for (const raw of files) {\n    const file = assertCensusRecord(raw, side, namespace, platforms);\n    if (rejectConflictingDuplicate(index.get(file.path), file, file.path, side, namespace)) continue;\n    index.set(file.path, file);\n  }\n  return index;\n}\n\n/**\n * A bare string satisfies `Iterable<string>`, and `new Set(\"abc…\")` would split\n * it into 64 one-character members — every membership test then misses and each\n * retracted file is planned as `pull` and resurrected. Reject the scalar and\n * canonicalize every member.\n */\nfunction parseTombstonedDigests(\n  value: Iterable<string> | undefined,\n  namespace: string,\n  field = \"tombstonedFileSha256\"\n): Set<string> {\n  if (value === undefined) return new Set();\n  if (typeof value === \"string\") {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${field} for namespace ${namespace} must be a collection of digests, not a single string`\n    );\n  }\n  if (value === null || typeof value !== \"object\" || typeof value[Symbol.iterator] !== \"function\") {\n    // Otherwise the for...of below throws a raw TypeError and a caller handling\n    // ReconcilePlanInputError cannot tell a bad request from a planner bug.\n    throw new ReconcilePlanInputError(\n      `reconcile: ${field} for namespace ${namespace} must be an iterable collection of digests`\n    );\n  }\n  const digests = new Set<string>();\n  for (const entry of value) {\n    digests.add(assertDigest(entry, `${field} for namespace ${namespace}`));\n  }\n  return digests;\n}\n\n/**\n * Validate a census while keeping ONLY path -> digest.\n *\n * The base cursor is read for digests alone, so indexing full records and\n * compacting afterwards would hold a corpus-sized record map and its copy at\n * once - the peak this avoids.\n */\nfunction indexDigestsByPath(\n  files: Iterable<ReconcileFileState>,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): Map<string, string> {\n  const index = new Map<string, string>();\n  for (const raw of files) {\n    const file = assertCensusRecord(raw, side, namespace, platforms);\n    const existing = index.get(file.path);\n    // One map, not a parallel `seen`: the base's own mtimeMs is never a\n    // decision input (only the local and peer timestamps order a conflict), so\n    // a duplicate that agrees on the digest is unambiguous here regardless of\n    // its timestamp, and the digest alone is enough to detect a real clash.\n    if (existing !== undefined) {\n      if (existing !== file.sha256) {\n        throw new ReconcilePlanInputError(\n          `reconcile: ${side} census for namespace ${namespace} lists ${file.path} twice with different digests`\n        );\n      }\n      continue;\n    }\n    index.set(file.path, file.sha256);\n  }\n  return index;\n}\n\nfunction assertConflictPolicy(value: ConvergeConflictPolicy | undefined): ConvergeConflictPolicy {\n  if (value === undefined) return DEFAULT_CONVERGE_CONFLICT_POLICY;\n  if (!CONVERGE_CONFLICT_POLICIES.includes(value)) {\n    throw new ReconcilePlanInputError(\n      `reconcile: unknown conflictPolicy ${JSON.stringify(value)}; expected one of ${CONVERGE_CONFLICT_POLICIES.join(\", \")}`\n    );\n  }\n  return value;\n}\n\n/**\n * Total ordering for plan entries (§12): namespace, then path. Both are unique\n * per entry, so equal keys are impossible and the comparator never has to\n * return 0 for distinct rows — the output is byte-identical across runs, which\n * is what makes a convergence report diffable. Cursor and manifest sort with\n * this same export; a local copy on either side is how ordering drifts (§2477).\n */\nexport function compareReconcilePlanEntries(a: ReconcilePlanEntry, b: ReconcilePlanEntry): number {\n  if (a.namespace !== b.namespace) return a.namespace < b.namespace ? -1 : 1;\n  if (a.path !== b.path) return a.path < b.path ? -1 : 1;\n  return 0;\n}\n\n/**\n * Identity of a semantic-duplicate pair: the ordered (local, peer) path pair.\n * Cursor derivation and manifest collapse must key prior agreements with this\n * same export or a stored cursor stops matching the plan that wrote it.\n */\nexport function semanticAgreementKey(agreement: ReconcileSemanticAgreement): string {\n  return `${agreement.local.path}\\0${agreement.peer.path}`;\n}\n\nfunction resolveConflict(\n  policy: ConvergeConflictPolicy,\n  localMtimeMs: number | undefined,\n  peerMtimeMs: number | undefined,\n  missingTimestampResolution: ReconcileResolution\n): ReconcileResolution {\n  if (policy !== \"newest-wins\") return \"unresolved\";\n  if (localMtimeMs === undefined || peerMtimeMs === undefined || localMtimeMs === peerMtimeMs) {\n    return missingTimestampResolution;\n  }\n  return localMtimeMs > peerMtimeMs ? \"local-wins\" : \"peer-wins\";\n}\n\nfunction parseDeletionMtimes(\n  value: ReadonlyMap<string, number> | undefined,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): ReadonlyMap<string, number> {\n  if (value === undefined) return new Map();\n  if (!(value instanceof Map)) {\n    throw new ReconcilePlanInputError(`reconcile: ${side} deletion mtimes for namespace ${namespace} must be a Map`);\n  }\n  const parsed = new Map<string, number>();\n  for (const [path, mtimeMs] of value) {\n    try {\n      validateArchiveRelativePath(path, `reconcile: ${side} deletion mtimes for namespace ${namespace}`);\n    } catch (err) {\n      throw new ReconcilePlanInputError(err instanceof Error ? err.message : String(err));\n    }\n    assertPortablePathSegments(path, side, namespace, platforms);\n    parsed.set(path, assertMtimeMs(mtimeMs, `${side} deletion for namespace ${namespace} entry ${path}`));\n  }\n  return parsed;\n}\n\n/**\n * Plan one namespace. Exposed for callers that stream namespaces one at a time.\n *\n * Residency is one peer index + a set of local paths + the entry list. The\n * local census is consumed as a stream and never materialized, so a 100k-file\n * corpus does not hold two full censuses at once — but this is NOT constant\n * memory, and a caller holding its own census arrays adds to that.\n */\nexport function planNamespaceReconciliation(\n  input: ReconcileNamespaceInput,\n  options: ReconcileOptions = {}\n): ReconcilePlanEntry[] {\n  if (!isPlainObject(input)) {\n    throw new ReconcilePlanInputError(\"reconcile: namespace input must be a plain object\");\n  }\n  if (!isPlainObject(options)) {\n    // A Date, Map or RegExp passes a bare typeof check, exposes no\n    // `conflictPolicy`, and would silently take the default policy - hiding a\n    // malformed request behind `manual`.\n    throw new ReconcilePlanInputError(\"reconcile: options must be a plain object\");\n  }\n  const namespace = assertNamespace(input.namespace);\n  const policy = assertConflictPolicy(options.conflictPolicy);\n  const localCensus = assertIterable(input.local, \"local\", namespace);\n  const caseFold = new Map<string, string>();\n  // Index the peer census only, then stream the local one against it, removing\n  // each match as it is consumed. Peak residency is one index plus the entry\n  // list rather than two full censuses (round 2, codex P2).\n  const effectivePlatforms = [options.localPlatform ?? process.platform, options.peerPlatform];\n  const peer = indexByPath(assertIterable(input.peer, \"peer\", namespace), \"peer\", namespace, effectivePlatforms);\n  // Only `base.sha256` is ever read, so the base is compacted to path -> digest\n  // instead of a second full record index (round 7, codex P2).\n  // Only an ABSENT base means bootstrap. A null/invalid cursor silently read as\n  // \"no prior agreement\" would turn a peer-side deletion into a push and\n  // resurrect it.\n  const base =\n    input.base === undefined\n      ? null\n      : indexDigestsByPath(assertIterable(input.base, \"base\", namespace), \"base\", namespace, effectivePlatforms);\n  const tombstoned = parseTombstonedDigests(input.tombstonedFileSha256, namespace);\n  const peerTombstoned = parseTombstonedDigests(input.peerTombstonedFileSha256, namespace, \"peerTombstonedFileSha256\");\n  const localDeletionMtimeMs = parseDeletionMtimes(input.localDeletionMtimeMs, \"local\", namespace, effectivePlatforms);\n  const peerDeletionMtimeMs = parseDeletionMtimes(input.peerDeletionMtimeMs, \"peer\", namespace, effectivePlatforms);\n  const entries: ReconcilePlanEntry[] = [];\n\n  // Path -> digest only, never the file objects: enough to make the stream\n  // idempotent and to catch contradictory duplicates without materializing the\n  // second census.\n  // Base paths participate in the collision check: a base `Facts/A.md` against\n  // a local `facts/a.md` is the same delete/change ambiguity on a\n  // case-insensitive participant.\n  if (base) for (const basePath of base.keys()) assertNoPathAlias(caseFold, basePath, namespace);\n  // Path -> decision-relevant fields only, never the whole record: enough to\n  // make the stream idempotent and to catch contradictory duplicates without\n  // materializing the second census.\n  const seenLocal = new Map<string, { sha256: string; mtimeMs?: number }>();\n  for (const rawLocal of localCensus) {\n    const localFile = assertCensusRecord(rawLocal, \"local\", namespace, effectivePlatforms);\n    const path = localFile.path;\n    assertNoPathAlias(caseFold, path, namespace);\n    const seen = seenLocal.get(path);\n    if (seen !== undefined) {\n      // Same rule the indexed censuses get: mtimeMs is decision-relevant under\n      // `newest-wins`, so a duplicate that disagrees on it is ambiguous too.\n      if (rejectConflictingDuplicate(seen, localFile, path, \"local\", namespace)) continue;\n    }\n    seenLocal.set(path, { sha256: localFile.sha256, mtimeMs: localFile.mtimeMs });\n    const peerFile = peer.get(path);\n    // Consumed: whatever remains in the index afterwards is peer-only.\n    peer.delete(path);\n    const baseSha256 = base?.get(path);\n    // Retraction outranks every other decision for this path, on EITHER side.\n    // Checked before hash comparison and conflict resolution: a retracted peer\n    // revision reaching the conflict ladder can win under `newest-wins`, and a\n    // retracted LOCAL revision would otherwise be pushed - which is also how a\n    // suppression undoes itself on the next run, since the local copy survives\n    // the peer-side delete (round 4).\n    // Either side's retraction removes the copy that carries the digest, so a\n    // peer retraction of something we still hold suppresses OUR copy rather\n    // than pushing it back.\n    const localRetracted = tombstoned.has(localFile.sha256) || peerTombstoned.has(localFile.sha256);\n    const peerRetracted =\n      peerFile !== undefined && (tombstoned.has(peerFile.sha256) || peerTombstoned.has(peerFile.sha256));\n    if (localRetracted || peerRetracted) {\n      entries.push({\n        path,\n        namespace,\n        action: \"suppress\",\n        reason: \"tombstoned\",\n        localSha256: localFile.sha256,\n        ...(peerFile ? { peerSha256: peerFile.sha256 } : {}),\n        ...(baseSha256 === undefined ? {} : { baseSha256 }),\n        suppressSide: localRetracted && peerRetracted ? \"both\" : localRetracted ? \"local\" : \"peer\",\n      });\n      continue;\n    }\n    if (!peerFile) {\n      // Base PRESENCE is what proves a deletion, not equality with whatever the\n      // surviving side now holds. If we also edited since the base, this is\n      // delete-versus-modify: still a conflict, and pushing it would resurrect\n      // a deliberate deletion. Without a base the peer simply never saw the\n      // path, and a bootstrap merge must push — both sides hold unique data.\n      if (baseSha256 !== undefined) {\n        const peerDeletionMtime = peerDeletionMtimeMs.get(path);\n        const resolution =\n          baseSha256 === localFile.sha256\n            ? \"unresolved\"\n            : resolveConflict(policy, localFile.mtimeMs, peerDeletionMtime, \"unresolved\");\n        entries.push({\n          path,\n          namespace,\n          action: \"conflict\",\n          reason: baseSha256 === localFile.sha256 ? \"peer_deleted\" : \"local_modified_peer_deleted\",\n          localSha256: localFile.sha256,\n          baseSha256,\n          resolution,\n          ...(resolution === \"peer-wins\" && peerDeletionMtime !== undefined\n            ? { deletionMtimeMs: peerDeletionMtime }\n            : {}),\n        });\n        continue;\n      }\n      entries.push({\n        path,\n        namespace,\n        action: \"push\",\n        reason: \"local_only\",\n        localSha256: localFile.sha256,\n      });\n      continue;\n    }\n    if (peerFile.sha256 === localFile.sha256) {\n      entries.push({\n        path,\n        namespace,\n        action: \"identical\",\n        reason: \"same_content\",\n        localSha256: localFile.sha256,\n        peerSha256: peerFile.sha256,\n        ...(baseSha256 === undefined ? {} : { baseSha256 }),\n      });\n      continue;\n    }\n    // A base that matches one side turns a \"conflict\" into an ordinary\n    // one-sided change: that side is the only one that moved since agreement.\n    if (baseSha256 !== undefined && baseSha256 === localFile.sha256) {\n      entries.push({\n        path,\n        namespace,\n        action: \"pull\",\n        reason: \"peer_changed\",\n        localSha256: localFile.sha256,\n        peerSha256: peerFile.sha256,\n        baseSha256,\n      });\n      continue;\n    }\n    if (baseSha256 !== undefined && baseSha256 === peerFile.sha256) {\n      entries.push({\n        path,\n        namespace,\n        action: \"push\",\n        reason: \"local_changed\",\n        localSha256: localFile.sha256,\n        peerSha256: peerFile.sha256,\n        baseSha256,\n      });\n      continue;\n    }\n    const resolution = resolveConflict(policy, localFile.mtimeMs, peerFile.mtimeMs, \"supersede-link\");\n    entries.push({\n      path,\n      namespace,\n      action: \"conflict\",\n      reason: \"both_modified\",\n      localSha256: localFile.sha256,\n      peerSha256: peerFile.sha256,\n      ...(baseSha256 === undefined ? {} : { baseSha256 }),\n      resolution,\n    });\n  }\n\n  for (const [path, peerFile] of peer) {\n    assertNoPathAlias(caseFold, path, namespace);\n    const baseSha256 = base?.get(path);\n    if (tombstoned.has(peerFile.sha256) || peerTombstoned.has(peerFile.sha256)) {\n      // Retracted here on purpose, and the peer still serves it. Pulling it\n      // back would undo the retraction; calling it `identical` would be worse,\n      // because a converged plan lets transport skip everything and the peer\n      // keeps serving the retracted fact forever. It is work: propagate the\n      // tombstone.\n      entries.push({\n        path,\n        namespace,\n        action: \"suppress\",\n        reason: \"tombstoned\",\n        peerSha256: peerFile.sha256,\n        ...(baseSha256 === undefined ? {} : { baseSha256 }),\n        suppressSide: \"peer\",\n      });\n      continue;\n    }\n    if (baseSha256 !== undefined) {\n      const localDeletionMtime = localDeletionMtimeMs.get(path);\n      const resolution =\n        baseSha256 === peerFile.sha256\n          ? \"unresolved\"\n          : resolveConflict(policy, localDeletionMtime, peerFile.mtimeMs, \"unresolved\");\n      entries.push({\n        path,\n        namespace,\n        action: \"conflict\",\n        reason: baseSha256 === peerFile.sha256 ? \"local_deleted\" : \"local_deleted_peer_modified\",\n        peerSha256: peerFile.sha256,\n        baseSha256,\n        resolution,\n        ...(resolution === \"local-wins\" && localDeletionMtime !== undefined\n          ? { deletionMtimeMs: localDeletionMtime }\n          : {}),\n      });\n      continue;\n    }\n    entries.push({\n      path,\n      namespace,\n      action: \"pull\",\n      reason: \"peer_only\",\n      peerSha256: peerFile.sha256,\n    });\n  }\n\n  return entries.sort(compareReconcilePlanEntries);\n}\n\n/** Aggregate entries into the per-namespace convergence report (#2150). */\nexport function summarizeReconcilePlan(entries: readonly ReconcilePlanEntry[]): ReconcileNamespaceReport[] {\n  const byNamespace = new Map<string, ReconcileNamespaceReport>();\n  for (const entry of entries) {\n    let report = byNamespace.get(entry.namespace);\n    if (!report) {\n      report = { namespace: entry.namespace, pull: 0, push: 0, identical: 0, conflict: 0, suppress: 0, unresolved: 0 };\n      byNamespace.set(entry.namespace, report);\n    }\n    report[entry.action] += 1;\n    const needsOperator = entry.resolution === \"unresolved\" || entry.resolution === \"supersede-link\";\n    if (entry.action === \"conflict\" && needsOperator) report.unresolved += 1;\n  }\n  return [...byNamespace.values()].sort((a, b) =>\n    a.namespace === b.namespace ? 0 : a.namespace < b.namespace ? -1 : 1\n  );\n}\n\n/**\n * Plan a full reconciliation across namespaces.\n *\n * `converged` is an affirmative claim that nothing needs to move, so it is\n * derived from the entries rather than tracked alongside them: any action other\n * than `identical` disproves it.\n */\nexport function planReconciliation(\n  namespaces: readonly ReconcileNamespaceInput[],\n  options: ReconcileOptions = {}\n): ReconcilePlan {\n  if (!Array.isArray(namespaces)) {\n    throw new ReconcilePlanInputError(\"reconcile: planReconciliation expects an array of namespace inputs\");\n  }\n  // Validated here too: with an empty array the per-namespace path never runs,\n  // and a malformed options envelope would return `converged` instead of\n  // raising - the same call failing or succeeding based on list length.\n  if (!isPlainObject(options)) {\n    throw new ReconcilePlanInputError(\"reconcile: options must be a plain object\");\n  }\n  assertConflictPolicy(options.conflictPolicy);\n  const entries: ReconcilePlanEntry[] = [];\n  // Two inputs for one namespace are planned independently, so the same\n  // (namespace, path) can draw contradictory actions - and because those\n  // entries also sort equal, batch order would decide which revision survives.\n  const seenNamespaces = new Set<string>();\n  for (const namespace of namespaces) {\n    const name = assertNamespace(namespace?.namespace);\n    if (seenNamespaces.has(name)) {\n      throw new ReconcilePlanInputError(\n        `reconcile: namespace ${name} appears twice; merge its censuses before planning`\n      );\n    }\n    seenNamespaces.add(name);\n    entries.push(...planNamespaceReconciliation(namespace, options));\n  }\n  entries.sort(compareReconcilePlanEntries);\n  return {\n    entries,\n    byNamespace: summarizeReconcilePlan(entries),\n    converged: entries.every((entry) => entry.action === \"identical\"),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4MO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAWA,SAAS,mBACP,MACA,MACA,WACA,WACoB;AACpB,QAAM,OAAO,MAAM;AACnB,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,yBAAyB,SAAS;AAAA,IACtD;AAAA,EACF;AAIA,MAAI;AACF,gCAA4B,MAAM,cAAc,IAAI,yBAAyB,SAAS,EAAE;AAAA,EAC1F,SAAS,KAAK;AACZ,UAAM,IAAI,wBAAwB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,EACpF;AACA,6BAA2B,MAAM,MAAM,WAAW,SAAS;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,QAAQ,aAAa,MAAM,QAAQ,GAAG,IAAI,yBAAyB,SAAS,UAAU,IAAI,EAAE;AAAA,IAC5F,GAAI,MAAM,YAAY,SAClB,CAAC,IACD,EAAE,SAAS,cAAc,KAAK,SAAS,GAAG,IAAI,yBAAyB,SAAS,UAAU,IAAI,EAAE,EAAE;AAAA,EACxG;AACF;AAWA,SAAS,cAAc,OAAgB,SAAyB;AAC9D,MAAI,CAAC,gBAAgB,KAAK,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,cAAc,OAAO,uEAAuE,mBAAmB;AAAA,IACjH;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,aAAa,OAAgB,SAAyB;AAC7D,MAAI,CAAC,YAAY,KAAK,GAAG;AACvB,UAAM,IAAI,wBAAwB,cAAc,OAAO,8CAA8C;AAAA,EACvG;AACA,SAAO,MAAM,YAAY;AAC3B;AAEA,SAAS,cAAc,OAAyB;AAC9C,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,QAAiB,OAAO,eAAe,KAAK;AAClD,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,gBAAgB,WAA4B;AACnD,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,wBAAwB,8DAA8D;AAAA,EAClG;AAKA,MAAI,eAAe,KAAK,SAAS,GAAG;AAIlC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,2BAA2B,SAAS,MAAM,WAAW;AACvD,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,SAAS,CAAC,2BAA2B,KAAK,UAAU,2BAA2B,SAAS,CAAC,CAAC;AAAA,IACnI;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,MAAc,WAAiD;AACrG,MACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAQ,MAAuC,OAAO,QAAQ,MAAM,YACpE;AACA,UAAM,IAAI,wBAAwB,cAAc,IAAI,yBAAyB,SAAS,mBAAmB;AAAA,EAC3G;AACA,SAAO;AACT;AAYA,IAAM,sBAAsB;AAE5B,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAE7B,SAAS,2BACP,MACA,MACA,WACA,WACM;AAQN,QAAM,YAAY,UAAU,KAAK,CAAC,cAAc,cAAc,OAAO;AACrE,aAAW,WAAW,KAAK,MAAM,GAAG,GAAG;AACrC,QAAI,QAAQ,WAAW,EAAG;AAC1B,QAAI,cAAc,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,IAAI;AACjE,YAAM,IAAI;AAAA,QACR,cAAc,IAAI,yBAAyB,SAAS,SAAS,IAAI;AAAA,MAEnE;AAAA,IACF;AAIA,QAAI,eAAe,KAAK,OAAO,GAAG;AAGhC,YAAM,IAAI;AAAA,QACR,cAAc,IAAI,yBAAyB,SAAS,SAAS,IAAI;AAAA,MACnE;AAAA,IACF;AACA,QAAI,aAAa,oBAAoB,KAAK,OAAO,GAAG;AAClD,YAAM,IAAI;AAAA,QACR,cAAc,IAAI,yBAAyB,SAAS,SAAS,IAAI;AAAA,MACnE;AAAA,IACF;AACA,QAAI,aAAa,qBAAqB,KAAK,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG;AACvE,YAAM,IAAI;AAAA,QACR,cAAc,IAAI,yBAAyB,SAAS,SAAS,IAAI;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,MAA2B,MAAc,WAAyB;AAQ3F,QAAM,SAAS,KACZ,UAAU,KAAK,EACf,YAAY,EACZ,YAAY,EACZ,QAAQ,WAAW,IAAI;AAC1B,QAAM,WAAW,KAAK,IAAI,MAAM;AAChC,MAAI,aAAa,UAAa,aAAa,MAAM;AAC/C,UAAM,IAAI;AAAA,MACR,wBAAwB,SAAS,wBAAwB,QAAQ,KAAK,IAAI;AAAA,IAE5E;AAAA,EACF;AACA,OAAK,IAAI,QAAQ,IAAI;AACvB;AAOA,SAAS,2BACP,UACA,UACA,MACA,MACA,WACS;AACT,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,WAAW,SAAS,QAAQ;AACvC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,yBAAyB,SAAS,UAAU,IAAI;AAAA,IACpE;AAAA,EACF;AAIA,MAAI,SAAS,YAAY,SAAS,SAAS;AACzC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,yBAAyB,SAAS,UAAU,IAAI;AAAA,IACpE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YACP,OACA,MACA,WACA,WACiC;AACjC,QAAM,QAAQ,oBAAI,IAAgC;AAClD,aAAW,OAAO,OAAO;AACvB,UAAM,OAAO,mBAAmB,KAAK,MAAM,WAAW,SAAS;AAC/D,QAAI,2BAA2B,MAAM,IAAI,KAAK,IAAI,GAAG,MAAM,KAAK,MAAM,MAAM,SAAS,EAAG;AACxF,UAAM,IAAI,KAAK,MAAM,IAAI;AAAA,EAC3B;AACA,SAAO;AACT;AAQA,SAAS,uBACP,OACA,WACA,QAAQ,wBACK;AACb,MAAI,UAAU,OAAW,QAAO,oBAAI,IAAI;AACxC,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI;AAAA,MACR,cAAc,KAAK,kBAAkB,SAAS;AAAA,IAChD;AAAA,EACF;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,MAAM,OAAO,QAAQ,MAAM,YAAY;AAG/F,UAAM,IAAI;AAAA,MACR,cAAc,KAAK,kBAAkB,SAAS;AAAA,IAChD;AAAA,EACF;AACA,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,OAAO;AACzB,YAAQ,IAAI,aAAa,OAAO,GAAG,KAAK,kBAAkB,SAAS,EAAE,CAAC;AAAA,EACxE;AACA,SAAO;AACT;AASA,SAAS,mBACP,OACA,MACA,WACA,WACqB;AACrB,QAAM,QAAQ,oBAAI,IAAoB;AACtC,aAAW,OAAO,OAAO;AACvB,UAAM,OAAO,mBAAmB,KAAK,MAAM,WAAW,SAAS;AAC/D,UAAM,WAAW,MAAM,IAAI,KAAK,IAAI;AAKpC,QAAI,aAAa,QAAW;AAC1B,UAAI,aAAa,KAAK,QAAQ;AAC5B,cAAM,IAAI;AAAA,UACR,cAAc,IAAI,yBAAyB,SAAS,UAAU,KAAK,IAAI;AAAA,QACzE;AAAA,MACF;AACA;AAAA,IACF;AACA,UAAM,IAAI,KAAK,MAAM,KAAK,MAAM;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAmE;AAC/F,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,2BAA2B,SAAS,KAAK,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,qCAAqC,KAAK,UAAU,KAAK,CAAC,qBAAqB,2BAA2B,KAAK,IAAI,CAAC;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,4BAA4B,GAAuB,GAA+B;AAChG,MAAI,EAAE,cAAc,EAAE,UAAW,QAAO,EAAE,YAAY,EAAE,YAAY,KAAK;AACzE,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO,EAAE,OAAO,EAAE,OAAO,KAAK;AACrD,SAAO;AACT;AAOO,SAAS,qBAAqB,WAA+C;AAClF,SAAO,GAAG,UAAU,MAAM,IAAI,KAAK,UAAU,KAAK,IAAI;AACxD;AAEA,SAAS,gBACP,QACA,cACA,aACA,4BACqB;AACrB,MAAI,WAAW,cAAe,QAAO;AACrC,MAAI,iBAAiB,UAAa,gBAAgB,UAAa,iBAAiB,aAAa;AAC3F,WAAO;AAAA,EACT;AACA,SAAO,eAAe,cAAc,eAAe;AACrD;AAEA,SAAS,oBACP,OACA,MACA,WACA,WAC6B;AAC7B,MAAI,UAAU,OAAW,QAAO,oBAAI,IAAI;AACxC,MAAI,EAAE,iBAAiB,MAAM;AAC3B,UAAM,IAAI,wBAAwB,cAAc,IAAI,kCAAkC,SAAS,gBAAgB;AAAA,EACjH;AACA,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO;AACnC,QAAI;AACF,kCAA4B,MAAM,cAAc,IAAI,kCAAkC,SAAS,EAAE;AAAA,IACnG,SAAS,KAAK;AACZ,YAAM,IAAI,wBAAwB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACpF;AACA,+BAA2B,MAAM,MAAM,WAAW,SAAS;AAC3D,WAAO,IAAI,MAAM,cAAc,SAAS,GAAG,IAAI,2BAA2B,SAAS,UAAU,IAAI,EAAE,CAAC;AAAA,EACtG;AACA,SAAO;AACT;AAUO,SAAS,4BACd,OACA,UAA4B,CAAC,GACP;AACtB,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI,wBAAwB,mDAAmD;AAAA,EACvF;AACA,MAAI,CAAC,cAAc,OAAO,GAAG;AAI3B,UAAM,IAAI,wBAAwB,2CAA2C;AAAA,EAC/E;AACA,QAAM,YAAY,gBAAgB,MAAM,SAAS;AACjD,QAAM,SAAS,qBAAqB,QAAQ,cAAc;AAC1D,QAAM,cAAc,eAAe,MAAM,OAAO,SAAS,SAAS;AAClE,QAAM,WAAW,oBAAI,IAAoB;AAIzC,QAAM,qBAAqB,CAAC,QAAQ,iBAAiB,QAAQ,UAAU,QAAQ,YAAY;AAC3F,QAAM,OAAO,YAAY,eAAe,MAAM,MAAM,QAAQ,SAAS,GAAG,QAAQ,WAAW,kBAAkB;AAM7G,QAAM,OACJ,MAAM,SAAS,SACX,OACA,mBAAmB,eAAe,MAAM,MAAM,QAAQ,SAAS,GAAG,QAAQ,WAAW,kBAAkB;AAC7G,QAAM,aAAa,uBAAuB,MAAM,sBAAsB,SAAS;AAC/E,QAAM,iBAAiB,uBAAuB,MAAM,0BAA0B,WAAW,0BAA0B;AACnH,QAAM,uBAAuB,oBAAoB,MAAM,sBAAsB,SAAS,WAAW,kBAAkB;AACnH,QAAM,sBAAsB,oBAAoB,MAAM,qBAAqB,QAAQ,WAAW,kBAAkB;AAChH,QAAM,UAAgC,CAAC;AAQvC,MAAI,KAAM,YAAW,YAAY,KAAK,KAAK,EAAG,mBAAkB,UAAU,UAAU,SAAS;AAI7F,QAAM,YAAY,oBAAI,IAAkD;AACxE,aAAW,YAAY,aAAa;AAClC,UAAM,YAAY,mBAAmB,UAAU,SAAS,WAAW,kBAAkB;AACrF,UAAM,OAAO,UAAU;AACvB,sBAAkB,UAAU,MAAM,SAAS;AAC3C,UAAM,OAAO,UAAU,IAAI,IAAI;AAC/B,QAAI,SAAS,QAAW;AAGtB,UAAI,2BAA2B,MAAM,WAAW,MAAM,SAAS,SAAS,EAAG;AAAA,IAC7E;AACA,cAAU,IAAI,MAAM,EAAE,QAAQ,UAAU,QAAQ,SAAS,UAAU,QAAQ,CAAC;AAC5E,UAAM,WAAW,KAAK,IAAI,IAAI;AAE9B,SAAK,OAAO,IAAI;AAChB,UAAM,aAAa,MAAM,IAAI,IAAI;AAUjC,UAAM,iBAAiB,WAAW,IAAI,UAAU,MAAM,KAAK,eAAe,IAAI,UAAU,MAAM;AAC9F,UAAM,gBACJ,aAAa,WAAc,WAAW,IAAI,SAAS,MAAM,KAAK,eAAe,IAAI,SAAS,MAAM;AAClG,QAAI,kBAAkB,eAAe;AACnC,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,QACvB,GAAI,WAAW,EAAE,YAAY,SAAS,OAAO,IAAI,CAAC;AAAA,QAClD,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,QACjD,cAAc,kBAAkB,gBAAgB,SAAS,iBAAiB,UAAU;AAAA,MACtF,CAAC;AACD;AAAA,IACF;AACA,QAAI,CAAC,UAAU;AAMb,UAAI,eAAe,QAAW;AAC5B,cAAM,oBAAoB,oBAAoB,IAAI,IAAI;AACtD,cAAMA,cACJ,eAAe,UAAU,SACrB,eACA,gBAAgB,QAAQ,UAAU,SAAS,mBAAmB,YAAY;AAChF,gBAAQ,KAAK;AAAA,UACX;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,QAAQ,eAAe,UAAU,SAAS,iBAAiB;AAAA,UAC3D,aAAa,UAAU;AAAA,UACvB;AAAA,UACA,YAAAA;AAAA,UACA,GAAIA,gBAAe,eAAe,sBAAsB,SACpD,EAAE,iBAAiB,kBAAkB,IACrC,CAAC;AAAA,QACP,CAAC;AACD;AAAA,MACF;AACA,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,MACzB,CAAC;AACD;AAAA,IACF;AACA,QAAI,SAAS,WAAW,UAAU,QAAQ;AACxC,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,MACnD,CAAC;AACD;AAAA,IACF;AAGA,QAAI,eAAe,UAAa,eAAe,UAAU,QAAQ;AAC/D,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB;AAAA,MACF,CAAC;AACD;AAAA,IACF;AACA,QAAI,eAAe,UAAa,eAAe,SAAS,QAAQ;AAC9D,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB;AAAA,MACF,CAAC;AACD;AAAA,IACF;AACA,UAAM,aAAa,gBAAgB,QAAQ,UAAU,SAAS,SAAS,SAAS,gBAAgB;AAChG,YAAQ,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa,UAAU;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,CAAC,MAAM,QAAQ,KAAK,MAAM;AACnC,sBAAkB,UAAU,MAAM,SAAS;AAC3C,UAAM,aAAa,MAAM,IAAI,IAAI;AACjC,QAAI,WAAW,IAAI,SAAS,MAAM,KAAK,eAAe,IAAI,SAAS,MAAM,GAAG;AAM1E,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,YAAY,SAAS;AAAA,QACrB,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,QACjD,cAAc;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AACA,QAAI,eAAe,QAAW;AAC5B,YAAM,qBAAqB,qBAAqB,IAAI,IAAI;AACxD,YAAM,aACJ,eAAe,SAAS,SACpB,eACA,gBAAgB,QAAQ,oBAAoB,SAAS,SAAS,YAAY;AAChF,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,eAAe,SAAS,SAAS,kBAAkB;AAAA,QAC3D,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA,GAAI,eAAe,gBAAgB,uBAAuB,SACtD,EAAE,iBAAiB,mBAAmB,IACtC,CAAC;AAAA,MACP,CAAC;AACD;AAAA,IACF;AACA,YAAQ,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY,SAAS;AAAA,IACvB,CAAC;AAAA,EACH;AAEA,SAAO,QAAQ,KAAK,2BAA2B;AACjD;AAGO,SAAS,uBAAuB,SAAoE;AACzG,QAAM,cAAc,oBAAI,IAAsC;AAC9D,aAAW,SAAS,SAAS;AAC3B,QAAI,SAAS,YAAY,IAAI,MAAM,SAAS;AAC5C,QAAI,CAAC,QAAQ;AACX,eAAS,EAAE,WAAW,MAAM,WAAW,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,EAAE;AAC/G,kBAAY,IAAI,MAAM,WAAW,MAAM;AAAA,IACzC;AACA,WAAO,MAAM,MAAM,KAAK;AACxB,UAAM,gBAAgB,MAAM,eAAe,gBAAgB,MAAM,eAAe;AAChF,QAAI,MAAM,WAAW,cAAc,cAAe,QAAO,cAAc;AAAA,EACzE;AACA,SAAO,CAAC,GAAG,YAAY,OAAO,CAAC,EAAE;AAAA,IAAK,CAAC,GAAG,MACxC,EAAE,cAAc,EAAE,YAAY,IAAI,EAAE,YAAY,EAAE,YAAY,KAAK;AAAA,EACrE;AACF;AASO,SAAS,mBACd,YACA,UAA4B,CAAC,GACd;AACf,MAAI,CAAC,MAAM,QAAQ,UAAU,GAAG;AAC9B,UAAM,IAAI,wBAAwB,oEAAoE;AAAA,EACxG;AAIA,MAAI,CAAC,cAAc,OAAO,GAAG;AAC3B,UAAM,IAAI,wBAAwB,2CAA2C;AAAA,EAC/E;AACA,uBAAqB,QAAQ,cAAc;AAC3C,QAAM,UAAgC,CAAC;AAIvC,QAAM,iBAAiB,oBAAI,IAAY;AACvC,aAAW,aAAa,YAAY;AAClC,UAAM,OAAO,gBAAgB,WAAW,SAAS;AACjD,QAAI,eAAe,IAAI,IAAI,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,wBAAwB,IAAI;AAAA,MAC9B;AAAA,IACF;AACA,mBAAe,IAAI,IAAI;AACvB,YAAQ,KAAK,GAAG,4BAA4B,WAAW,OAAO,CAAC;AAAA,EACjE;AACA,UAAQ,KAAK,2BAA2B;AACxC,SAAO;AAAA,IACL;AAAA,IACA,aAAa,uBAAuB,OAAO;AAAA,IAC3C,WAAW,QAAQ,MAAM,CAAC,UAAU,MAAM,WAAW,WAAW;AAAA,EAClE;AACF;","names":["resolution"]}
+{"version":3,"sources":["../src/reconcile/plan.ts"],"sourcesContent":["import { CENSUS_MAX_MTIME_MS, isCensusMtimeMs, isSha256Hex } from \"../census-validation.js\";\nimport { normalizeNamespaceIdentity } from \"../namespaces/identity.js\";\nimport { validateArchiveRelativePath } from \"../transfer/fs-utils.js\";\nimport type { OfflineSyncFileState } from \"../offline-sync.js\";\nimport { CONVERGE_CONFLICT_POLICIES, DEFAULT_CONVERGE_CONFLICT_POLICY } from \"../converge-config.js\";\nimport type { ConvergeConflictPolicy } from \"../types.js\";\nexport type ReconcileConflictPolicy = ConvergeConflictPolicy;\n\n/**\n * Bootstrap reconciliation planner for two peer daemons whose corpora have\n * already diverged (issue #2150).\n *\n * The offline-sync protocol assumes a satellite that shares a common base with\n * one daemon: every path it does not know about is a pull, and a conflict is\n * rare. Two long-lived daemons are the opposite case — each side holds months\n * of history the other never saw, both sides are authoritative, and there is\n * NO common base on the first run. That is a different decision problem, so it\n * gets its own planner rather than another mode flag inside `applyOfflineSync*`.\n *\n * This module is deliberately pure: it takes two file censuses and returns what\n * to do. No I/O, no transport, no clock. Everything that makes reconciliation\n * risky — which side wins, what counts as converged, what is reported — is\n * decided here where it can be exhaustively tested, and the transport layer is\n * left to carry out an already-settled plan.\n */\n\n/** Which way a path must move for the two corpora to agree. */\nexport type ReconcileAction = \"pull\" | \"push\" | \"identical\" | \"conflict\" | \"suppress\";\n\n/**\n * What the planner decided for a conflicting path.\n * `supersede-link` records that both revisions need durable preservation when\n * timestamps cannot safely select a winner. Apply must stop until transport\n * can assign distinct durable identities to both revisions.\n */\nexport type ReconcileResolution = \"local-wins\" | \"peer-wins\" | \"supersede-link\" | \"unresolved\";\n\nexport interface ReconcileSemanticFileState {\n  path: string;\n  sha256: string;\n}\n\nexport interface ReconcileSemanticAgreement {\n  local: ReconcileSemanticFileState;\n  peer: ReconcileSemanticFileState;\n}\n\nexport type ReconcileSemanticChange = \"unchanged\" | \"local_changed\" | \"peer_changed\" | \"both_modified\";\n\nexport interface ReconcilePlanEntry {\n  path: string;\n  namespace: string;\n  action: ReconcileAction;\n  /** Stable machine-readable cause, safe to assert on and to aggregate. */\n  reason: ReconcileReason;\n  localSha256?: string;\n  peerSha256?: string;\n  /** Present only when a prior converged run left a cursor covering this path. */\n  baseSha256?: string;\n  /** Set only when `action` is `conflict`. */\n  resolution?: ReconcileResolution;\n  /** Original revision time when conflict resolution propagates a deletion. */\n  deletionMtimeMs?: number;\n  /**\n   * Which side holds the retracted revision. Set only when `action` is\n   * `suppress`: with different digests on each side and only one retracted,\n   * the entry would otherwise be identical either way and transport could\n   * delete the live copy instead of the retracted one.\n   */\n  suppressSide?: \"local\" | \"peer\" | \"both\";\n  /**\n   * Real per-side identities for a cross-path semantic agreement. Synthetic\n   * rows omit the top-level side digests because `path` cannot name both files.\n   */\n  semanticAgreement?: ReconcileSemanticAgreement;\n  /** Each side's current digest compared with its own prior semantic digest. */\n  semanticChange?: ReconcileSemanticChange;\n}\n\nexport type ReconcileReason =\n  | \"peer_only\"\n  | \"local_only\"\n  /** Cursor showed only that side moved since agreement; both still hold the path. */\n  | \"peer_changed\"\n  | \"local_changed\"\n  | \"same_content\"\n  | \"semantic_duplicate\"\n  | \"both_modified\"\n  | \"peer_deleted\"\n  | \"local_deleted\"\n  /** Peer deleted it while this side edited it — the offline-sync delete/modify pair. */\n  | \"local_modified_peer_deleted\"\n  | \"local_deleted_peer_modified\"\n  | \"tombstoned\";\n\nexport interface ReconcileNamespaceReport {\n  namespace: string;\n  pull: number;\n  push: number;\n  identical: number;\n  conflict: number;\n  /** Local retractions the peer must be told about before the pair agrees. */\n  suppress: number;\n  /**\n   * Conflicts still needing an operator: those the policy declined to settle,\n   * plus supersede links whose direction could not be determined.\n   */\n  unresolved: number;\n}\n\nexport interface ReconcilePlan {\n  entries: ReconcilePlanEntry[];\n  byNamespace: ReconcileNamespaceReport[];\n  /**\n   * True when the two corpora already agree — every shared path matches and\n   * neither side holds a path the other lacks.\n   *\n   * This is the idempotency contract from #2150: running reconciliation against\n   * an already-converged peer must be a no-op, and a caller can skip the whole\n   * transfer phase on this flag alone.\n   */\n  converged: boolean;\n}\n\n/** Minimal shape the planner needs; `OfflineSyncFileState` satisfies it. */\nexport type ReconcileFileState = Pick<OfflineSyncFileState, \"path\" | \"sha256\"> &\n  Partial<Pick<OfflineSyncFileState, \"mtimeMs\" | \"bytes\">>;\n\nexport interface ReconcileNamespaceInput {\n  namespace: string;\n  local: Iterable<ReconcileFileState>;\n  peer: Iterable<ReconcileFileState>;\n  /**\n   * File states agreed at the end of the last converged run with THIS peer.\n   * Absent on a bootstrap merge, which is why a path missing from one side is\n   * read as \"never seen\" rather than \"deleted\".\n   */\n  base?: Iterable<ReconcileFileState>;\n  /**\n   * Revision timestamps for paths deleted locally since the base cursor.\n   * A deletion is a revision and must carry a comparable time for\n   * `newest-wins`; absence alone has no timestamp.\n   */\n  localDeletionMtimeMs?: ReadonlyMap<string, number>;\n  /** Revision timestamps for paths deleted by the peer since the base cursor. */\n  peerDeletionMtimeMs?: ReadonlyMap<string, number>;\n  /**\n   * Digests of FILES this side has retracted, in the same form as\n   * `ReconcileFileState.sha256` — a hash of the serialized file.\n   *\n   * Deliberately NOT `TombstoneEntry.contentHash`, which hashes the canonical\n   * raw fact text and therefore never equals a file digest (§13: one content\n   * form, everywhere). Mapping retracted fact hashes onto the file digests that\n   * carry them is the caller's job, because only the caller can read its own\n   * corpus; handing this the wrong form would silently plan `pull` and\n   * resurrect every retracted fact, so the parameter name states the form.\n   */\n  tombstonedFileSha256?: Iterable<string>;\n  /**\n   * Digests the PEER has retracted, same form.\n   *\n   * Without this a bootstrap merge cannot tell \"the peer never had it\" from\n   * \"the peer deliberately retracted it\": the peer census simply omits both,\n   * so a file we still hold is planned `push` and the peer's retraction is\n   * undone. Reconciliation is symmetric, so retraction has to be too.\n   *\n   * SCOPE: these sets decide what happens to files that still EXIST on one\n   * side. Sharing the retraction records themselves is not modelled here -\n   * tombstones are corpus files (`state/tombstones.jsonl`), so they reconcile\n   * as ordinary paths through this same plan. A digest both censuses have\n   * already dropped therefore produces no entry, by design: there is no file\n   * left to act on, and synthesizing a path-less entry would hand transport\n   * something it cannot apply.\n   */\n  peerTombstonedFileSha256?: Iterable<string>;\n}\n\nexport interface ReconcileOptions {\n  conflictPolicy?: ConvergeConflictPolicy;\n  /**\n   * Platform whose filesystem constraints the portability gates enforce\n   * (trailing dot/space, Windows-invalid characters, reserved device names).\n   * Defaults to the local platform: a POSIX planner may reason about\n   * POSIX-origin paths that carry characters Windows cannot store, because\n   * that plan will never be applied on a Windows participant. Injectable so\n   * the Windows branches stay testable from any platform.\n   */\n  localPlatform?: NodeJS.Platform;\n  /**\n   * Platform of the PEER participant when known (advertised via the\n   * offline-sync capabilities route). Push entries materialize on the peer,\n   * so Windows path hazards apply when EITHER participant is win32.\n   */\n  peerPlatform?: string;\n}\n\n/**\n * A census the planner refuses to reason about.\n *\n * Dropping a malformed or contradictory record would let the planner return\n * `converged: true` for a corpus it could not actually read, and transport is\n * invited to skip everything on that flag — so bad input fails loudly instead\n * (§1/§39).\n */\nexport class ReconcilePlanInputError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ReconcilePlanInputError\";\n  }\n}\n\n/** Shared with offline-sync's census validation (issue #2477): one acceptance set. */\n\n/**\n * Validate a census record's identity fields.\n *\n * The digest matters as much as the path: two records that both omit `sha256`\n * compare `undefined === undefined` and plan as `identical`, converging a\n * corpus the planner never actually read.\n */\nfunction assertCensusRecord(\n  file: ReconcileFileState | undefined,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): ReconcileFileState {\n  const path = file?.path;\n  if (typeof path !== \"string\" || path.length === 0) {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${side} census for namespace ${namespace} contains a record with no path`\n    );\n  }\n  // Same boundary offline-sync applies to this field: a peer census is\n  // untrusted input, and an absolute or traversal path would otherwise become\n  // a transfer instruction pointing outside the corpus root.\n  try {\n    validateArchiveRelativePath(path, `reconcile: ${side} census for namespace ${namespace}`);\n  } catch (err) {\n    throw new ReconcilePlanInputError(err instanceof Error ? err.message : String(err));\n  }\n  assertPortablePathSegments(path, side, namespace, platforms);\n  return {\n    ...file,\n    path,\n    sha256: assertDigest(file?.sha256, `${side} census for namespace ${namespace} entry ${path}`),\n    ...(file?.mtimeMs === undefined\n      ? {}\n      : { mtimeMs: assertMtimeMs(file.mtimeMs, `${side} census for namespace ${namespace} entry ${path}`) }),\n  };\n}\n\n/**\n * `newest-wins` decides which corpus keeps its history from this number, so a\n * NaN, an Infinity or a value past the Date range must not pick the winner.\n *\n * Fractional values ARE valid: `fs.stat()` reports sub-millisecond mtimes on\n * common filesystems and offline-sync forwards them unrounded, so this matches\n * its `assertOfflineSyncMtimeMs` — non-negative finite within Date range — and\n * deliberately does not require an integer.\n */\nfunction assertMtimeMs(value: unknown, context: string): number {\n  if (!isCensusMtimeMs(value)) {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${context} has an out-of-range mtimeMs; expected a finite value between 0 and ${CENSUS_MAX_MTIME_MS}`\n    );\n  }\n  return value;\n}\n\n/**\n * Digests are canonicalized to lowercase, exactly as offline-sync's\n * `assertSha256` does. Keeping the caller's spelling would make two forms of\n * one digest compare unequal, so identical files would plan `both_modified`\n * and tombstone lookups would silently miss.\n */\nfunction assertDigest(value: unknown, context: string): string {\n  if (!isSha256Hex(value)) {\n    throw new ReconcilePlanInputError(`reconcile: ${context} must carry a 64-character sha256 hex digest`);\n  }\n  return value.toLowerCase();\n}\n\nfunction isPlainObject(value: unknown): boolean {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const proto: unknown = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n\nfunction assertNamespace(namespace: unknown): string {\n  if (typeof namespace !== \"string\" || namespace.length === 0) {\n    throw new ReconcilePlanInputError(\"reconcile: every namespace input needs a non-empty namespace\");\n  }\n  // `team` and ` team ` are one namespace to the rest of core, so accepting\n  // both here would slip two inputs past the duplicate check and let them plan\n  // contradictory actions for the same path. Rejected rather than silently\n  // rewritten, so the namespace on every entry is the caller's own string.\n  if (LONE_SURROGATE.test(namespace)) {\n    // `namespaceIdentityToken()` encodes through TextEncoder, so a lone\n    // surrogate and a literal U+FFFD collapse to ONE storage identity while\n    // comparing as two here - slipping both past the duplicate-namespace guard.\n    throw new ReconcilePlanInputError(\n      \"reconcile: namespace contains an unpaired surrogate; it would collide with another namespace on disk\"\n    );\n  }\n  if (normalizeNamespaceIdentity(namespace) !== namespace) {\n    throw new ReconcilePlanInputError(\n      `reconcile: namespace ${JSON.stringify(namespace)} is not canonical; pass ${JSON.stringify(normalizeNamespaceIdentity(namespace))}`\n    );\n  }\n  return namespace;\n}\n\nfunction assertIterable(value: unknown, side: string, namespace: string): Iterable<ReconcileFileState> {\n  if (\n    value === null ||\n    typeof value !== \"object\" ||\n    typeof (value as Iterable<ReconcileFileState>)[Symbol.iterator] !== \"function\"\n  ) {\n    throw new ReconcilePlanInputError(`reconcile: ${side} census for namespace ${namespace} must be iterable`);\n  }\n  return value as Iterable<ReconcileFileState>;\n}\n\n/**\n * Two paths that a participant's filesystem resolves to ONE file must not draw\n * separate push/pull work, or application order decides which revision\n * survives. Remnic is explicitly multi-platform, so all three aliasing rules\n * are folded together and a collision is rejected rather than raced:\n * case (macOS, Windows), Unicode normalization (macOS stores decomposed and\n * compares canonically), and Win32 trailing dots/spaces, which the Windows API\n * strips before touching disk.\n */\n// eslint-disable-next-line no-control-regex -- control characters are exactly what this rejects\nconst WIN32_INVALID_CHARS = /[<>:\"|?*\\u0000-\\u001f]/;\n// Windows treats the superscripts as their digits in COM/LPT device names.\nconst LONE_SURROGATE = /[\\ud800-\\udbff](?![\\udc00-\\udfff])|(?<![\\ud800-\\udbff])[\\udc00-\\udfff]/;\nconst WIN32_RESERVED_NAMES = /^(con|prn|aux|nul|(com|lpt)[1-9\\u00b9\\u00b2\\u00b3])$/i;\n\nfunction assertPortablePathSegments(\n  path: string,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): void {\n  // Windows-only hazards (trailing dot/space stripping, invalid characters\n  // like `:`, reserved device names) only constrain a plan whose LOCAL\n  // participant would materialize those paths on Windows. POSIX-origin\n  // corpora legitimately contain `:` (e.g. sqlite sidecar names), so the\n  // gates are skipped for non-win32 planners. The lone-surrogate check is\n  // UNCONDITIONAL: Node mangles unpaired surrogates identically everywhere,\n  // which corrupts cross-platform path comparison itself.\n  const isWindows = platforms.some((candidate) => candidate === \"win32\");\n  for (const segment of path.split(\"/\")) {\n    if (segment.length === 0) continue;\n    if (isWindows && (segment.endsWith(\".\") || segment.endsWith(\" \"))) {\n      throw new ReconcilePlanInputError(\n        `reconcile: ${side} census for namespace ${namespace} path ${path} has a segment ending in a dot or space; ` +\n          \"Windows strips those and would alias it onto another file\"\n      );\n    }\n    // `:` opens an alternate data stream, the rest cannot be created at all,\n    // and a reserved device name resolves to hardware. A plan containing any of\n    // them cannot be applied on a Windows participant.\n    if (LONE_SURROGATE.test(segment)) {\n      // Node encodes an unpaired surrogate as U+FFFD, so this path and a\n      // literal U+FFFD path are one file on disk while comparing as distinct.\n      throw new ReconcilePlanInputError(\n        `reconcile: ${side} census for namespace ${namespace} path ${path} contains an unpaired surrogate`\n      );\n    }\n    if (isWindows && WIN32_INVALID_CHARS.test(segment)) {\n      throw new ReconcilePlanInputError(\n        `reconcile: ${side} census for namespace ${namespace} path ${path} contains a character Windows cannot store`\n      );\n    }\n    if (isWindows && WIN32_RESERVED_NAMES.test(segment.split(\".\")[0] ?? \"\")) {\n      throw new ReconcilePlanInputError(\n        `reconcile: ${side} census for namespace ${namespace} path ${path} uses a reserved Windows device name`\n      );\n    }\n  }\n}\n\nfunction assertNoPathAlias(seen: Map<string, string>, path: string, namespace: string): void {\n  // NFC first: macOS stores decomposed names and compares canonically, so\n  // `é` (U+00E9) and `é` (e + U+0301) are ONE file there. Then a FULL caseless\n  // fold - upper-then-lower, which collapses forms a bare toLowerCase() keeps\n  // apart, such as final sigma `ς` against `σ`. Lowercasing alone would leave\n  // those distinct and the planner would emit both a push and a pull.\n  // `ß` upper-folds to `ss` while `ẞ` folds to `ß`, so one more pass equalizes\n  // the pair that a single upper-then-lower still leaves apart.\n  const folded = path\n    .normalize(\"NFC\")\n    .toUpperCase()\n    .toLowerCase()\n    .replace(/\\u00df/g, \"ss\");\n  const existing = seen.get(folded);\n  if (existing !== undefined && existing !== path) {\n    throw new ReconcilePlanInputError(\n      `reconcile: namespace ${namespace} has aliasing paths (${existing}, ${path}); ` +\n        \"they resolve to one file on a case-insensitive or Unicode-normalizing peer\"\n    );\n  }\n  seen.set(folded, path);\n}\n\n/**\n * Duplicate paths are accepted only when they agree. Two digests for one path\n * make the plan depend on which record arrived last, which would break the\n * byte-stable ordering the convergence report relies on.\n */\nfunction rejectConflictingDuplicate(\n  existing: { sha256: string; mtimeMs?: number } | undefined,\n  incoming: { sha256: string; mtimeMs?: number },\n  path: string,\n  side: string,\n  namespace: string\n): boolean {\n  if (!existing) return false;\n  if (existing.sha256 !== incoming.sha256) {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${side} census for namespace ${namespace} lists ${path} twice with different digests`\n    );\n  }\n  // Same bytes but a different mtime is still ambiguous: `newest-wins` reads\n  // that timestamp, so accepting the first arrival would let input order decide\n  // the winner.\n  if (existing.mtimeMs !== incoming.mtimeMs) {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${side} census for namespace ${namespace} lists ${path} twice with different mtimeMs`\n    );\n  }\n  return true;\n}\n\nfunction indexByPath(\n  files: Iterable<ReconcileFileState>,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): Map<string, ReconcileFileState> {\n  const index = new Map<string, ReconcileFileState>();\n  for (const raw of files) {\n    const file = assertCensusRecord(raw, side, namespace, platforms);\n    if (rejectConflictingDuplicate(index.get(file.path), file, file.path, side, namespace)) continue;\n    index.set(file.path, file);\n  }\n  return index;\n}\n\n/**\n * A bare string satisfies `Iterable<string>`, and `new Set(\"abc…\")` would split\n * it into 64 one-character members — every membership test then misses and each\n * retracted file is planned as `pull` and resurrected. Reject the scalar and\n * canonicalize every member.\n */\nfunction parseTombstonedDigests(\n  value: Iterable<string> | undefined,\n  namespace: string,\n  field = \"tombstonedFileSha256\"\n): Set<string> {\n  if (value === undefined) return new Set();\n  if (typeof value === \"string\") {\n    throw new ReconcilePlanInputError(\n      `reconcile: ${field} for namespace ${namespace} must be a collection of digests, not a single string`\n    );\n  }\n  if (value === null || typeof value !== \"object\" || typeof value[Symbol.iterator] !== \"function\") {\n    // Otherwise the for...of below throws a raw TypeError and a caller handling\n    // ReconcilePlanInputError cannot tell a bad request from a planner bug.\n    throw new ReconcilePlanInputError(\n      `reconcile: ${field} for namespace ${namespace} must be an iterable collection of digests`\n    );\n  }\n  const digests = new Set<string>();\n  for (const entry of value) {\n    digests.add(assertDigest(entry, `${field} for namespace ${namespace}`));\n  }\n  return digests;\n}\n\n/**\n * Validate a census while keeping ONLY path -> digest.\n *\n * The base cursor is read for digests alone, so indexing full records and\n * compacting afterwards would hold a corpus-sized record map and its copy at\n * once - the peak this avoids.\n */\nfunction indexDigestsByPath(\n  files: Iterable<ReconcileFileState>,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): Map<string, string> {\n  const index = new Map<string, string>();\n  for (const raw of files) {\n    const file = assertCensusRecord(raw, side, namespace, platforms);\n    const existing = index.get(file.path);\n    // One map, not a parallel `seen`: the base's own mtimeMs is never a\n    // decision input (only the local and peer timestamps order a conflict), so\n    // a duplicate that agrees on the digest is unambiguous here regardless of\n    // its timestamp, and the digest alone is enough to detect a real clash.\n    if (existing !== undefined) {\n      if (existing !== file.sha256) {\n        throw new ReconcilePlanInputError(\n          `reconcile: ${side} census for namespace ${namespace} lists ${file.path} twice with different digests`\n        );\n      }\n      continue;\n    }\n    index.set(file.path, file.sha256);\n  }\n  return index;\n}\n\nfunction assertConflictPolicy(value: ConvergeConflictPolicy | undefined): ConvergeConflictPolicy {\n  if (value === undefined) return DEFAULT_CONVERGE_CONFLICT_POLICY;\n  if (!CONVERGE_CONFLICT_POLICIES.includes(value)) {\n    throw new ReconcilePlanInputError(\n      `reconcile: unknown conflictPolicy ${JSON.stringify(value)}; expected one of ${CONVERGE_CONFLICT_POLICIES.join(\", \")}`\n    );\n  }\n  return value;\n}\n\n/**\n * Total ordering for plan entries (§12): namespace, then path. Both are unique\n * per entry, so equal keys are impossible and the comparator never has to\n * return 0 for distinct rows — the output is byte-identical across runs, which\n * is what makes a convergence report diffable. Cursor and manifest sort with\n * this same export; a local copy on either side is how ordering drifts (§2477).\n */\nexport function compareReconcilePlanEntries(a: ReconcilePlanEntry, b: ReconcilePlanEntry): number {\n  if (a.namespace !== b.namespace) return a.namespace < b.namespace ? -1 : 1;\n  if (a.path !== b.path) return a.path < b.path ? -1 : 1;\n  return 0;\n}\n\n/**\n * Identity of a semantic-duplicate pair: the ordered (local, peer) path pair.\n * Cursor derivation and manifest collapse must key prior agreements with this\n * same export or a stored cursor stops matching the plan that wrote it.\n */\nexport function semanticAgreementKey(agreement: ReconcileSemanticAgreement): string {\n  return `${agreement.local.path}\\0${agreement.peer.path}`;\n}\n\nfunction resolveConflict(\n  policy: ConvergeConflictPolicy,\n  localMtimeMs: number | undefined,\n  peerMtimeMs: number | undefined,\n  missingTimestampResolution: ReconcileResolution\n): ReconcileResolution {\n  if (policy !== \"newest-wins\") return \"unresolved\";\n  if (localMtimeMs === undefined || peerMtimeMs === undefined || localMtimeMs === peerMtimeMs) {\n    return missingTimestampResolution;\n  }\n  return localMtimeMs > peerMtimeMs ? \"local-wins\" : \"peer-wins\";\n}\n\nfunction parseDeletionMtimes(\n  value: ReadonlyMap<string, number> | undefined,\n  side: string,\n  namespace: string,\n  platforms: readonly (string | undefined)[]\n): ReadonlyMap<string, number> {\n  if (value === undefined) return new Map();\n  if (!(value instanceof Map)) {\n    throw new ReconcilePlanInputError(`reconcile: ${side} deletion mtimes for namespace ${namespace} must be a Map`);\n  }\n  const parsed = new Map<string, number>();\n  for (const [path, mtimeMs] of value) {\n    try {\n      validateArchiveRelativePath(path, `reconcile: ${side} deletion mtimes for namespace ${namespace}`);\n    } catch (err) {\n      throw new ReconcilePlanInputError(err instanceof Error ? err.message : String(err));\n    }\n    assertPortablePathSegments(path, side, namespace, platforms);\n    parsed.set(path, assertMtimeMs(mtimeMs, `${side} deletion for namespace ${namespace} entry ${path}`));\n  }\n  return parsed;\n}\n\n/**\n * Plan one namespace. Exposed for callers that stream namespaces one at a time.\n *\n * Residency is one peer index + a set of local paths + the entry list. The\n * local census is consumed as a stream and never materialized, so a 100k-file\n * corpus does not hold two full censuses at once — but this is NOT constant\n * memory, and a caller holding its own census arrays adds to that.\n */\nexport function planNamespaceReconciliation(\n  input: ReconcileNamespaceInput,\n  options: ReconcileOptions = {}\n): ReconcilePlanEntry[] {\n  if (!isPlainObject(input)) {\n    throw new ReconcilePlanInputError(\"reconcile: namespace input must be a plain object\");\n  }\n  if (!isPlainObject(options)) {\n    // A Date, Map or RegExp passes a bare typeof check, exposes no\n    // `conflictPolicy`, and would silently take the default policy - hiding a\n    // malformed request behind `manual`.\n    throw new ReconcilePlanInputError(\"reconcile: options must be a plain object\");\n  }\n  const namespace = assertNamespace(input.namespace);\n  const policy = assertConflictPolicy(options.conflictPolicy);\n  const localCensus = assertIterable(input.local, \"local\", namespace);\n  const caseFold = new Map<string, string>();\n  // Index the peer census only, then stream the local one against it, removing\n  // each match as it is consumed. Peak residency is one index plus the entry\n  // list rather than two full censuses (round 2, codex P2).\n  const effectivePlatforms = [options.localPlatform ?? process.platform, options.peerPlatform];\n  const peer = indexByPath(assertIterable(input.peer, \"peer\", namespace), \"peer\", namespace, effectivePlatforms);\n  // Only `base.sha256` is ever read, so the base is compacted to path -> digest\n  // instead of a second full record index (round 7, codex P2).\n  // Only an ABSENT base means bootstrap. A null/invalid cursor silently read as\n  // \"no prior agreement\" would turn a peer-side deletion into a push and\n  // resurrect it.\n  const base =\n    input.base === undefined\n      ? null\n      : indexDigestsByPath(assertIterable(input.base, \"base\", namespace), \"base\", namespace, effectivePlatforms);\n  const tombstoned = parseTombstonedDigests(input.tombstonedFileSha256, namespace);\n  const peerTombstoned = parseTombstonedDigests(input.peerTombstonedFileSha256, namespace, \"peerTombstonedFileSha256\");\n  const localDeletionMtimeMs = parseDeletionMtimes(input.localDeletionMtimeMs, \"local\", namespace, effectivePlatforms);\n  const peerDeletionMtimeMs = parseDeletionMtimes(input.peerDeletionMtimeMs, \"peer\", namespace, effectivePlatforms);\n  const entries: ReconcilePlanEntry[] = [];\n\n  // Path -> digest only, never the file objects: enough to make the stream\n  // idempotent and to catch contradictory duplicates without materializing the\n  // second census.\n  // Base paths participate in the collision check: a base `Facts/A.md` against\n  // a local `facts/a.md` is the same delete/change ambiguity on a\n  // case-insensitive participant.\n  if (base) for (const basePath of base.keys()) assertNoPathAlias(caseFold, basePath, namespace);\n  // Path -> decision-relevant fields only, never the whole record: enough to\n  // make the stream idempotent and to catch contradictory duplicates without\n  // materializing the second census.\n  const seenLocal = new Map<string, { sha256: string; mtimeMs?: number }>();\n  for (const rawLocal of localCensus) {\n    const localFile = assertCensusRecord(rawLocal, \"local\", namespace, effectivePlatforms);\n    const path = localFile.path;\n    assertNoPathAlias(caseFold, path, namespace);\n    const seen = seenLocal.get(path);\n    if (seen !== undefined) {\n      // Same rule the indexed censuses get: mtimeMs is decision-relevant under\n      // `newest-wins`, so a duplicate that disagrees on it is ambiguous too.\n      if (rejectConflictingDuplicate(seen, localFile, path, \"local\", namespace)) continue;\n    }\n    seenLocal.set(path, { sha256: localFile.sha256, mtimeMs: localFile.mtimeMs });\n    const peerFile = peer.get(path);\n    // Consumed: whatever remains in the index afterwards is peer-only.\n    peer.delete(path);\n    const baseSha256 = base?.get(path);\n    // Retraction outranks every other decision for this path, on EITHER side.\n    // Checked before hash comparison and conflict resolution: a retracted peer\n    // revision reaching the conflict ladder can win under `newest-wins`, and a\n    // retracted LOCAL revision would otherwise be pushed - which is also how a\n    // suppression undoes itself on the next run, since the local copy survives\n    // the peer-side delete (round 4).\n    // Either side's retraction removes the copy that carries the digest, so a\n    // peer retraction of something we still hold suppresses OUR copy rather\n    // than pushing it back.\n    const localRetracted = tombstoned.has(localFile.sha256) || peerTombstoned.has(localFile.sha256);\n    const peerRetracted =\n      peerFile !== undefined && (tombstoned.has(peerFile.sha256) || peerTombstoned.has(peerFile.sha256));\n    if (localRetracted || peerRetracted) {\n      entries.push({\n        path,\n        namespace,\n        action: \"suppress\",\n        reason: \"tombstoned\",\n        localSha256: localFile.sha256,\n        ...(peerFile ? { peerSha256: peerFile.sha256 } : {}),\n        ...(baseSha256 === undefined ? {} : { baseSha256 }),\n        suppressSide: localRetracted && peerRetracted ? \"both\" : localRetracted ? \"local\" : \"peer\",\n      });\n      continue;\n    }\n    if (!peerFile) {\n      // Base PRESENCE is what proves a deletion, not equality with whatever the\n      // surviving side now holds. If we also edited since the base, this is\n      // delete-versus-modify: still a conflict, and pushing it would resurrect\n      // a deliberate deletion. Without a base the peer simply never saw the\n      // path, and a bootstrap merge must push — both sides hold unique data.\n      if (baseSha256 !== undefined) {\n        const peerDeletionMtime = peerDeletionMtimeMs.get(path);\n        const resolution =\n          baseSha256 === localFile.sha256\n            ? \"unresolved\"\n            : resolveConflict(policy, localFile.mtimeMs, peerDeletionMtime, \"unresolved\");\n        entries.push({\n          path,\n          namespace,\n          action: \"conflict\",\n          reason: baseSha256 === localFile.sha256 ? \"peer_deleted\" : \"local_modified_peer_deleted\",\n          localSha256: localFile.sha256,\n          baseSha256,\n          resolution,\n          ...(resolution === \"peer-wins\" && peerDeletionMtime !== undefined\n            ? { deletionMtimeMs: peerDeletionMtime }\n            : {}),\n        });\n        continue;\n      }\n      entries.push({\n        path,\n        namespace,\n        action: \"push\",\n        reason: \"local_only\",\n        localSha256: localFile.sha256,\n      });\n      continue;\n    }\n    if (peerFile.sha256 === localFile.sha256) {\n      entries.push({\n        path,\n        namespace,\n        action: \"identical\",\n        reason: \"same_content\",\n        localSha256: localFile.sha256,\n        peerSha256: peerFile.sha256,\n        ...(baseSha256 === undefined ? {} : { baseSha256 }),\n      });\n      continue;\n    }\n    // A base that matches one side turns a \"conflict\" into an ordinary\n    // one-sided change: that side is the only one that moved since agreement.\n    if (baseSha256 !== undefined && baseSha256 === localFile.sha256) {\n      entries.push({\n        path,\n        namespace,\n        action: \"pull\",\n        reason: \"peer_changed\",\n        localSha256: localFile.sha256,\n        peerSha256: peerFile.sha256,\n        baseSha256,\n      });\n      continue;\n    }\n    if (baseSha256 !== undefined && baseSha256 === peerFile.sha256) {\n      entries.push({\n        path,\n        namespace,\n        action: \"push\",\n        reason: \"local_changed\",\n        localSha256: localFile.sha256,\n        peerSha256: peerFile.sha256,\n        baseSha256,\n      });\n      continue;\n    }\n    const resolution = resolveConflict(policy, localFile.mtimeMs, peerFile.mtimeMs, \"supersede-link\");\n    entries.push({\n      path,\n      namespace,\n      action: \"conflict\",\n      reason: \"both_modified\",\n      localSha256: localFile.sha256,\n      peerSha256: peerFile.sha256,\n      ...(baseSha256 === undefined ? {} : { baseSha256 }),\n      resolution,\n    });\n  }\n\n  for (const [path, peerFile] of peer) {\n    assertNoPathAlias(caseFold, path, namespace);\n    const baseSha256 = base?.get(path);\n    if (tombstoned.has(peerFile.sha256) || peerTombstoned.has(peerFile.sha256)) {\n      // Retracted here on purpose, and the peer still serves it. Pulling it\n      // back would undo the retraction; calling it `identical` would be worse,\n      // because a converged plan lets transport skip everything and the peer\n      // keeps serving the retracted fact forever. It is work: propagate the\n      // tombstone.\n      entries.push({\n        path,\n        namespace,\n        action: \"suppress\",\n        reason: \"tombstoned\",\n        peerSha256: peerFile.sha256,\n        ...(baseSha256 === undefined ? {} : { baseSha256 }),\n        suppressSide: \"peer\",\n      });\n      continue;\n    }\n    if (baseSha256 !== undefined) {\n      const localDeletionMtime = localDeletionMtimeMs.get(path);\n      const resolution =\n        baseSha256 === peerFile.sha256\n          ? \"unresolved\"\n          : resolveConflict(policy, localDeletionMtime, peerFile.mtimeMs, \"unresolved\");\n      entries.push({\n        path,\n        namespace,\n        action: \"conflict\",\n        reason: baseSha256 === peerFile.sha256 ? \"local_deleted\" : \"local_deleted_peer_modified\",\n        peerSha256: peerFile.sha256,\n        baseSha256,\n        resolution,\n        ...(resolution === \"local-wins\" && localDeletionMtime !== undefined\n          ? { deletionMtimeMs: localDeletionMtime }\n          : {}),\n      });\n      continue;\n    }\n    entries.push({\n      path,\n      namespace,\n      action: \"pull\",\n      reason: \"peer_only\",\n      peerSha256: peerFile.sha256,\n    });\n  }\n\n  return entries.sort(compareReconcilePlanEntries);\n}\n\n/** Aggregate entries into the per-namespace convergence report (#2150). */\nexport function summarizeReconcilePlan(entries: readonly ReconcilePlanEntry[]): ReconcileNamespaceReport[] {\n  const byNamespace = new Map<string, ReconcileNamespaceReport>();\n  for (const entry of entries) {\n    let report = byNamespace.get(entry.namespace);\n    if (!report) {\n      report = { namespace: entry.namespace, pull: 0, push: 0, identical: 0, conflict: 0, suppress: 0, unresolved: 0 };\n      byNamespace.set(entry.namespace, report);\n    }\n    report[entry.action] += 1;\n    const needsOperator = entry.resolution === \"unresolved\" || entry.resolution === \"supersede-link\";\n    if (entry.action === \"conflict\" && needsOperator) report.unresolved += 1;\n  }\n  return [...byNamespace.values()].sort((a, b) =>\n    a.namespace === b.namespace ? 0 : a.namespace < b.namespace ? -1 : 1\n  );\n}\n\n/**\n * Plan a full reconciliation across namespaces.\n *\n * `converged` is an affirmative claim that nothing needs to move, so it is\n * derived from the entries rather than tracked alongside them: any action other\n * than `identical` disproves it.\n */\nexport function planReconciliation(\n  namespaces: readonly ReconcileNamespaceInput[],\n  options: ReconcileOptions = {}\n): ReconcilePlan {\n  if (!Array.isArray(namespaces)) {\n    throw new ReconcilePlanInputError(\"reconcile: planReconciliation expects an array of namespace inputs\");\n  }\n  // Validated here too: with an empty array the per-namespace path never runs,\n  // and a malformed options envelope would return `converged` instead of\n  // raising - the same call failing or succeeding based on list length.\n  if (!isPlainObject(options)) {\n    throw new ReconcilePlanInputError(\"reconcile: options must be a plain object\");\n  }\n  assertConflictPolicy(options.conflictPolicy);\n  const entries: ReconcilePlanEntry[] = [];\n  // Two inputs for one namespace are planned independently, so the same\n  // (namespace, path) can draw contradictory actions - and because those\n  // entries also sort equal, batch order would decide which revision survives.\n  const seenNamespaces = new Set<string>();\n  for (const namespace of namespaces) {\n    const name = assertNamespace(namespace?.namespace);\n    if (seenNamespaces.has(name)) {\n      throw new ReconcilePlanInputError(\n        `reconcile: namespace ${name} appears twice; merge its censuses before planning`\n      );\n    }\n    seenNamespaces.add(name);\n    // Spread-push over a boot-scale namespace (~100k entries) exceeds the\n    // call-stack argument limit (RangeError: Maximum call stack size exceeded)\n    // — push per entry instead.\n    for (const entry of planNamespaceReconciliation(namespace, options)) {\n      entries.push(entry);\n    }\n  }\n  entries.sort(compareReconcilePlanEntries);\n  return {\n    entries,\n    byNamespace: summarizeReconcilePlan(entries),\n    converged: entries.every((entry) => entry.action === \"identical\"),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4MO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAWA,SAAS,mBACP,MACA,MACA,WACA,WACoB;AACpB,QAAM,OAAO,MAAM;AACnB,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,yBAAyB,SAAS;AAAA,IACtD;AAAA,EACF;AAIA,MAAI;AACF,gCAA4B,MAAM,cAAc,IAAI,yBAAyB,SAAS,EAAE;AAAA,EAC1F,SAAS,KAAK;AACZ,UAAM,IAAI,wBAAwB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,EACpF;AACA,6BAA2B,MAAM,MAAM,WAAW,SAAS;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,QAAQ,aAAa,MAAM,QAAQ,GAAG,IAAI,yBAAyB,SAAS,UAAU,IAAI,EAAE;AAAA,IAC5F,GAAI,MAAM,YAAY,SAClB,CAAC,IACD,EAAE,SAAS,cAAc,KAAK,SAAS,GAAG,IAAI,yBAAyB,SAAS,UAAU,IAAI,EAAE,EAAE;AAAA,EACxG;AACF;AAWA,SAAS,cAAc,OAAgB,SAAyB;AAC9D,MAAI,CAAC,gBAAgB,KAAK,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,cAAc,OAAO,uEAAuE,mBAAmB;AAAA,IACjH;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,aAAa,OAAgB,SAAyB;AAC7D,MAAI,CAAC,YAAY,KAAK,GAAG;AACvB,UAAM,IAAI,wBAAwB,cAAc,OAAO,8CAA8C;AAAA,EACvG;AACA,SAAO,MAAM,YAAY;AAC3B;AAEA,SAAS,cAAc,OAAyB;AAC9C,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,QAAiB,OAAO,eAAe,KAAK;AAClD,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,gBAAgB,WAA4B;AACnD,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,wBAAwB,8DAA8D;AAAA,EAClG;AAKA,MAAI,eAAe,KAAK,SAAS,GAAG;AAIlC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,2BAA2B,SAAS,MAAM,WAAW;AACvD,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,SAAS,CAAC,2BAA2B,KAAK,UAAU,2BAA2B,SAAS,CAAC,CAAC;AAAA,IACnI;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAgB,MAAc,WAAiD;AACrG,MACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAQ,MAAuC,OAAO,QAAQ,MAAM,YACpE;AACA,UAAM,IAAI,wBAAwB,cAAc,IAAI,yBAAyB,SAAS,mBAAmB;AAAA,EAC3G;AACA,SAAO;AACT;AAYA,IAAM,sBAAsB;AAE5B,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAE7B,SAAS,2BACP,MACA,MACA,WACA,WACM;AAQN,QAAM,YAAY,UAAU,KAAK,CAAC,cAAc,cAAc,OAAO;AACrE,aAAW,WAAW,KAAK,MAAM,GAAG,GAAG;AACrC,QAAI,QAAQ,WAAW,EAAG;AAC1B,QAAI,cAAc,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,IAAI;AACjE,YAAM,IAAI;AAAA,QACR,cAAc,IAAI,yBAAyB,SAAS,SAAS,IAAI;AAAA,MAEnE;AAAA,IACF;AAIA,QAAI,eAAe,KAAK,OAAO,GAAG;AAGhC,YAAM,IAAI;AAAA,QACR,cAAc,IAAI,yBAAyB,SAAS,SAAS,IAAI;AAAA,MACnE;AAAA,IACF;AACA,QAAI,aAAa,oBAAoB,KAAK,OAAO,GAAG;AAClD,YAAM,IAAI;AAAA,QACR,cAAc,IAAI,yBAAyB,SAAS,SAAS,IAAI;AAAA,MACnE;AAAA,IACF;AACA,QAAI,aAAa,qBAAqB,KAAK,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG;AACvE,YAAM,IAAI;AAAA,QACR,cAAc,IAAI,yBAAyB,SAAS,SAAS,IAAI;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,MAA2B,MAAc,WAAyB;AAQ3F,QAAM,SAAS,KACZ,UAAU,KAAK,EACf,YAAY,EACZ,YAAY,EACZ,QAAQ,WAAW,IAAI;AAC1B,QAAM,WAAW,KAAK,IAAI,MAAM;AAChC,MAAI,aAAa,UAAa,aAAa,MAAM;AAC/C,UAAM,IAAI;AAAA,MACR,wBAAwB,SAAS,wBAAwB,QAAQ,KAAK,IAAI;AAAA,IAE5E;AAAA,EACF;AACA,OAAK,IAAI,QAAQ,IAAI;AACvB;AAOA,SAAS,2BACP,UACA,UACA,MACA,MACA,WACS;AACT,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,WAAW,SAAS,QAAQ;AACvC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,yBAAyB,SAAS,UAAU,IAAI;AAAA,IACpE;AAAA,EACF;AAIA,MAAI,SAAS,YAAY,SAAS,SAAS;AACzC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,yBAAyB,SAAS,UAAU,IAAI;AAAA,IACpE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YACP,OACA,MACA,WACA,WACiC;AACjC,QAAM,QAAQ,oBAAI,IAAgC;AAClD,aAAW,OAAO,OAAO;AACvB,UAAM,OAAO,mBAAmB,KAAK,MAAM,WAAW,SAAS;AAC/D,QAAI,2BAA2B,MAAM,IAAI,KAAK,IAAI,GAAG,MAAM,KAAK,MAAM,MAAM,SAAS,EAAG;AACxF,UAAM,IAAI,KAAK,MAAM,IAAI;AAAA,EAC3B;AACA,SAAO;AACT;AAQA,SAAS,uBACP,OACA,WACA,QAAQ,wBACK;AACb,MAAI,UAAU,OAAW,QAAO,oBAAI,IAAI;AACxC,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI;AAAA,MACR,cAAc,KAAK,kBAAkB,SAAS;AAAA,IAChD;AAAA,EACF;AACA,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,MAAM,OAAO,QAAQ,MAAM,YAAY;AAG/F,UAAM,IAAI;AAAA,MACR,cAAc,KAAK,kBAAkB,SAAS;AAAA,IAChD;AAAA,EACF;AACA,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,OAAO;AACzB,YAAQ,IAAI,aAAa,OAAO,GAAG,KAAK,kBAAkB,SAAS,EAAE,CAAC;AAAA,EACxE;AACA,SAAO;AACT;AASA,SAAS,mBACP,OACA,MACA,WACA,WACqB;AACrB,QAAM,QAAQ,oBAAI,IAAoB;AACtC,aAAW,OAAO,OAAO;AACvB,UAAM,OAAO,mBAAmB,KAAK,MAAM,WAAW,SAAS;AAC/D,UAAM,WAAW,MAAM,IAAI,KAAK,IAAI;AAKpC,QAAI,aAAa,QAAW;AAC1B,UAAI,aAAa,KAAK,QAAQ;AAC5B,cAAM,IAAI;AAAA,UACR,cAAc,IAAI,yBAAyB,SAAS,UAAU,KAAK,IAAI;AAAA,QACzE;AAAA,MACF;AACA;AAAA,IACF;AACA,UAAM,IAAI,KAAK,MAAM,KAAK,MAAM;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,OAAmE;AAC/F,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,CAAC,2BAA2B,SAAS,KAAK,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,qCAAqC,KAAK,UAAU,KAAK,CAAC,qBAAqB,2BAA2B,KAAK,IAAI,CAAC;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,4BAA4B,GAAuB,GAA+B;AAChG,MAAI,EAAE,cAAc,EAAE,UAAW,QAAO,EAAE,YAAY,EAAE,YAAY,KAAK;AACzE,MAAI,EAAE,SAAS,EAAE,KAAM,QAAO,EAAE,OAAO,EAAE,OAAO,KAAK;AACrD,SAAO;AACT;AAOO,SAAS,qBAAqB,WAA+C;AAClF,SAAO,GAAG,UAAU,MAAM,IAAI,KAAK,UAAU,KAAK,IAAI;AACxD;AAEA,SAAS,gBACP,QACA,cACA,aACA,4BACqB;AACrB,MAAI,WAAW,cAAe,QAAO;AACrC,MAAI,iBAAiB,UAAa,gBAAgB,UAAa,iBAAiB,aAAa;AAC3F,WAAO;AAAA,EACT;AACA,SAAO,eAAe,cAAc,eAAe;AACrD;AAEA,SAAS,oBACP,OACA,MACA,WACA,WAC6B;AAC7B,MAAI,UAAU,OAAW,QAAO,oBAAI,IAAI;AACxC,MAAI,EAAE,iBAAiB,MAAM;AAC3B,UAAM,IAAI,wBAAwB,cAAc,IAAI,kCAAkC,SAAS,gBAAgB;AAAA,EACjH;AACA,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO;AACnC,QAAI;AACF,kCAA4B,MAAM,cAAc,IAAI,kCAAkC,SAAS,EAAE;AAAA,IACnG,SAAS,KAAK;AACZ,YAAM,IAAI,wBAAwB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACpF;AACA,+BAA2B,MAAM,MAAM,WAAW,SAAS;AAC3D,WAAO,IAAI,MAAM,cAAc,SAAS,GAAG,IAAI,2BAA2B,SAAS,UAAU,IAAI,EAAE,CAAC;AAAA,EACtG;AACA,SAAO;AACT;AAUO,SAAS,4BACd,OACA,UAA4B,CAAC,GACP;AACtB,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI,wBAAwB,mDAAmD;AAAA,EACvF;AACA,MAAI,CAAC,cAAc,OAAO,GAAG;AAI3B,UAAM,IAAI,wBAAwB,2CAA2C;AAAA,EAC/E;AACA,QAAM,YAAY,gBAAgB,MAAM,SAAS;AACjD,QAAM,SAAS,qBAAqB,QAAQ,cAAc;AAC1D,QAAM,cAAc,eAAe,MAAM,OAAO,SAAS,SAAS;AAClE,QAAM,WAAW,oBAAI,IAAoB;AAIzC,QAAM,qBAAqB,CAAC,QAAQ,iBAAiB,QAAQ,UAAU,QAAQ,YAAY;AAC3F,QAAM,OAAO,YAAY,eAAe,MAAM,MAAM,QAAQ,SAAS,GAAG,QAAQ,WAAW,kBAAkB;AAM7G,QAAM,OACJ,MAAM,SAAS,SACX,OACA,mBAAmB,eAAe,MAAM,MAAM,QAAQ,SAAS,GAAG,QAAQ,WAAW,kBAAkB;AAC7G,QAAM,aAAa,uBAAuB,MAAM,sBAAsB,SAAS;AAC/E,QAAM,iBAAiB,uBAAuB,MAAM,0BAA0B,WAAW,0BAA0B;AACnH,QAAM,uBAAuB,oBAAoB,MAAM,sBAAsB,SAAS,WAAW,kBAAkB;AACnH,QAAM,sBAAsB,oBAAoB,MAAM,qBAAqB,QAAQ,WAAW,kBAAkB;AAChH,QAAM,UAAgC,CAAC;AAQvC,MAAI,KAAM,YAAW,YAAY,KAAK,KAAK,EAAG,mBAAkB,UAAU,UAAU,SAAS;AAI7F,QAAM,YAAY,oBAAI,IAAkD;AACxE,aAAW,YAAY,aAAa;AAClC,UAAM,YAAY,mBAAmB,UAAU,SAAS,WAAW,kBAAkB;AACrF,UAAM,OAAO,UAAU;AACvB,sBAAkB,UAAU,MAAM,SAAS;AAC3C,UAAM,OAAO,UAAU,IAAI,IAAI;AAC/B,QAAI,SAAS,QAAW;AAGtB,UAAI,2BAA2B,MAAM,WAAW,MAAM,SAAS,SAAS,EAAG;AAAA,IAC7E;AACA,cAAU,IAAI,MAAM,EAAE,QAAQ,UAAU,QAAQ,SAAS,UAAU,QAAQ,CAAC;AAC5E,UAAM,WAAW,KAAK,IAAI,IAAI;AAE9B,SAAK,OAAO,IAAI;AAChB,UAAM,aAAa,MAAM,IAAI,IAAI;AAUjC,UAAM,iBAAiB,WAAW,IAAI,UAAU,MAAM,KAAK,eAAe,IAAI,UAAU,MAAM;AAC9F,UAAM,gBACJ,aAAa,WAAc,WAAW,IAAI,SAAS,MAAM,KAAK,eAAe,IAAI,SAAS,MAAM;AAClG,QAAI,kBAAkB,eAAe;AACnC,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,QACvB,GAAI,WAAW,EAAE,YAAY,SAAS,OAAO,IAAI,CAAC;AAAA,QAClD,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,QACjD,cAAc,kBAAkB,gBAAgB,SAAS,iBAAiB,UAAU;AAAA,MACtF,CAAC;AACD;AAAA,IACF;AACA,QAAI,CAAC,UAAU;AAMb,UAAI,eAAe,QAAW;AAC5B,cAAM,oBAAoB,oBAAoB,IAAI,IAAI;AACtD,cAAMA,cACJ,eAAe,UAAU,SACrB,eACA,gBAAgB,QAAQ,UAAU,SAAS,mBAAmB,YAAY;AAChF,gBAAQ,KAAK;AAAA,UACX;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,QAAQ,eAAe,UAAU,SAAS,iBAAiB;AAAA,UAC3D,aAAa,UAAU;AAAA,UACvB;AAAA,UACA,YAAAA;AAAA,UACA,GAAIA,gBAAe,eAAe,sBAAsB,SACpD,EAAE,iBAAiB,kBAAkB,IACrC,CAAC;AAAA,QACP,CAAC;AACD;AAAA,MACF;AACA,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,MACzB,CAAC;AACD;AAAA,IACF;AACA,QAAI,SAAS,WAAW,UAAU,QAAQ;AACxC,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,MACnD,CAAC;AACD;AAAA,IACF;AAGA,QAAI,eAAe,UAAa,eAAe,UAAU,QAAQ;AAC/D,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB;AAAA,MACF,CAAC;AACD;AAAA,IACF;AACA,QAAI,eAAe,UAAa,eAAe,SAAS,QAAQ;AAC9D,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,UAAU;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB;AAAA,MACF,CAAC;AACD;AAAA,IACF;AACA,UAAM,aAAa,gBAAgB,QAAQ,UAAU,SAAS,SAAS,SAAS,gBAAgB;AAChG,YAAQ,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa,UAAU;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,CAAC,MAAM,QAAQ,KAAK,MAAM;AACnC,sBAAkB,UAAU,MAAM,SAAS;AAC3C,UAAM,aAAa,MAAM,IAAI,IAAI;AACjC,QAAI,WAAW,IAAI,SAAS,MAAM,KAAK,eAAe,IAAI,SAAS,MAAM,GAAG;AAM1E,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,YAAY,SAAS;AAAA,QACrB,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAAA,QACjD,cAAc;AAAA,MAChB,CAAC;AACD;AAAA,IACF;AACA,QAAI,eAAe,QAAW;AAC5B,YAAM,qBAAqB,qBAAqB,IAAI,IAAI;AACxD,YAAM,aACJ,eAAe,SAAS,SACpB,eACA,gBAAgB,QAAQ,oBAAoB,SAAS,SAAS,YAAY;AAChF,cAAQ,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,eAAe,SAAS,SAAS,kBAAkB;AAAA,QAC3D,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA,GAAI,eAAe,gBAAgB,uBAAuB,SACtD,EAAE,iBAAiB,mBAAmB,IACtC,CAAC;AAAA,MACP,CAAC;AACD;AAAA,IACF;AACA,YAAQ,KAAK;AAAA,MACX;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY,SAAS;AAAA,IACvB,CAAC;AAAA,EACH;AAEA,SAAO,QAAQ,KAAK,2BAA2B;AACjD;AAGO,SAAS,uBAAuB,SAAoE;AACzG,QAAM,cAAc,oBAAI,IAAsC;AAC9D,aAAW,SAAS,SAAS;AAC3B,QAAI,SAAS,YAAY,IAAI,MAAM,SAAS;AAC5C,QAAI,CAAC,QAAQ;AACX,eAAS,EAAE,WAAW,MAAM,WAAW,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,EAAE;AAC/G,kBAAY,IAAI,MAAM,WAAW,MAAM;AAAA,IACzC;AACA,WAAO,MAAM,MAAM,KAAK;AACxB,UAAM,gBAAgB,MAAM,eAAe,gBAAgB,MAAM,eAAe;AAChF,QAAI,MAAM,WAAW,cAAc,cAAe,QAAO,cAAc;AAAA,EACzE;AACA,SAAO,CAAC,GAAG,YAAY,OAAO,CAAC,EAAE;AAAA,IAAK,CAAC,GAAG,MACxC,EAAE,cAAc,EAAE,YAAY,IAAI,EAAE,YAAY,EAAE,YAAY,KAAK;AAAA,EACrE;AACF;AASO,SAAS,mBACd,YACA,UAA4B,CAAC,GACd;AACf,MAAI,CAAC,MAAM,QAAQ,UAAU,GAAG;AAC9B,UAAM,IAAI,wBAAwB,oEAAoE;AAAA,EACxG;AAIA,MAAI,CAAC,cAAc,OAAO,GAAG;AAC3B,UAAM,IAAI,wBAAwB,2CAA2C;AAAA,EAC/E;AACA,uBAAqB,QAAQ,cAAc;AAC3C,QAAM,UAAgC,CAAC;AAIvC,QAAM,iBAAiB,oBAAI,IAAY;AACvC,aAAW,aAAa,YAAY;AAClC,UAAM,OAAO,gBAAgB,WAAW,SAAS;AACjD,QAAI,eAAe,IAAI,IAAI,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,wBAAwB,IAAI;AAAA,MAC9B;AAAA,IACF;AACA,mBAAe,IAAI,IAAI;AAIvB,eAAW,SAAS,4BAA4B,WAAW,OAAO,GAAG;AACnE,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AACA,UAAQ,KAAK,2BAA2B;AACxC,SAAO;AAAA,IACL;AAAA,IACA,aAAa,uBAAuB,OAAO;AAAA,IAC3C,WAAW,QAAQ,MAAM,CAAC,UAAU,MAAM,WAAW,WAAW;AAAA,EAClE;AACF;","names":["resolution"]}

package/dist/{chunk-N7JK2RKG.js → chunk-REX2B74A.js}

@@ -1,6 +1,6 @@
 import {
   resolveCorpusNamespaceRoots
-} from "./chunk-EJ5RKUXW.js";
+} from "./chunk-FK3QH6VS.js";
 import {
   capabilityAllowsNamespace
 } from "./chunk-MZWSOLMT.js";
@@ -200,4 +200,4 @@ async function readAggregateExtractionWatermark(options) {
 export {
   readAggregateExtractionWatermark
 };
-//# sourceMappingURL=chunk-N7JK2RKG.js.map
+//# sourceMappingURL=chunk-REX2B74A.js.map

package/dist/{chunk-3LADWWMA.js → chunk-RGD2ZQGR.js}

@@ -1,9 +1,9 @@
 import {
   hasMemoryData
-} from "./chunk-GGYDJJBO.js";
+} from "./chunk-5OLY6KA4.js";
 import {
   resolveNamespaceStorageRoot
-} from "./chunk-UMEOXLIZ.js";
+} from "./chunk-YEQZHG4U.js";
 import {
   getConfiguredNamespaces
 } from "./chunk-EGALNSZ4.js";
@@ -724,4 +724,4 @@ export {
   runNamespaceMaintenancePlan,
   runNamespaceMaintenanceBatchPlan
 };
-//# sourceMappingURL=chunk-3LADWWMA.js.map
+//# sourceMappingURL=chunk-RGD2ZQGR.js.map

package/dist/{chunk-PC7WNIRL.js → chunk-ROJQV22V.js}

@@ -15,10 +15,10 @@ import {
 } from "./chunk-ZEBRENA6.js";
 import {
   handleSupportPassportOwnerHttp
-} from "./chunk-5SGOARQJ.js";
+} from "./chunk-T4KF3GOE.js";
 import {
   buildSupportPassportPublicRequestHandler
-} from "./chunk-JZ6EYAVP.js";
+} from "./chunk-LP3LC7DV.js";
 import {
   EngramMcpServer,
   MCP_SUPPORTED_PROTOCOL_VERSIONS,
@@ -28,10 +28,10 @@ import {
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-EFCBJDYE.js";
+} from "./chunk-7XK5U6FK.js";
 import {
   RelayMissionStoreError
-} from "./chunk-L74A6NTI.js";
+} from "./chunk-TNIJAM2R.js";
 import {
   executeResolution,
   isValidResolutionVerb
@@ -52,7 +52,7 @@ import {
   optionalNamespaceKindQueryParam,
   optionalQueryString,
   positiveIntQueryParam
-} from "./chunk-S37NN23M.js";
+} from "./chunk-HEPUZGLY.js";
 import {
   handleMcpGetSse
 } from "./chunk-SRT6SHVZ.js";
@@ -70,15 +70,15 @@ import {
   authorizationProbeNamespaces,
   authorizationProbeRequiresPrincipalNamespace,
   probeOperationAuthorization
-} from "./chunk-AWF4CNYJ.js";
+} from "./chunk-EP55XMFJ.js";
 import {
   CorrectionContractError,
   getOperation,
   resolveQueryNamespaceWritablePreflight
-} from "./chunk-IZZ7Q2RJ.js";
+} from "./chunk-AEE3YMZQ.js";
 import {
   handleWhoKnowsHttpQuery
-} from "./chunk-R7LY4YKF.js";
+} from "./chunk-4UCKF4SK.js";
 import {
   isTrustZoneName
 } from "./chunk-5QZR2RA3.js";
@@ -3587,4 +3587,4 @@ export {
   resolveDefaultAdminConsolePublicDir,
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-PC7WNIRL.js.map
+//# sourceMappingURL=chunk-ROJQV22V.js.map

package/dist/{chunk-YVLENSNS.js → chunk-S3UTKH4Q.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-OGTKQ5MJ.js";
+} from "./chunk-ZD73N3OM.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -119,4 +119,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-YVLENSNS.js.map
+//# sourceMappingURL=chunk-S3UTKH4Q.js.map

package/dist/{chunk-5SGOARQJ.js → chunk-T4KF3GOE.js}

@@ -2,7 +2,7 @@ import {
   SupportPassportError,
   SupportPassportOwnerCreateGrantRequestSchema,
   getOperation
-} from "./chunk-IZZ7Q2RJ.js";
+} from "./chunk-AEE3YMZQ.js";
 
 // src/support-passport/access-http.ts
 var OWNER_ROOT = "/engram/v1/support-passport";
@@ -137,4 +137,4 @@ export {
   SUPPORT_PASSPORT_OWNER_HTTP_ROUTES,
   handleSupportPassportOwnerHttp
 };
-//# sourceMappingURL=chunk-5SGOARQJ.js.map
+//# sourceMappingURL=chunk-T4KF3GOE.js.map

package/dist/{chunk-L74A6NTI.js → chunk-TNIJAM2R.js}

@@ -1,7 +1,7 @@
 import {
   buildStandup,
   parseStandupDate
-} from "./chunk-HOUST5UX.js";
+} from "./chunk-43VDPXOH.js";
 import {
   backfillMemoryStorage,
   runLocationBackfill,
@@ -9,10 +9,10 @@ import {
   runLocationDay,
   runLocationStatus,
   runLocationSync
-} from "./chunk-ZJWDWPX6.js";
+} from "./chunk-YDCNNVED.js";
 import {
   externalWikiSearchOperation
-} from "./chunk-B2AGUKSS.js";
+} from "./chunk-BIU4BMUT.js";
 import {
   memoryStoreRequestSchema
 } from "./chunk-I4Y6TBD7.js";
@@ -22,7 +22,7 @@ import {
   DELTA_SUBCOMMANDS,
   defineOperation,
   isCodegraphToolName
-} from "./chunk-IZZ7Q2RJ.js";
+} from "./chunk-AEE3YMZQ.js";
 import {
   serializeMutations,
   withHeldFileLock
@@ -1909,4 +1909,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-L74A6NTI.js.map
+//# sourceMappingURL=chunk-TNIJAM2R.js.map

package/dist/{chunk-ZZM476NV.js → chunk-UT2YCKQU.js}

@@ -318,4 +318,4 @@ export {
   readProjectedHarmonicGraph,
   searchHarmonicRetrieval
 };
-//# sourceMappingURL=chunk-ZZM476NV.js.map
+//# sourceMappingURL=chunk-UT2YCKQU.js.map

package/dist/{chunk-4HYNMLT6.js → chunk-XBJKNZNY.js}

@@ -1,6 +1,6 @@
 import {
   runLocationSync
-} from "./chunk-ZJWDWPX6.js";
+} from "./chunk-YDCNNVED.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -58,4 +58,4 @@ export {
   LOCATION_SYNC_DEFAULT_INTERVAL_MS,
   startLocationAutoSync
 };
-//# sourceMappingURL=chunk-4HYNMLT6.js.map
+//# sourceMappingURL=chunk-XBJKNZNY.js.map

package/dist/{chunk-CFKCFY4B.js → chunk-XJW75JLZ.js}

@@ -1,7 +1,7 @@
 import {
   SUPPORT_PASSPORT_DRAFT_MAX_CONTENT_CHARACTERS,
   SUPPORT_PASSPORT_DRAFT_MAX_MEMORIES
-} from "./chunk-IZZ7Q2RJ.js";
+} from "./chunk-AEE3YMZQ.js";
 import {
   SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH
 } from "./chunk-EEOUMG3J.js";
@@ -343,4 +343,4 @@ export {
   parseSupportPassportModelJob,
   SupportPassportModelBridge
 };
-//# sourceMappingURL=chunk-CFKCFY4B.js.map
+//# sourceMappingURL=chunk-XJW75JLZ.js.map

package/dist/{chunk-ZJWDWPX6.js → chunk-YDCNNVED.js}

@@ -1,9 +1,9 @@
 import {
   resolveDefaultNamespaceRoot
-} from "./chunk-UMEOXLIZ.js";
+} from "./chunk-YEQZHG4U.js";
 import {
   StorageManager
-} from "./chunk-OGTKQ5MJ.js";
+} from "./chunk-ZD73N3OM.js";
 import {
   composeLocationDayBody,
   composeLocationDayMeta,
@@ -728,4 +728,4 @@ export {
   runLocationBackfill,
   runLocationCliCommand
 };
-//# sourceMappingURL=chunk-ZJWDWPX6.js.map
+//# sourceMappingURL=chunk-YDCNNVED.js.map

package/dist/{chunk-UMEOXLIZ.js → chunk-YEQZHG4U.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-OGTKQ5MJ.js";
+} from "./chunk-ZD73N3OM.js";
 import {
   keyring_exports,
   secureStoreDir
@@ -412,4 +412,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-UMEOXLIZ.js.map
+//# sourceMappingURL=chunk-YEQZHG4U.js.map

package/dist/{chunk-PPOT6SPR.js → chunk-YMYOPR33.js}

@@ -9,17 +9,17 @@ import {
 } from "./chunk-666A3MOW.js";
 import {
   startLocationAutoSync
-} from "./chunk-4HYNMLT6.js";
+} from "./chunk-XBJKNZNY.js";
 import {
   rebuildMemoryLifecycleLedger
-} from "./chunk-DP4EBV7C.js";
+} from "./chunk-ET4OBZKW.js";
 import {
   planNamespaceMaintenance,
   runNamespaceMaintenanceBatchPlan
-} from "./chunk-3LADWWMA.js";
+} from "./chunk-RGD2ZQGR.js";
 import {
   rebuildMemoryProjection
-} from "./chunk-DK6GMO6D.js";
+} from "./chunk-KQY4KIFO.js";
 import {
   validateActivityBaseUrl
 } from "./chunk-OGUKSLYZ.js";
@@ -1729,4 +1729,4 @@ export {
   ActivitySyncScheduler,
   MaintenanceScheduler
 };
-//# sourceMappingURL=chunk-PPOT6SPR.js.map
+//# sourceMappingURL=chunk-YMYOPR33.js.map

package/dist/{chunk-OGTKQ5MJ.js → chunk-ZD73N3OM.js}

@@ -17,7 +17,7 @@ import {
 } from "./chunk-4ZWCQJNM.js";
 import {
   normalizeQmdResultPath
-} from "./chunk-6FUMA6AA.js";
+} from "./chunk-OERZXNSK.js";
 import {
   withholdToolScopedFromSharedNamespace
 } from "./chunk-S2V7RUCL.js";
@@ -11374,4 +11374,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-OGTKQ5MJ.js.map
+//# sourceMappingURL=chunk-ZD73N3OM.js.map

package/dist/{chunk-BZTJEILZ.js → chunk-ZETTGSEG.js}

@@ -2,7 +2,7 @@ import {
   WHO_KNOWS_DEFAULT_LIMIT,
   WHO_KNOWS_MAX_LIMIT,
   validateWhoKnowsInput
-} from "./chunk-R7LY4YKF.js";
+} from "./chunk-4UCKF4SK.js";
 
 // src/who-knows-cli.ts
 function extractWhoKnowsRawArgs(rest) {
@@ -74,4 +74,4 @@ export {
   renderWhoKnowsText,
   renderWhoKnows
 };
-//# sourceMappingURL=chunk-BZTJEILZ.js.map
+//# sourceMappingURL=chunk-ZETTGSEG.js.map

package/dist/{chunk-CASWJ2HM.js → chunk-ZJTSVIBS.js}

@@ -1,6 +1,6 @@
 import {
   OKF_RESERVED_BASENAMES
-} from "./chunk-OGTKQ5MJ.js";
+} from "./chunk-ZD73N3OM.js";
 import {
   MAGIC_BYTES
 } from "./chunk-ET2CNMLD.js";
@@ -202,4 +202,4 @@ export {
   publishBundle,
   rejectSymlinkPath
 };
-//# sourceMappingURL=chunk-CASWJ2HM.js.map
+//# sourceMappingURL=chunk-ZJTSVIBS.js.map

package/dist/{chunk-ZL3XX5LW.js → chunk-ZUYZPDEC.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-N4F7ZSSG.js";
 import {
   StorageManager
-} from "./chunk-OGTKQ5MJ.js";
+} from "./chunk-ZD73N3OM.js";
 import {
   parseContinuityImprovementLoops
 } from "./chunk-LDXUBPMO.js";
@@ -1283,4 +1283,4 @@ export {
   defaultTierMigrationCycleBudget,
   CompoundingEngine
 };
-//# sourceMappingURL=chunk-ZL3XX5LW.js.map
+//# sourceMappingURL=chunk-ZUYZPDEC.js.map