@serve.zone/interfaces 27.2.0 → 27.3.0

package/ts/runtime.cloudlylegacydeploymentsettlement.ts

@@ -37,6 +37,12 @@ export const cloudlyLegacyDeploymentSettlementDomains = Object.freeze({
     'serve.zone/cloudly-legacy-deployment-settlement/scratch-receipt-hmac-v1\0',
   productionReceiptHmac:
     'serve.zone/cloudly-legacy-deployment-settlement/production-receipt-hmac-v1\0',
+  productionExecutionAuthorizationHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/production-execution-authorization-hmac-v1\0',
+  productionReceiptV2Hmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/production-receipt-hmac-v2\0',
+  resolutionHmac:
+    'serve.zone/cloudly-legacy-deployment-settlement/resolution-recovery-attestation-hmac-v1\0',
 } as const);
 
 export type TCloudlyLegacyDeploymentSettlementCodecErrorCode =
@@ -84,8 +90,7 @@ export interface ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1 {
   authorityMetadataSha256: string;
 }
 
-export interface ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1
-{
+interface ICloudlyLegacyDeploymentSettlementAuthorityMetadataBaseV1 {
   schemaVersion: 1;
   operationId: string;
   authorityId: string;
@@ -115,6 +120,47 @@ export interface ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1
   digestProofSha256: string;
 }
 
+export interface ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1
+extends ICloudlyLegacyDeploymentSettlementAuthorityMetadataBaseV1 {
+  executionProtocol?: 'fenced-attempt-v1';
+  sourceAuthority?: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  sourceAuthenticatedPlanSha256?: string;
+  sourceRequestBundleSha256?: string;
+  scratchReceiptSha256?: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementLegacyAuthorityMetadataV1
+extends ICloudlyLegacyDeploymentSettlementAuthorityMetadataBaseV1 {
+  executionProtocol?: never;
+  sourceAuthority?: never;
+  sourceAuthenticatedPlanSha256?: never;
+  sourceRequestBundleSha256?: never;
+  scratchReceiptSha256?: never;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1
+extends ICloudlyLegacyDeploymentSettlementAuthorityMetadataBaseV1 {
+  executionProtocol: 'fenced-attempt-v1';
+  sourceAuthority?: never;
+  sourceAuthenticatedPlanSha256?: never;
+  sourceRequestBundleSha256?: never;
+  scratchReceiptSha256?: never;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementFencedProductionAuthorityMetadataV1
+extends ICloudlyLegacyDeploymentSettlementAuthorityMetadataBaseV1 {
+  executionProtocol: 'fenced-attempt-v1';
+  sourceAuthority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  sourceAuthenticatedPlanSha256: string;
+  sourceRequestBundleSha256: string;
+  scratchReceiptSha256: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementAuthorityMetadataV1 =
+  | ICloudlyLegacyDeploymentSettlementLegacyAuthorityMetadataV1
+  | ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1
+  | ICloudlyLegacyDeploymentSettlementFencedProductionAuthorityMetadataV1;
+
 /** Private plaintext HMAC key. Never persist, log, or place in summaries or receipts. */
 export interface ICloudlyLegacyDeploymentSettlementHmacKeyPlaintextV1 {
   format: 'raw-32-byte-base64url';
@@ -123,9 +169,9 @@ export interface ICloudlyLegacyDeploymentSettlementHmacKeyPlaintextV1 {
 
 /**
  * Exact private-file handoff parsed by pinned maintenance containers.
- * Interfaces only parses and encodes it; consumers own secure generation,
- * storage, use, and destruction of the plaintext key.
- * This package never generates, stores, logs, or performs HMAC with the key.
+ * Consumers own secure generation, storage, use, and destruction of the key.
+ * Interfaces never generates, persists, or logs it; the private stdio verifier
+ * transiently decodes it for HMAC verification and wipes the decoded bytes.
  */
 export interface ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1 {
   schemaVersion: 1;
@@ -444,6 +490,38 @@ const authorityMetadataKeys = [
   'restoredDataSha256',
   'digestProofSha256',
 ] as const;
+const authorityMetadataOptionalKeys = [
+  'executionProtocol',
+  'sourceAuthority',
+  'sourceAuthenticatedPlanSha256',
+  'sourceRequestBundleSha256',
+  'scratchReceiptSha256',
+] as const;
+const authorityMetadataCrossAuthorityKeys = [
+  'schemaVersion',
+  'operationId',
+  'keyVersion',
+  'settlementId',
+  'maintenanceImageDigest',
+  'sourceImageDigest',
+  'targetImageDigest',
+  'targetVersion',
+  'targetManifestSha256',
+  'targetConfigSha256',
+  'backupId',
+  'backupSnapshotIdSha256',
+  'backupProofSha256',
+  'runId',
+  'rehearsalId',
+  'scratchServiceId',
+  'allocationId',
+  'allocationGeneration',
+  'allocationBindingSha256',
+  'allocationReceiptSha256',
+  'sourceDataSha256',
+  'restoredDataSha256',
+  'digestProofSha256',
+] as const;
 const classificationKeys = [
   'image-recorded-not-current',
   'image-recorded-current-failed',
@@ -707,9 +785,10 @@ export const normalizeCloudlyLegacyDeploymentSettlementAuthorityReference = (
 const normalizeAuthorityMetadataInternal = (
   valueArg: unknown,
   pathArg: string,
-): ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1 => {
+): TCloudlyLegacyDeploymentSettlementAuthorityMetadataV1 => {
   const value = readRecord(valueArg, pathArg);
-  assertExactKeys(value, authorityMetadataKeys, pathArg);
+  const optionalKeys = authorityMetadataOptionalKeys.filter((keyArg) => Object.hasOwn(value, keyArg));
+  assertExactKeys(value, [...authorityMetadataKeys, ...optionalKeys], pathArg);
   if (value.schemaVersion !== 1 || value.keyVersion !== 1) {
     fail('INVALID_VALUE', `${pathArg}.schemaVersion`);
   }
@@ -731,11 +810,37 @@ const normalizeAuthorityMetadataInternal = (
   if (sourceDataSha256 !== restoredDataSha256) {
     fail('CROSS_FIELD_MISMATCH', `${pathArg}.restoredDataSha256`);
   }
-  return {
+  const predecessorKeys = authorityMetadataOptionalKeys.filter((keyArg) => (
+    keyArg !== 'executionProtocol'
+  ));
+  const hasExecutionProtocol = Object.hasOwn(value, 'executionProtocol');
+  const predecessorKeyCount = predecessorKeys.filter((keyArg) => Object.hasOwn(value, keyArg)).length;
+  if (hasExecutionProtocol && value.executionProtocol !== 'fenced-attempt-v1') {
+    fail('INVALID_VALUE', `${pathArg}.executionProtocol`);
+  }
+  if (predecessorKeyCount !== 0 && predecessorKeyCount !== predecessorKeys.length) {
+    fail('INVALID_SCHEMA', `${pathArg}.sourceAuthority`);
+  }
+  if (predecessorKeyCount > 0 && !hasExecutionProtocol) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.executionProtocol`);
+  }
+  const operationId = readIdentifier(value.operationId, `${pathArg}.operationId`);
+  const authorityId = readIdentifier(value.authorityId, `${pathArg}.authorityId`);
+  const keyId = readIdentifier(value.keyId, `${pathArg}.keyId`);
+  const sourceAuthority = predecessorKeyCount === 0
+    ? undefined
+    : normalizeAuthorityReferenceInternal(value.sourceAuthority, `${pathArg}.sourceAuthority`);
+  if (sourceAuthority
+    && (sourceAuthority.operationId !== operationId
+      || sourceAuthority.authorityId === authorityId
+      || sourceAuthority.keyId === keyId)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.sourceAuthority`);
+  }
+  const common: ICloudlyLegacyDeploymentSettlementAuthorityMetadataBaseV1 = {
     schemaVersion: 1,
-    operationId: readIdentifier(value.operationId, `${pathArg}.operationId`),
-    authorityId: readIdentifier(value.authorityId, `${pathArg}.authorityId`),
-    keyId: readIdentifier(value.keyId, `${pathArg}.keyId`),
+    operationId,
+    authorityId,
+    keyId,
     keyVersion: 1,
     settlementId: readIdentifier(value.settlementId, `${pathArg}.settlementId`),
     issuedAt,
@@ -779,11 +884,37 @@ const normalizeAuthorityMetadataInternal = (
     restoredDataSha256,
     digestProofSha256: readSha256(value.digestProofSha256, `${pathArg}.digestProofSha256`),
   };
+  if (!hasExecutionProtocol) {
+    return common as ICloudlyLegacyDeploymentSettlementLegacyAuthorityMetadataV1;
+  }
+  if (!sourceAuthority) {
+    return {
+      ...common,
+      executionProtocol: 'fenced-attempt-v1',
+    } as ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1;
+  }
+  return {
+    ...common,
+    executionProtocol: 'fenced-attempt-v1',
+    sourceAuthority,
+    sourceAuthenticatedPlanSha256: readSha256(
+      value.sourceAuthenticatedPlanSha256,
+      `${pathArg}.sourceAuthenticatedPlanSha256`,
+    ),
+    sourceRequestBundleSha256: readSha256(
+      value.sourceRequestBundleSha256,
+      `${pathArg}.sourceRequestBundleSha256`,
+    ),
+    scratchReceiptSha256: readSha256(
+      value.scratchReceiptSha256,
+      `${pathArg}.scratchReceiptSha256`,
+    ),
+  } as ICloudlyLegacyDeploymentSettlementFencedProductionAuthorityMetadataV1;
 };
 
 export const normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata = (
   valueArg: unknown,
-): Readonly<ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1> => finalize(
+): Readonly<TCloudlyLegacyDeploymentSettlementAuthorityMetadataV1> => finalize(
   normalizeAuthorityMetadataInternal(valueArg, 'authorityMetadata'),
   cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityBytes,
   'authorityMetadata',
@@ -834,6 +965,81 @@ export const normalizeCloudlyLegacyDeploymentSettlementAuthorityReferenceForMeta
   return reference;
 };
 
+const normalizeFencedSourceAuthorityMetadata = (
+  metadataArg: unknown,
+  pathArg: string,
+): Readonly<ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  if (metadata.executionProtocol !== 'fenced-attempt-v1'
+    || Object.hasOwn(metadata, 'sourceAuthority')) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+  return metadata as Readonly<
+    ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1
+  >;
+};
+
+const normalizeProductionAuthorityMetadataPair = (
+  productionMetadataArg: unknown,
+  sourceMetadataArg: unknown,
+): {
+  productionMetadata: Readonly<
+    ICloudlyLegacyDeploymentSettlementFencedProductionAuthorityMetadataV1
+  >;
+  sourceMetadata: Readonly<ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1>;
+} => {
+  const productionMetadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(
+    productionMetadataArg,
+  );
+  const sourceMetadata = normalizeFencedSourceAuthorityMetadata(
+    sourceMetadataArg,
+    'sourceAuthorityMetadata',
+  );
+  if (productionMetadata.executionProtocol !== 'fenced-attempt-v1'
+    || !Object.hasOwn(productionMetadata, 'sourceAuthority')) {
+    fail('CROSS_FIELD_MISMATCH', 'productionAuthorityMetadata');
+  }
+  const fencedSourceMetadata = sourceMetadata;
+  const fencedProductionMetadata = productionMetadata as Readonly<
+    ICloudlyLegacyDeploymentSettlementFencedProductionAuthorityMetadataV1
+  >;
+  const sourceAuthority = createCloudlyLegacyDeploymentSettlementAuthorityReference(
+    fencedSourceMetadata,
+  );
+  const productionAuthority = createCloudlyLegacyDeploymentSettlementAuthorityReference(
+    fencedProductionMetadata,
+  );
+  const sourceContext = Object.fromEntries(authorityMetadataCrossAuthorityKeys.map((keyArg) => [
+    keyArg,
+    fencedSourceMetadata[keyArg],
+  ]));
+  const productionContext = Object.fromEntries(authorityMetadataCrossAuthorityKeys.map((keyArg) => [
+    keyArg,
+    fencedProductionMetadata[keyArg],
+  ]));
+  if (canonicalize(fencedProductionMetadata.sourceAuthority, 'productionMetadata.sourceAuthority')
+      !== canonicalize(sourceAuthority, 'sourceMetadata.authority')
+    || canonicalize(productionAuthority, 'productionMetadata.authority')
+      === canonicalize(sourceAuthority, 'sourceMetadata.authority')
+    || fencedProductionMetadata.authorityId === fencedSourceMetadata.authorityId
+    || fencedProductionMetadata.keyId === fencedSourceMetadata.keyId
+    || canonicalize(productionContext, 'productionMetadata.context')
+      !== canonicalize(sourceContext, 'sourceMetadata.context')) {
+    fail('CROSS_FIELD_MISMATCH', 'productionAuthorityMetadata.sourceAuthority');
+  }
+  return {
+    productionMetadata: fencedProductionMetadata,
+    sourceMetadata: fencedSourceMetadata,
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionAuthorityMetadataForSourceAuthority = (
+  productionMetadataArg: unknown,
+  sourceMetadataArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementFencedProductionAuthorityMetadataV1> => (
+  normalizeProductionAuthorityMetadataPair(productionMetadataArg, sourceMetadataArg).productionMetadata
+);
+
 export const normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext = (
   valueArg: unknown,
 ): Readonly<ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1> => {
@@ -875,8 +1081,12 @@ export const normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext
     fail('INVALID_VALUE', 'authorityHandoffPlaintext.hmacKeyPlaintext');
   }
   const keyBytes = Buffer.from(keyValue, 'base64url');
-  if (keyBytes.byteLength !== 32 || keyBytes.toString('base64url') !== keyValue) {
-    fail('INVALID_VALUE', 'authorityHandoffPlaintext.hmacKeyPlaintext.value');
+  try {
+    if (keyBytes.byteLength !== 32 || keyBytes.toString('base64url') !== keyValue) {
+      fail('INVALID_VALUE', 'authorityHandoffPlaintext.hmacKeyPlaintext.value');
+    }
+  } finally {
+    keyBytes.fill(0);
   }
   return finalize({
     schemaVersion: 1,
@@ -894,6 +1104,61 @@ export const encodeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext =
   'authorityHandoffPlaintext',
 );
 
+/**
+ * Private in-process stdio handoff verification only. Do not persist or log the
+ * handoff or returned verifier; discard both as soon as the stdio exchange ends.
+ */
+export const createCloudlyLegacyDeploymentSettlementStdioHandoffHmacVerifier = (
+  handoffArg: unknown,
+): TCloudlyLegacyDeploymentSettlementHmacVerifier => {
+  const handoff = normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext(
+    handoffArg,
+  );
+  const authorityCanonical = canonicalize(
+    handoff.authorityReference,
+    'stdioHandoffHmacVerifier.authority',
+  );
+  const keyValue = handoff.hmacKeyPlaintext.value;
+  return (inputArg): boolean => {
+    let keyBytes: Buffer | undefined;
+    let suppliedMacBytes: Buffer | undefined;
+    let expectedMacBytes: Buffer | undefined;
+    try {
+      if (!(inputArg.hmacInput instanceof Uint8Array)
+        || canonicalize(inputArg.authority, 'stdioHandoffHmacVerifier.input.authority')
+          !== authorityCanonical
+        || !macPattern.test(inputArg.mac)) {
+        return false;
+      }
+      const domainBytes = Buffer.from(inputArg.domain, 'utf8');
+      const hmacInputBytes = Buffer.from(inputArg.hmacInput);
+      if (hmacInputBytes.byteLength < domainBytes.byteLength
+        || !hmacInputBytes.subarray(0, domainBytes.byteLength).equals(domainBytes)) {
+        return false;
+      }
+      keyBytes = Buffer.from(keyValue, 'base64url');
+      suppliedMacBytes = Buffer.from(inputArg.mac, 'base64url');
+      if (keyBytes.byteLength !== 32
+        || keyBytes.toString('base64url') !== keyValue
+        || suppliedMacBytes.byteLength !== 32
+        || suppliedMacBytes.toString('base64url') !== inputArg.mac) {
+        return false;
+      }
+      expectedMacBytes = plugins.crypto
+        .createHmac('sha256', keyBytes)
+        .update(hmacInputBytes)
+        .digest();
+      return plugins.crypto.timingSafeEqual(expectedMacBytes, suppliedMacBytes);
+    } catch {
+      return false;
+    } finally {
+      keyBytes?.fill(0);
+      suppliedMacBytes?.fill(0);
+      expectedMacBytes?.fill(0);
+    }
+  };
+};
+
 const normalizeClassificationCounts = (
   valueArg: unknown,
   pathArg: string,
@@ -2321,7 +2586,7 @@ const requireConsumerVerifiedHmac = async (
 
 const assertAuthorityTimestamp = (
   timestampArg: number,
-  metadataArg: ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
+  metadataArg: TCloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
   pathArg: string,
 ): void => {
   if (timestampArg < metadataArg.issuedAt || timestampArg >= metadataArg.expiresAt) {
@@ -2331,7 +2596,7 @@ const assertAuthorityTimestamp = (
 
 const assertAuthorityReferenceMatchesMetadata = (
   referenceArg: unknown,
-  metadataArg: ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
+  metadataArg: TCloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
   pathArg: string,
 ): void => {
   try {
@@ -2346,7 +2611,7 @@ const assertAuthorityReferenceMatchesMetadata = (
 
 const assertRehearsalBindingMatchesAuthorityMetadata = (
   bindingArg: ICloudlyLegacyDeploymentSettlementRehearsalBindingV1,
-  metadataArg: ICloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
+  metadataArg: TCloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
   pathArg: string,
 ): void => {
   const expected = {
@@ -2882,4 +3147,3473 @@ export const normalizeCloudlyLegacyDeploymentSettlementProductionReceiptStructur
   return receipt;
 };
 
+export interface ICloudlyLegacyDeploymentSettlementRequestBundleV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-request-bundle';
+  authenticatedRehearsalBinding:
+    IAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingV1;
+  authenticatedRequest: IAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestV1;
+}
+
+export type TCloudlyLegacyDeploymentSettlementExecutionPurpose =
+  | 'scratch-rehearsal'
+  | 'production';
+
+export interface ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-execution-attempt-identity';
+  attemptId: string;
+  purpose: TCloudlyLegacyDeploymentSettlementExecutionPurpose;
+  operationId: string;
+  settlementId: string;
+  executionAuthority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  sourceAuthority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  authenticatedPlanSha256: string;
+  requestBundleSha256: string;
+  scratchReceiptSha256: string | null;
+}
+
+export type TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1 =
+  ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1 & {
+    purpose: 'scratch-rehearsal';
+    scratchReceiptSha256: null;
+  };
+export type TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1 =
+  ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1 & {
+    purpose: 'production';
+    scratchReceiptSha256: string;
+  };
+export type TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1 =
+  | TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1
+  | TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1;
+
+export interface ICloudlyLegacyDeploymentSettlementExecutionAttemptPreparedV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-execution-attempt-observation';
+  identity: TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1;
+  state: 'prepared';
+  preparedAt: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementExecutionAttemptCommittedV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-execution-attempt-observation';
+  identity: TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1;
+  state: 'committed';
+  preparedAt: number;
+  resolvedAt: number;
+  receiptSchemaVersion: 1 | 2;
+  receiptSha256: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementExecutionAttemptAbortedV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-execution-attempt-observation';
+  identity: TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1;
+  state: 'aborted';
+  preparedAt: number;
+  resolvedAt: number;
+}
+
+export type TCloudlyLegacyDeploymentSettlementExecutionAttemptObservationV1 =
+  | ICloudlyLegacyDeploymentSettlementExecutionAttemptPreparedV1
+  | ICloudlyLegacyDeploymentSettlementExecutionAttemptCommittedV1
+  | ICloudlyLegacyDeploymentSettlementExecutionAttemptAbortedV1;
+
+const requestBundleKeys = [
+  'schemaVersion',
+  'kind',
+  'authenticatedRehearsalBinding',
+  'authenticatedRequest',
+] as const;
+
+export const normalizeCloudlyLegacyDeploymentSettlementRequestBundle = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementRequestBundleV1> => {
+  const value = readRecord(valueArg, 'requestBundle');
+  assertExactKeys(value, requestBundleKeys, 'requestBundle');
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-request-bundle') {
+    fail('INVALID_VALUE', 'requestBundle.kind');
+  }
+  const authenticatedRehearsalBinding =
+    normalizeCloudlyLegacyDeploymentSettlementAuthenticatedRehearsalBindingStructure(
+      value.authenticatedRehearsalBinding,
+    );
+  const authenticatedRequest =
+    normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure(
+      value.authenticatedRequest,
+    );
+  if (canonicalize(authenticatedRehearsalBinding.authority, 'requestBundle.binding.authority')
+      !== canonicalize(authenticatedRequest.authority, 'requestBundle.request.authority')
+    || canonicalize(
+      authenticatedRehearsalBinding.payload,
+      'requestBundle.binding.payload',
+    ) !== canonicalize(
+      authenticatedRequest.payload.rehearsalBinding,
+      'requestBundle.request.rehearsalBinding',
+    )
+    || authenticatedRehearsalBinding.payloadSha256
+      !== authenticatedRequest.payload.rehearsalBindingSha256) {
+    fail('CROSS_FIELD_MISMATCH', 'requestBundle.authenticatedRehearsalBinding');
+  }
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-request-bundle',
+    authenticatedRehearsalBinding,
+    authenticatedRequest,
+  }, cloudlyLegacyDeploymentSettlementLimits.maximumAuthenticatedArtifactBytes * 2, 'requestBundle');
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementRequestBundle = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementRequestBundle(valueArg),
+  'requestBundle',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementRequestBundle = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementRequestBundle(valueArg));
+
+const executionAttemptIdentityKeys = [
+  'schemaVersion',
+  'kind',
+  'attemptId',
+  'purpose',
+  'operationId',
+  'settlementId',
+  'executionAuthority',
+  'sourceAuthority',
+  'authenticatedPlanSha256',
+  'requestBundleSha256',
+  'scratchReceiptSha256',
+] as const;
+
+const executionAttemptIdentitySeed = (
+  valueArg: Omit<ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1, 'attemptId'>,
+): unknown => ({
+  schemaVersion: valueArg.schemaVersion,
+  kind: valueArg.kind,
+  purpose: valueArg.purpose,
+  operationId: valueArg.operationId,
+  settlementId: valueArg.settlementId,
+  executionAuthority: valueArg.executionAuthority,
+  sourceAuthority: valueArg.sourceAuthority,
+  authenticatedPlanSha256: valueArg.authenticatedPlanSha256,
+  requestBundleSha256: valueArg.requestBundleSha256,
+  scratchReceiptSha256: valueArg.scratchReceiptSha256,
+});
+
+const createExecutionAttemptId = (
+  valueArg: Omit<ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1, 'attemptId'>,
+): string => `settlement-attempt-${digestBytes(encodeNormalized(
+  executionAttemptIdentitySeed(valueArg),
+  'executionAttemptIdentity.seed',
+)).slice(0, 40)}`;
+
+const normalizeExecutionAttemptIdentityInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, executionAttemptIdentityKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-execution-attempt-identity') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const purpose = readLiteral(
+    value.purpose,
+    ['scratch-rehearsal', 'production'],
+    `${pathArg}.purpose`,
+  );
+  const operationId = readIdentifier(value.operationId, `${pathArg}.operationId`);
+  const executionAuthority = normalizeAuthorityReferenceInternal(
+    value.executionAuthority,
+    `${pathArg}.executionAuthority`,
+  );
+  const sourceAuthority = normalizeAuthorityReferenceInternal(
+    value.sourceAuthority,
+    `${pathArg}.sourceAuthority`,
+  );
+  const usesSameAuthority = canonicalize(executionAuthority, `${pathArg}.executionAuthority`)
+    === canonicalize(sourceAuthority, `${pathArg}.sourceAuthority`);
+  if (executionAuthority.operationId !== operationId
+    || sourceAuthority.operationId !== operationId
+    || (purpose === 'scratch-rehearsal') !== usesSameAuthority) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.executionAuthority`);
+  }
+  const scratchReceiptSha256 = value.scratchReceiptSha256 === null
+    ? null
+    : readSha256(value.scratchReceiptSha256, `${pathArg}.scratchReceiptSha256`);
+  if ((purpose === 'production') !== (scratchReceiptSha256 !== null)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.scratchReceiptSha256`);
+  }
+  const identityWithoutId = {
+    schemaVersion: 1 as const,
+    kind: 'cloudly-legacy-deployment-settlement-execution-attempt-identity' as const,
+    purpose,
+    operationId,
+    settlementId: readIdentifier(value.settlementId, `${pathArg}.settlementId`),
+    executionAuthority,
+    sourceAuthority,
+    authenticatedPlanSha256: readSha256(
+      value.authenticatedPlanSha256,
+      `${pathArg}.authenticatedPlanSha256`,
+    ),
+    requestBundleSha256: readSha256(
+      value.requestBundleSha256,
+      `${pathArg}.requestBundleSha256`,
+    ),
+    scratchReceiptSha256,
+  };
+  const attemptId = readIdentifier(value.attemptId, `${pathArg}.attemptId`);
+  if (attemptId !== createExecutionAttemptId(identityWithoutId)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.attemptId`);
+  }
+  return { ...identityWithoutId, attemptId } as
+    TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1;
+};
+
+export function createCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity(
+  valueArg: Omit<
+    TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1,
+    'schemaVersion' | 'kind' | 'attemptId'
+  >,
+): Readonly<TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1>;
+export function createCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity(
+  valueArg: Omit<
+    TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1,
+    'schemaVersion' | 'kind' | 'attemptId'
+  >,
+): Readonly<TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1>;
+export function createCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity(
+  valueArg: Omit<
+    ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1,
+    'schemaVersion' | 'kind' | 'attemptId'
+  >,
+): Readonly<TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1>;
+export function createCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity(
+  valueArg: Omit<
+    ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1,
+    'schemaVersion' | 'kind' | 'attemptId'
+  >,
+): Readonly<TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1> {
+  const seed = {
+    schemaVersion: 1 as const,
+    kind: 'cloudly-legacy-deployment-settlement-execution-attempt-identity' as const,
+    purpose: valueArg.purpose,
+    operationId: valueArg.operationId,
+    settlementId: valueArg.settlementId,
+    executionAuthority: valueArg.executionAuthority,
+    sourceAuthority: valueArg.sourceAuthority,
+    authenticatedPlanSha256: valueArg.authenticatedPlanSha256,
+    requestBundleSha256: valueArg.requestBundleSha256,
+    scratchReceiptSha256: valueArg.scratchReceiptSha256,
+  };
+  return normalizeCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity({
+    ...seed,
+    attemptId: createExecutionAttemptId(seed),
+  });
+}
+
+export const normalizeCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1> => finalize(
+  normalizeExecutionAttemptIdentityInternal(valueArg, 'executionAttemptIdentity'),
+  cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityBytes,
+  'executionAttemptIdentity',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity(valueArg),
+  'executionAttemptIdentity',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementExecutionAttemptIdentity(valueArg),
+);
+
+const normalizeExecutionAttemptObservationInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementExecutionAttemptObservationV1 => {
+  const value = readRecord(valueArg, pathArg);
+  const state = readLiteral(value.state, ['prepared', 'committed', 'aborted'], `${pathArg}.state`);
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'identity',
+    'state',
+    'preparedAt',
+    ...(state === 'committed' ? ['resolvedAt', 'receiptSchemaVersion', 'receiptSha256'] : []),
+    ...(state === 'aborted' ? ['resolvedAt'] : []),
+  ], pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-execution-attempt-observation') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const identity = normalizeExecutionAttemptIdentityInternal(value.identity, `${pathArg}.identity`);
+  const preparedAt = readInteger(value.preparedAt, `${pathArg}.preparedAt`, 1);
+  if (state === 'prepared') {
+    return {
+      schemaVersion: 1,
+      kind: 'cloudly-legacy-deployment-settlement-execution-attempt-observation',
+      identity,
+      state,
+      preparedAt,
+    };
+  }
+  const resolvedAt = readInteger(value.resolvedAt, `${pathArg}.resolvedAt`, preparedAt);
+  if (state === 'aborted') {
+    return {
+      schemaVersion: 1,
+      kind: 'cloudly-legacy-deployment-settlement-execution-attempt-observation',
+      identity,
+      state,
+      preparedAt,
+      resolvedAt,
+    };
+  }
+  if (value.receiptSchemaVersion !== 1 && value.receiptSchemaVersion !== 2) {
+    fail('INVALID_VALUE', `${pathArg}.receiptSchemaVersion`);
+  }
+  const receiptSchemaVersion = value.receiptSchemaVersion as 1 | 2;
+  return {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-execution-attempt-observation',
+    identity,
+    state,
+    preparedAt,
+    resolvedAt,
+    receiptSchemaVersion,
+    receiptSha256: readSha256(value.receiptSha256, `${pathArg}.receiptSha256`),
+  };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementExecutionAttemptObservation = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementExecutionAttemptObservationV1> => finalize(
+  normalizeExecutionAttemptObservationInternal(valueArg, 'executionAttemptObservation'),
+  cloudlyLegacyDeploymentSettlementLimits.maximumAuthorityBytes,
+  'executionAttemptObservation',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementExecutionAttemptObservation = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementExecutionAttemptObservation(valueArg),
+  'executionAttemptObservation',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementExecutionAttemptObservation = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementExecutionAttemptObservation(valueArg),
+);
+
+export interface ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationPayloadV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-production-execution-authorization';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  sourceAuthority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  executionAttempt: TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1;
+  authenticatedPlanSha256: string;
+  requestBundleSha256: string;
+  scratchReceiptSha256: string;
+  maintenanceImageDigest: `sha256:${string}`;
+  operationId: string;
+  settlementId: string;
+  runId: string;
+  rehearsalId: string;
+  scratchServiceId: string;
+  allocationId: string;
+  allocationGeneration: number;
+  allocationBindingSha256: string;
+  allocationReceiptSha256: string;
+  sourceImageDigest: `sha256:${string}`;
+  targetImageDigest: `sha256:${string}`;
+  requestedAt: number;
+  approvedAt: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1
+extends ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationPayloadV1 {
+  payloadSha256: string;
+  mac: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementUnsignedProductionExecutionAuthorizationV1 =
+  Omit<ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1, 'mac'>;
+
+export interface ICloudlyLegacyDeploymentSettlementProductionReceiptPayloadV2 {
+  schemaVersion: 2;
+  kind: 'cloudly-legacy-deployment-settlement-production-receipt';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  sourceAuthority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  executionAttempt: TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1;
+  productionAuthorization:
+    ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1;
+  productionAuthorizationSha256: string;
+  requestSha256: string;
+  requestBundleSha256: string;
+  scratchReceipt: ICloudlyLegacyDeploymentSettlementScratchReceiptV1;
+  scratchReceiptSha256: string;
+  stableOutcome: ICloudlyLegacyDeploymentSettlementStableOutcomeV1;
+  stableOutcomeSha256: string;
+  transactionCommitted: true;
+  disposition: 'applied' | 'exact-replay' | 'no-op';
+  completedAt: number;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementProductionReceiptV2
+extends ICloudlyLegacyDeploymentSettlementProductionReceiptPayloadV2 {
+  payloadSha256: string;
+  mac: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementUnsignedProductionReceiptV2 =
+  Omit<ICloudlyLegacyDeploymentSettlementProductionReceiptV2, 'mac'>;
+export type TCloudlyLegacyDeploymentSettlementProductionReceipt =
+  | ICloudlyLegacyDeploymentSettlementProductionReceiptV1
+  | ICloudlyLegacyDeploymentSettlementProductionReceiptV2;
+
+const productionExecutionAuthorizationPayloadKeys = [
+  'schemaVersion',
+  'kind',
+  'authority',
+  'sourceAuthority',
+  'executionAttempt',
+  'authenticatedPlanSha256',
+  'requestBundleSha256',
+  'scratchReceiptSha256',
+  'maintenanceImageDigest',
+  'operationId',
+  'settlementId',
+  'runId',
+  'rehearsalId',
+  'scratchServiceId',
+  'allocationId',
+  'allocationGeneration',
+  'allocationBindingSha256',
+  'allocationReceiptSha256',
+  'sourceImageDigest',
+  'targetImageDigest',
+  'requestedAt',
+  'approvedAt',
+] as const;
+const unsignedProductionExecutionAuthorizationKeys = [
+  ...productionExecutionAuthorizationPayloadKeys,
+  'payloadSha256',
+] as const;
+const productionExecutionAuthorizationKeys = [
+  ...unsignedProductionExecutionAuthorizationKeys,
+  'mac',
+] as const;
+
+const productionExecutionAuthorizationPayload = (
+  valueArg: ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationPayloadV1,
+): unknown => Object.fromEntries(productionExecutionAuthorizationPayloadKeys.map((keyArg) => [
+  keyArg,
+  valueArg[keyArg],
+]));
+
+const normalizeProductionExecutionAuthorizationPayloadInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationPayloadV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, productionExecutionAuthorizationPayloadKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind
+      !== 'cloudly-legacy-deployment-settlement-production-execution-authorization') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const authority = normalizeAuthorityReferenceInternal(value.authority, `${pathArg}.authority`);
+  const sourceAuthority = normalizeAuthorityReferenceInternal(
+    value.sourceAuthority,
+    `${pathArg}.sourceAuthority`,
+  );
+  const executionAttempt = normalizeExecutionAttemptIdentityInternal(
+    value.executionAttempt,
+    `${pathArg}.executionAttempt`,
+  );
+  const operationId = readIdentifier(value.operationId, `${pathArg}.operationId`);
+  const settlementId = readIdentifier(value.settlementId, `${pathArg}.settlementId`);
+  const authenticatedPlanSha256 = readSha256(
+    value.authenticatedPlanSha256,
+    `${pathArg}.authenticatedPlanSha256`,
+  );
+  const requestBundleSha256 = readSha256(
+    value.requestBundleSha256,
+    `${pathArg}.requestBundleSha256`,
+  );
+  const scratchReceiptSha256 = readSha256(
+    value.scratchReceiptSha256,
+    `${pathArg}.scratchReceiptSha256`,
+  );
+  if (executionAttempt.purpose !== 'production'
+    || executionAttempt.operationId !== operationId
+    || executionAttempt.settlementId !== settlementId
+    || authority.authorityId === sourceAuthority.authorityId
+    || authority.keyId === sourceAuthority.keyId
+    || canonicalize(authority, `${pathArg}.authority`)
+      === canonicalize(sourceAuthority, `${pathArg}.sourceAuthority`)
+    || canonicalize(executionAttempt.executionAuthority, `${pathArg}.attempt.executionAuthority`)
+      !== canonicalize(authority, `${pathArg}.authority`)
+    || canonicalize(executionAttempt.sourceAuthority, `${pathArg}.attempt.sourceAuthority`)
+      !== canonicalize(sourceAuthority, `${pathArg}.sourceAuthority`)
+    || executionAttempt.authenticatedPlanSha256 !== authenticatedPlanSha256
+    || executionAttempt.requestBundleSha256 !== requestBundleSha256
+    || executionAttempt.scratchReceiptSha256 !== scratchReceiptSha256) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.executionAttempt`);
+  }
+  const requestedAt = readInteger(value.requestedAt, `${pathArg}.requestedAt`, 1);
+  const approvedAt = readInteger(value.approvedAt, `${pathArg}.approvedAt`, requestedAt);
+  return {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-production-execution-authorization',
+    authority,
+    sourceAuthority,
+    executionAttempt: executionAttempt as
+      TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1,
+    authenticatedPlanSha256,
+    requestBundleSha256,
+    scratchReceiptSha256,
+    maintenanceImageDigest: readOciDigest(
+      value.maintenanceImageDigest,
+      `${pathArg}.maintenanceImageDigest`,
+    ),
+    operationId,
+    settlementId,
+    runId: readIdentifier(value.runId, `${pathArg}.runId`),
+    rehearsalId: readIdentifier(value.rehearsalId, `${pathArg}.rehearsalId`),
+    scratchServiceId: readIdentifier(value.scratchServiceId, `${pathArg}.scratchServiceId`),
+    allocationId: readIdentifier(value.allocationId, `${pathArg}.allocationId`),
+    allocationGeneration: readInteger(
+      value.allocationGeneration,
+      `${pathArg}.allocationGeneration`,
+      1,
+    ),
+    allocationBindingSha256: readSha256(
+      value.allocationBindingSha256,
+      `${pathArg}.allocationBindingSha256`,
+    ),
+    allocationReceiptSha256: readSha256(
+      value.allocationReceiptSha256,
+      `${pathArg}.allocationReceiptSha256`,
+    ),
+    sourceImageDigest: readOciDigest(value.sourceImageDigest, `${pathArg}.sourceImageDigest`),
+    targetImageDigest: readOciDigest(value.targetImageDigest, `${pathArg}.targetImageDigest`),
+    requestedAt,
+    approvedAt,
+  };
+};
+
+const normalizeUnsignedProductionExecutionAuthorizationInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementUnsignedProductionExecutionAuthorizationV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, unsignedProductionExecutionAuthorizationKeys, pathArg);
+  const payloadInput = Object.fromEntries(productionExecutionAuthorizationPayloadKeys.map(
+    (keyArg) => [keyArg, value[keyArg]],
+  ));
+  const payload = normalizeProductionExecutionAuthorizationPayloadInternal(
+    payloadInput,
+    `${pathArg}.payload`,
+  );
+  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
+  if (payloadSha256 !== digestBytes(encodeNormalized(
+    productionExecutionAuthorizationPayload(payload),
+    `${pathArg}.payload`,
+  ))) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
+  }
+  return { ...payload, payloadSha256 };
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1> => {
+  const value = readRecord(valueArg, 'productionExecutionAuthorization');
+  assertExactKeys(value, productionExecutionAuthorizationKeys, 'productionExecutionAuthorization');
+  const unsignedInput = Object.fromEntries(unsignedProductionExecutionAuthorizationKeys.map(
+    (keyArg) => [keyArg, value[keyArg]],
+  ));
+  return finalize({
+    ...normalizeUnsignedProductionExecutionAuthorizationInternal(
+      unsignedInput,
+      'productionExecutionAuthorization.unsigned',
+    ),
+    mac: readMac(value.mac, 'productionExecutionAuthorization.mac'),
+  }, cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes, 'productionExecutionAuthorization');
+};
+
+export const digestCloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationPayload = (
+  valueArg: unknown,
+): string => digestBytes(encodeNormalized(
+  productionExecutionAuthorizationPayload(
+    normalizeProductionExecutionAuthorizationPayloadInternal(
+      valueArg,
+      'productionExecutionAuthorizationPayload',
+    ),
+  ),
+  'productionExecutionAuthorizationPayload',
+));
+
+export const encodeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization(valueArg),
+  'productionExecutionAuthorization',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization = (
+  valueArg: unknown,
+): string => digestBytes(
+  encodeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization(valueArg),
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.productionExecutionAuthorizationHmac,
+  encodeNormalized(
+    finalize(
+      normalizeUnsignedProductionExecutionAuthorizationInternal(
+        valueArg,
+        'unsignedProductionExecutionAuthorization',
+      ),
+      cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes,
+      'unsignedProductionExecutionAuthorization',
+    ),
+    'productionExecutionAuthorization.authenticated',
+  ),
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementRequestBundleForAuthority = async (
+  bundleArg: unknown,
+  authenticatedPlanArg: unknown,
+  metadataArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<ICloudlyLegacyDeploymentSettlementRequestBundleV1>> => {
+  const metadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(metadataArg);
+  const plan = await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementPlanForAuthority(
+    authenticatedPlanArg,
+    metadata,
+    verifierArg,
+  );
+  const bundle = normalizeCloudlyLegacyDeploymentSettlementRequestBundle(bundleArg);
+  await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementRehearsalBindingForAuthority(
+    bundle.authenticatedRehearsalBinding,
+    metadata,
+    verifierArg,
+  );
+  await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementProductionRequestForAuthority(
+    bundle.authenticatedRequest,
+    metadata,
+    verifierArg,
+  );
+  if (canonicalize(plan.payload, 'requestBundle.plan')
+      !== canonicalize(bundle.authenticatedRequest.payload.plan, 'requestBundle.request.plan')
+    || plan.payloadSha256 !== bundle.authenticatedRequest.payload.planSha256) {
+    fail('CROSS_FIELD_MISMATCH', 'requestBundle.authenticatedRequest.plan');
+  }
+  return bundle;
+};
+
+const assertProductionAuthorizationMetadata = (
+  authorizationArg: ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1,
+  productionMetadataArg:
+    ICloudlyLegacyDeploymentSettlementFencedProductionAuthorityMetadataV1,
+  sourceMetadataArg: ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1,
+): void => {
+  assertAuthorityReferenceMatchesMetadata(
+    authorizationArg.authority,
+    productionMetadataArg,
+    'productionExecutionAuthorization.authority',
+  );
+  assertAuthorityReferenceMatchesMetadata(
+    authorizationArg.sourceAuthority,
+    sourceMetadataArg,
+    'productionExecutionAuthorization.sourceAuthority',
+  );
+  if (canonicalize(productionMetadataArg.sourceAuthority, 'productionMetadata.sourceAuthority')
+      !== canonicalize(authorizationArg.sourceAuthority, 'authorization.sourceAuthority')
+    || productionMetadataArg.sourceAuthenticatedPlanSha256
+      !== authorizationArg.authenticatedPlanSha256
+    || productionMetadataArg.sourceRequestBundleSha256 !== authorizationArg.requestBundleSha256
+    || productionMetadataArg.scratchReceiptSha256 !== authorizationArg.scratchReceiptSha256
+    || authorizationArg.operationId !== productionMetadataArg.operationId
+    || authorizationArg.operationId !== sourceMetadataArg.operationId
+    || authorizationArg.settlementId !== productionMetadataArg.settlementId
+    || authorizationArg.settlementId !== sourceMetadataArg.settlementId
+    || authorizationArg.runId !== productionMetadataArg.runId
+    || authorizationArg.runId !== sourceMetadataArg.runId
+    || authorizationArg.rehearsalId !== productionMetadataArg.rehearsalId
+    || authorizationArg.rehearsalId !== sourceMetadataArg.rehearsalId
+    || authorizationArg.scratchServiceId !== productionMetadataArg.scratchServiceId
+    || authorizationArg.scratchServiceId !== sourceMetadataArg.scratchServiceId
+    || authorizationArg.allocationId !== productionMetadataArg.allocationId
+    || authorizationArg.allocationId !== sourceMetadataArg.allocationId
+    || authorizationArg.allocationGeneration !== productionMetadataArg.allocationGeneration
+    || authorizationArg.allocationGeneration !== sourceMetadataArg.allocationGeneration
+    || authorizationArg.allocationBindingSha256 !== productionMetadataArg.allocationBindingSha256
+    || authorizationArg.allocationBindingSha256 !== sourceMetadataArg.allocationBindingSha256
+    || authorizationArg.allocationReceiptSha256 !== productionMetadataArg.allocationReceiptSha256
+    || authorizationArg.allocationReceiptSha256 !== sourceMetadataArg.allocationReceiptSha256
+    || authorizationArg.maintenanceImageDigest !== productionMetadataArg.maintenanceImageDigest
+    || authorizationArg.sourceImageDigest !== productionMetadataArg.sourceImageDigest
+    || authorizationArg.sourceImageDigest !== sourceMetadataArg.sourceImageDigest
+    || authorizationArg.targetImageDigest !== productionMetadataArg.targetImageDigest
+    || authorizationArg.targetImageDigest !== sourceMetadataArg.targetImageDigest) {
+    fail('CROSS_FIELD_MISMATCH', 'productionExecutionAuthorization.authorityMetadata');
+  }
+  assertAuthorityTimestamp(
+    authorizationArg.requestedAt,
+    productionMetadataArg,
+    'productionExecutionAuthorization.requestedAt',
+  );
+  assertAuthorityTimestamp(
+    authorizationArg.approvedAt,
+    productionMetadataArg,
+    'productionExecutionAuthorization.approvedAt',
+  );
+};
+
+const assertProductionAuthorizationArtifacts = (
+  authorizationArg: ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1,
+  productionMetadataArg:
+    ICloudlyLegacyDeploymentSettlementFencedProductionAuthorityMetadataV1,
+  sourceMetadataArg: ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1,
+  authenticatedPlanArg: IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1,
+  requestBundleArg: ICloudlyLegacyDeploymentSettlementRequestBundleV1,
+  scratchReceiptArg: ICloudlyLegacyDeploymentSettlementScratchReceiptV1,
+): void => {
+  if (authorizationArg.authenticatedPlanSha256
+      !== digestAuthenticatedCloudlyLegacyDeploymentSettlementPlan(authenticatedPlanArg)
+    || authorizationArg.requestBundleSha256
+      !== digestCloudlyLegacyDeploymentSettlementRequestBundle(requestBundleArg)
+    || authorizationArg.scratchReceiptSha256
+      !== digestCloudlyLegacyDeploymentSettlementScratchReceipt(scratchReceiptArg)
+    || productionMetadataArg.issuedAt < scratchReceiptArg.completedAt
+    || authorizationArg.requestedAt < scratchReceiptArg.completedAt
+    || authorizationArg.requestedAt < productionMetadataArg.issuedAt
+    || authorizationArg.approvedAt < authorizationArg.requestedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'productionExecutionAuthorization.sourceProof');
+  }
+  assertProductionAuthorizationMetadata(
+    authorizationArg,
+    productionMetadataArg,
+    sourceMetadataArg,
+  );
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationForAuthorities = async (
+  authorizationArg: unknown,
+  productionMetadataArg: unknown,
+  sourceMetadataArg: unknown,
+  authenticatedPlanArg: unknown,
+  requestBundleArg: unknown,
+  scratchReceiptArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1>> => {
+  const {
+    productionMetadata,
+    sourceMetadata,
+  } = normalizeProductionAuthorityMetadataPair(
+    productionMetadataArg,
+    sourceMetadataArg,
+  );
+  const plan = await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementPlanForAuthority(
+    authenticatedPlanArg,
+    sourceMetadata,
+    verifierArg,
+  );
+  const requestBundle = await normalizeCloudlyLegacyDeploymentSettlementRequestBundleForAuthority(
+    requestBundleArg,
+    plan,
+    sourceMetadata,
+    verifierArg,
+  );
+  const scratchReceipt = await normalizeCloudlyLegacyDeploymentSettlementScratchReceiptForAuthority(
+    scratchReceiptArg,
+    sourceMetadata,
+    requestBundle.authenticatedRequest,
+    verifierArg,
+  );
+  const authorization =
+    normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization(authorizationArg);
+  assertProductionAuthorizationArtifacts(
+    authorization,
+    productionMetadata,
+    sourceMetadata,
+    plan,
+    requestBundle,
+    scratchReceipt,
+  );
+  await requireConsumerVerifiedHmac(
+    authorization.authority,
+    cloudlyLegacyDeploymentSettlementDomains.productionExecutionAuthorizationHmac,
+    encodeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationHmacInput(
+      withoutArtifactMac(authorization),
+    ),
+    authorization.mac,
+    verifierArg,
+    'productionExecutionAuthorization.mac',
+  );
+  return authorization;
+};
+
+const productionReceiptV2PayloadKeys = [
+  'schemaVersion',
+  'kind',
+  'authority',
+  'sourceAuthority',
+  'executionAttempt',
+  'productionAuthorization',
+  'productionAuthorizationSha256',
+  'requestSha256',
+  'requestBundleSha256',
+  'scratchReceipt',
+  'scratchReceiptSha256',
+  'stableOutcome',
+  'stableOutcomeSha256',
+  'transactionCommitted',
+  'disposition',
+  'completedAt',
+] as const;
+const unsignedProductionReceiptV2Keys = [...productionReceiptV2PayloadKeys, 'payloadSha256'] as const;
+const productionReceiptV2Keys = [...unsignedProductionReceiptV2Keys, 'mac'] as const;
+
+const productionReceiptV2Payload = (
+  valueArg: ICloudlyLegacyDeploymentSettlementProductionReceiptPayloadV2,
+): unknown => Object.fromEntries(productionReceiptV2PayloadKeys.map((keyArg) => [
+  keyArg,
+  valueArg[keyArg],
+]));
+
+const normalizeProductionReceiptV2PayloadInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementProductionReceiptPayloadV2 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, productionReceiptV2PayloadKeys, pathArg);
+  if (value.schemaVersion !== 2
+    || value.kind !== 'cloudly-legacy-deployment-settlement-production-receipt'
+    || value.transactionCommitted !== true) {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const authority = normalizeAuthorityReferenceInternal(value.authority, `${pathArg}.authority`);
+  const sourceAuthority = normalizeAuthorityReferenceInternal(
+    value.sourceAuthority,
+    `${pathArg}.sourceAuthority`,
+  );
+  const executionAttempt = normalizeExecutionAttemptIdentityInternal(
+    value.executionAttempt,
+    `${pathArg}.executionAttempt`,
+  );
+  const productionAuthorization =
+    normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization(
+      value.productionAuthorization,
+    );
+  const productionAuthorizationSha256 = readSha256(
+    value.productionAuthorizationSha256,
+    `${pathArg}.productionAuthorizationSha256`,
+  );
+  const requestBundleSha256 = readSha256(
+    value.requestBundleSha256,
+    `${pathArg}.requestBundleSha256`,
+  );
+  const scratchReceipt = normalizeScratchReceiptInternal(
+    value.scratchReceipt,
+    `${pathArg}.scratchReceipt`,
+  );
+  const scratchReceiptSha256 = readSha256(
+    value.scratchReceiptSha256,
+    `${pathArg}.scratchReceiptSha256`,
+  );
+  const stableOutcome = normalizeStableOutcomeInternal(
+    value.stableOutcome,
+    `${pathArg}.stableOutcome`,
+  );
+  const stableOutcomeSha256 = readSha256(
+    value.stableOutcomeSha256,
+    `${pathArg}.stableOutcomeSha256`,
+  );
+  const requestSha256 = readSha256(value.requestSha256, `${pathArg}.requestSha256`);
+  const disposition = readLiteral(
+    value.disposition,
+    ['applied', 'exact-replay', 'no-op'],
+    `${pathArg}.disposition`,
+  );
+  const dispositionMatchesScratch = disposition === scratchReceipt.disposition
+    || (scratchReceipt.disposition === 'applied' && disposition === 'exact-replay');
+  if (canonicalize(authority, `${pathArg}.authority`)
+      !== canonicalize(productionAuthorization.authority, `${pathArg}.authorization.authority`)
+    || canonicalize(sourceAuthority, `${pathArg}.sourceAuthority`)
+      !== canonicalize(productionAuthorization.sourceAuthority, `${pathArg}.authorization.sourceAuthority`)
+    || canonicalize(executionAttempt, `${pathArg}.executionAttempt`)
+      !== canonicalize(productionAuthorization.executionAttempt, `${pathArg}.authorization.attempt`)
+    || productionAuthorizationSha256
+      !== digestCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization(
+        productionAuthorization,
+      )
+    || requestBundleSha256 !== productionAuthorization.requestBundleSha256
+    || scratchReceiptSha256 !== productionAuthorization.scratchReceiptSha256
+    || scratchReceiptSha256
+      !== digestCloudlyLegacyDeploymentSettlementScratchReceipt(scratchReceipt)
+    || canonicalize(sourceAuthority, `${pathArg}.sourceAuthority`)
+      !== canonicalize(scratchReceipt.authority, `${pathArg}.scratchReceipt.authority`)
+    || requestSha256 !== scratchReceipt.requestSha256
+    || !dispositionMatchesScratch
+    || canonicalize(stableOutcome, `${pathArg}.stableOutcome`)
+      !== canonicalize(scratchReceipt.stableOutcome, `${pathArg}.scratchReceipt.stableOutcome`)
+    || stableOutcomeSha256 !== scratchReceipt.stableOutcomeSha256
+    || stableOutcomeSha256
+      !== digestCloudlyLegacyDeploymentSettlementStableOutcome(stableOutcome)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.productionAuthorization`);
+  }
+  return {
+    schemaVersion: 2,
+    kind: 'cloudly-legacy-deployment-settlement-production-receipt',
+    authority,
+    sourceAuthority,
+    executionAttempt: executionAttempt as
+      TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1,
+    productionAuthorization,
+    productionAuthorizationSha256,
+    requestSha256,
+    requestBundleSha256,
+    scratchReceipt,
+    scratchReceiptSha256,
+    stableOutcome,
+    stableOutcomeSha256,
+    transactionCommitted: true,
+    disposition,
+    completedAt: readInteger(
+      value.completedAt,
+      `${pathArg}.completedAt`,
+      productionAuthorization.approvedAt,
+    ),
+  };
+};
+
+const normalizeUnsignedProductionReceiptV2Internal = (
+  valueArg: unknown,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementUnsignedProductionReceiptV2 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, unsignedProductionReceiptV2Keys, pathArg);
+  const payloadInput = Object.fromEntries(productionReceiptV2PayloadKeys.map(
+    (keyArg) => [keyArg, value[keyArg]],
+  ));
+  const payload = normalizeProductionReceiptV2PayloadInternal(payloadInput, `${pathArg}.payload`);
+  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
+  if (payloadSha256 !== digestBytes(encodeNormalized(
+    productionReceiptV2Payload(payload),
+    `${pathArg}.payload`,
+  ))) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payloadSha256`);
+  }
+  return { ...payload, payloadSha256 };
+};
+
+export const digestCloudlyLegacyDeploymentSettlementProductionReceiptPayloadV2 = (
+  valueArg: unknown,
+): string => digestBytes(encodeNormalized(
+  productionReceiptV2Payload(
+    normalizeProductionReceiptV2PayloadInternal(valueArg, 'productionReceiptPayloadV2'),
+  ),
+  'productionReceiptPayloadV2',
+));
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionReceiptV2 = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementProductionReceiptV2> => {
+  const value = readRecord(valueArg, 'productionReceiptV2');
+  assertExactKeys(value, productionReceiptV2Keys, 'productionReceiptV2');
+  const unsignedInput = Object.fromEntries(unsignedProductionReceiptV2Keys.map(
+    (keyArg) => [keyArg, value[keyArg]],
+  ));
+  return finalize({
+    ...normalizeUnsignedProductionReceiptV2Internal(unsignedInput, 'productionReceiptV2.unsigned'),
+    mac: readMac(value.mac, 'productionReceiptV2.mac'),
+  }, cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes * 3, 'productionReceiptV2');
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionReceiptAnyVersion = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementProductionReceipt> => {
+  const value = readRecord(valueArg, 'productionReceipt');
+  return value.schemaVersion === 2
+    ? normalizeCloudlyLegacyDeploymentSettlementProductionReceiptV2(value)
+    : normalizeCloudlyLegacyDeploymentSettlementProductionReceipt(value);
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementProductionReceiptV2 = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementProductionReceiptV2(valueArg),
+  'productionReceiptV2',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementProductionReceiptV2 = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementProductionReceiptV2(valueArg));
+
+export const encodeCloudlyLegacyDeploymentSettlementProductionReceiptV2HmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.productionReceiptV2Hmac,
+  encodeNormalized(
+    finalize(
+      normalizeUnsignedProductionReceiptV2Internal(valueArg, 'unsignedProductionReceiptV2'),
+      cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes * 3,
+      'unsignedProductionReceiptV2',
+    ),
+    'productionReceiptV2.authenticated',
+  ),
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionReceiptV2ForAuthorities = async (
+  receiptArg: unknown,
+  productionMetadataArg: unknown,
+  sourceMetadataArg: unknown,
+  authenticatedPlanArg: unknown,
+  requestBundleArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<ICloudlyLegacyDeploymentSettlementProductionReceiptV2>> => {
+  const {
+    productionMetadata,
+    sourceMetadata,
+  } = normalizeProductionAuthorityMetadataPair(
+    productionMetadataArg,
+    sourceMetadataArg,
+  );
+  const receipt = normalizeCloudlyLegacyDeploymentSettlementProductionReceiptV2(receiptArg);
+  const requestBundle = normalizeCloudlyLegacyDeploymentSettlementRequestBundle(requestBundleArg);
+  await normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationForAuthorities(
+    receipt.productionAuthorization,
+    productionMetadata,
+    sourceMetadata,
+    authenticatedPlanArg,
+    requestBundle,
+    receipt.scratchReceipt,
+    verifierArg,
+  );
+  await normalizeCloudlyLegacyDeploymentSettlementScratchReceiptForAuthority(
+    receipt.scratchReceipt,
+    sourceMetadata,
+    requestBundle.authenticatedRequest,
+    verifierArg,
+  );
+  assertAuthorityReferenceMatchesMetadata(
+    receipt.authority,
+    productionMetadata,
+    'productionReceiptV2.authority',
+  );
+  assertAuthorityTimestamp(receipt.completedAt, productionMetadata, 'productionReceiptV2.completedAt');
+  await requireConsumerVerifiedHmac(
+    receipt.authority,
+    cloudlyLegacyDeploymentSettlementDomains.productionReceiptV2Hmac,
+    encodeCloudlyLegacyDeploymentSettlementProductionReceiptV2HmacInput(
+      withoutArtifactMac(receipt),
+    ),
+    receipt.mac,
+    verifierArg,
+    'productionReceiptV2.mac',
+  );
+  return receipt;
+};
+
+export type TCloudlyLegacyDeploymentSettlementAuthorityStatus = 'active' | 'expired';
+export type TCloudlyLegacyDeploymentSettlementResolutionMode =
+  | 'committed-schema1'
+  | 'committed-schema2'
+  | 'aborted-prepared'
+  | 'observed-aborted'
+  | 'absent-tombstone'
+  | 'legacy-no-op';
+
+export type TCloudlyLegacyDeploymentSettlementCommittedReceipt =
+  | ICloudlyLegacyDeploymentSettlementScratchReceiptV1
+  | ICloudlyLegacyDeploymentSettlementProductionReceiptV2;
+type TCloudlyLegacyDeploymentSettlementCommittedObservationV1<
+  TAttempt extends TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1,
+  TReceiptSchemaVersion extends 1 | 2,
+> = Omit<
+  ICloudlyLegacyDeploymentSettlementExecutionAttemptCommittedV1,
+  'identity' | 'receiptSchemaVersion'
+> & {
+  identity: TAttempt;
+  receiptSchemaVersion: TReceiptSchemaVersion;
+};
+
+interface ICloudlyLegacyDeploymentSettlementResolutionBundleBaseV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-resolution-bundle';
+  executionAttempt: TCloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1;
+  observedAt: number;
+  sourceAuthorityStatus: TCloudlyLegacyDeploymentSettlementAuthorityStatus;
+  executionAuthorityStatus: TCloudlyLegacyDeploymentSettlementAuthorityStatus;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementCommittedScratchSchema1ResolutionBundleV1
+extends ICloudlyLegacyDeploymentSettlementResolutionBundleBaseV1 {
+  outcome: 'committed';
+  mode: 'committed-schema1';
+  executionAttempt: TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1;
+  attemptObservation: TCloudlyLegacyDeploymentSettlementCommittedObservationV1<
+    TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1,
+    1
+  >;
+  originalReceipt: ICloudlyLegacyDeploymentSettlementScratchReceiptV1;
+  originalReceiptSha256: string;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementCommittedSchema2ResolutionBundleV1
+extends ICloudlyLegacyDeploymentSettlementResolutionBundleBaseV1 {
+  outcome: 'committed';
+  mode: 'committed-schema2';
+  executionAttempt: TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1;
+  attemptObservation: TCloudlyLegacyDeploymentSettlementCommittedObservationV1<
+    TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1,
+    2
+  >;
+  originalReceipt: ICloudlyLegacyDeploymentSettlementProductionReceiptV2;
+  originalReceiptSha256: string;
+}
+
+export type TCloudlyLegacyDeploymentSettlementCommittedResolutionBundleV1 =
+  | ICloudlyLegacyDeploymentSettlementCommittedScratchSchema1ResolutionBundleV1
+  | ICloudlyLegacyDeploymentSettlementCommittedSchema2ResolutionBundleV1;
+
+export interface ICloudlyLegacyDeploymentSettlementAbortedPreparedResolutionBundleV1
+extends ICloudlyLegacyDeploymentSettlementResolutionBundleBaseV1 {
+  outcome: 'unapplied';
+  mode: 'aborted-prepared';
+  attemptObservation: ICloudlyLegacyDeploymentSettlementExecutionAttemptAbortedV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementObservedAbortedResolutionBundleV1
+extends ICloudlyLegacyDeploymentSettlementResolutionBundleBaseV1 {
+  outcome: 'unapplied';
+  mode: 'observed-aborted';
+  attemptObservation: ICloudlyLegacyDeploymentSettlementExecutionAttemptAbortedV1;
+}
+
+export type TCloudlyLegacyDeploymentSettlementAbortedResolutionBundleV1 =
+  | ICloudlyLegacyDeploymentSettlementAbortedPreparedResolutionBundleV1
+  | ICloudlyLegacyDeploymentSettlementObservedAbortedResolutionBundleV1;
+
+export interface ICloudlyLegacyDeploymentSettlementAbsentTombstoneResolutionBundleV1
+extends ICloudlyLegacyDeploymentSettlementResolutionBundleBaseV1 {
+  outcome: 'unapplied';
+  mode: 'absent-tombstone';
+  attemptObservation: ICloudlyLegacyDeploymentSettlementExecutionAttemptAbortedV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementLegacyNoOpResolutionBundleV1
+extends ICloudlyLegacyDeploymentSettlementResolutionBundleBaseV1 {
+  outcome: 'unapplied';
+  mode: 'legacy-no-op';
+  executionAttempt: TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1;
+  attemptObservation: null;
+}
+
+export type TCloudlyLegacyDeploymentSettlementResolutionBundleV1 =
+  | ICloudlyLegacyDeploymentSettlementCommittedScratchSchema1ResolutionBundleV1
+  | ICloudlyLegacyDeploymentSettlementCommittedSchema2ResolutionBundleV1
+  | ICloudlyLegacyDeploymentSettlementAbortedPreparedResolutionBundleV1
+  | ICloudlyLegacyDeploymentSettlementObservedAbortedResolutionBundleV1
+  | ICloudlyLegacyDeploymentSettlementAbsentTombstoneResolutionBundleV1
+  | ICloudlyLegacyDeploymentSettlementLegacyNoOpResolutionBundleV1;
+
+const normalizeCommittedResolutionReceipt = (
+  valueArg: unknown,
+  pathArg: string,
+): Readonly<TCloudlyLegacyDeploymentSettlementCommittedReceipt> => {
+  const value = readRecord(valueArg, pathArg);
+  if (value.kind === 'cloudly-legacy-deployment-settlement-scratch-receipt') {
+    return normalizeCloudlyLegacyDeploymentSettlementScratchReceipt(value);
+  }
+  if (value.kind !== 'cloudly-legacy-deployment-settlement-production-receipt') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  if (value.schemaVersion !== 2) {
+    fail('INVALID_VALUE', `${pathArg}.schemaVersion`);
+  }
+  return normalizeCloudlyLegacyDeploymentSettlementProductionReceiptV2(value);
+};
+
+/** Structural only; this function does not authenticate receipt MACs. */
+export const normalizeCloudlyLegacyDeploymentSettlementResolutionBundle = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementResolutionBundleV1> => {
+  const value = readRecord(valueArg, 'resolutionBundle');
+  const outcome = readLiteral(value.outcome, ['committed', 'unapplied'], 'resolutionBundle.outcome');
+  const mode = readLiteral(value.mode, [
+    'committed-schema1',
+    'committed-schema2',
+    'aborted-prepared',
+    'observed-aborted',
+    'absent-tombstone',
+    'legacy-no-op',
+  ], 'resolutionBundle.mode');
+  const committed = outcome === 'committed';
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'executionAttempt',
+    'observedAt',
+    'sourceAuthorityStatus',
+    'executionAuthorityStatus',
+    'outcome',
+    'mode',
+    'attemptObservation',
+    ...(committed ? ['originalReceipt', 'originalReceiptSha256'] : []),
+  ], 'resolutionBundle');
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-resolution-bundle') {
+    fail('INVALID_VALUE', 'resolutionBundle.kind');
+  }
+  const executionAttempt = normalizeExecutionAttemptIdentityInternal(
+    value.executionAttempt,
+    'resolutionBundle.executionAttempt',
+  );
+  const observedAt = readInteger(value.observedAt, 'resolutionBundle.observedAt', 1);
+  const sourceAuthorityStatus = readLiteral(
+    value.sourceAuthorityStatus,
+    ['active', 'expired'],
+    'resolutionBundle.sourceAuthorityStatus',
+  );
+  const executionAuthorityStatus = readLiteral(
+    value.executionAuthorityStatus,
+    ['active', 'expired'],
+    'resolutionBundle.executionAuthorityStatus',
+  );
+  if (canonicalize(executionAttempt.sourceAuthority, 'resolutionBundle.sourceAuthority')
+      === canonicalize(executionAttempt.executionAuthority, 'resolutionBundle.executionAuthority')
+    && sourceAuthorityStatus !== executionAuthorityStatus) {
+    fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.executionAuthorityStatus');
+  }
+  if (committed) {
+    if (mode !== 'committed-schema1' && mode !== 'committed-schema2') {
+      fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.mode');
+    }
+    const attemptObservation = normalizeExecutionAttemptObservationInternal(
+      value.attemptObservation,
+      'resolutionBundle.attemptObservation',
+    );
+    if (attemptObservation.state !== 'committed') {
+      fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.attemptObservation');
+    }
+    const committedObservation = attemptObservation as
+      ICloudlyLegacyDeploymentSettlementExecutionAttemptCommittedV1;
+    if (canonicalize(committedObservation.identity, 'resolutionBundle.observation.identity')
+        !== canonicalize(executionAttempt, 'resolutionBundle.executionAttempt')) {
+      fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.attemptObservation');
+    }
+    const originalReceipt = normalizeCommittedResolutionReceipt(
+      value.originalReceipt,
+      'resolutionBundle.originalReceipt',
+    );
+    const receiptSchemaVersion = originalReceipt.schemaVersion;
+    const originalReceiptSha256 = readSha256(
+      value.originalReceiptSha256,
+      'resolutionBundle.originalReceiptSha256',
+    );
+    const expectedReceiptSha256 = originalReceipt.kind
+      === 'cloudly-legacy-deployment-settlement-scratch-receipt'
+      ? digestCloudlyLegacyDeploymentSettlementScratchReceipt(originalReceipt)
+      : originalReceipt.schemaVersion === 2
+        ? digestCloudlyLegacyDeploymentSettlementProductionReceiptV2(originalReceipt)
+        : digestCloudlyLegacyDeploymentSettlementProductionReceipt(originalReceipt);
+    const receiptExecutionAuthority = originalReceipt.authority;
+    const receiptSourceAuthority = originalReceipt.schemaVersion === 2
+      ? originalReceipt.sourceAuthority
+      : originalReceipt.authority;
+    if ((mode === 'committed-schema1') !== (receiptSchemaVersion === 1)
+      || committedObservation.receiptSchemaVersion !== receiptSchemaVersion
+      || committedObservation.receiptSha256 !== originalReceiptSha256
+      || originalReceiptSha256 !== expectedReceiptSha256
+      || committedObservation.resolvedAt !== originalReceipt.completedAt
+      || observedAt < committedObservation.resolvedAt
+      || canonicalize(receiptExecutionAuthority, 'resolutionBundle.receipt.executionAuthority')
+        !== canonicalize(executionAttempt.executionAuthority, 'resolutionBundle.executionAuthority')
+      || canonicalize(receiptSourceAuthority, 'resolutionBundle.receipt.sourceAuthority')
+        !== canonicalize(executionAttempt.sourceAuthority, 'resolutionBundle.sourceAuthority')
+      || (originalReceipt.schemaVersion === 2
+        && canonicalize(originalReceipt.executionAttempt, 'resolutionBundle.receipt.executionAttempt')
+          !== canonicalize(executionAttempt, 'resolutionBundle.executionAttempt'))
+      || (executionAttempt.purpose === 'scratch-rehearsal')
+        !== (originalReceipt.kind
+          === 'cloudly-legacy-deployment-settlement-scratch-receipt')) {
+      fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.originalReceipt');
+    }
+    let result: TCloudlyLegacyDeploymentSettlementCommittedResolutionBundleV1;
+    if (mode === 'committed-schema1'
+      && originalReceipt.kind === 'cloudly-legacy-deployment-settlement-scratch-receipt') {
+      const scratchAttempt = executionAttempt as
+        TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1;
+      result = {
+        schemaVersion: 1,
+        kind: 'cloudly-legacy-deployment-settlement-resolution-bundle',
+        executionAttempt: scratchAttempt,
+        observedAt,
+        sourceAuthorityStatus,
+        executionAuthorityStatus,
+        outcome,
+        mode,
+        attemptObservation: {
+          ...committedObservation,
+          identity: scratchAttempt,
+          receiptSchemaVersion: 1,
+        },
+        originalReceipt,
+        originalReceiptSha256,
+      };
+    } else {
+      const productionAttempt = executionAttempt as
+        TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1;
+      result = {
+        schemaVersion: 1,
+        kind: 'cloudly-legacy-deployment-settlement-resolution-bundle',
+        executionAttempt: productionAttempt,
+        observedAt,
+        sourceAuthorityStatus,
+        executionAuthorityStatus,
+        outcome,
+        mode: 'committed-schema2',
+        attemptObservation: {
+          ...committedObservation,
+          identity: productionAttempt,
+          receiptSchemaVersion: 2,
+        },
+        originalReceipt: originalReceipt as
+          ICloudlyLegacyDeploymentSettlementProductionReceiptV2,
+        originalReceiptSha256,
+      };
+    }
+    return finalize(
+      result,
+      cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes * 4,
+      'resolutionBundle',
+    );
+  }
+  if (mode === 'committed-schema1' || mode === 'committed-schema2') {
+    fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.mode');
+  }
+  if (mode === 'aborted-prepared'
+    || mode === 'observed-aborted'
+    || mode === 'absent-tombstone') {
+    const attemptObservation = normalizeExecutionAttemptObservationInternal(
+      value.attemptObservation,
+      'resolutionBundle.attemptObservation',
+    );
+    if (attemptObservation.state !== 'aborted') {
+      fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.attemptObservation');
+    }
+    const abortedObservation = attemptObservation as
+      ICloudlyLegacyDeploymentSettlementExecutionAttemptAbortedV1;
+    if (canonicalize(abortedObservation.identity, 'resolutionBundle.observation.identity')
+        !== canonicalize(executionAttempt, 'resolutionBundle.executionAttempt')
+      || observedAt < abortedObservation.resolvedAt) {
+      fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.attemptObservation');
+    }
+    if (mode === 'absent-tombstone') {
+      const result: ICloudlyLegacyDeploymentSettlementAbsentTombstoneResolutionBundleV1 = {
+        schemaVersion: 1,
+        kind: 'cloudly-legacy-deployment-settlement-resolution-bundle',
+        executionAttempt,
+        observedAt,
+        sourceAuthorityStatus,
+        executionAuthorityStatus,
+        outcome,
+        mode,
+        attemptObservation: abortedObservation,
+      };
+      return finalize(
+        result,
+        cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes,
+        'resolutionBundle',
+      );
+    }
+    const result = mode === 'aborted-prepared'
+      ? {
+          schemaVersion: 1 as const,
+          kind: 'cloudly-legacy-deployment-settlement-resolution-bundle' as const,
+          executionAttempt,
+          observedAt,
+          sourceAuthorityStatus,
+          executionAuthorityStatus,
+          outcome,
+          mode,
+          attemptObservation: abortedObservation,
+        } satisfies ICloudlyLegacyDeploymentSettlementAbortedPreparedResolutionBundleV1
+      : {
+          schemaVersion: 1 as const,
+          kind: 'cloudly-legacy-deployment-settlement-resolution-bundle' as const,
+          executionAttempt,
+          observedAt,
+          sourceAuthorityStatus,
+          executionAuthorityStatus,
+          outcome,
+          mode,
+          attemptObservation: abortedObservation,
+        } satisfies ICloudlyLegacyDeploymentSettlementObservedAbortedResolutionBundleV1;
+    return finalize(
+      result,
+      cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes,
+      'resolutionBundle',
+    );
+  }
+  if (value.attemptObservation !== null) {
+    fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.attemptObservation');
+  }
+  if (executionAttempt.purpose !== 'scratch-rehearsal') {
+    fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.executionAttempt');
+  }
+  const scratchExecutionAttempt = executionAttempt as
+    TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1;
+  const result: ICloudlyLegacyDeploymentSettlementLegacyNoOpResolutionBundleV1 = {
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-resolution-bundle',
+    executionAttempt: scratchExecutionAttempt,
+    observedAt,
+    sourceAuthorityStatus,
+    executionAuthorityStatus,
+    outcome,
+    mode: 'legacy-no-op',
+    attemptObservation: null,
+  };
+  return finalize(
+    result,
+    cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes,
+    'resolutionBundle',
+  );
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementResolutionBundle = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementResolutionBundle(valueArg),
+  'resolutionBundle',
+);
+
+export const digestCloudlyLegacyDeploymentSettlementResolutionBundle = (
+  valueArg: unknown,
+): string => digestBytes(encodeCloudlyLegacyDeploymentSettlementResolutionBundle(valueArg));
+
+/** Recovery attestation only; this is neither a receipt nor an execution authorization. */
+export interface IAuthenticatedCloudlyLegacyDeploymentSettlementResolutionV1 {
+  schemaVersion: 1;
+  kind: 'authenticated-cloudly-legacy-deployment-settlement-resolution';
+  authority: ICloudlyLegacyDeploymentSettlementAuthorityReferenceV1;
+  payload: TCloudlyLegacyDeploymentSettlementResolutionBundleV1;
+  payloadSha256: string;
+  mac: string;
+}
+
+export type TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementResolutionV1 = Omit<
+  IAuthenticatedCloudlyLegacyDeploymentSettlementResolutionV1,
+  'mac'
+>;
+
+const unsignedAuthenticatedResolutionKeys = [
+  'schemaVersion',
+  'kind',
+  'authority',
+  'payload',
+  'payloadSha256',
+] as const;
+const authenticatedResolutionKeys = [...unsignedAuthenticatedResolutionKeys, 'mac'] as const;
+
+const normalizeUnsignedAuthenticatedResolutionInternal = (
+  valueArg: unknown,
+  pathArg: string,
+): TUnsignedAuthenticatedCloudlyLegacyDeploymentSettlementResolutionV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, unsignedAuthenticatedResolutionKeys, pathArg);
+  if (value.schemaVersion !== 1
+    || value.kind !== 'authenticated-cloudly-legacy-deployment-settlement-resolution') {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const authority = normalizeAuthorityReferenceInternal(value.authority, `${pathArg}.authority`);
+  const payload = normalizeCloudlyLegacyDeploymentSettlementResolutionBundle(value.payload);
+  const payloadSha256 = readSha256(value.payloadSha256, `${pathArg}.payloadSha256`);
+  if (canonicalize(authority, `${pathArg}.authority`)
+      !== canonicalize(payload.executionAttempt.executionAuthority, `${pathArg}.payload.authority`)
+    || payloadSha256 !== digestCloudlyLegacyDeploymentSettlementResolutionBundle(payload)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.payload`);
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'authenticated-cloudly-legacy-deployment-settlement-resolution',
+    authority,
+    payload,
+    payloadSha256,
+  };
+};
+
+/** Structural only; this function does not authenticate the recovery-attestation MAC. */
+export const normalizeCloudlyLegacyDeploymentSettlementAuthenticatedResolutionStructure = (
+  valueArg: unknown,
+): Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementResolutionV1> => {
+  const value = readRecord(valueArg, 'authenticatedResolution');
+  assertExactKeys(value, authenticatedResolutionKeys, 'authenticatedResolution');
+  return finalize({
+    ...normalizeUnsignedAuthenticatedResolutionInternal(
+      Object.fromEntries(unsignedAuthenticatedResolutionKeys.map((keyArg) => [
+        keyArg,
+        value[keyArg],
+      ])),
+      'authenticatedResolution.unsigned',
+    ),
+    mac: readMac(value.mac, 'authenticatedResolution.mac'),
+  }, cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes * 5, 'authenticatedResolution');
+};
+
+export const encodeAuthenticatedCloudlyLegacyDeploymentSettlementResolution = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementAuthenticatedResolutionStructure(valueArg),
+  'authenticatedResolution',
+);
+
+export const digestAuthenticatedCloudlyLegacyDeploymentSettlementResolution = (
+  valueArg: unknown,
+): string => digestBytes(encodeAuthenticatedCloudlyLegacyDeploymentSettlementResolution(valueArg));
+
+export const encodeCloudlyLegacyDeploymentSettlementResolutionHmacInput = (
+  valueArg: unknown,
+): Uint8Array => frame(
+  cloudlyLegacyDeploymentSettlementDomains.resolutionHmac,
+  encodeNormalized(
+    finalize(
+      normalizeUnsignedAuthenticatedResolutionInternal(
+        valueArg,
+        'unsignedAuthenticatedResolution',
+      ),
+      cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes * 5,
+      'unsignedAuthenticatedResolution',
+    ),
+    'authenticatedResolution.authenticated',
+  ),
+);
+
+const normalizeExecutionAttemptAuthorityMetadata = (
+  attemptArg: ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1,
+  sourceMetadataArg: unknown,
+  executionMetadataArg: unknown,
+): {
+  sourceMetadata: Readonly<ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1>;
+  executionMetadata: Readonly<TCloudlyLegacyDeploymentSettlementAuthorityMetadataV1>;
+  splitProductionAuthority: boolean;
+} => {
+  const sourceMetadata = normalizeFencedSourceAuthorityMetadata(
+    sourceMetadataArg,
+    'executionAttempt.sourceAuthorityMetadata',
+  );
+  const executionMetadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(
+    executionMetadataArg,
+  );
+  assertAuthorityReferenceMatchesMetadata(
+    attemptArg.sourceAuthority,
+    sourceMetadata,
+    'executionAttempt.sourceAuthority',
+  );
+  assertAuthorityReferenceMatchesMetadata(
+    attemptArg.executionAuthority,
+    executionMetadata,
+    'executionAttempt.executionAuthority',
+  );
+  const splitProductionAuthority = canonicalize(
+    attemptArg.sourceAuthority,
+    'executionAttempt.sourceAuthority',
+  ) !== canonicalize(attemptArg.executionAuthority, 'executionAttempt.executionAuthority');
+  if (attemptArg.purpose === 'scratch-rehearsal') {
+    if (splitProductionAuthority) {
+      fail('CROSS_FIELD_MISMATCH', 'executionAttempt.executionAuthority');
+    }
+    normalizeFencedSourceAuthorityMetadata(
+      executionMetadata,
+      'executionAttempt.executionAuthorityMetadata',
+    );
+  } else {
+    if (!splitProductionAuthority) {
+      fail('CROSS_FIELD_MISMATCH', 'executionAttempt.executionAuthority');
+    }
+    const productionMetadata = normalizeProductionAuthorityMetadataPair(
+      executionMetadata,
+      sourceMetadata,
+    ).productionMetadata;
+    if (productionMetadata.sourceAuthenticatedPlanSha256
+        !== attemptArg.authenticatedPlanSha256
+      || productionMetadata.sourceRequestBundleSha256 !== attemptArg.requestBundleSha256
+      || productionMetadata.scratchReceiptSha256 !== attemptArg.scratchReceiptSha256) {
+      fail('CROSS_FIELD_MISMATCH', 'executionAttempt.productionAuthorityMetadata');
+    }
+  }
+  return { sourceMetadata, executionMetadata, splitProductionAuthority };
+};
+
+const authorityStatusAt = (
+  observedAtArg: number,
+  metadataArg: TCloudlyLegacyDeploymentSettlementAuthorityMetadataV1,
+  pathArg: string,
+): TCloudlyLegacyDeploymentSettlementAuthorityStatus => {
+  if (observedAtArg < metadataArg.issuedAt) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+  return observedAtArg < metadataArg.expiresAt ? 'active' : 'expired';
+};
+
+const normalizeExecutionAttemptProofArtifacts = async (argsArg: {
+  executionAttempt: ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1;
+  sourceMetadata: unknown;
+  executionMetadata: unknown;
+  authenticatedPlan: unknown;
+  requestBundle: unknown;
+  scratchReceipt: unknown | null;
+  productionAuthorization: unknown | null;
+  requireProductionAuthorization: boolean;
+  verifier: TCloudlyLegacyDeploymentSettlementHmacVerifier;
+}): Promise<{
+  sourceMetadata: Readonly<ICloudlyLegacyDeploymentSettlementFencedSourceAuthorityMetadataV1>;
+  executionMetadata: Readonly<TCloudlyLegacyDeploymentSettlementAuthorityMetadataV1>;
+  authenticatedPlan: Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1>;
+  requestBundle: Readonly<ICloudlyLegacyDeploymentSettlementRequestBundleV1>;
+  scratchReceipt: Readonly<ICloudlyLegacyDeploymentSettlementScratchReceiptV1> | null;
+  productionAuthorization:
+    Readonly<ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1> | null;
+  splitProductionAuthority: boolean;
+}> => {
+  const metadata = normalizeExecutionAttemptAuthorityMetadata(
+    argsArg.executionAttempt,
+    argsArg.sourceMetadata,
+    argsArg.executionMetadata,
+  );
+  const authenticatedPlan =
+    await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementPlanForAuthority(
+      argsArg.authenticatedPlan,
+      metadata.sourceMetadata,
+      argsArg.verifier,
+    );
+  const requestBundle = await normalizeCloudlyLegacyDeploymentSettlementRequestBundleForAuthority(
+    argsArg.requestBundle,
+    authenticatedPlan,
+    metadata.sourceMetadata,
+    argsArg.verifier,
+  );
+  let scratchReceipt: Readonly<ICloudlyLegacyDeploymentSettlementScratchReceiptV1> | null = null;
+  let productionAuthorization:
+    Readonly<ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1> | null = null;
+  if (argsArg.executionAttempt.purpose === 'production') {
+    if (argsArg.scratchReceipt === null) {
+      fail('INVALID_SCHEMA', 'executionAttempt.scratchReceipt');
+    }
+    scratchReceipt = await normalizeCloudlyLegacyDeploymentSettlementScratchReceiptForAuthority(
+      argsArg.scratchReceipt,
+      metadata.sourceMetadata,
+      requestBundle.authenticatedRequest,
+      argsArg.verifier,
+    );
+    if (metadata.splitProductionAuthority) {
+      if (argsArg.productionAuthorization === null) {
+        if (argsArg.requireProductionAuthorization) {
+          fail('INVALID_SCHEMA', 'executionAttempt.productionAuthorization');
+        }
+      } else {
+        productionAuthorization =
+          await normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationForAuthorities(
+            argsArg.productionAuthorization,
+            metadata.executionMetadata,
+            metadata.sourceMetadata,
+            authenticatedPlan,
+            requestBundle,
+            scratchReceipt,
+            argsArg.verifier,
+          );
+      }
+    } else if (argsArg.productionAuthorization !== null) {
+      fail('INVALID_SCHEMA', 'executionAttempt.productionAuthorization');
+    }
+  } else if (argsArg.scratchReceipt !== null || argsArg.productionAuthorization !== null) {
+    fail('INVALID_SCHEMA', 'executionAttempt.sourceProof');
+  }
+  const expectedScratchReceiptSha256 = scratchReceipt
+    ? digestCloudlyLegacyDeploymentSettlementScratchReceipt(scratchReceipt)
+    : null;
+  if (argsArg.executionAttempt.authenticatedPlanSha256
+      !== digestAuthenticatedCloudlyLegacyDeploymentSettlementPlan(authenticatedPlan)
+    || argsArg.executionAttempt.requestBundleSha256
+      !== digestCloudlyLegacyDeploymentSettlementRequestBundle(requestBundle)
+    || argsArg.executionAttempt.scratchReceiptSha256 !== expectedScratchReceiptSha256) {
+    fail('CROSS_FIELD_MISMATCH', 'executionAttempt.sourceProof');
+  }
+  return {
+    ...metadata,
+    authenticatedPlan,
+    requestBundle,
+    scratchReceipt,
+    productionAuthorization,
+  };
+};
+
+const normalizeAuthenticatedApplyResultForExecutionAuthority = async (
+  resultArg: unknown,
+  executionMetadataArg: unknown,
+  requestArg: unknown,
+  productionAuthorizationArg:
+    ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1>> => {
+  const executionMetadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(
+    executionMetadataArg,
+  );
+  const request = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure(
+    requestArg,
+  );
+  const result = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedApplyResultStructure(resultArg);
+  assertAuthorityReferenceMatchesMetadata(result.authority, executionMetadata, 'applyResult.authority');
+  assertSummaryMatchesProductionRequest(result.payload, request.payload, 'applyResult.payload');
+  const resultAt = result.payload.status === 'completed'
+    ? result.payload.completedAt
+    : result.payload.rejectedAt;
+  const resultAtPath = result.payload.status === 'completed'
+    ? 'applyResult.payload.completedAt'
+    : 'applyResult.payload.rejectedAt';
+  if (canonicalize(result.authority, 'applyResult.authority')
+      !== canonicalize(productionAuthorizationArg.authority, 'productionAuthorization.authority')
+    || resultAt < request.payload.requestedAt
+    || resultAt < productionAuthorizationArg.approvedAt) {
+    fail('CROSS_FIELD_MISMATCH', resultAtPath);
+  }
+  assertAuthorityTimestamp(resultAt, executionMetadata, resultAtPath);
+  await requireConsumerVerifiedHmac(
+    result.authority,
+    cloudlyLegacyDeploymentSettlementDomains.applyResultHmac,
+    encodeCloudlyLegacyDeploymentSettlementApplyResultHmacInput(withoutArtifactMac(result)),
+    result.mac,
+    verifierArg,
+    'applyResult.mac',
+  );
+  return result;
+};
+
+const normalizeAuthenticatedCheckResultForExecutionAuthority = async (
+  resultArg: unknown,
+  executionMetadataArg: unknown,
+  requestArg: unknown,
+  productionAuthorizationArg:
+    ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1>> => {
+  const executionMetadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(
+    executionMetadataArg,
+  );
+  const request = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedProductionRequestStructure(
+    requestArg,
+  );
+  const result = normalizeCloudlyLegacyDeploymentSettlementAuthenticatedCheckResultStructure(resultArg);
+  assertAuthorityReferenceMatchesMetadata(result.authority, executionMetadata, 'checkResult.authority');
+  assertSummaryMatchesProductionRequest(result.payload, request.payload, 'checkResult.payload');
+  if (canonicalize(result.authority, 'checkResult.authority')
+      !== canonicalize(productionAuthorizationArg.authority, 'productionAuthorization.authority')
+    || result.payload.checkedAt < request.payload.requestedAt
+    || result.payload.checkedAt < productionAuthorizationArg.approvedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'checkResult.payload.checkedAt');
+  }
+  assertAuthorityTimestamp(result.payload.checkedAt, executionMetadata, 'checkResult.checkedAt');
+  await requireConsumerVerifiedHmac(
+    result.authority,
+    cloudlyLegacyDeploymentSettlementDomains.checkResultHmac,
+    encodeCloudlyLegacyDeploymentSettlementCheckResultHmacInput(withoutArtifactMac(result)),
+    result.mac,
+    verifierArg,
+    'checkResult.mac',
+  );
+  return result;
+};
+
+/** Artifact/status binding only; trust the authenticated recovery attestation instead. */
+export const normalizeCloudlyLegacyDeploymentSettlementResolutionBundleForAuthorities = async (
+  bundleArg: unknown,
+  sourceMetadataArg: unknown,
+  executionMetadataArg: unknown,
+  authenticatedPlanArg: unknown,
+  requestBundleArg: unknown,
+  scratchReceiptArg: unknown | null,
+  productionAuthorizationArg: unknown | null,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<TCloudlyLegacyDeploymentSettlementResolutionBundleV1>> => {
+  const bundle = normalizeCloudlyLegacyDeploymentSettlementResolutionBundle(bundleArg);
+  const artifacts = await normalizeExecutionAttemptProofArtifacts({
+    executionAttempt: bundle.executionAttempt,
+    sourceMetadata: sourceMetadataArg,
+    executionMetadata: executionMetadataArg,
+    authenticatedPlan: authenticatedPlanArg,
+    requestBundle: requestBundleArg,
+    scratchReceipt: scratchReceiptArg,
+    productionAuthorization: productionAuthorizationArg,
+    requireProductionAuthorization: true,
+    verifier: verifierArg,
+  });
+  if (bundle.sourceAuthorityStatus !== authorityStatusAt(
+    bundle.observedAt,
+    artifacts.sourceMetadata,
+    'resolutionBundle.sourceAuthorityStatus',
+  )) {
+    fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.sourceAuthorityStatus');
+  }
+  if (bundle.executionAuthorityStatus !== authorityStatusAt(
+    bundle.observedAt,
+    artifacts.executionMetadata,
+    'resolutionBundle.executionAuthorityStatus',
+  )) {
+    fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.executionAuthorityStatus');
+  }
+  if (bundle.executionAttempt.purpose === 'production') {
+    const productionAuthorization = artifacts.productionAuthorization
+      ?? fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.productionAuthorization');
+    const attemptObservation = bundle.attemptObservation
+      ?? fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.attemptObservation');
+    if (attemptObservation.preparedAt < productionAuthorization.approvedAt
+      || attemptObservation.resolvedAt < productionAuthorization.approvedAt
+      || bundle.observedAt < productionAuthorization.approvedAt) {
+      fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.attemptObservation.preparedAt');
+    }
+  }
+  if (bundle.outcome === 'committed') {
+    const receipt = bundle.originalReceipt;
+    if (receipt.kind === 'cloudly-legacy-deployment-settlement-scratch-receipt') {
+      await normalizeCloudlyLegacyDeploymentSettlementScratchReceiptForAuthority(
+        receipt,
+        artifacts.sourceMetadata,
+        artifacts.requestBundle.authenticatedRequest,
+        verifierArg,
+      );
+    } else if (receipt.schemaVersion === 2) {
+      if (!artifacts.splitProductionAuthority || !artifacts.productionAuthorization) {
+        fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.originalReceipt.authority');
+      }
+      await normalizeCloudlyLegacyDeploymentSettlementProductionReceiptV2ForAuthorities(
+        receipt,
+        artifacts.executionMetadata,
+        artifacts.sourceMetadata,
+        artifacts.authenticatedPlan,
+        artifacts.requestBundle,
+        verifierArg,
+      );
+      if (canonicalize(
+        receipt.productionAuthorization,
+        'resolutionBundle.originalReceipt.productionAuthorization',
+      ) !== canonicalize(
+        artifacts.productionAuthorization,
+        'resolutionBundle.productionAuthorization',
+      )) {
+        fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.originalReceipt.productionAuthorization');
+      }
+    } else {
+      if (artifacts.splitProductionAuthority) {
+        fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.originalReceipt.authority');
+      }
+      await normalizeCloudlyLegacyDeploymentSettlementProductionReceiptForAuthority(
+        receipt,
+        artifacts.sourceMetadata,
+        artifacts.requestBundle.authenticatedRequest,
+        verifierArg,
+      );
+    }
+    if (receipt.kind === 'cloudly-legacy-deployment-settlement-production-receipt'
+      && artifacts.scratchReceipt
+      && digestCloudlyLegacyDeploymentSettlementScratchReceipt(receipt.scratchReceipt)
+        !== digestCloudlyLegacyDeploymentSettlementScratchReceipt(artifacts.scratchReceipt)) {
+      fail('CROSS_FIELD_MISMATCH', 'resolutionBundle.originalReceipt.scratchReceipt');
+    }
+  }
+  return bundle;
+};
+
+export const normalizeAuthenticatedCloudlyLegacyDeploymentSettlementResolutionForAuthorities = async (
+  attestationArg: unknown,
+  sourceMetadataArg: unknown,
+  executionMetadataArg: unknown,
+  authenticatedPlanArg: unknown,
+  requestBundleArg: unknown,
+  scratchReceiptArg: unknown | null,
+  productionAuthorizationArg: unknown | null,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<IAuthenticatedCloudlyLegacyDeploymentSettlementResolutionV1>> => {
+  const attestation =
+    normalizeCloudlyLegacyDeploymentSettlementAuthenticatedResolutionStructure(attestationArg);
+  const executionMetadata = normalizeCloudlyLegacyDeploymentSettlementAuthorityMetadata(
+    executionMetadataArg,
+  );
+  assertAuthorityReferenceMatchesMetadata(
+    attestation.authority,
+    executionMetadata,
+    'authenticatedResolution.authority',
+  );
+  await requireConsumerVerifiedHmac(
+    attestation.authority,
+    cloudlyLegacyDeploymentSettlementDomains.resolutionHmac,
+    encodeCloudlyLegacyDeploymentSettlementResolutionHmacInput(
+      withoutArtifactMac(attestation),
+    ),
+    attestation.mac,
+    verifierArg,
+    'authenticatedResolution.mac',
+  );
+  const payload = await normalizeCloudlyLegacyDeploymentSettlementResolutionBundleForAuthorities(
+    attestation.payload,
+    sourceMetadataArg,
+    executionMetadata,
+    authenticatedPlanArg,
+    requestBundleArg,
+    scratchReceiptArg,
+    productionAuthorizationArg,
+    verifierArg,
+  );
+  if (canonicalize(attestation.payload, 'authenticatedResolution.payload')
+      !== canonicalize(payload, 'authenticatedResolution.verifiedPayload')) {
+    fail('CROSS_FIELD_MISMATCH', 'authenticatedResolution.payload');
+  }
+  return attestation;
+};
+
+export type TCloudlyLegacyDeploymentSettlementCompletedApplyResultV1 = Extract<
+  TCloudlyLegacyDeploymentSettlementApplyResultV1,
+  { status: 'completed' }
+>;
+export type TCloudlyLegacyDeploymentSettlementRejectedApplyResultV1 = Extract<
+  TCloudlyLegacyDeploymentSettlementApplyResultV1,
+  { status: 'rejected' }
+>;
+export type TAuthenticatedCloudlyLegacyDeploymentSettlementCompletedApplyResultV1 = Omit<
+  IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1,
+  'payload'
+> & {
+  payload: TCloudlyLegacyDeploymentSettlementCompletedApplyResultV1;
+};
+export type TAuthenticatedCloudlyLegacyDeploymentSettlementRejectedApplyResultV1 = Omit<
+  IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1,
+  'payload'
+> & {
+  payload: TCloudlyLegacyDeploymentSettlementRejectedApplyResultV1;
+};
+
+interface ICloudlyLegacyDeploymentSettlementScratchExecutionBundleBaseV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-execution-bundle';
+  purpose: 'scratch-rehearsal';
+  executionAttempt: TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementCompletedScratchExecutionBundleV1
+extends ICloudlyLegacyDeploymentSettlementScratchExecutionBundleBaseV1 {
+  authenticatedResult:
+    TAuthenticatedCloudlyLegacyDeploymentSettlementCompletedApplyResultV1;
+  receipt: ICloudlyLegacyDeploymentSettlementScratchReceiptV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementRejectedScratchExecutionBundleV1
+extends ICloudlyLegacyDeploymentSettlementScratchExecutionBundleBaseV1 {
+  authenticatedResult:
+    TAuthenticatedCloudlyLegacyDeploymentSettlementRejectedApplyResultV1;
+  receipt?: never;
+}
+
+export type TCloudlyLegacyDeploymentSettlementScratchExecutionBundleV1 =
+  | ICloudlyLegacyDeploymentSettlementCompletedScratchExecutionBundleV1
+  | ICloudlyLegacyDeploymentSettlementRejectedScratchExecutionBundleV1;
+
+interface ICloudlyLegacyDeploymentSettlementProductionExecutionBundleBaseV2 {
+  schemaVersion: 2;
+  kind: 'cloudly-legacy-deployment-settlement-execution-bundle';
+  purpose: 'production';
+  executionAttempt: TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementCompletedProductionExecutionBundleV2
+extends ICloudlyLegacyDeploymentSettlementProductionExecutionBundleBaseV2 {
+  authenticatedResult:
+    TAuthenticatedCloudlyLegacyDeploymentSettlementCompletedApplyResultV1;
+  receipt: ICloudlyLegacyDeploymentSettlementProductionReceiptV2;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementRejectedProductionExecutionBundleV2
+extends ICloudlyLegacyDeploymentSettlementProductionExecutionBundleBaseV2 {
+  authenticatedResult:
+    TAuthenticatedCloudlyLegacyDeploymentSettlementRejectedApplyResultV1;
+  receipt?: never;
+}
+
+export type TCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2 =
+  | ICloudlyLegacyDeploymentSettlementCompletedProductionExecutionBundleV2
+  | ICloudlyLegacyDeploymentSettlementRejectedProductionExecutionBundleV2;
+
+const normalizeSettlementExecutionBundleCommon = (
+  valueArg: unknown,
+  pathArg: string,
+  purposeArg: TCloudlyLegacyDeploymentSettlementExecutionPurpose,
+): {
+  value: Record<string, unknown>;
+  executionAttempt: ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1;
+  authenticatedResult: IAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultV1;
+  hasReceipt: boolean;
+} => {
+  const value = readRecord(valueArg, pathArg);
+  const hasReceipt = Object.hasOwn(value, 'receipt');
+  assertExactKeys(value, [
+    'schemaVersion',
+    'kind',
+    'purpose',
+    'executionAttempt',
+    'authenticatedResult',
+    ...(hasReceipt ? ['receipt'] : []),
+  ], pathArg);
+  if (value.kind !== 'cloudly-legacy-deployment-settlement-execution-bundle'
+    || value.purpose !== purposeArg) {
+    fail('INVALID_VALUE', `${pathArg}.kind`);
+  }
+  const executionAttempt = normalizeExecutionAttemptIdentityInternal(
+    value.executionAttempt,
+    `${pathArg}.executionAttempt`,
+  );
+  const authenticatedResult =
+    normalizeCloudlyLegacyDeploymentSettlementAuthenticatedApplyResultStructure(
+      value.authenticatedResult,
+    );
+  if (executionAttempt.purpose !== purposeArg
+    || canonicalize(authenticatedResult.authority, `${pathArg}.result.authority`)
+      !== canonicalize(executionAttempt.executionAuthority, `${pathArg}.attempt.authority`)
+    || (authenticatedResult.payload.status === 'completed') !== hasReceipt) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.authenticatedResult`);
+  }
+  return { value, executionAttempt, authenticatedResult, hasReceipt };
+};
+
+/** Structural only; this function does not authenticate result or receipt MACs. */
+export const normalizeCloudlyLegacyDeploymentSettlementScratchExecutionBundle = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementScratchExecutionBundleV1> => {
+  const normalized = normalizeSettlementExecutionBundleCommon(
+    valueArg,
+    'scratchExecutionBundle',
+    'scratch-rehearsal',
+  );
+  if (normalized.value.schemaVersion !== 1) {
+    fail('INVALID_VALUE', 'scratchExecutionBundle.schemaVersion');
+  }
+  const receipt = normalized.hasReceipt
+    ? normalizeCloudlyLegacyDeploymentSettlementScratchReceipt(normalized.value.receipt)
+    : undefined;
+  if (receipt
+    && (canonicalize(receipt.authority, 'scratchExecutionBundle.receipt.authority')
+        !== canonicalize(
+          normalized.executionAttempt.executionAuthority,
+          'scratchExecutionBundle.attempt.authority',
+        )
+      || normalized.authenticatedResult.payload.status !== 'completed'
+      || normalized.authenticatedResult.payload.requestSha256 !== receipt.requestSha256
+      || (normalized.authenticatedResult.payload.disposition !== receipt.disposition
+        && !(receipt.disposition === 'applied'
+          && normalized.authenticatedResult.payload.disposition === 'exact-replay')))) {
+    fail('CROSS_FIELD_MISMATCH', 'scratchExecutionBundle.receipt');
+  }
+  const executionAttempt = normalized.executionAttempt as
+    TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1;
+  const result: TCloudlyLegacyDeploymentSettlementScratchExecutionBundleV1 = receipt
+    ? {
+        schemaVersion: 1,
+        kind: 'cloudly-legacy-deployment-settlement-execution-bundle',
+        purpose: 'scratch-rehearsal',
+        executionAttempt,
+        authenticatedResult: normalized.authenticatedResult as
+          TAuthenticatedCloudlyLegacyDeploymentSettlementCompletedApplyResultV1,
+        receipt,
+      }
+    : {
+        schemaVersion: 1,
+        kind: 'cloudly-legacy-deployment-settlement-execution-bundle',
+        purpose: 'scratch-rehearsal',
+        executionAttempt,
+        authenticatedResult: normalized.authenticatedResult as
+          TAuthenticatedCloudlyLegacyDeploymentSettlementRejectedApplyResultV1,
+      };
+  return finalize(
+    result,
+    cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes * 2,
+    'scratchExecutionBundle',
+  );
+};
+
+/** Structural only; this function does not authenticate result or receipt MACs. */
+export const normalizeCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2 = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2> => {
+  const normalized = normalizeSettlementExecutionBundleCommon(
+    valueArg,
+    'productionExecutionBundleV2',
+    'production',
+  );
+  if (normalized.value.schemaVersion !== 2) {
+    fail('INVALID_VALUE', 'productionExecutionBundleV2.schemaVersion');
+  }
+  const receipt = normalized.hasReceipt
+    ? normalizeCloudlyLegacyDeploymentSettlementProductionReceiptV2(normalized.value.receipt)
+    : undefined;
+  if (receipt
+    && (canonicalize(receipt.executionAttempt, 'productionExecutionBundleV2.receipt.attempt')
+        !== canonicalize(
+          normalized.executionAttempt,
+          'productionExecutionBundleV2.executionAttempt',
+        )
+      || normalized.authenticatedResult.payload.status !== 'completed'
+      || normalized.authenticatedResult.payload.requestSha256 !== receipt.requestSha256
+      || (normalized.authenticatedResult.payload.disposition !== receipt.disposition
+        && !(receipt.disposition === 'applied'
+          && normalized.authenticatedResult.payload.disposition === 'exact-replay')))) {
+    fail('CROSS_FIELD_MISMATCH', 'productionExecutionBundleV2.receipt');
+  }
+  const executionAttempt = normalized.executionAttempt as
+    TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1;
+  const result: TCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2 = receipt
+    ? {
+        schemaVersion: 2,
+        kind: 'cloudly-legacy-deployment-settlement-execution-bundle',
+        purpose: 'production',
+        executionAttempt,
+        authenticatedResult: normalized.authenticatedResult as
+          TAuthenticatedCloudlyLegacyDeploymentSettlementCompletedApplyResultV1,
+        receipt,
+      }
+    : {
+        schemaVersion: 2,
+        kind: 'cloudly-legacy-deployment-settlement-execution-bundle',
+        purpose: 'production',
+        executionAttempt,
+        authenticatedResult: normalized.authenticatedResult as
+          TAuthenticatedCloudlyLegacyDeploymentSettlementRejectedApplyResultV1,
+      };
+  return finalize(
+    result,
+    cloudlyLegacyDeploymentSettlementLimits.maximumReceiptBytes * 4,
+    'productionExecutionBundleV2',
+  );
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementScratchExecutionBundle = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementScratchExecutionBundle(valueArg),
+  'scratchExecutionBundle',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2 = (
+  valueArg: unknown,
+): Uint8Array => encodeNormalized(
+  normalizeCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2(valueArg),
+  'productionExecutionBundleV2',
+);
+
+export const normalizeCloudlyLegacyDeploymentSettlementScratchExecutionBundleForAuthority = async (
+  bundleArg: unknown,
+  sourceMetadataArg: unknown,
+  authenticatedPlanArg: unknown,
+  requestBundleArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<TCloudlyLegacyDeploymentSettlementScratchExecutionBundleV1>> => {
+  const bundle = normalizeCloudlyLegacyDeploymentSettlementScratchExecutionBundle(bundleArg);
+  const artifacts = await normalizeExecutionAttemptProofArtifacts({
+    executionAttempt: bundle.executionAttempt,
+    sourceMetadata: sourceMetadataArg,
+    executionMetadata: sourceMetadataArg,
+    authenticatedPlan: authenticatedPlanArg,
+    requestBundle: requestBundleArg,
+    scratchReceipt: null,
+    productionAuthorization: null,
+    requireProductionAuthorization: false,
+    verifier: verifierArg,
+  });
+  await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementApplyResultForAuthority(
+    bundle.authenticatedResult,
+    artifacts.sourceMetadata,
+    artifacts.requestBundle.authenticatedRequest,
+    verifierArg,
+  );
+  if (bundle.receipt) {
+    await normalizeCloudlyLegacyDeploymentSettlementScratchReceiptForAuthority(
+      bundle.receipt,
+      artifacts.sourceMetadata,
+      artifacts.requestBundle.authenticatedRequest,
+      verifierArg,
+    );
+  }
+  return bundle;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2ForAuthorities = async (
+  bundleArg: unknown,
+  productionAuthorizationArg: unknown,
+  productionMetadataArg: unknown,
+  sourceMetadataArg: unknown,
+  authenticatedPlanArg: unknown,
+  requestBundleArg: unknown,
+  scratchReceiptArg: unknown,
+  verifierArg: TCloudlyLegacyDeploymentSettlementHmacVerifier,
+): Promise<Readonly<TCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2>> => {
+  const bundle = normalizeCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2(bundleArg);
+  const artifacts = await normalizeExecutionAttemptProofArtifacts({
+    executionAttempt: bundle.executionAttempt,
+    sourceMetadata: sourceMetadataArg,
+    executionMetadata: productionMetadataArg,
+    authenticatedPlan: authenticatedPlanArg,
+    requestBundle: requestBundleArg,
+    scratchReceipt: scratchReceiptArg,
+    productionAuthorization: productionAuthorizationArg,
+    requireProductionAuthorization: true,
+    verifier: verifierArg,
+  });
+  const productionAuthorization = artifacts.productionAuthorization
+    ?? fail('CROSS_FIELD_MISMATCH', 'productionExecutionBundleV2.executionAuthority');
+  if (!artifacts.splitProductionAuthority) {
+    fail('CROSS_FIELD_MISMATCH', 'productionExecutionBundleV2.executionAuthority');
+  }
+  await normalizeAuthenticatedApplyResultForExecutionAuthority(
+    bundle.authenticatedResult,
+    artifacts.executionMetadata,
+    artifacts.requestBundle.authenticatedRequest,
+    productionAuthorization,
+    verifierArg,
+  );
+  if (bundle.receipt) {
+    await normalizeCloudlyLegacyDeploymentSettlementProductionReceiptV2ForAuthorities(
+      bundle.receipt,
+      artifacts.executionMetadata,
+      artifacts.sourceMetadata,
+      artifacts.authenticatedPlan,
+      artifacts.requestBundle,
+      verifierArg,
+    );
+    if (canonicalize(
+      bundle.receipt.productionAuthorization,
+      'productionExecutionBundleV2.receipt.productionAuthorization',
+    ) !== canonicalize(
+      artifacts.productionAuthorization,
+      'productionExecutionBundleV2.productionAuthorization',
+    )) {
+      fail('CROSS_FIELD_MISMATCH', 'productionExecutionBundleV2.productionAuthorization');
+    }
+  }
+  return bundle;
+};
+
+export const cloudlyLegacyDeploymentSettlementStdioLimits = Object.freeze({
+  maximumMongoDescriptorBytes: 16 * 1024,
+  maximumPrivateArtifactAggregateBytes: 4 * 1024 * 1024,
+  maximumRequestFrameBytes: 5 * 1024 * 1024,
+  maximumResponseFrameBytes: 4 * 1024 * 1024,
+});
+
+export const cloudlyLegacyDeploymentSettlementStdioCommands = Object.freeze([
+  'settlement-plan',
+  'settlement-request',
+  'settlement-scratch-check',
+  'settlement-scratch-apply',
+  'settlement-scratch-resolve',
+  'settlement-production-authorize',
+  'settlement-production-check',
+  'settlement-production-apply',
+  'settlement-production-resolve',
+] as const);
+
+export type TCloudlyLegacyDeploymentSettlementStdioCommand =
+  typeof cloudlyLegacyDeploymentSettlementStdioCommands[number];
+
+export interface ICloudlyLegacyDeploymentSettlementMongoDescriptorV1 {
+  mongoDbUrl: string;
+  mongoDbName: string;
+  mongoDbUser: string;
+  mongoDbPass: string;
+}
+
+interface ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-stdio-request';
+  requestId: string;
+  command: TCloudlyLegacyDeploymentSettlementStdioCommand;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementPlanStdioRequestV1
+extends ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  command: 'settlement-plan';
+  payload: {
+    mongoDescriptor: ICloudlyLegacyDeploymentSettlementMongoDescriptorV1;
+    authorityHandoff: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1;
+    effectiveAt: number;
+  };
+}
+
+export interface ICloudlyLegacyDeploymentSettlementRequestStdioRequestV1
+extends ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  command: 'settlement-request';
+  payload: {
+    authorityHandoff: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1;
+    authenticatedPlan: IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1;
+    requestedAt: number;
+  };
+}
+
+interface ICloudlyLegacyDeploymentSettlementScratchStdioPayloadV1 {
+  mongoDescriptor: ICloudlyLegacyDeploymentSettlementMongoDescriptorV1;
+  authorityHandoff: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1;
+  authenticatedPlan: IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1;
+  requestBundle: ICloudlyLegacyDeploymentSettlementRequestBundleV1;
+  executionAttempt: TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementScratchCheckStdioRequestV1
+extends ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  command: 'settlement-scratch-check';
+  payload: ICloudlyLegacyDeploymentSettlementScratchStdioPayloadV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementScratchApplyStdioRequestV1
+extends ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  command: 'settlement-scratch-apply';
+  payload: ICloudlyLegacyDeploymentSettlementScratchStdioPayloadV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementScratchResolveStdioRequestV1
+extends ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  command: 'settlement-scratch-resolve';
+  payload: ICloudlyLegacyDeploymentSettlementScratchStdioPayloadV1 & {
+    observedAt: number;
+  };
+}
+
+export interface ICloudlyLegacyDeploymentSettlementProductionAuthorizeStdioRequestV1
+extends ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  command: 'settlement-production-authorize';
+  payload: {
+    sourceAuthorityHandoff: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1;
+    productionAuthorityHandoff: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1;
+    authenticatedPlan: IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1;
+    requestBundle: ICloudlyLegacyDeploymentSettlementRequestBundleV1;
+    scratchReceipt: ICloudlyLegacyDeploymentSettlementScratchReceiptV1;
+    executionAttempt: TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1;
+    requestedAt: number;
+    approvedAt: number;
+  };
+}
+
+interface ICloudlyLegacyDeploymentSettlementProductionStdioPayloadV1 {
+  mongoDescriptor: ICloudlyLegacyDeploymentSettlementMongoDescriptorV1;
+  sourceAuthorityHandoff: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1;
+  productionAuthorityHandoff: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1;
+  authenticatedPlan: IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1;
+  requestBundle: ICloudlyLegacyDeploymentSettlementRequestBundleV1;
+  scratchReceipt: ICloudlyLegacyDeploymentSettlementScratchReceiptV1;
+  productionAuthorization:
+    ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1;
+  executionAttempt: TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementProductionCheckStdioRequestV1
+extends ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  command: 'settlement-production-check';
+  payload: ICloudlyLegacyDeploymentSettlementProductionStdioPayloadV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementProductionApplyStdioRequestV1
+extends ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  command: 'settlement-production-apply';
+  payload: ICloudlyLegacyDeploymentSettlementProductionStdioPayloadV1;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementProductionResolveStdioRequestV1
+extends ICloudlyLegacyDeploymentSettlementStdioRequestBaseV1 {
+  command: 'settlement-production-resolve';
+  payload: ICloudlyLegacyDeploymentSettlementProductionStdioPayloadV1 & {
+    observedAt: number;
+  };
+}
+
+export type TCloudlyLegacyDeploymentSettlementStdioRequestV1 =
+  | ICloudlyLegacyDeploymentSettlementPlanStdioRequestV1
+  | ICloudlyLegacyDeploymentSettlementRequestStdioRequestV1
+  | ICloudlyLegacyDeploymentSettlementScratchCheckStdioRequestV1
+  | ICloudlyLegacyDeploymentSettlementScratchApplyStdioRequestV1
+  | ICloudlyLegacyDeploymentSettlementScratchResolveStdioRequestV1
+  | ICloudlyLegacyDeploymentSettlementProductionAuthorizeStdioRequestV1
+  | ICloudlyLegacyDeploymentSettlementProductionCheckStdioRequestV1
+  | ICloudlyLegacyDeploymentSettlementProductionApplyStdioRequestV1
+  | ICloudlyLegacyDeploymentSettlementProductionResolveStdioRequestV1;
+
+export const cloudlyLegacyDeploymentSettlementStdioErrorMetadata = Object.freeze({
+  INVALID_FRAME: Object.freeze({ retryable: false }),
+  INVALID_REQUEST: Object.freeze({ retryable: false }),
+  AUTHORITY_INVALID: Object.freeze({ retryable: false }),
+  AUTHORITY_EXPIRED: Object.freeze({ retryable: true }),
+  REQUEST_MISMATCH: Object.freeze({ retryable: false }),
+  PLAN_MISMATCH: Object.freeze({ retryable: false }),
+  SOURCE_STATE_MISMATCH: Object.freeze({ retryable: false }),
+  FINAL_STATE_MISMATCH: Object.freeze({ retryable: true }),
+  TRANSACTIONS_UNSUPPORTED: Object.freeze({ retryable: false }),
+  OPERATION_DRIFT: Object.freeze({ retryable: false }),
+  CLAIM_DRIFT: Object.freeze({ retryable: false }),
+  CLASSIFICATION_MISMATCH: Object.freeze({ retryable: false }),
+  ATTEMPT_CONFLICT: Object.freeze({ retryable: false }),
+  ATTEMPT_NOT_FOUND: Object.freeze({ retryable: false }),
+  INTERNAL_ERROR: Object.freeze({ retryable: true }),
+} as const);
+
+export type TCloudlyLegacyDeploymentSettlementStdioErrorCode =
+  keyof typeof cloudlyLegacyDeploymentSettlementStdioErrorMetadata;
+
+export type TCloudlyLegacyDeploymentSettlementStdioSafeErrorV1 = {
+  [TCode in TCloudlyLegacyDeploymentSettlementStdioErrorCode]: {
+    code: TCode;
+    retryable: typeof cloudlyLegacyDeploymentSettlementStdioErrorMetadata[TCode]['retryable'];
+  };
+}[TCloudlyLegacyDeploymentSettlementStdioErrorCode];
+
+interface ICloudlyLegacyDeploymentSettlementStdioResponseBaseV1<
+  TCommand extends TCloudlyLegacyDeploymentSettlementStdioCommand,
+> {
+  schemaVersion: 1;
+  kind: 'cloudly-legacy-deployment-settlement-stdio-response';
+  requestId: string;
+  command: TCommand;
+}
+
+export interface ICloudlyLegacyDeploymentSettlementStdioSuccessPayloadByCommandV1 {
+  'settlement-plan': {
+    authenticatedPlan: IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1;
+  };
+  'settlement-request': {
+    requestBundle: ICloudlyLegacyDeploymentSettlementRequestBundleV1;
+  };
+  'settlement-scratch-check': {
+    authenticatedResult: IAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1;
+  };
+  'settlement-scratch-apply': {
+    executionBundle: TCloudlyLegacyDeploymentSettlementScratchExecutionBundleV1;
+  };
+  'settlement-scratch-resolve': {
+    authenticatedResolution: IAuthenticatedCloudlyLegacyDeploymentSettlementResolutionV1;
+  };
+  'settlement-production-authorize': {
+    productionAuthorization:
+      ICloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationV1;
+  };
+  'settlement-production-check': {
+    authenticatedResult: IAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultV1;
+  };
+  'settlement-production-apply': {
+    executionBundle: TCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2;
+  };
+  'settlement-production-resolve': {
+    authenticatedResolution: IAuthenticatedCloudlyLegacyDeploymentSettlementResolutionV1;
+  };
+}
+
+export type TCloudlyLegacyDeploymentSettlementStdioSuccessPayloadV1 =
+  ICloudlyLegacyDeploymentSettlementStdioSuccessPayloadByCommandV1[
+    TCloudlyLegacyDeploymentSettlementStdioCommand
+  ];
+
+export type TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1 = {
+  [TCommand in TCloudlyLegacyDeploymentSettlementStdioCommand]:
+    ICloudlyLegacyDeploymentSettlementStdioResponseBaseV1<TCommand> & {
+      ok: true;
+      payload: ICloudlyLegacyDeploymentSettlementStdioSuccessPayloadByCommandV1[TCommand];
+    };
+}[TCloudlyLegacyDeploymentSettlementStdioCommand];
+
+export type TCloudlyLegacyDeploymentSettlementStdioErrorResponseV1 = {
+  [TCommand in TCloudlyLegacyDeploymentSettlementStdioCommand]:
+    ICloudlyLegacyDeploymentSettlementStdioResponseBaseV1<TCommand> & {
+      ok: false;
+      error: TCloudlyLegacyDeploymentSettlementStdioSafeErrorV1;
+    };
+}[TCloudlyLegacyDeploymentSettlementStdioCommand];
+
+export type TCloudlyLegacyDeploymentSettlementStdioResponseV1 =
+  | TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1
+  | TCloudlyLegacyDeploymentSettlementStdioErrorResponseV1;
+
+const stdioRequestKeys = ['schemaVersion', 'kind', 'requestId', 'command', 'payload'] as const;
+const stdioResponseSuccessKeys = [
+  'schemaVersion',
+  'kind',
+  'requestId',
+  'command',
+  'ok',
+  'payload',
+] as const;
+const stdioResponseErrorKeys = [
+  'schemaVersion',
+  'kind',
+  'requestId',
+  'command',
+  'ok',
+  'error',
+] as const;
+
+const normalizeSettlementMongoDescriptor = (
+  valueArg: unknown,
+  pathArg: string,
+): ICloudlyLegacyDeploymentSettlementMongoDescriptorV1 => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, ['mongoDbUrl', 'mongoDbName', 'mongoDbUser', 'mongoDbPass'], pathArg);
+  for (const key of ['mongoDbUrl', 'mongoDbName', 'mongoDbUser', 'mongoDbPass'] as const) {
+    if (typeof value[key] !== 'string'
+      || value[key].length === 0
+      || Buffer.byteLength(value[key], 'utf8')
+        > cloudlyLegacyDeploymentSettlementStdioLimits.maximumMongoDescriptorBytes
+      || /[\u0000-\u0020\u007f]/u.test(value[key])) {
+      fail('INVALID_VALUE', `${pathArg}.${key}`);
+    }
+  }
+  const descriptor = value as unknown as ICloudlyLegacyDeploymentSettlementMongoDescriptorV1;
+  let url: URL;
+  let mongoDbName: string;
+  let mongoDbUser: string;
+  let mongoDbPass: string;
+  try {
+    url = new URL(descriptor.mongoDbUrl);
+    mongoDbName = decodeURIComponent(url.pathname.slice(1));
+    mongoDbUser = decodeURIComponent(url.username);
+    mongoDbPass = decodeURIComponent(url.password);
+  } catch {
+    return fail('INVALID_VALUE', `${pathArg}.mongoDbUrl`);
+  }
+  const queryKeys = [...new Set(url.searchParams.keys())].sort();
+  if (url.protocol !== 'mongodb:'
+    || !url.hostname
+    || !url.port
+    || url.hash !== ''
+    || mongoDbName !== descriptor.mongoDbName
+    || mongoDbUser !== descriptor.mongoDbUser
+    || mongoDbPass !== descriptor.mongoDbPass
+    || JSON.stringify(queryKeys) !== JSON.stringify(['authSource', 'directConnection'])
+    || url.searchParams.getAll('authSource').length !== 1
+    || url.searchParams.get('authSource') !== descriptor.mongoDbName
+    || url.searchParams.getAll('directConnection').length !== 1
+    || url.searchParams.get('directConnection') !== 'true') {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+  const output = {
+    mongoDbUrl: descriptor.mongoDbUrl,
+    mongoDbName: descriptor.mongoDbName,
+    mongoDbUser: descriptor.mongoDbUser,
+    mongoDbPass: descriptor.mongoDbPass,
+  };
+  if (Buffer.byteLength(canonicalize(output, pathArg), 'utf8')
+    > cloudlyLegacyDeploymentSettlementStdioLimits.maximumMongoDescriptorBytes) {
+    fail('LIMIT_EXCEEDED', pathArg);
+  }
+  return output;
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementMongoDescriptor = (
+  valueArg: unknown,
+): Readonly<ICloudlyLegacyDeploymentSettlementMongoDescriptorV1> => finalize(
+  normalizeSettlementMongoDescriptor(valueArg, 'mongoDescriptor'),
+  cloudlyLegacyDeploymentSettlementStdioLimits.maximumMongoDescriptorBytes,
+  'mongoDescriptor',
+);
+
+const assertStdioArtifactAggregate = (valueArg: unknown, pathArg: string): void => {
+  if (Buffer.byteLength(canonicalize(valueArg, pathArg), 'utf8')
+    > cloudlyLegacyDeploymentSettlementStdioLimits.maximumPrivateArtifactAggregateBytes) {
+    fail('LIMIT_EXCEEDED', pathArg);
+  }
+};
+
+const assertDistinctStdioHandoffKeyMaterial = (
+  sourceHandoffArg: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1,
+  executionHandoffArg: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1,
+  pathArg: string,
+): void => {
+  const sourceKey = Buffer.from(sourceHandoffArg.hmacKeyPlaintext.value, 'base64url');
+  const executionKey = Buffer.from(executionHandoffArg.hmacKeyPlaintext.value, 'base64url');
+  let equal = false;
+  try {
+    equal = plugins.crypto.timingSafeEqual(sourceKey, executionKey);
+  } finally {
+    sourceKey.fill(0);
+    executionKey.fill(0);
+  }
+  if (equal) {
+    fail('CROSS_FIELD_MISMATCH', pathArg);
+  }
+};
+
+const assertExecutionAttemptMatchesStdioArtifacts = (argsArg: {
+  attempt: ICloudlyLegacyDeploymentSettlementExecutionAttemptIdentityV1;
+  purpose: TCloudlyLegacyDeploymentSettlementExecutionPurpose;
+  sourceHandoff: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1;
+  executionHandoff: ICloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintextV1;
+  authenticatedPlan: IAuthenticatedCloudlyLegacyDeploymentSettlementPlanV1;
+  requestBundle: ICloudlyLegacyDeploymentSettlementRequestBundleV1;
+  scratchReceipt?: ICloudlyLegacyDeploymentSettlementScratchReceiptV1;
+  path: string;
+}): void => {
+  const sourceReference = argsArg.sourceHandoff.authorityReference;
+  const executionReference = argsArg.executionHandoff.authorityReference;
+  const sourceMetadata = normalizeFencedSourceAuthorityMetadata(
+    argsArg.sourceHandoff.authorityMetadata,
+    `${argsArg.path}.sourceAuthorityMetadata`,
+  );
+  if (argsArg.purpose === 'production') {
+    assertDistinctStdioHandoffKeyMaterial(
+      argsArg.sourceHandoff,
+      argsArg.executionHandoff,
+      `${argsArg.path}.authorityKeySeparation`,
+    );
+    normalizeProductionAuthorityMetadataPair(
+      argsArg.executionHandoff.authorityMetadata,
+      sourceMetadata,
+    );
+  } else {
+    normalizeFencedSourceAuthorityMetadata(
+      argsArg.executionHandoff.authorityMetadata,
+      `${argsArg.path}.executionAuthorityMetadata`,
+    );
+  }
+  normalizeCloudlyLegacyDeploymentSettlementPlanForAuthority(
+    argsArg.authenticatedPlan.payload,
+    sourceMetadata,
+  );
+  normalizeCloudlyLegacyDeploymentSettlementProductionRequestForAuthority(
+    argsArg.requestBundle.authenticatedRequest.payload,
+    sourceMetadata,
+  );
+  if (argsArg.scratchReceipt) {
+    normalizeCloudlyLegacyDeploymentSettlementScratchReceiptStructureForRequest(
+      argsArg.scratchReceipt,
+      argsArg.requestBundle.authenticatedRequest,
+    );
+  }
+  if (canonicalize(argsArg.authenticatedPlan.authority, `${argsArg.path}.plan.authority`)
+      !== canonicalize(sourceReference, `${argsArg.path}.sourceAuthority`)
+    || canonicalize(
+      argsArg.requestBundle.authenticatedRequest.authority,
+      `${argsArg.path}.request.authority`,
+    ) !== canonicalize(sourceReference, `${argsArg.path}.sourceAuthority`)
+    || canonicalize(
+      argsArg.requestBundle.authenticatedRehearsalBinding.authority,
+      `${argsArg.path}.binding.authority`,
+    ) !== canonicalize(sourceReference, `${argsArg.path}.sourceAuthority`)
+    || canonicalize(argsArg.authenticatedPlan.payload, `${argsArg.path}.plan.payload`)
+      !== canonicalize(
+        argsArg.requestBundle.authenticatedRequest.payload.plan,
+        `${argsArg.path}.request.plan`,
+      )
+    || argsArg.authenticatedPlan.payloadSha256
+      !== argsArg.requestBundle.authenticatedRequest.payload.planSha256
+    || (argsArg.scratchReceipt !== undefined
+      && (canonicalize(argsArg.scratchReceipt.authority, `${argsArg.path}.scratch.authority`)
+        !== canonicalize(sourceReference, `${argsArg.path}.sourceAuthority`)
+        || argsArg.scratchReceipt.requestSha256
+          !== argsArg.requestBundle.authenticatedRequest.payloadSha256))) {
+    fail('CROSS_FIELD_MISMATCH', `${argsArg.path}.sourceArtifacts`);
+  }
+  const scratchReceiptSha256 = argsArg.scratchReceipt
+    ? digestCloudlyLegacyDeploymentSettlementScratchReceipt(argsArg.scratchReceipt)
+    : null;
+  if (argsArg.attempt.purpose !== argsArg.purpose
+    || argsArg.attempt.operationId !== argsArg.executionHandoff.authorityMetadata.operationId
+    || argsArg.attempt.settlementId !== argsArg.executionHandoff.authorityMetadata.settlementId
+    || canonicalize(argsArg.attempt.sourceAuthority, `${argsArg.path}.attempt.sourceAuthority`)
+      !== canonicalize(sourceReference, `${argsArg.path}.sourceAuthority`)
+    || canonicalize(argsArg.attempt.executionAuthority, `${argsArg.path}.attempt.executionAuthority`)
+      !== canonicalize(executionReference, `${argsArg.path}.executionAuthority`)
+    || argsArg.attempt.authenticatedPlanSha256
+      !== digestAuthenticatedCloudlyLegacyDeploymentSettlementPlan(argsArg.authenticatedPlan)
+    || argsArg.attempt.requestBundleSha256
+      !== digestCloudlyLegacyDeploymentSettlementRequestBundle(argsArg.requestBundle)
+    || argsArg.attempt.scratchReceiptSha256 !== scratchReceiptSha256) {
+    fail('CROSS_FIELD_MISMATCH', `${argsArg.path}.executionAttempt`);
+  }
+  if (argsArg.purpose === 'production') {
+    const productionMetadata = argsArg.executionHandoff.authorityMetadata;
+    if (!productionMetadata.sourceAuthority
+      || canonicalize(productionMetadata.sourceAuthority, `${argsArg.path}.metadata.sourceAuthority`)
+        !== canonicalize(sourceReference, `${argsArg.path}.sourceAuthority`)
+      || productionMetadata.sourceAuthenticatedPlanSha256
+        !== argsArg.attempt.authenticatedPlanSha256
+      || productionMetadata.sourceRequestBundleSha256 !== argsArg.attempt.requestBundleSha256
+      || productionMetadata.scratchReceiptSha256 !== scratchReceiptSha256) {
+      fail('CROSS_FIELD_MISMATCH', `${argsArg.path}.productionAuthorityHandoff`);
+    }
+  }
+};
+
+const normalizeScratchStdioPayload = (
+  valueArg: unknown,
+  pathArg: string,
+  resolveArg: boolean,
+): ICloudlyLegacyDeploymentSettlementScratchStdioPayloadV1 & { observedAt?: number } => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, [
+    'mongoDescriptor',
+    'authorityHandoff',
+    'authenticatedPlan',
+    'requestBundle',
+    'executionAttempt',
+    ...(resolveArg ? ['observedAt'] : []),
+  ], pathArg);
+  const authorityHandoff = normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext(
+    value.authorityHandoff,
+  );
+  const authenticatedPlan =
+    normalizeCloudlyLegacyDeploymentSettlementAuthenticatedPlanStructure(value.authenticatedPlan);
+  const requestBundle = normalizeCloudlyLegacyDeploymentSettlementRequestBundle(value.requestBundle);
+  const executionAttempt = normalizeExecutionAttemptIdentityInternal(
+    value.executionAttempt,
+    `${pathArg}.executionAttempt`,
+  );
+  assertExecutionAttemptMatchesStdioArtifacts({
+    attempt: executionAttempt,
+    purpose: 'scratch-rehearsal',
+    sourceHandoff: authorityHandoff,
+    executionHandoff: authorityHandoff,
+    authenticatedPlan,
+    requestBundle,
+    path: pathArg,
+  });
+  const output = {
+    mongoDescriptor: normalizeSettlementMongoDescriptor(
+      value.mongoDescriptor,
+      `${pathArg}.mongoDescriptor`,
+    ),
+    authorityHandoff,
+    authenticatedPlan,
+    requestBundle,
+    executionAttempt: executionAttempt as
+      TCloudlyLegacyDeploymentSettlementScratchExecutionAttemptIdentityV1,
+    ...(resolveArg
+      ? { observedAt: readInteger(value.observedAt, `${pathArg}.observedAt`, 1) }
+      : {}),
+  };
+  assertStdioArtifactAggregate(output, pathArg);
+  return output;
+};
+
+const normalizeProductionStdioPayload = (
+  valueArg: unknown,
+  pathArg: string,
+  resolveArg: boolean,
+): ICloudlyLegacyDeploymentSettlementProductionStdioPayloadV1 & { observedAt?: number } => {
+  const value = readRecord(valueArg, pathArg);
+  assertExactKeys(value, [
+    'mongoDescriptor',
+    'sourceAuthorityHandoff',
+    'productionAuthorityHandoff',
+    'authenticatedPlan',
+    'requestBundle',
+    'scratchReceipt',
+    'productionAuthorization',
+    'executionAttempt',
+    ...(resolveArg ? ['observedAt'] : []),
+  ], pathArg);
+  const sourceAuthorityHandoff =
+    normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext(
+      value.sourceAuthorityHandoff,
+    );
+  const productionAuthorityHandoff =
+    normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext(
+      value.productionAuthorityHandoff,
+    );
+  const authenticatedPlan =
+    normalizeCloudlyLegacyDeploymentSettlementAuthenticatedPlanStructure(value.authenticatedPlan);
+  const requestBundle = normalizeCloudlyLegacyDeploymentSettlementRequestBundle(value.requestBundle);
+  const scratchReceipt = normalizeCloudlyLegacyDeploymentSettlementScratchReceipt(
+    value.scratchReceipt,
+  );
+  const productionAuthorization =
+    normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization(
+      value.productionAuthorization,
+    );
+  const executionAttempt = normalizeExecutionAttemptIdentityInternal(
+    value.executionAttempt,
+    `${pathArg}.executionAttempt`,
+  );
+  assertExecutionAttemptMatchesStdioArtifacts({
+    attempt: executionAttempt,
+    purpose: 'production',
+    sourceHandoff: sourceAuthorityHandoff,
+    executionHandoff: productionAuthorityHandoff,
+    authenticatedPlan,
+    requestBundle,
+    scratchReceipt,
+    path: pathArg,
+  });
+  if (canonicalize(productionAuthorization.executionAttempt, `${pathArg}.authorization.attempt`)
+      !== canonicalize(executionAttempt, `${pathArg}.executionAttempt`)) {
+    fail('CROSS_FIELD_MISMATCH', `${pathArg}.productionAuthorization`);
+  }
+  const metadata = normalizeProductionAuthorityMetadataPair(
+    productionAuthorityHandoff.authorityMetadata,
+    sourceAuthorityHandoff.authorityMetadata,
+  );
+  assertProductionAuthorizationArtifacts(
+    productionAuthorization,
+    metadata.productionMetadata,
+    metadata.sourceMetadata,
+    authenticatedPlan,
+    requestBundle,
+    scratchReceipt,
+  );
+  const output = {
+    mongoDescriptor: normalizeSettlementMongoDescriptor(
+      value.mongoDescriptor,
+      `${pathArg}.mongoDescriptor`,
+    ),
+    sourceAuthorityHandoff,
+    productionAuthorityHandoff,
+    authenticatedPlan,
+    requestBundle,
+    scratchReceipt,
+    productionAuthorization,
+    executionAttempt: executionAttempt as
+      TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1,
+    ...(resolveArg
+      ? { observedAt: readInteger(value.observedAt, `${pathArg}.observedAt`, 1) }
+      : {}),
+  };
+  assertStdioArtifactAggregate(output, pathArg);
+  return output;
+};
+
+/** Structural only; use the authority-aware variant before trusting artifacts. */
+export const normalizeCloudlyLegacyDeploymentSettlementStdioRequest = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementStdioRequestV1> => {
+  const value = readRecord(valueArg, 'stdioRequest');
+  assertExactKeys(value, stdioRequestKeys, 'stdioRequest');
+  assertStdioArtifactAggregate(value.payload, 'stdioRequest.payload');
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-stdio-request') {
+    fail('INVALID_VALUE', 'stdioRequest.kind');
+  }
+  const requestId = readIdentifier(value.requestId, 'stdioRequest.requestId');
+  const command = readLiteral(
+    value.command,
+    cloudlyLegacyDeploymentSettlementStdioCommands,
+    'stdioRequest.command',
+  );
+  const payloadPath = 'stdioRequest.payload';
+  let payload: TCloudlyLegacyDeploymentSettlementStdioRequestV1['payload'];
+  if (command === 'settlement-plan') {
+    const input = readRecord(value.payload, payloadPath);
+    assertExactKeys(input, ['mongoDescriptor', 'authorityHandoff', 'effectiveAt'], payloadPath);
+    const authorityHandoff = normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext(
+      input.authorityHandoff,
+    );
+    const sourceMetadata = normalizeFencedSourceAuthorityMetadata(
+      authorityHandoff.authorityMetadata,
+      `${payloadPath}.authorityHandoff.authorityMetadata`,
+    );
+    const effectiveAt = readInteger(input.effectiveAt, `${payloadPath}.effectiveAt`, 1);
+    assertAuthorityTimestamp(effectiveAt, sourceMetadata, `${payloadPath}.effectiveAt`);
+    payload = {
+      mongoDescriptor: normalizeSettlementMongoDescriptor(
+        input.mongoDescriptor,
+        `${payloadPath}.mongoDescriptor`,
+      ),
+      authorityHandoff,
+      effectiveAt,
+    };
+  } else if (command === 'settlement-request') {
+    const input = readRecord(value.payload, payloadPath);
+    assertExactKeys(input, ['authorityHandoff', 'authenticatedPlan', 'requestedAt'], payloadPath);
+    const authorityHandoff = normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext(
+      input.authorityHandoff,
+    );
+    const sourceMetadata = normalizeFencedSourceAuthorityMetadata(
+      authorityHandoff.authorityMetadata,
+      `${payloadPath}.authorityHandoff.authorityMetadata`,
+    );
+    const authenticatedPlan =
+      normalizeCloudlyLegacyDeploymentSettlementAuthenticatedPlanStructure(
+        input.authenticatedPlan,
+      );
+    assertAuthorityReferenceMatchesMetadata(
+      authenticatedPlan.authority,
+      sourceMetadata,
+      `${payloadPath}.authenticatedPlan.authority`,
+    );
+    normalizeCloudlyLegacyDeploymentSettlementPlanForAuthority(
+      authenticatedPlan.payload,
+      sourceMetadata,
+    );
+    const requestedAt = readInteger(input.requestedAt, `${payloadPath}.requestedAt`, 1);
+    assertAuthorityTimestamp(requestedAt, sourceMetadata, `${payloadPath}.requestedAt`);
+    if (requestedAt < authenticatedPlan.payload.effectiveAt) {
+      fail('CROSS_FIELD_MISMATCH', `${payloadPath}.requestedAt`);
+    }
+    payload = {
+      authorityHandoff,
+      authenticatedPlan,
+      requestedAt,
+    };
+  } else if (command === 'settlement-scratch-check'
+    || command === 'settlement-scratch-apply') {
+    payload = normalizeScratchStdioPayload(value.payload, payloadPath, false);
+  } else if (command === 'settlement-scratch-resolve') {
+    payload = normalizeScratchStdioPayload(value.payload, payloadPath, true) as
+      ICloudlyLegacyDeploymentSettlementScratchResolveStdioRequestV1['payload'];
+  } else if (command === 'settlement-production-authorize') {
+    const input = readRecord(value.payload, payloadPath);
+    assertExactKeys(input, [
+      'sourceAuthorityHandoff',
+      'productionAuthorityHandoff',
+      'authenticatedPlan',
+      'requestBundle',
+      'scratchReceipt',
+      'executionAttempt',
+      'requestedAt',
+      'approvedAt',
+    ], payloadPath);
+    const sourceAuthorityHandoff =
+      normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext(
+        input.sourceAuthorityHandoff,
+      );
+    const productionAuthorityHandoff =
+      normalizeCloudlyLegacyDeploymentSettlementAuthorityHandoffPlaintext(
+        input.productionAuthorityHandoff,
+      );
+    const authenticatedPlan =
+      normalizeCloudlyLegacyDeploymentSettlementAuthenticatedPlanStructure(
+        input.authenticatedPlan,
+      );
+    const requestBundle = normalizeCloudlyLegacyDeploymentSettlementRequestBundle(
+      input.requestBundle,
+    );
+    const scratchReceipt = normalizeCloudlyLegacyDeploymentSettlementScratchReceipt(
+      input.scratchReceipt,
+    );
+    const executionAttempt = normalizeExecutionAttemptIdentityInternal(
+      input.executionAttempt,
+      `${payloadPath}.executionAttempt`,
+    );
+    assertExecutionAttemptMatchesStdioArtifacts({
+      attempt: executionAttempt,
+      purpose: 'production',
+      sourceHandoff: sourceAuthorityHandoff,
+      executionHandoff: productionAuthorityHandoff,
+      authenticatedPlan,
+      requestBundle,
+      scratchReceipt,
+      path: payloadPath,
+    });
+    const requestedAt = readInteger(input.requestedAt, `${payloadPath}.requestedAt`, 1);
+    const metadata = normalizeProductionAuthorityMetadataPair(
+      productionAuthorityHandoff.authorityMetadata,
+      sourceAuthorityHandoff.authorityMetadata,
+    );
+    const approvedAt = readInteger(input.approvedAt, `${payloadPath}.approvedAt`, requestedAt);
+    assertAuthorityTimestamp(requestedAt, metadata.productionMetadata, `${payloadPath}.requestedAt`);
+    assertAuthorityTimestamp(approvedAt, metadata.productionMetadata, `${payloadPath}.approvedAt`);
+    if (metadata.productionMetadata.issuedAt < scratchReceipt.completedAt
+      || requestedAt < scratchReceipt.completedAt) {
+      fail('CROSS_FIELD_MISMATCH', `${payloadPath}.requestedAt`);
+    }
+    payload = {
+      sourceAuthorityHandoff,
+      productionAuthorityHandoff,
+      authenticatedPlan,
+      requestBundle,
+      scratchReceipt,
+      executionAttempt: executionAttempt as
+        TCloudlyLegacyDeploymentSettlementProductionExecutionAttemptIdentityV1,
+      requestedAt,
+      approvedAt,
+    };
+  } else if (command === 'settlement-production-resolve') {
+    payload = normalizeProductionStdioPayload(value.payload, payloadPath, true) as
+      ICloudlyLegacyDeploymentSettlementProductionResolveStdioRequestV1['payload'];
+  } else {
+    payload = normalizeProductionStdioPayload(value.payload, payloadPath, false);
+  }
+  assertStdioArtifactAggregate(payload, payloadPath);
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-stdio-request',
+    requestId,
+    command,
+    payload,
+  } as TCloudlyLegacyDeploymentSettlementStdioRequestV1,
+  cloudlyLegacyDeploymentSettlementStdioLimits.maximumRequestFrameBytes - 1,
+  'stdioRequest');
+};
+
+const createCloudlyLegacyDeploymentSettlementStdioRequestHmacVerifier = (
+  requestArg: TCloudlyLegacyDeploymentSettlementStdioRequestV1,
+): TCloudlyLegacyDeploymentSettlementHmacVerifier => {
+  if (requestArg.command === 'settlement-plan'
+    || requestArg.command === 'settlement-request'
+    || requestArg.command === 'settlement-scratch-check'
+    || requestArg.command === 'settlement-scratch-apply'
+    || requestArg.command === 'settlement-scratch-resolve') {
+    return createCloudlyLegacyDeploymentSettlementStdioHandoffHmacVerifier(
+      requestArg.payload.authorityHandoff,
+    );
+  }
+  const sourceVerifier = createCloudlyLegacyDeploymentSettlementStdioHandoffHmacVerifier(
+    requestArg.payload.sourceAuthorityHandoff,
+  );
+  const executionVerifier = createCloudlyLegacyDeploymentSettlementStdioHandoffHmacVerifier(
+    requestArg.payload.productionAuthorityHandoff,
+  );
+  return async (inputArg): Promise<boolean> => (
+    await sourceVerifier(inputArg) || await executionVerifier(inputArg)
+  );
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementStdioRequestForAuthorities = async (
+  valueArg: unknown,
+): Promise<Readonly<TCloudlyLegacyDeploymentSettlementStdioRequestV1>> => {
+  const request = normalizeCloudlyLegacyDeploymentSettlementStdioRequest(valueArg);
+  const verifier = createCloudlyLegacyDeploymentSettlementStdioRequestHmacVerifier(request);
+  if (request.command === 'settlement-plan') {
+    return request;
+  }
+  if (request.command === 'settlement-request') {
+    await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementPlanForAuthority(
+      request.payload.authenticatedPlan,
+      request.payload.authorityHandoff.authorityMetadata,
+      verifier,
+    );
+    return request;
+  }
+  if (request.command === 'settlement-scratch-check'
+    || request.command === 'settlement-scratch-apply'
+    || request.command === 'settlement-scratch-resolve') {
+    await normalizeExecutionAttemptProofArtifacts({
+      executionAttempt: request.payload.executionAttempt,
+      sourceMetadata: request.payload.authorityHandoff.authorityMetadata,
+      executionMetadata: request.payload.authorityHandoff.authorityMetadata,
+      authenticatedPlan: request.payload.authenticatedPlan,
+      requestBundle: request.payload.requestBundle,
+      scratchReceipt: null,
+      productionAuthorization: null,
+      requireProductionAuthorization: false,
+      verifier,
+    });
+    return request;
+  }
+  await normalizeExecutionAttemptProofArtifacts({
+    executionAttempt: request.payload.executionAttempt,
+    sourceMetadata: request.payload.sourceAuthorityHandoff.authorityMetadata,
+    executionMetadata: request.payload.productionAuthorityHandoff.authorityMetadata,
+    authenticatedPlan: request.payload.authenticatedPlan,
+    requestBundle: request.payload.requestBundle,
+    scratchReceipt: request.payload.scratchReceipt,
+    productionAuthorization: request.command === 'settlement-production-authorize'
+      ? null
+      : request.payload.productionAuthorization,
+    requireProductionAuthorization: request.command !== 'settlement-production-authorize',
+    verifier,
+  });
+  return request;
+};
+
+const normalizeStdioSuccessPayload = (
+  commandArg: TCloudlyLegacyDeploymentSettlementStdioCommand,
+  valueArg: unknown,
+): TCloudlyLegacyDeploymentSettlementStdioSuccessPayloadV1 => {
+  const path = 'stdioResponse.payload';
+  const value = readRecord(valueArg, path);
+  if (commandArg === 'settlement-plan') {
+    assertExactKeys(value, ['authenticatedPlan'], path);
+    return {
+      authenticatedPlan: normalizeCloudlyLegacyDeploymentSettlementAuthenticatedPlanStructure(
+        value.authenticatedPlan,
+      ),
+    };
+  }
+  if (commandArg === 'settlement-request') {
+    assertExactKeys(value, ['requestBundle'], path);
+    return { requestBundle: normalizeCloudlyLegacyDeploymentSettlementRequestBundle(
+      value.requestBundle,
+    ) };
+  }
+  if (commandArg === 'settlement-scratch-check'
+    || commandArg === 'settlement-production-check') {
+    assertExactKeys(value, ['authenticatedResult'], path);
+    return {
+      authenticatedResult:
+        normalizeCloudlyLegacyDeploymentSettlementAuthenticatedCheckResultStructure(
+          value.authenticatedResult,
+        ),
+    };
+  }
+  if (commandArg === 'settlement-scratch-apply') {
+    assertExactKeys(value, ['executionBundle'], path);
+    return {
+      executionBundle: normalizeCloudlyLegacyDeploymentSettlementScratchExecutionBundle(
+        value.executionBundle,
+      ),
+    };
+  }
+  if (commandArg === 'settlement-production-apply') {
+    assertExactKeys(value, ['executionBundle'], path);
+    return {
+      executionBundle: normalizeCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2(
+        value.executionBundle,
+      ),
+    };
+  }
+  if (commandArg === 'settlement-production-authorize') {
+    assertExactKeys(value, ['productionAuthorization'], path);
+    return {
+      productionAuthorization:
+        normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorization(
+          value.productionAuthorization,
+        ),
+    };
+  }
+  assertExactKeys(value, ['authenticatedResolution'], path);
+  return {
+    authenticatedResolution:
+      normalizeCloudlyLegacyDeploymentSettlementAuthenticatedResolutionStructure(
+        value.authenticatedResolution,
+      ),
+  };
+};
+
+const createCloudlyLegacyDeploymentSettlementStdioSafeError = (
+  codeArg: TCloudlyLegacyDeploymentSettlementStdioErrorCode,
+): TCloudlyLegacyDeploymentSettlementStdioSafeErrorV1 => ({
+  code: codeArg,
+  retryable: cloudlyLegacyDeploymentSettlementStdioErrorMetadata[codeArg].retryable,
+} as TCloudlyLegacyDeploymentSettlementStdioSafeErrorV1);
+
+/** Structural only; use the request-authority-aware variant before trusting artifacts. */
+export const normalizeCloudlyLegacyDeploymentSettlementStdioResponse = (
+  valueArg: unknown,
+): Readonly<TCloudlyLegacyDeploymentSettlementStdioResponseV1> => {
+  const value = readRecord(valueArg, 'stdioResponse');
+  if (typeof value.ok !== 'boolean') fail('INVALID_VALUE', 'stdioResponse.ok');
+  assertExactKeys(
+    value,
+    value.ok ? stdioResponseSuccessKeys : stdioResponseErrorKeys,
+    'stdioResponse',
+  );
+  if (value.schemaVersion !== 1
+    || value.kind !== 'cloudly-legacy-deployment-settlement-stdio-response') {
+    fail('INVALID_VALUE', 'stdioResponse.kind');
+  }
+  if (value.ok) {
+    assertStdioArtifactAggregate(value.payload, 'stdioResponse.payload');
+  }
+  const requestId = readIdentifier(value.requestId, 'stdioResponse.requestId');
+  const command = readLiteral(
+    value.command,
+    cloudlyLegacyDeploymentSettlementStdioCommands,
+    'stdioResponse.command',
+  );
+  if (value.ok) {
+    const payload = normalizeStdioSuccessPayload(command, value.payload);
+    assertStdioArtifactAggregate(payload, 'stdioResponse.payload');
+    return finalize({
+      schemaVersion: 1,
+      kind: 'cloudly-legacy-deployment-settlement-stdio-response',
+      requestId,
+      command,
+      ok: true,
+      payload,
+    } as TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+    cloudlyLegacyDeploymentSettlementStdioLimits.maximumResponseFrameBytes - 1,
+    'stdioResponse');
+  }
+  const error = readRecord(value.error, 'stdioResponse.error');
+  assertExactKeys(error, ['code', 'retryable'], 'stdioResponse.error');
+  if (typeof error.code !== 'string'
+    || !Object.hasOwn(cloudlyLegacyDeploymentSettlementStdioErrorMetadata, error.code)) {
+    fail('INVALID_VALUE', 'stdioResponse.error.code');
+  }
+  const code = error.code as TCloudlyLegacyDeploymentSettlementStdioErrorCode;
+  if (error.retryable !== cloudlyLegacyDeploymentSettlementStdioErrorMetadata[code].retryable) {
+    fail('CROSS_FIELD_MISMATCH', 'stdioResponse.error.retryable');
+  }
+  return finalize({
+    schemaVersion: 1,
+    kind: 'cloudly-legacy-deployment-settlement-stdio-response',
+    requestId,
+    command,
+    ok: false,
+    error: createCloudlyLegacyDeploymentSettlementStdioSafeError(code),
+  } as TCloudlyLegacyDeploymentSettlementStdioErrorResponseV1,
+  cloudlyLegacyDeploymentSettlementStdioLimits.maximumResponseFrameBytes - 1,
+  'stdioResponse');
+};
+
+export const normalizeCloudlyLegacyDeploymentSettlementStdioResponseForRequestAuthorities = async (
+  responseArg: unknown,
+  requestArg: unknown,
+): Promise<Readonly<TCloudlyLegacyDeploymentSettlementStdioResponseV1>> => {
+  const request = await normalizeCloudlyLegacyDeploymentSettlementStdioRequestForAuthorities(
+    requestArg,
+  );
+  const verifier = createCloudlyLegacyDeploymentSettlementStdioRequestHmacVerifier(request);
+  const response = normalizeCloudlyLegacyDeploymentSettlementStdioResponse(responseArg);
+  if (response.requestId !== request.requestId || response.command !== request.command) {
+    fail('CROSS_FIELD_MISMATCH', 'stdioResponse.request');
+  }
+  if (!response.ok) {
+    return response;
+  }
+  if (request.command === 'settlement-plan') {
+    const success = response as Extract<
+      TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+      { command: 'settlement-plan' }
+    >;
+    const plan = await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementPlanForAuthority(
+      success.payload.authenticatedPlan,
+      request.payload.authorityHandoff.authorityMetadata,
+      verifier,
+    );
+    if (plan.payload.effectiveAt !== request.payload.effectiveAt) {
+      fail('CROSS_FIELD_MISMATCH', 'stdioResponse.payload.authenticatedPlan.effectiveAt');
+    }
+    return response;
+  }
+  if (request.command === 'settlement-request') {
+    const success = response as Extract<
+      TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+      { command: 'settlement-request' }
+    >;
+    const requestBundle =
+      await normalizeCloudlyLegacyDeploymentSettlementRequestBundleForAuthority(
+        success.payload.requestBundle,
+        request.payload.authenticatedPlan,
+        request.payload.authorityHandoff.authorityMetadata,
+        verifier,
+      );
+    if (requestBundle.authenticatedRequest.payload.requestedAt
+      !== request.payload.requestedAt) {
+      fail('CROSS_FIELD_MISMATCH', 'stdioResponse.payload.requestBundle.requestedAt');
+    }
+    return response;
+  }
+  if (request.command === 'settlement-scratch-check') {
+    const success = response as Extract<
+      TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+      { command: 'settlement-scratch-check' }
+    >;
+    await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementCheckResultForAuthority(
+      success.payload.authenticatedResult,
+      request.payload.authorityHandoff.authorityMetadata,
+      request.payload.requestBundle.authenticatedRequest,
+      verifier,
+    );
+    return response;
+  }
+  if (request.command === 'settlement-scratch-apply') {
+    const success = response as Extract<
+      TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+      { command: 'settlement-scratch-apply' }
+    >;
+    await normalizeCloudlyLegacyDeploymentSettlementScratchExecutionBundleForAuthority(
+      success.payload.executionBundle,
+      request.payload.authorityHandoff.authorityMetadata,
+      request.payload.authenticatedPlan,
+      request.payload.requestBundle,
+      verifier,
+    );
+    return response;
+  }
+  if (request.command === 'settlement-scratch-resolve') {
+    const success = response as Extract<
+      TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+      { command: 'settlement-scratch-resolve' }
+    >;
+    const resolution =
+      await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementResolutionForAuthorities(
+        success.payload.authenticatedResolution,
+        request.payload.authorityHandoff.authorityMetadata,
+        request.payload.authorityHandoff.authorityMetadata,
+        request.payload.authenticatedPlan,
+        request.payload.requestBundle,
+        null,
+        null,
+        verifier,
+      );
+    if (resolution.payload.observedAt !== request.payload.observedAt) {
+      fail('CROSS_FIELD_MISMATCH', 'stdioResponse.payload.authenticatedResolution.observedAt');
+    }
+    return response;
+  }
+  if (request.command === 'settlement-production-authorize') {
+    const success = response as Extract<
+      TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+      { command: 'settlement-production-authorize' }
+    >;
+    const authorization =
+      await normalizeCloudlyLegacyDeploymentSettlementProductionExecutionAuthorizationForAuthorities(
+        success.payload.productionAuthorization,
+        request.payload.productionAuthorityHandoff.authorityMetadata,
+        request.payload.sourceAuthorityHandoff.authorityMetadata,
+        request.payload.authenticatedPlan,
+        request.payload.requestBundle,
+        request.payload.scratchReceipt,
+        verifier,
+      );
+    if (authorization.requestedAt !== request.payload.requestedAt
+      || authorization.approvedAt !== request.payload.approvedAt) {
+      fail('CROSS_FIELD_MISMATCH', 'stdioResponse.payload.productionAuthorization.timestamp');
+    }
+    return response;
+  }
+  if (request.command === 'settlement-production-check') {
+    const success = response as Extract<
+      TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+      { command: 'settlement-production-check' }
+    >;
+    await normalizeAuthenticatedCheckResultForExecutionAuthority(
+      success.payload.authenticatedResult,
+      request.payload.productionAuthorityHandoff.authorityMetadata,
+      request.payload.requestBundle.authenticatedRequest,
+      request.payload.productionAuthorization,
+      verifier,
+    );
+    return response;
+  }
+  if (request.command === 'settlement-production-apply') {
+    const success = response as Extract<
+      TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+      { command: 'settlement-production-apply' }
+    >;
+    await normalizeCloudlyLegacyDeploymentSettlementProductionExecutionBundleV2ForAuthorities(
+      success.payload.executionBundle,
+      request.payload.productionAuthorization,
+      request.payload.productionAuthorityHandoff.authorityMetadata,
+      request.payload.sourceAuthorityHandoff.authorityMetadata,
+      request.payload.authenticatedPlan,
+      request.payload.requestBundle,
+      request.payload.scratchReceipt,
+      verifier,
+    );
+    return response;
+  }
+  const success = response as Extract<
+    TCloudlyLegacyDeploymentSettlementStdioSuccessResponseV1,
+    { command: 'settlement-production-resolve' }
+  >;
+  const resolution =
+    await normalizeAuthenticatedCloudlyLegacyDeploymentSettlementResolutionForAuthorities(
+      success.payload.authenticatedResolution,
+      request.payload.sourceAuthorityHandoff.authorityMetadata,
+      request.payload.productionAuthorityHandoff.authorityMetadata,
+      request.payload.authenticatedPlan,
+      request.payload.requestBundle,
+      request.payload.scratchReceipt,
+      request.payload.productionAuthorization,
+      verifier,
+    );
+  if (resolution.payload.observedAt !== request.payload.observedAt) {
+    fail('CROSS_FIELD_MISMATCH', 'stdioResponse.payload.authenticatedResolution.observedAt');
+  }
+  return response;
+};
+
+const encodeStdioFrame = (
+  valueArg: unknown,
+  maximumBytesArg: number,
+  pathArg: string,
+): Uint8Array => {
+  const payload = encodeNormalized(valueArg, pathArg);
+  if (payload.byteLength + 1 > maximumBytesArg) fail('LIMIT_EXCEEDED', pathArg);
+  const output = new Uint8Array(payload.byteLength + 1);
+  output.set(payload);
+  output[payload.byteLength] = 0x0a;
+  return output;
+};
+
+export const encodeCloudlyLegacyDeploymentSettlementStdioRequestFrame = (
+  valueArg: unknown,
+): Uint8Array => encodeStdioFrame(
+  normalizeCloudlyLegacyDeploymentSettlementStdioRequest(valueArg),
+  cloudlyLegacyDeploymentSettlementStdioLimits.maximumRequestFrameBytes,
+  'stdioRequest',
+);
+
+export const encodeCloudlyLegacyDeploymentSettlementStdioResponseFrame = (
+  valueArg: unknown,
+): Uint8Array => encodeStdioFrame(
+  normalizeCloudlyLegacyDeploymentSettlementStdioResponse(valueArg),
+  cloudlyLegacyDeploymentSettlementStdioLimits.maximumResponseFrameBytes,
+  'stdioResponse',
+);
+
+const decodeStdioFrame = <T>(
+  frameArg: Uint8Array,
+  maximumBytesArg: number,
+  pathArg: string,
+  normalizeArg: (valueArg: unknown) => Readonly<T>,
+  encodeArg: (valueArg: unknown) => Uint8Array,
+): Readonly<T> => {
+  if (!(frameArg instanceof Uint8Array)
+    || frameArg.byteLength < 3
+    || frameArg.byteLength > maximumBytesArg
+    || frameArg.at(-1) !== 0x0a
+    || frameArg.subarray(0, -1).some((byteArg) => byteArg === 0x0a || byteArg === 0x0d)) {
+    fail('INVALID_DATA', pathArg);
+  }
+  const payloadBytes = new Uint8Array(frameArg.subarray(0, -1));
+  let text: string;
+  try {
+    text = new TextDecoder('utf-8', { fatal: true }).decode(payloadBytes);
+  } catch {
+    return fail('INVALID_DATA', pathArg);
+  }
+  let value: unknown;
+  try {
+    value = JSON.parse(text) as unknown;
+  } catch {
+    return fail('INVALID_DATA', pathArg);
+  }
+  const normalized = normalizeArg(value);
+  const canonicalFrame = encodeArg(normalized);
+  if (!Buffer.from(canonicalFrame).equals(Buffer.from(frameArg))) {
+    fail('INVALID_DATA', pathArg);
+  }
+  return normalized;
+};
+
+export const decodeCloudlyLegacyDeploymentSettlementStdioRequestFrame = (
+  frameArg: Uint8Array,
+): Readonly<TCloudlyLegacyDeploymentSettlementStdioRequestV1> => decodeStdioFrame(
+  frameArg,
+  cloudlyLegacyDeploymentSettlementStdioLimits.maximumRequestFrameBytes,
+  'stdioRequestFrame',
+  normalizeCloudlyLegacyDeploymentSettlementStdioRequest,
+  encodeCloudlyLegacyDeploymentSettlementStdioRequestFrame,
+);
+
+export const decodeCloudlyLegacyDeploymentSettlementStdioResponseFrame = (
+  frameArg: Uint8Array,
+): Readonly<TCloudlyLegacyDeploymentSettlementStdioResponseV1> => decodeStdioFrame(
+  frameArg,
+  cloudlyLegacyDeploymentSettlementStdioLimits.maximumResponseFrameBytes,
+  'stdioResponseFrame',
+  normalizeCloudlyLegacyDeploymentSettlementStdioResponse,
+  encodeCloudlyLegacyDeploymentSettlementStdioResponseFrame,
+);
+
 export { cloudlyLegacyDeploymentSettlementGoldenVectors } from './runtime.cloudlylegacydeploymentsettlement.golden.js';