@serve.zone/interfaces 32.12.0 → 32.14.0

package/ts/data/fleetcutover.ts

@@ -0,0 +1,1693 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IClusterRuntimeReference, TClusterRuntimePhase } from './clusterruntime.js';
+import { snapshotClusterRuntimeReference } from './clusterruntime.js';
+import type {
+  IRuntimeAssignmentReference,
+  IRuntimeAuthorityReference,
+} from './runtimeassignment.js';
+import type { IRuntimeSessionBinding } from './runtimesession.js';
+import type { ISecretVersionReference } from './secret.js';
+import {
+  canonicalizeStrictJson,
+  createCanonicalJsonSha256Hex,
+} from '../private/canonicaljson.js';
+import {
+  captureNetwork,
+  networkCounter,
+  networkDigest,
+  networkId,
+  networkList,
+  networkNodeId,
+  networkRecord,
+  networkReference,
+  networkSorted,
+  requireNetwork,
+} from '../private/networkcontract.js';
+
+/**
+ * A server-owned accepted record reference. It contains no bearer, secret, or proof boolean.
+ * Consumers dereference it against the current owner record before applying policy.
+ */
+export type IFleetCutoverAcceptedEvidenceReference = IRuntimeAuthorityReference;
+
+export type TFleetCutoverPlatformOwner =
+  | 'application'
+  | 'coreflow'
+  | 'corestore'
+  | 'coretraffic';
+
+export type TFleetCutoverMountClass =
+  | 'docker-socket'
+  | 'cgroup'
+  | 'persistent-volume'
+  | 'bind'
+  | 'tmpfs'
+  | 'other'
+  | 'unknown';
+
+export type TFleetCutoverMountType = 'volume' | 'bind' | 'tmpfs' | 'unknown';
+
+/**
+ * Value-free mount identity. The three digests are derived from exact Docker Engine bytes by the
+ * helpers below; no path, volume-name, case, separator, or alias normalization is permitted.
+ */
+export interface IFleetCutoverMountDescriptor {
+  type: TFleetCutoverMountType;
+  classification: TFleetCutoverMountClass;
+  sourceIdentityDigest: TSha256Digest;
+  targetIdentityDigest: TSha256Digest;
+  readOnly: boolean;
+  mountIdentityDigest: TSha256Digest;
+}
+
+export interface IFleetCutoverMountSourceIdentityInput {
+  /** Docker Engine Mount.Type exactly as returned; unsupported values are represented as unknown. */
+  type: TFleetCutoverMountType;
+  /** Docker Engine Mount.Source exact UTF-8 bytes, including the empty string; never normalize. */
+  source: string;
+}
+
+export interface IFleetCutoverMountTargetIdentityInput {
+  /** Docker Engine Mount.Destination exact UTF-8 bytes; never normalize. */
+  target: string;
+}
+
+export type TFleetCutoverDockerTaskState =
+  | 'new'
+  | 'allocated'
+  | 'pending'
+  | 'assigned'
+  | 'accepted'
+  | 'preparing'
+  | 'ready'
+  | 'starting'
+  | 'running'
+  | 'complete'
+  | 'shutdown'
+  | 'failed'
+  | 'rejected'
+  | 'remove'
+  | 'orphaned';
+
+export type TFleetCutoverDockerDesiredState = TFleetCutoverDockerTaskState;
+
+export type TFleetCutoverDockerServiceMode =
+  | { kind: 'global' }
+  | { kind: 'replicated'; replicas: number };
+
+/** Only the ownership labels used by cutover policy are transported. */
+export interface IFleetCutoverDockerOwnershipLabels {
+  serviceId: string | null;
+  platformOwner: Exclude<TFleetCutoverPlatformOwner, 'application'> | null;
+}
+
+/** Value-free immutable identity of one Docker service specification. */
+export interface IFleetCutoverDockerService {
+  dockerServiceId: string;
+  dockerServiceName: string;
+  specVersion: number;
+  specDigest: TSha256Digest;
+  imageDigest: TSha256Digest;
+  mode: TFleetCutoverDockerServiceMode;
+  desiredTaskCount: number;
+  constraintCount: number;
+  constraintSetDigest: TSha256Digest;
+  mounts: IFleetCutoverMountDescriptor[];
+  ownershipLabels: IFleetCutoverDockerOwnershipLabels;
+}
+
+/** Value-free physical task/container evidence from the same Docker census. */
+export interface IFleetCutoverDockerTask {
+  dockerTaskId: string;
+  dockerServiceId: string;
+  /** Null exactly when Docker Task.NodeID is absent and the task remains unassigned. */
+  swarmNodeId: string | null;
+  /** Resolved from the same manager census as swarmNodeId; null iff swarmNodeId is null. */
+  nodeName: string | null;
+  desiredState: TFleetCutoverDockerDesiredState;
+  state: TFleetCutoverDockerTaskState;
+  container: null | {
+    dockerContainerId: string;
+  };
+}
+
+export interface IFleetCutoverPhysicalContainer {
+  dockerContainerId: string;
+  dockerServiceId: string | null;
+  dockerTaskId: string | null;
+  imageId: TSha256Digest;
+  serviceIdLabel: string | null;
+  mounts: IFleetCutoverMountDescriptor[];
+}
+
+export interface IFleetCutoverContainerSetIdentity {
+  containerCount: number;
+  containerIdsDigest: TSha256Digest;
+}
+
+/**
+ * One node's local Docker daemon snapshot. `before` and `after` are independently read bounded
+ * container-ID sets around all inspect calls and must equal the transported container list.
+ */
+export interface IFleetCutoverLocalNodeSnapshot {
+  swarmNodeId: string;
+  before: IFleetCutoverContainerSetIdentity;
+  containers: IFleetCutoverPhysicalContainer[];
+  after: IFleetCutoverContainerSetIdentity;
+  snapshotDigest: TSha256Digest;
+}
+
+/** Manager-visible Swarm state only; physical containers come from each node's own observation. */
+export interface IFleetCutoverDockerInventory {
+  swarmClusterId: string;
+  managerSwarmNodeId: string;
+  services: IFleetCutoverDockerService[];
+  tasks: IFleetCutoverDockerTask[];
+}
+
+export interface IFleetCutoverManagerSnapshot {
+  inventory: IFleetCutoverDockerInventory;
+  inventoryDigest: TSha256Digest;
+}
+
+/** Cloudly-owned reference to one already authenticated and accepted Spark observation. */
+export interface IFleetCutoverSparkObservationReference {
+  observation: IFleetCutoverAcceptedEvidenceReference;
+  nodeId: string;
+  swarmNodeId: string;
+  credentialGeneration: number;
+  reporterSessionId: string;
+  observationSequence: number;
+  observedAt: number;
+  acceptedAt: number;
+  freshUntil: number;
+  observationDigest: TSha256Digest;
+  snapshotDigest: TSha256Digest;
+}
+
+export interface IFleetCutoverManagerCensusRead
+extends IFleetCutoverSparkObservationReference {
+  swarmSnapshotDigest: TSha256Digest;
+  inventoryDigest: TSha256Digest;
+}
+
+export interface IFleetCutoverTargetSetReference {
+  cloudlyClusterId: string;
+  generation: number;
+  targetSetDigest: TSha256Digest;
+}
+
+/** Cloudly-assembled candidate over accepted Spark observations; Spark never submits this shape. */
+export interface IFleetCutoverCensusCandidate {
+  clusterId: string;
+  runtime: IClusterRuntimeReference;
+  targetSet: IFleetCutoverTargetSetReference;
+  inventory: IFleetCutoverDockerInventory;
+  /** Exactly two consecutive accepted reads by the same current manager session. */
+  managerReads: [IFleetCutoverManagerCensusRead, IFleetCutoverManagerCensusRead];
+  /** Exactly one accepted local physical-container observation per current target node. */
+  nodeObservations: IFleetCutoverSparkObservationReference[];
+  /** Fixed by the oldest referenced observation; reassembly cannot extend it. */
+  freshUntil: number;
+}
+
+/** Cloudly-owned accepted census. Acceptance freshness and authentication are owner policy. */
+export interface IFleetCutoverCensus extends IFleetCutoverCensusCandidate {
+  id: string;
+  generation: number;
+  acceptedAt: number;
+  digest: TSha256Digest;
+}
+
+export interface IFleetCutoverScopeEntry {
+  dockerServiceId: string;
+  serviceId: string | null;
+  owner: TFleetCutoverPlatformOwner | 'unknown';
+  serviceAuthority: IFleetCutoverAcceptedEvidenceReference | null;
+  classificationAuthority: IFleetCutoverAcceptedEvidenceReference | null;
+}
+
+/**
+ * Authoritative cutover scope. `complete` is a Cloudly policy verdict over current service
+ * authority and a fresh accepted census; structural validation only checks its closed content.
+ */
+export interface IFleetCutoverScope {
+  id: string;
+  generation: number;
+  previous: IFleetCutoverAcceptedEvidenceReference | null;
+  state: 'incomplete' | 'complete';
+  clusterId: string;
+  census: IFleetCutoverAcceptedEvidenceReference;
+  runtime: IClusterRuntimeReference;
+  targetSet: IFleetCutoverTargetSetReference;
+  entries: IFleetCutoverScopeEntry[];
+  actorId: string;
+  acceptedAt: number;
+  digest: TSha256Digest;
+}
+
+/** Legitimate administrator classification bound to one current accepted census. */
+export interface IFleetCutoverClassification {
+  dockerServiceId: string;
+  serviceId: string;
+  owner: TFleetCutoverPlatformOwner;
+}
+
+export interface IFleetCutoverScopeClassificationRequest {
+  mutationId: string;
+  clusterId: string;
+  expectedScopeGeneration: number;
+  census: IFleetCutoverAcceptedEvidenceReference;
+  classifications: IFleetCutoverClassification[];
+}
+
+/** Server-owned pre-switch intent. It is not a ready storage claim or mount authority. */
+export interface IFleetCutoverVolumeHandoffIntent {
+  id: string;
+  generation: number;
+  clusterId: string;
+  nodeId: string;
+  serviceId: string;
+  volumeId: string;
+  mountIdentityDigest: TSha256Digest;
+  sourceLineageDigest: TSha256Digest;
+  storageRequestDigest: TSha256Digest;
+  runtime: IClusterRuntimeReference & { phase: 'draining' };
+  scope: IFleetCutoverAcceptedEvidenceReference;
+  targetSet: IFleetCutoverTargetSetReference;
+  legacyStorageEvidence: IFleetCutoverAcceptedEvidenceReference;
+  sourceNodeObservation: IFleetCutoverAcceptedEvidenceReference;
+  acceptedAt: number;
+  digest: TSha256Digest;
+}
+
+interface IFleetCutoverVolumeFenceBase {
+  id: string;
+  generation: number;
+  previous: IFleetCutoverAcceptedEvidenceReference | null;
+  clusterId: string;
+  nodeId: string;
+  serviceId: string;
+  volumeId: string;
+  mountIdentityDigest: TSha256Digest;
+  handoffIntent: IFleetCutoverAcceptedEvidenceReference;
+  heldRuntime: IClusterRuntimeReference & { phase: 'draining' };
+  heldAt: number;
+  digest: TSha256Digest;
+}
+
+/**
+ * Pallet root-local durable negative authority. `held` grants no runtime session, assignment,
+ * attachment, reservation, confirmation, or execution authority.
+ */
+export type TFleetCutoverVolumeFence =
+  | (IFleetCutoverVolumeFenceBase & { state: 'held' })
+  | (IFleetCutoverVolumeFenceBase & {
+      state: 'consumed';
+      consumedRuntime: IClusterRuntimeReference & { phase: 'pallet' };
+      adoptionReceipt: IFleetCutoverAcceptedEvidenceReference;
+      claim: IRuntimeAuthorityReference;
+      consumedAt: number;
+    });
+
+/** Corestore's one-shot accepted result around the initial lineage/RWO CAS. */
+export interface IFleetCutoverCorestoreAdoptionReceipt {
+  id: string;
+  generation: 1;
+  clusterId: string;
+  nodeId: string;
+  serviceId: string;
+  volumeId: string;
+  mountIdentityDigest: TSha256Digest;
+  handoffIntent: IFleetCutoverAcceptedEvidenceReference;
+  palletFence: IFleetCutoverAcceptedEvidenceReference;
+  sourceLineageDigest: TSha256Digest;
+  claim: IRuntimeAuthorityReference;
+  accessMode: 'ReadWriteOnce';
+  acceptedAt: number;
+  digest: TSha256Digest;
+}
+
+export interface IFleetCutoverCoreflowRetirementEvidence {
+  id: string;
+  generation: number;
+  clusterId: string;
+  scope: IFleetCutoverAcceptedEvidenceReference;
+  targetSet: IFleetCutoverTargetSetReference;
+  runtime: IClusterRuntimeReference;
+  relay: {
+    serviceId: string;
+    nodeId: string;
+    dockerServiceId: string;
+    dockerContainerId: string;
+    specVersion: number;
+    specDigest: TSha256Digest;
+    imageDigest: TSha256Digest;
+    managerObservation: IFleetCutoverAcceptedEvidenceReference;
+    nodeObservation: IFleetCutoverAcceptedEvidenceReference;
+    credential: IRuntimeAuthorityReference;
+    acceptedRegistration: IFleetCutoverAcceptedEvidenceReference;
+    version: string;
+  };
+  spark: {
+    nodeId: string;
+    credentialGeneration: number;
+    reporterSessionId: string;
+    observationSequence: number;
+    observation: IFleetCutoverAcceptedEvidenceReference;
+    bundleVersion: string;
+    bundleSourceCommit: string;
+    bundleManifestSha256: string;
+    unitName: string;
+    unitDigest: TSha256Digest;
+  };
+  legacy: {
+    credential: IRuntimeAuthorityReference;
+    invalidation: IFleetCutoverAcceptedEvidenceReference;
+    oldModeRefusal: IFleetCutoverAcceptedEvidenceReference;
+    configurationCas: IFleetCutoverAcceptedEvidenceReference;
+    sourceOwnerGeneration: number;
+    sourceSha256: string;
+    sourceDisposition: 'retained-inert' | 'removed';
+  };
+  acceptedAt: number;
+  digest: TSha256Digest;
+}
+
+/**
+ * Administrator intent to prepare the one explicitly designated ingress service. The caller
+ * supplies only compare-and-swap inputs; Cloudly owns credential generation and acceptance.
+ */
+export interface IFleetCutoverIngressPreparationRequest {
+  mutationId: string;
+  clusterId: string;
+  ingressServiceId: string;
+  currentRuntime: IClusterRuntimeReference & { phase: 'pallet' };
+  scope: IFleetCutoverAcceptedEvidenceReference;
+  targetSet: IFleetCutoverTargetSetReference;
+  expectedSpecRevision: number;
+  /** Null for creation; the exact current designation for same-service credential rotation. */
+  expectedDesignation: IFleetCutoverAcceptedEvidenceReference | null;
+}
+
+/** Public identity of the active ingress credential generation; it contains no credential value. */
+export interface IFleetCutoverIngressCredentialReference {
+  credentialId: string;
+  generation: number;
+  secretVersion: ISecretVersionReference;
+}
+
+/**
+ * Cloudly's accepted pre-assignment designation. This grants no assignment, session,
+ * registration, publication, port-transfer, or post-registration ingress authority.
+ */
+export interface IFleetCutoverIngressDesignation {
+  id: string;
+  generation: number;
+  previous: IFleetCutoverAcceptedEvidenceReference | null;
+  clusterId: string;
+  runtime: IClusterRuntimeReference & { phase: 'pallet' };
+  scope: IFleetCutoverAcceptedEvidenceReference;
+  targetSet: IFleetCutoverTargetSetReference;
+  ingressServiceId: string;
+  preparedSpecRevision: number;
+  credential: IFleetCutoverIngressCredentialReference;
+  actorId: string;
+  acceptedAt: number;
+  digest: TSha256Digest;
+}
+
+export interface IFleetCutoverIngressAuthority {
+  id: string;
+  generation: number;
+  clusterId: string;
+  runtime: IClusterRuntimeReference & { phase: 'pallet' };
+  scope: IFleetCutoverAcceptedEvidenceReference;
+  targetSet: IFleetCutoverTargetSetReference;
+  ingressServiceId: string;
+  assignment: IRuntimeAssignmentReference;
+  session: IRuntimeSessionBinding;
+  ingressRegistration: IFleetCutoverAcceptedEvidenceReference;
+  registrationRouteRevision: number | null;
+  legacyIngressAbsence: IFleetCutoverAcceptedEvidenceReference;
+  sourcePublication: IFleetCutoverAcceptedEvidenceReference;
+  targetPublication: IFleetCutoverAcceptedEvidenceReference;
+  portTransfer: IFleetCutoverAcceptedEvidenceReference;
+  routeTableRevision: number;
+  routeTableReadback: IFleetCutoverAcceptedEvidenceReference;
+  acceptedAt: number;
+  digest: TSha256Digest;
+}
+
+interface IFleetCutoverPhaseAdvanceBase {
+  mutationId: string;
+  clusterId: string;
+  currentRuntime: IClusterRuntimeReference;
+  scope: IFleetCutoverAcceptedEvidenceReference;
+  targetSet: IFleetCutoverTargetSetReference;
+}
+
+/** Caller intent only. Cloudly dereferences every receipt and applies the transition atomically. */
+export type TFleetCutoverPhaseAdvance =
+  | (IFleetCutoverPhaseAdvanceBase & {
+      from: 'swarm';
+      to: 'draining';
+      coreflowRetirement: IFleetCutoverAcceptedEvidenceReference;
+    })
+  | (IFleetCutoverPhaseAdvanceBase & {
+      from: 'draining';
+      to: 'switching';
+      swarmQuiescence: IFleetCutoverAcceptedEvidenceReference;
+      heldRuntimeSpecs: IFleetCutoverAcceptedEvidenceReference;
+      heldVolumeFences: IFleetCutoverAcceptedEvidenceReference;
+    })
+  | (IFleetCutoverPhaseAdvanceBase & {
+      from: 'switching';
+      to: 'pallet';
+      heldRuntimeSpecs: IFleetCutoverAcceptedEvidenceReference;
+      heldVolumeFences: IFleetCutoverAcceptedEvidenceReference;
+      palletPreparation: IFleetCutoverAcceptedEvidenceReference;
+    });
+
+export type TFleetCutoverRuntimeSpecRelease =
+  | {
+      kind: 'ingress';
+      mutationId: string;
+      clusterId: string;
+      serviceId: string;
+      expectedSpecRevision: number;
+      runtime: IClusterRuntimeReference & { phase: 'pallet' };
+      scope: IFleetCutoverAcceptedEvidenceReference;
+      emptyPublishedPortsPolicy: IFleetCutoverAcceptedEvidenceReference;
+    }
+  | {
+      kind: 'application';
+      mutationId: string;
+      clusterId: string;
+      serviceId: string;
+      expectedSpecRevision: number;
+      runtime: IClusterRuntimeReference & { phase: 'pallet' };
+      scope: IFleetCutoverAcceptedEvidenceReference;
+      ingressAuthority: IFleetCutoverAcceptedEvidenceReference;
+    };
+
+export const fleetCutoverContract = Object.freeze({
+  maximumServices: 512,
+  maximumTasks: 4096,
+  maximumNodes: 1024,
+  maximumContainersPerNode: 512,
+  maximumMountsPerOwner: 32,
+  maximumClassifications: 512,
+  observationFreshnessMs: 300_000,
+  mountSourceIdentityDigestDomain: 'serve.zone/fleet-cutover-mount-source-identity',
+  mountTargetIdentityDigestDomain: 'serve.zone/fleet-cutover-mount-target-identity',
+  mountIdentityDigestDomain: 'serve.zone/fleet-cutover-mount-identity',
+  containerSetIdentityDigestDomain: 'serve.zone/fleet-cutover-container-set-identity',
+  localNodeSnapshotDigestDomain: 'serve.zone/fleet-cutover-local-node-snapshot',
+  managerSnapshotDigestDomain: 'serve.zone/fleet-cutover-manager-snapshot',
+  censusDigestDomain: 'serve.zone/fleet-cutover-census',
+  scopeDigestDomain: 'serve.zone/fleet-cutover-scope',
+  volumeHandoffDigestDomain: 'serve.zone/fleet-cutover-volume-handoff',
+  volumeFenceDigestDomain: 'serve.zone/fleet-cutover-volume-fence',
+  corestoreAdoptionDigestDomain: 'serve.zone/fleet-cutover-corestore-adoption',
+  coreflowRetirementDigestDomain: 'serve.zone/fleet-cutover-coreflow-retirement',
+  ingressDesignationDigestDomain: 'serve.zone/fleet-cutover-ingress-designation',
+  ingressAuthorityDigestDomain: 'serve.zone/fleet-cutover-ingress-authority',
+  legalPhaseTransitions: Object.freeze({
+    swarm: 'draining',
+    draining: 'switching',
+    switching: 'pallet',
+    pallet: null,
+  } satisfies Record<TClusterRuntimePhase, TClusterRuntimePhase | null>),
+} as const);
+
+const fail = (): never => { throw new Error('Fleet cutover contract rejected.'); };
+const safe = <T>(operationArg: () => T): T => {
+  try { return operationArg(); } catch { return fail(); }
+};
+const nonNegative = (valueArg: unknown): number => {
+  requireNetwork(Number.isSafeInteger(valueArg) && (valueArg as number) >= 0);
+  return valueArg as number;
+};
+const literal = <T extends string>(valuesArg: readonly T[], valueArg: unknown): T => {
+  requireNetwork(valuesArg.includes(valueArg as T));
+  return valueArg as T;
+};
+const sha256Hex = (valueArg: unknown): string => {
+  requireNetwork(typeof valueArg === 'string' && /^[a-f0-9]{64}$/.test(valueArg));
+  return valueArg;
+};
+const releaseVersion = (valueArg: unknown): string => {
+  requireNetwork(typeof valueArg === 'string'
+    && /^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$/.test(valueArg)
+    && valueArg.length <= 32);
+  return valueArg;
+};
+const reference = (valueArg: unknown): IFleetCutoverAcceptedEvidenceReference =>
+  networkReference(valueArg);
+const targetSetReference = (valueArg: unknown): IFleetCutoverTargetSetReference => {
+  const value = networkRecord(valueArg, ['cloudlyClusterId', 'generation', 'targetSetDigest']);
+  return {
+    cloudlyClusterId: networkId(value.cloudlyClusterId),
+    generation: networkCounter(value.generation),
+    targetSetDigest: networkDigest(value.targetSetDigest),
+  };
+};
+const runtimeReference = (valueArg: unknown): IClusterRuntimeReference =>
+  snapshotClusterRuntimeReference(valueArg);
+const assignmentReference = (valueArg: unknown): IRuntimeAssignmentReference => {
+  const value = networkRecord(valueArg, ['assignmentId', 'generation', 'digest']);
+  return {
+    assignmentId: networkId(value.assignmentId),
+    generation: networkCounter(value.generation),
+    digest: networkDigest(value.digest),
+  };
+};
+const ingressCredentialReference = (
+  valueArg: unknown,
+): IFleetCutoverIngressCredentialReference => {
+  const value = networkRecord(valueArg, ['credentialId', 'generation', 'secretVersion']);
+  const secretVersion = networkRecord(value.secretVersion, ['secretId', 'secretVersionId']);
+  return {
+    credentialId: networkId(value.credentialId),
+    generation: networkCounter(value.generation),
+    secretVersion: {
+      secretId: networkId(secretVersion.secretId),
+      secretVersionId: networkId(secretVersion.secretVersionId),
+    },
+  };
+};
+const mountTypeAndClassification = (
+  typeArg: unknown,
+  classificationArg: unknown,
+): Pick<IFleetCutoverMountDescriptor, 'type' | 'classification'> => {
+  const type = literal(['volume', 'bind', 'tmpfs', 'unknown'] as const, typeArg);
+  const classification = literal([
+    'docker-socket', 'cgroup', 'persistent-volume', 'bind', 'tmpfs', 'other', 'unknown',
+  ] as const, classificationArg);
+  requireNetwork(
+    (type === 'volume' && ['persistent-volume', 'other', 'unknown'].includes(classification))
+    || (type === 'bind' && ['docker-socket', 'cgroup', 'bind', 'other', 'unknown'].includes(classification))
+    || (type === 'tmpfs' && ['tmpfs', 'other', 'unknown'].includes(classification))
+    || (type === 'unknown' && classification === 'unknown'),
+  );
+  return { type, classification };
+};
+const mountDescriptor = (valueArg: unknown): IFleetCutoverMountDescriptor => {
+  const value = networkRecord(valueArg, [
+    'type', 'classification', 'sourceIdentityDigest', 'targetIdentityDigest', 'readOnly',
+    'mountIdentityDigest',
+  ]);
+  requireNetwork(typeof value.readOnly === 'boolean');
+  const shape = mountTypeAndClassification(value.type, value.classification);
+  return {
+    ...shape,
+    sourceIdentityDigest: networkDigest(value.sourceIdentityDigest),
+    targetIdentityDigest: networkDigest(value.targetIdentityDigest),
+    readOnly: value.readOnly,
+    mountIdentityDigest: networkDigest(value.mountIdentityDigest),
+  };
+};
+const sortedMountDescriptors = (valueArg: unknown): IFleetCutoverMountDescriptor[] => networkSorted(
+  networkList(valueArg, fleetCutoverContract.maximumMountsPerOwner, mountDescriptor),
+  itemArg => itemArg.mountIdentityDigest,
+);
+const dockerMode = (valueArg: unknown): TFleetCutoverDockerServiceMode => {
+  requireNetwork(valueArg !== null && typeof valueArg === 'object');
+  const kind = (valueArg as Record<string, unknown>).kind;
+  if (kind === 'global') {
+    networkRecord(valueArg, ['kind']);
+    return { kind };
+  }
+  const value = networkRecord(valueArg, ['kind', 'replicas']);
+  requireNetwork(kind === 'replicated');
+  return { kind, replicas: nonNegative(value.replicas) };
+};
+const ownershipLabels = (valueArg: unknown): IFleetCutoverDockerOwnershipLabels => {
+  const value = networkRecord(valueArg, ['serviceId', 'platformOwner']);
+  const serviceId = value.serviceId === null ? null : networkId(value.serviceId);
+  const platformOwner = value.platformOwner === null ? null : literal([
+    'coreflow', 'corestore', 'coretraffic',
+  ] as const, value.platformOwner);
+  return { serviceId, platformOwner };
+};
+const dockerService = (valueArg: unknown): IFleetCutoverDockerService => {
+  const value = networkRecord(valueArg, [
+    'dockerServiceId', 'dockerServiceName', 'specVersion', 'specDigest', 'imageDigest', 'mode',
+    'desiredTaskCount', 'constraintCount', 'constraintSetDigest', 'mounts', 'ownershipLabels',
+  ]);
+  return {
+    dockerServiceId: networkId(value.dockerServiceId),
+    dockerServiceName: networkId(value.dockerServiceName),
+    specVersion: networkCounter(value.specVersion),
+    specDigest: networkDigest(value.specDigest),
+    imageDigest: networkDigest(value.imageDigest),
+    mode: dockerMode(value.mode),
+    desiredTaskCount: nonNegative(value.desiredTaskCount),
+    constraintCount: nonNegative(value.constraintCount),
+    constraintSetDigest: networkDigest(value.constraintSetDigest),
+    mounts: sortedMountDescriptors(value.mounts),
+    ownershipLabels: ownershipLabels(value.ownershipLabels),
+  };
+};
+const dockerTask = (valueArg: unknown): IFleetCutoverDockerTask => {
+  const value = networkRecord(valueArg, [
+    'dockerTaskId', 'dockerServiceId', 'swarmNodeId', 'nodeName', 'desiredState', 'state', 'container',
+  ]);
+  let container: IFleetCutoverDockerTask['container'] = null;
+  if (value.container !== null) {
+    const containerValue = networkRecord(value.container, ['dockerContainerId']);
+    container = {
+      dockerContainerId: networkId(containerValue.dockerContainerId),
+    };
+  }
+  const swarmNodeId = value.swarmNodeId === null ? null : networkId(value.swarmNodeId);
+  const nodeName = value.nodeName === null ? null : networkId(value.nodeName);
+  requireNetwork((swarmNodeId === null) === (nodeName === null));
+  const taskStates = [
+    'new', 'allocated', 'pending', 'assigned', 'accepted', 'preparing', 'ready', 'starting',
+    'running', 'complete', 'shutdown', 'failed', 'rejected', 'remove', 'orphaned',
+  ] as const;
+  return {
+    dockerTaskId: networkId(value.dockerTaskId),
+    dockerServiceId: networkId(value.dockerServiceId),
+    swarmNodeId,
+    nodeName,
+    desiredState: literal(taskStates, value.desiredState),
+    state: literal(taskStates, value.state),
+    container,
+  };
+};
+const physicalContainer = (valueArg: unknown): IFleetCutoverPhysicalContainer => {
+  const value = networkRecord(valueArg, [
+    'dockerContainerId', 'dockerServiceId', 'dockerTaskId', 'imageId', 'serviceIdLabel', 'mounts',
+  ]);
+  return {
+    dockerContainerId: networkId(value.dockerContainerId),
+    dockerServiceId: value.dockerServiceId === null ? null : networkId(value.dockerServiceId),
+    dockerTaskId: value.dockerTaskId === null ? null : networkId(value.dockerTaskId),
+    imageId: networkDigest(value.imageId),
+    serviceIdLabel: value.serviceIdLabel === null ? null : networkId(value.serviceIdLabel),
+    mounts: sortedMountDescriptors(value.mounts),
+  };
+};
+const inventory = (valueArg: unknown): IFleetCutoverDockerInventory => {
+  const value = networkRecord(valueArg, [
+    'swarmClusterId', 'managerSwarmNodeId', 'services', 'tasks',
+  ]);
+  const services = networkSorted(networkList(
+    value.services,
+    fleetCutoverContract.maximumServices,
+    dockerService,
+  ), itemArg => itemArg.dockerServiceId);
+  const serviceIds = new Set(services.map(itemArg => itemArg.dockerServiceId));
+  const tasks = networkSorted(networkList(
+    value.tasks,
+    fleetCutoverContract.maximumTasks,
+    dockerTask,
+  ), itemArg => `${itemArg.dockerServiceId}\0${itemArg.dockerTaskId}`);
+  requireNetwork(tasks.every(itemArg => serviceIds.has(itemArg.dockerServiceId)));
+  return {
+    swarmClusterId: networkId(value.swarmClusterId),
+    managerSwarmNodeId: networkId(value.managerSwarmNodeId),
+    services,
+    tasks,
+  };
+};
+const observationReference = (valueArg: unknown): IFleetCutoverSparkObservationReference => {
+  const value = networkRecord(valueArg, [
+    'observation', 'nodeId', 'swarmNodeId', 'credentialGeneration', 'reporterSessionId',
+    'observationSequence', 'observedAt', 'acceptedAt', 'freshUntil', 'observationDigest',
+    'snapshotDigest',
+  ]);
+  const result: IFleetCutoverSparkObservationReference = {
+    observation: reference(value.observation),
+    nodeId: networkNodeId(value.nodeId),
+    swarmNodeId: networkId(value.swarmNodeId),
+    credentialGeneration: networkCounter(value.credentialGeneration),
+    reporterSessionId: networkId(value.reporterSessionId),
+    observationSequence: networkCounter(value.observationSequence),
+    observedAt: networkCounter(value.observedAt),
+    acceptedAt: networkCounter(value.acceptedAt),
+    freshUntil: networkCounter(value.freshUntil),
+    observationDigest: networkDigest(value.observationDigest),
+    snapshotDigest: networkDigest(value.snapshotDigest),
+  };
+  requireNetwork(result.acceptedAt >= result.observedAt
+    && result.acceptedAt <= result.freshUntil
+    && result.freshUntil === result.observedAt + fleetCutoverContract.observationFreshnessMs);
+  return result;
+};
+const managerCensusRead = (valueArg: unknown): IFleetCutoverManagerCensusRead => {
+  const value = networkRecord(valueArg, [
+    'observation', 'nodeId', 'swarmNodeId', 'credentialGeneration', 'reporterSessionId',
+    'observationSequence', 'observedAt', 'acceptedAt', 'freshUntil', 'observationDigest',
+    'snapshotDigest', 'swarmSnapshotDigest', 'inventoryDigest',
+  ]);
+  return {
+    ...observationReference({
+      observation: value.observation,
+      nodeId: value.nodeId,
+      swarmNodeId: value.swarmNodeId,
+      credentialGeneration: value.credentialGeneration,
+      reporterSessionId: value.reporterSessionId,
+      observationSequence: value.observationSequence,
+      observedAt: value.observedAt,
+      acceptedAt: value.acceptedAt,
+      freshUntil: value.freshUntil,
+      observationDigest: value.observationDigest,
+      snapshotDigest: value.snapshotDigest,
+    }),
+    swarmSnapshotDigest: networkDigest(value.swarmSnapshotDigest),
+    inventoryDigest: networkDigest(value.inventoryDigest),
+  };
+};
+
+const canonicalDigest = async (domainArg: string, valueArg: object): Promise<TSha256Digest> => {
+  const { digest: _digest, ...payload } = valueArg as { digest?: unknown };
+  return `sha256:${await createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+    domain: domainArg,
+    payload,
+  }, fail), fail)}`;
+};
+
+const exactDockerText = (valueArg: unknown, allowEmptyArg: boolean): string => {
+  requireNetwork(typeof valueArg === 'string'
+    && new TextEncoder().encode(valueArg).length <= 4096
+    && (allowEmptyArg || valueArg.length > 0));
+  return valueArg;
+};
+
+const computeExactIdentityDigest = async (
+  domainArg: string,
+  inputArg: object,
+): Promise<TSha256Digest> => `sha256:${await createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+  domain: domainArg,
+  input: inputArg,
+}, fail), fail)}`;
+
+export const computeFleetCutoverMountSourceIdentityDigest = async (
+  valueArg: IFleetCutoverMountSourceIdentityInput,
+): Promise<TSha256Digest> => safe(async () => {
+  const value = networkRecord(valueArg, ['type', 'source']);
+  return computeExactIdentityDigest(fleetCutoverContract.mountSourceIdentityDigestDomain, {
+    type: literal(['volume', 'bind', 'tmpfs', 'unknown'] as const, value.type),
+    source: exactDockerText(value.source, true),
+  });
+});
+
+export const computeFleetCutoverMountTargetIdentityDigest = async (
+  valueArg: IFleetCutoverMountTargetIdentityInput,
+): Promise<TSha256Digest> => safe(async () => {
+  const value = networkRecord(valueArg, ['target']);
+  return computeExactIdentityDigest(fleetCutoverContract.mountTargetIdentityDigestDomain, {
+    target: exactDockerText(value.target, false),
+  });
+});
+
+export const computeFleetCutoverMountIdentityDigest = async (
+  valueArg: Omit<IFleetCutoverMountDescriptor, 'mountIdentityDigest'>,
+): Promise<TSha256Digest> => safe(async () => {
+  const value = networkRecord(valueArg, [
+    'type', 'classification', 'sourceIdentityDigest', 'targetIdentityDigest', 'readOnly',
+  ]);
+  requireNetwork(typeof value.readOnly === 'boolean');
+  const shape = mountTypeAndClassification(value.type, value.classification);
+  return computeExactIdentityDigest(fleetCutoverContract.mountIdentityDigestDomain, {
+    ...shape,
+    sourceIdentityDigest: networkDigest(value.sourceIdentityDigest),
+    targetIdentityDigest: networkDigest(value.targetIdentityDigest),
+    readOnly: value.readOnly,
+  });
+});
+
+const validateMountDescriptors = async (
+  mountsArg: IFleetCutoverMountDescriptor[],
+): Promise<void> => {
+  for (const mount of mountsArg) {
+    const { mountIdentityDigest, ...input } = mount;
+    requireNetwork(mountIdentityDigest === await computeFleetCutoverMountIdentityDigest(input));
+  }
+};
+
+export const computeFleetCutoverContainerSetIdentityDigest = async (
+  containerIdsArg: string[],
+): Promise<TSha256Digest> => safe(async () => {
+  const containerIds = networkSorted(networkList(
+    containerIdsArg,
+    fleetCutoverContract.maximumContainersPerNode,
+    networkId,
+  ), itemArg => itemArg);
+  return computeExactIdentityDigest(fleetCutoverContract.containerSetIdentityDigestDomain, {
+    containerIds,
+  });
+});
+
+const containerSetIdentity = (valueArg: unknown): IFleetCutoverContainerSetIdentity => {
+  const value = networkRecord(valueArg, ['containerCount', 'containerIdsDigest']);
+  return {
+    containerCount: nonNegative(value.containerCount),
+    containerIdsDigest: networkDigest(value.containerIdsDigest),
+  };
+};
+
+export const snapshotFleetCutoverLocalNodeSnapshot = (
+  valueArg: unknown,
+): IFleetCutoverLocalNodeSnapshot => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), [
+    'swarmNodeId', 'before', 'containers', 'after', 'snapshotDigest',
+  ]);
+  const containers = networkSorted(networkList(
+    value.containers,
+    fleetCutoverContract.maximumContainersPerNode,
+    physicalContainer,
+  ), itemArg => itemArg.dockerContainerId);
+  const before = containerSetIdentity(value.before);
+  const after = containerSetIdentity(value.after);
+  requireNetwork(before.containerCount === containers.length
+    && after.containerCount === containers.length
+    && before.containerIdsDigest === after.containerIdsDigest);
+  return {
+    swarmNodeId: networkId(value.swarmNodeId),
+    before,
+    containers,
+    after,
+    snapshotDigest: networkDigest(value.snapshotDigest),
+  };
+});
+
+export const computeFleetCutoverLocalNodeSnapshotDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => safe(async () => {
+  const value = snapshotFleetCutoverLocalNodeSnapshot(valueArg);
+  const { snapshotDigest: _omitted, ...input } = value;
+  return computeExactIdentityDigest(fleetCutoverContract.localNodeSnapshotDigestDomain, input);
+});
+
+export const validateFleetCutoverLocalNodeSnapshot = async (
+  valueArg: unknown,
+): Promise<string[]> => {
+  try {
+    const value = snapshotFleetCutoverLocalNodeSnapshot(valueArg);
+    const containerIdsDigest = await computeFleetCutoverContainerSetIdentityDigest(
+      value.containers.map(itemArg => itemArg.dockerContainerId),
+    );
+    requireNetwork(value.before.containerIdsDigest === containerIdsDigest
+      && value.after.containerIdsDigest === containerIdsDigest);
+    for (const container of value.containers) await validateMountDescriptors(container.mounts);
+    return value.snapshotDigest === await computeFleetCutoverLocalNodeSnapshotDigest(value)
+      ? [] : ['fleet cutover local node snapshot digest does not match'];
+  } catch {
+    return ['fleet cutover local node snapshot must use its exact canonical schema'];
+  }
+};
+
+export const computeFleetCutoverInventoryDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => safe(async () => {
+  const hex = await createCanonicalJsonSha256Hex(
+    canonicalizeStrictJson({
+      domain: 'serve.zone/fleet-cutover-inventory',
+      inventory: inventory(captureNetwork(valueArg)),
+    }, fail),
+    fail,
+  );
+  return `sha256:${hex}` as TSha256Digest;
+});
+
+export const snapshotFleetCutoverManagerSnapshot = async (
+  valueArg: unknown,
+): Promise<IFleetCutoverManagerSnapshot> => safe(async () => {
+  const value = networkRecord(captureNetwork(valueArg), ['inventory', 'inventoryDigest']);
+  const inventoryValue = inventory(value.inventory);
+  const inventoryDigest = networkDigest(value.inventoryDigest);
+  requireNetwork(inventoryDigest === await computeFleetCutoverInventoryDigest(inventoryValue));
+  for (const service of inventoryValue.services) await validateMountDescriptors(service.mounts);
+  return { inventory: inventoryValue, inventoryDigest };
+});
+
+export const computeFleetCutoverManagerSnapshotDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => computeExactIdentityDigest(
+  fleetCutoverContract.managerSnapshotDigestDomain,
+  await snapshotFleetCutoverManagerSnapshot(valueArg),
+);
+
+export const validateFleetCutoverManagerSnapshot = async (
+  valueArg: unknown,
+): Promise<string[]> => {
+  try {
+    await snapshotFleetCutoverManagerSnapshot(valueArg);
+    return [];
+  } catch {
+    return ['fleet cutover manager snapshot must use its exact canonical schema'];
+  }
+};
+
+export const snapshotFleetCutoverCensusCandidate = async (
+  valueArg: unknown,
+): Promise<IFleetCutoverCensusCandidate> => safe(async () => {
+  const value = networkRecord(captureNetwork(valueArg), [
+    'clusterId', 'runtime', 'targetSet', 'inventory', 'managerReads', 'nodeObservations',
+    'freshUntil',
+  ]);
+  const clusterId = networkId(value.clusterId);
+  const runtime = runtimeReference(value.runtime);
+  const targetSet = targetSetReference(value.targetSet);
+  const inventoryValue = inventory(value.inventory);
+  for (const service of inventoryValue.services) await validateMountDescriptors(service.mounts);
+  const managerReads = networkList(value.managerReads, 2, managerCensusRead);
+  const nodeObservations = networkSorted(networkList(
+    value.nodeObservations,
+    fleetCutoverContract.maximumNodes,
+    observationReference,
+  ), itemArg => `${itemArg.nodeId}\0${itemArg.swarmNodeId}`);
+  requireNetwork(managerReads.length === 2
+    && managerReads[1].nodeId === managerReads[0].nodeId
+    && managerReads[1].swarmNodeId === managerReads[0].swarmNodeId
+    && managerReads[1].credentialGeneration === managerReads[0].credentialGeneration
+    && managerReads[1].reporterSessionId === managerReads[0].reporterSessionId
+    && managerReads[1].observationSequence === managerReads[0].observationSequence + 1
+    && managerReads[1].observedAt > managerReads[0].observedAt
+    && managerReads[1].swarmSnapshotDigest === managerReads[0].swarmSnapshotDigest
+    && managerReads.every(itemArg => itemArg.swarmNodeId === inventoryValue.managerSwarmNodeId)
+    && nodeObservations.length > 0
+    && new Set(nodeObservations.map(itemArg => itemArg.nodeId)).size === nodeObservations.length
+    && new Set(nodeObservations.map(itemArg => itemArg.swarmNodeId)).size === nodeObservations.length
+    && runtime.id === clusterId
+    && targetSet.cloudlyClusterId === clusterId);
+  const inventoryDigest = await computeFleetCutoverInventoryDigest(inventoryValue);
+  const managerSnapshotDigest = await computeFleetCutoverManagerSnapshotDigest({
+    inventory: inventoryValue,
+    inventoryDigest,
+  });
+  requireNetwork(managerReads.every(itemArg => itemArg.inventoryDigest === inventoryDigest
+    && itemArg.snapshotDigest === managerSnapshotDigest));
+  const freshUntil = networkCounter(value.freshUntil);
+  requireNetwork(freshUntil === Math.min(
+    ...managerReads.map(itemArg => itemArg.freshUntil),
+    ...nodeObservations.map(itemArg => itemArg.freshUntil),
+  ));
+  return {
+    clusterId,
+    runtime,
+    targetSet,
+    inventory: inventoryValue,
+    managerReads: managerReads as [IFleetCutoverManagerCensusRead, IFleetCutoverManagerCensusRead],
+    nodeObservations,
+    freshUntil,
+  };
+});
+
+export const snapshotFleetCutoverCensus = async (
+  valueArg: unknown,
+): Promise<IFleetCutoverCensus> => safe(async () => {
+  const value = networkRecord(captureNetwork(valueArg), [
+    'id', 'generation', 'acceptedAt', 'digest', 'clusterId', 'runtime', 'targetSet',
+    'inventory', 'managerReads', 'nodeObservations', 'freshUntil',
+  ]);
+  const candidate = await snapshotFleetCutoverCensusCandidate({
+    clusterId: value.clusterId,
+    runtime: value.runtime,
+    targetSet: value.targetSet,
+    inventory: value.inventory,
+    managerReads: value.managerReads,
+    nodeObservations: value.nodeObservations,
+    freshUntil: value.freshUntil,
+  });
+  const acceptedAt = networkCounter(value.acceptedAt);
+  requireNetwork(acceptedAt <= candidate.freshUntil
+    && candidate.managerReads.every(itemArg => acceptedAt >= itemArg.acceptedAt)
+    && candidate.nodeObservations.every(itemArg => acceptedAt >= itemArg.acceptedAt));
+  return {
+    id: networkId(value.id),
+    generation: networkCounter(value.generation),
+    acceptedAt,
+    digest: networkDigest(value.digest),
+    ...candidate,
+  };
+});
+
+export const computeFleetCutoverCensusDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => canonicalDigest(
+  fleetCutoverContract.censusDigestDomain,
+  await snapshotFleetCutoverCensus(valueArg),
+);
+
+export const validateFleetCutoverCensus = async (valueArg: unknown): Promise<string[]> => {
+  try {
+    const value = await snapshotFleetCutoverCensus(valueArg);
+    return value.digest === await computeFleetCutoverCensusDigest(value)
+      ? [] : ['fleet cutover census digest does not match'];
+  } catch {
+    return ['fleet cutover census must use its exact canonical schema'];
+  }
+};
+
+export const fleetCutoverEvidenceReferenceOf = (
+  valueArg: { id: string; generation: number; digest: TSha256Digest },
+): IFleetCutoverAcceptedEvidenceReference => reference({
+  id: valueArg.id,
+  generation: valueArg.generation,
+  digest: valueArg.digest,
+});
+
+export const snapshotFleetCutoverAcceptedEvidenceReference = (
+  valueArg: unknown,
+): IFleetCutoverAcceptedEvidenceReference => safe(() => reference(captureNetwork(valueArg)));
+
+const scopeEntry = (valueArg: unknown): IFleetCutoverScopeEntry => {
+  const value = networkRecord(valueArg, [
+    'dockerServiceId', 'serviceId', 'owner', 'serviceAuthority', 'classificationAuthority',
+  ]);
+  const owner = literal([
+    'application', 'coreflow', 'corestore', 'coretraffic', 'unknown',
+  ] as const, value.owner);
+  const serviceId = value.serviceId === null ? null : networkId(value.serviceId);
+  const serviceAuthority = value.serviceAuthority === null ? null : reference(value.serviceAuthority);
+  const classificationAuthority = value.classificationAuthority === null
+    ? null : reference(value.classificationAuthority);
+  requireNetwork(owner === 'unknown'
+    ? serviceId === null && serviceAuthority === null && classificationAuthority === null
+    : serviceId !== null && serviceAuthority !== null && classificationAuthority !== null);
+  return {
+    dockerServiceId: networkId(value.dockerServiceId),
+    serviceId,
+    owner,
+    serviceAuthority,
+    classificationAuthority,
+  };
+};
+
+export const snapshotFleetCutoverScope = (valueArg: unknown): IFleetCutoverScope => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), [
+    'id', 'generation', 'previous', 'state', 'clusterId', 'census', 'runtime', 'targetSet', 'entries',
+    'actorId', 'acceptedAt', 'digest',
+  ]);
+  const state = literal(['incomplete', 'complete'] as const, value.state);
+  const id = networkId(value.id);
+  const generation = networkCounter(value.generation);
+  const previous = value.previous === null ? null : reference(value.previous);
+  const clusterId = networkId(value.clusterId);
+  const runtime = runtimeReference(value.runtime);
+  const targetSet = targetSetReference(value.targetSet);
+  const entries = networkSorted(networkList(
+    value.entries,
+    fleetCutoverContract.maximumServices,
+    scopeEntry,
+  ), itemArg => itemArg.dockerServiceId);
+  requireNetwork(runtime.id === clusterId
+    && targetSet.cloudlyClusterId === clusterId
+    && (generation === 1
+      ? previous === null && state === 'incomplete'
+      : previous?.id === id && previous.generation === generation - 1)
+    && (state === 'incomplete' || entries.every(itemArg => itemArg.owner !== 'unknown')));
+  return {
+    id,
+    generation,
+    previous,
+    state,
+    clusterId,
+    census: reference(value.census),
+    runtime,
+    targetSet,
+    entries,
+    actorId: networkId(value.actorId),
+    acceptedAt: networkCounter(value.acceptedAt),
+    digest: networkDigest(value.digest),
+  };
+});
+
+export const computeFleetCutoverScopeDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => canonicalDigest(
+  fleetCutoverContract.scopeDigestDomain,
+  snapshotFleetCutoverScope(valueArg),
+);
+
+export const validateFleetCutoverScope = async (valueArg: unknown): Promise<string[]> => {
+  try {
+    const value = snapshotFleetCutoverScope(valueArg);
+    return value.digest === await computeFleetCutoverScopeDigest(value)
+      ? [] : ['fleet cutover scope digest does not match'];
+  } catch {
+    return ['fleet cutover scope must use its exact canonical schema'];
+  }
+};
+
+export const snapshotFleetCutoverScopeClassificationRequest = (
+  valueArg: unknown,
+): IFleetCutoverScopeClassificationRequest => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), [
+    'mutationId', 'clusterId', 'expectedScopeGeneration', 'census', 'classifications',
+  ]);
+  const classifications = networkSorted(networkList(
+    value.classifications,
+    fleetCutoverContract.maximumClassifications,
+    itemArg => {
+      const item = networkRecord(itemArg, ['dockerServiceId', 'serviceId', 'owner']);
+      return {
+        dockerServiceId: networkId(item.dockerServiceId),
+        serviceId: networkId(item.serviceId),
+        owner: literal(['application', 'coreflow', 'corestore', 'coretraffic'] as const, item.owner),
+      };
+    },
+  ), itemArg => itemArg.dockerServiceId);
+  return {
+    mutationId: networkId(value.mutationId),
+    clusterId: networkId(value.clusterId),
+    expectedScopeGeneration: networkCounter(value.expectedScopeGeneration),
+    census: reference(value.census),
+    classifications,
+  };
+});
+
+export const snapshotFleetCutoverTargetSetReference = (
+  valueArg: unknown,
+): IFleetCutoverTargetSetReference => safe(() => targetSetReference(captureNetwork(valueArg)));
+
+const volumeHandoff = (valueArg: unknown): IFleetCutoverVolumeHandoffIntent => {
+  const value = networkRecord(valueArg, [
+    'id', 'generation', 'clusterId', 'nodeId', 'serviceId', 'volumeId',
+    'mountIdentityDigest', 'sourceLineageDigest', 'storageRequestDigest', 'runtime', 'scope',
+    'targetSet', 'legacyStorageEvidence', 'sourceNodeObservation', 'acceptedAt', 'digest',
+  ]);
+  const clusterId = networkId(value.clusterId);
+  const runtime = runtimeReference(value.runtime);
+  const targetSet = targetSetReference(value.targetSet);
+  requireNetwork(runtime.id === clusterId && runtime.phase === 'draining'
+    && targetSet.cloudlyClusterId === clusterId);
+  return {
+    id: networkId(value.id),
+    generation: networkCounter(value.generation),
+    clusterId,
+    nodeId: networkNodeId(value.nodeId),
+    serviceId: networkId(value.serviceId),
+    volumeId: networkId(value.volumeId),
+    mountIdentityDigest: networkDigest(value.mountIdentityDigest),
+    sourceLineageDigest: networkDigest(value.sourceLineageDigest),
+    storageRequestDigest: networkDigest(value.storageRequestDigest),
+    runtime: runtime as IFleetCutoverVolumeHandoffIntent['runtime'],
+    scope: reference(value.scope),
+    targetSet,
+    legacyStorageEvidence: reference(value.legacyStorageEvidence),
+    sourceNodeObservation: reference(value.sourceNodeObservation),
+    acceptedAt: networkCounter(value.acceptedAt),
+    digest: networkDigest(value.digest),
+  };
+};
+
+export const snapshotFleetCutoverVolumeHandoffIntent = (
+  valueArg: unknown,
+): IFleetCutoverVolumeHandoffIntent => safe(() => volumeHandoff(captureNetwork(valueArg)));
+
+export const computeFleetCutoverVolumeHandoffDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => canonicalDigest(
+  fleetCutoverContract.volumeHandoffDigestDomain,
+  snapshotFleetCutoverVolumeHandoffIntent(valueArg),
+);
+
+const volumeFence = (valueArg: unknown): TFleetCutoverVolumeFence => {
+  requireNetwork(valueArg !== null && typeof valueArg === 'object');
+  const state = (valueArg as Record<string, unknown>).state;
+  const consumedKeys = state === 'consumed'
+    ? ['consumedRuntime', 'adoptionReceipt', 'claim', 'consumedAt'] : [];
+  const value = networkRecord(valueArg, [
+    'id', 'generation', 'previous', 'clusterId', 'nodeId', 'serviceId', 'volumeId',
+    'mountIdentityDigest', 'handoffIntent', 'heldRuntime', 'heldAt', 'state', ...consumedKeys,
+    'digest',
+  ]);
+  requireNetwork(state === 'held' || state === 'consumed');
+  const id = networkId(value.id);
+  const generation = networkCounter(value.generation);
+  const previous = value.previous === null ? null : reference(value.previous);
+  requireNetwork(generation === 1
+    ? previous === null
+    : previous?.id === id && previous.generation === generation - 1);
+  const heldRuntime = runtimeReference(value.heldRuntime);
+  requireNetwork(heldRuntime.phase === 'draining');
+  const base: IFleetCutoverVolumeFenceBase = {
+    id,
+    generation,
+    previous,
+    clusterId: networkId(value.clusterId),
+    nodeId: networkNodeId(value.nodeId),
+    serviceId: networkId(value.serviceId),
+    volumeId: networkId(value.volumeId),
+    mountIdentityDigest: networkDigest(value.mountIdentityDigest),
+    handoffIntent: reference(value.handoffIntent),
+    heldRuntime: heldRuntime as IFleetCutoverVolumeFenceBase['heldRuntime'],
+    heldAt: networkCounter(value.heldAt),
+    digest: networkDigest(value.digest),
+  };
+  if (state === 'held') return { ...base, state };
+  const consumedRuntime = runtimeReference(value.consumedRuntime);
+  requireNetwork(consumedRuntime.phase === 'pallet');
+  return {
+    ...base,
+    state,
+    consumedRuntime: consumedRuntime as Extract<TFleetCutoverVolumeFence, { state: 'consumed' }>['consumedRuntime'],
+    adoptionReceipt: reference(value.adoptionReceipt),
+    claim: reference(value.claim),
+    consumedAt: networkCounter(value.consumedAt),
+  };
+};
+
+export const snapshotFleetCutoverVolumeFence = (
+  valueArg: unknown,
+): TFleetCutoverVolumeFence => safe(() => volumeFence(captureNetwork(valueArg)));
+
+export const computeFleetCutoverVolumeFenceDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => canonicalDigest(
+  fleetCutoverContract.volumeFenceDigestDomain,
+  snapshotFleetCutoverVolumeFence(valueArg),
+);
+
+const corestoreAdoption = (valueArg: unknown): IFleetCutoverCorestoreAdoptionReceipt => {
+  const value = networkRecord(valueArg, [
+    'id', 'generation', 'clusterId', 'nodeId', 'serviceId', 'volumeId',
+    'mountIdentityDigest', 'handoffIntent', 'palletFence', 'sourceLineageDigest', 'claim',
+    'accessMode', 'acceptedAt', 'digest',
+  ]);
+  requireNetwork(value.generation === 1 && value.accessMode === 'ReadWriteOnce');
+  return {
+    id: networkId(value.id),
+    generation: 1,
+    clusterId: networkId(value.clusterId),
+    nodeId: networkNodeId(value.nodeId),
+    serviceId: networkId(value.serviceId),
+    volumeId: networkId(value.volumeId),
+    mountIdentityDigest: networkDigest(value.mountIdentityDigest),
+    handoffIntent: reference(value.handoffIntent),
+    palletFence: reference(value.palletFence),
+    sourceLineageDigest: networkDigest(value.sourceLineageDigest),
+    claim: reference(value.claim),
+    accessMode: 'ReadWriteOnce',
+    acceptedAt: networkCounter(value.acceptedAt),
+    digest: networkDigest(value.digest),
+  };
+};
+
+export const snapshotFleetCutoverCorestoreAdoptionReceipt = (
+  valueArg: unknown,
+): IFleetCutoverCorestoreAdoptionReceipt => safe(() => corestoreAdoption(captureNetwork(valueArg)));
+
+export const computeFleetCutoverCorestoreAdoptionDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => canonicalDigest(
+  fleetCutoverContract.corestoreAdoptionDigestDomain,
+  snapshotFleetCutoverCorestoreAdoptionReceipt(valueArg),
+);
+
+/** Content join only. The Pallet owner must dereference both accepted records while holding its CAS. */
+export const bindFleetCutoverAdoptionToVolumeFence = (
+  adoptionArg: unknown,
+  fenceArg: unknown,
+): { adoption: IFleetCutoverCorestoreAdoptionReceipt; fence: TFleetCutoverVolumeFence } => safe(() => {
+  const adoption = snapshotFleetCutoverCorestoreAdoptionReceipt(adoptionArg);
+  const fence = snapshotFleetCutoverVolumeFence(fenceArg);
+  requireNetwork(fence.state === 'held'
+    && adoption.clusterId === fence.clusterId
+    && adoption.nodeId === fence.nodeId
+    && adoption.serviceId === fence.serviceId
+    && adoption.volumeId === fence.volumeId
+    && adoption.mountIdentityDigest === fence.mountIdentityDigest
+    && adoption.handoffIntent.id === fence.handoffIntent.id
+    && adoption.handoffIntent.generation === fence.handoffIntent.generation
+    && adoption.handoffIntent.digest === fence.handoffIntent.digest
+    && adoption.palletFence.id === fence.id
+    && adoption.palletFence.generation === fence.generation
+    && adoption.palletFence.digest === fence.digest);
+  return { adoption, fence };
+});
+
+export const validateFleetCutoverVolumeHandoffIntent = async (valueArg: unknown): Promise<string[]> => {
+  try {
+    const value = snapshotFleetCutoverVolumeHandoffIntent(valueArg);
+    return value.digest === await computeFleetCutoverVolumeHandoffDigest(value)
+      ? [] : ['fleet cutover volume handoff digest does not match'];
+  } catch { return ['fleet cutover volume handoff must use its exact canonical schema']; }
+};
+
+export const validateFleetCutoverVolumeFence = async (valueArg: unknown): Promise<string[]> => {
+  try {
+    const value = snapshotFleetCutoverVolumeFence(valueArg);
+    return value.digest === await computeFleetCutoverVolumeFenceDigest(value)
+      ? [] : ['fleet cutover volume fence digest does not match'];
+  } catch { return ['fleet cutover volume fence must use its exact canonical schema']; }
+};
+
+export const validateFleetCutoverCorestoreAdoptionReceipt = async (
+  valueArg: unknown,
+): Promise<string[]> => {
+  try {
+    const value = snapshotFleetCutoverCorestoreAdoptionReceipt(valueArg);
+    return value.digest === await computeFleetCutoverCorestoreAdoptionDigest(value)
+      ? [] : ['fleet cutover Corestore adoption digest does not match'];
+  } catch { return ['fleet cutover Corestore adoption receipt must use its exact canonical schema']; }
+};
+
+const runtimeSession = (valueArg: unknown): IRuntimeSessionBinding => {
+  const value = networkRecord(valueArg, [
+    'reporterSessionId', 'nodeId', 'clusterId', 'credentialGeneration', 'sessionEpoch',
+    'controllerInstanceId', 'controller', 'runtimeNamespace',
+  ]);
+  const controller = networkRecord(value.controller, ['kind', 'id', 'epoch']);
+  requireNetwork(controller.kind === 'cloudly' || controller.kind === 'onebox');
+  return {
+    reporterSessionId: networkId(value.reporterSessionId),
+    nodeId: networkNodeId(value.nodeId),
+    clusterId: networkId(value.clusterId),
+    credentialGeneration: networkCounter(value.credentialGeneration),
+    sessionEpoch: networkCounter(value.sessionEpoch),
+    controllerInstanceId: networkId(value.controllerInstanceId),
+    controller: {
+      kind: controller.kind,
+      id: networkId(controller.id),
+      epoch: networkId(controller.epoch),
+    },
+    runtimeNamespace: networkId(value.runtimeNamespace),
+  };
+};
+
+export const snapshotFleetCutoverCoreflowRetirementEvidence = (
+  valueArg: unknown,
+): IFleetCutoverCoreflowRetirementEvidence => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), [
+    'id', 'generation', 'clusterId', 'scope', 'targetSet', 'runtime', 'relay', 'spark',
+    'legacy', 'acceptedAt', 'digest',
+  ]);
+  const relay = networkRecord(value.relay, [
+    'serviceId', 'nodeId', 'dockerServiceId', 'dockerContainerId', 'specVersion', 'specDigest',
+    'imageDigest', 'managerObservation', 'nodeObservation', 'credential',
+    'acceptedRegistration', 'version',
+  ]);
+  const spark = networkRecord(value.spark, [
+    'nodeId', 'credentialGeneration', 'reporterSessionId', 'observationSequence',
+    'observation', 'bundleVersion', 'bundleSourceCommit',
+    'bundleManifestSha256', 'unitName', 'unitDigest',
+  ]);
+  const legacy = networkRecord(value.legacy, [
+    'credential', 'invalidation', 'oldModeRefusal', 'configurationCas',
+    'sourceOwnerGeneration', 'sourceSha256', 'sourceDisposition',
+  ]);
+  const clusterId = networkId(value.clusterId);
+  const runtime = runtimeReference(value.runtime);
+  const targetSet = targetSetReference(value.targetSet);
+  requireNetwork(runtime.id === clusterId && runtime.phase === 'swarm'
+    && targetSet.cloudlyClusterId === clusterId);
+  const relayNodeId = networkNodeId(relay.nodeId);
+  const sparkNodeId = networkNodeId(spark.nodeId);
+  requireNetwork(relayNodeId === sparkNodeId);
+  const relayNodeObservation = reference(relay.nodeObservation);
+  const sparkObservation = reference(spark.observation);
+  requireNetwork(relayNodeObservation.id === sparkObservation.id
+    && relayNodeObservation.generation === sparkObservation.generation
+    && relayNodeObservation.digest === sparkObservation.digest);
+  const relayVersion = releaseVersion(relay.version);
+  requireNetwork(relayVersion.startsWith('32.'));
+  return {
+    id: networkId(value.id),
+    generation: networkCounter(value.generation),
+    clusterId,
+    scope: reference(value.scope),
+    targetSet,
+    runtime,
+    relay: {
+      serviceId: networkId(relay.serviceId),
+      nodeId: relayNodeId,
+      dockerServiceId: networkId(relay.dockerServiceId),
+      dockerContainerId: networkId(relay.dockerContainerId),
+      specVersion: networkCounter(relay.specVersion),
+      specDigest: networkDigest(relay.specDigest),
+      imageDigest: networkDigest(relay.imageDigest),
+      managerObservation: reference(relay.managerObservation),
+      nodeObservation: relayNodeObservation,
+      credential: reference(relay.credential),
+      acceptedRegistration: reference(relay.acceptedRegistration),
+      version: relayVersion,
+    },
+    spark: {
+      nodeId: sparkNodeId,
+      credentialGeneration: networkCounter(spark.credentialGeneration),
+      reporterSessionId: networkId(spark.reporterSessionId),
+      observationSequence: networkCounter(spark.observationSequence),
+      observation: sparkObservation,
+      bundleVersion: releaseVersion(spark.bundleVersion),
+      bundleSourceCommit: (() => {
+        requireNetwork(typeof spark.bundleSourceCommit === 'string'
+          && /^[a-f0-9]{40}$/.test(spark.bundleSourceCommit));
+        return spark.bundleSourceCommit;
+      })(),
+      bundleManifestSha256: sha256Hex(spark.bundleManifestSha256),
+      unitName: networkId(spark.unitName),
+      unitDigest: networkDigest(spark.unitDigest),
+    },
+    legacy: {
+      credential: reference(legacy.credential),
+      invalidation: reference(legacy.invalidation),
+      oldModeRefusal: reference(legacy.oldModeRefusal),
+      configurationCas: reference(legacy.configurationCas),
+      sourceOwnerGeneration: networkCounter(legacy.sourceOwnerGeneration),
+      sourceSha256: sha256Hex(legacy.sourceSha256),
+      sourceDisposition: literal(['retained-inert', 'removed'] as const, legacy.sourceDisposition),
+    },
+    acceptedAt: networkCounter(value.acceptedAt),
+    digest: networkDigest(value.digest),
+  };
+});
+
+export const computeFleetCutoverCoreflowRetirementDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => canonicalDigest(
+  fleetCutoverContract.coreflowRetirementDigestDomain,
+  snapshotFleetCutoverCoreflowRetirementEvidence(valueArg),
+);
+
+export const validateFleetCutoverCoreflowRetirementEvidence = async (
+  valueArg: unknown,
+): Promise<string[]> => {
+  try {
+    const value = snapshotFleetCutoverCoreflowRetirementEvidence(valueArg);
+    return value.digest === await computeFleetCutoverCoreflowRetirementDigest(value)
+      ? [] : ['fleet cutover Coreflow retirement digest does not match'];
+  } catch { return ['fleet cutover Coreflow retirement evidence must use its exact canonical schema']; }
+};
+
+export const snapshotFleetCutoverIngressPreparationRequest = (
+  valueArg: unknown,
+): IFleetCutoverIngressPreparationRequest => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), [
+    'mutationId', 'clusterId', 'ingressServiceId', 'currentRuntime', 'scope', 'targetSet',
+    'expectedSpecRevision', 'expectedDesignation',
+  ]);
+  const clusterId = networkId(value.clusterId);
+  const currentRuntime = runtimeReference(value.currentRuntime);
+  const targetSet = targetSetReference(value.targetSet);
+  requireNetwork(currentRuntime.id === clusterId && currentRuntime.phase === 'pallet'
+    && targetSet.cloudlyClusterId === clusterId);
+  return {
+    mutationId: networkId(value.mutationId),
+    clusterId,
+    ingressServiceId: networkId(value.ingressServiceId),
+    currentRuntime: currentRuntime as IFleetCutoverIngressPreparationRequest['currentRuntime'],
+    scope: reference(value.scope),
+    targetSet,
+    expectedSpecRevision: networkCounter(value.expectedSpecRevision),
+    expectedDesignation: value.expectedDesignation === null
+      ? null : reference(value.expectedDesignation),
+  };
+});
+
+export const snapshotFleetCutoverIngressDesignation = (
+  valueArg: unknown,
+): IFleetCutoverIngressDesignation => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), [
+    'id', 'generation', 'previous', 'clusterId', 'runtime', 'scope', 'targetSet',
+    'ingressServiceId', 'preparedSpecRevision', 'credential', 'actorId', 'acceptedAt', 'digest',
+  ]);
+  const id = networkId(value.id);
+  const generation = networkCounter(value.generation);
+  const previous = value.previous === null ? null : reference(value.previous);
+  const clusterId = networkId(value.clusterId);
+  const runtime = runtimeReference(value.runtime);
+  const targetSet = targetSetReference(value.targetSet);
+  requireNetwork(runtime.id === clusterId && runtime.phase === 'pallet'
+    && targetSet.cloudlyClusterId === clusterId
+    && (generation === 1
+      ? previous === null
+      : previous?.id === id && previous.generation === generation - 1));
+  return {
+    id,
+    generation,
+    previous,
+    clusterId,
+    runtime: runtime as IFleetCutoverIngressDesignation['runtime'],
+    scope: reference(value.scope),
+    targetSet,
+    ingressServiceId: networkId(value.ingressServiceId),
+    preparedSpecRevision: networkCounter(value.preparedSpecRevision),
+    credential: ingressCredentialReference(value.credential),
+    actorId: networkId(value.actorId),
+    acceptedAt: networkCounter(value.acceptedAt),
+    digest: networkDigest(value.digest),
+  };
+});
+
+export const computeFleetCutoverIngressDesignationDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => canonicalDigest(
+  fleetCutoverContract.ingressDesignationDigestDomain,
+  snapshotFleetCutoverIngressDesignation(valueArg),
+);
+
+export const validateFleetCutoverIngressDesignation = async (
+  valueArg: unknown,
+): Promise<string[]> => {
+  try {
+    const value = snapshotFleetCutoverIngressDesignation(valueArg);
+    return value.digest === await computeFleetCutoverIngressDesignationDigest(value)
+      ? [] : ['fleet cutover ingress designation digest does not match'];
+  } catch { return ['fleet cutover ingress designation must use its exact canonical schema']; }
+};
+
+export const snapshotFleetCutoverIngressAuthority = (
+  valueArg: unknown,
+): IFleetCutoverIngressAuthority => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), [
+    'id', 'generation', 'clusterId', 'runtime', 'scope', 'targetSet', 'ingressServiceId',
+    'assignment', 'session', 'ingressRegistration', 'registrationRouteRevision',
+    'legacyIngressAbsence', 'sourcePublication', 'targetPublication', 'portTransfer',
+    'routeTableRevision', 'routeTableReadback', 'acceptedAt', 'digest',
+  ]);
+  const clusterId = networkId(value.clusterId);
+  const runtime = runtimeReference(value.runtime);
+  const targetSet = targetSetReference(value.targetSet);
+  const session = runtimeSession(value.session);
+  requireNetwork(runtime.id === clusterId && runtime.phase === 'pallet'
+    && targetSet.cloudlyClusterId === clusterId && session.clusterId === clusterId);
+  return {
+    id: networkId(value.id),
+    generation: networkCounter(value.generation),
+    clusterId,
+    runtime: runtime as IFleetCutoverIngressAuthority['runtime'],
+    scope: reference(value.scope),
+    targetSet,
+    ingressServiceId: networkId(value.ingressServiceId),
+    assignment: assignmentReference(value.assignment),
+    session,
+    ingressRegistration: reference(value.ingressRegistration),
+    registrationRouteRevision: value.registrationRouteRevision === null
+      ? null : nonNegative(value.registrationRouteRevision),
+    legacyIngressAbsence: reference(value.legacyIngressAbsence),
+    sourcePublication: reference(value.sourcePublication),
+    targetPublication: reference(value.targetPublication),
+    portTransfer: reference(value.portTransfer),
+    routeTableRevision: nonNegative(value.routeTableRevision),
+    routeTableReadback: reference(value.routeTableReadback),
+    acceptedAt: networkCounter(value.acceptedAt),
+    digest: networkDigest(value.digest),
+  };
+});
+
+export const computeFleetCutoverIngressAuthorityDigest = async (
+  valueArg: unknown,
+): Promise<TSha256Digest> => canonicalDigest(
+  fleetCutoverContract.ingressAuthorityDigestDomain,
+  snapshotFleetCutoverIngressAuthority(valueArg),
+);
+
+export const validateFleetCutoverIngressAuthority = async (valueArg: unknown): Promise<string[]> => {
+  try {
+    const value = snapshotFleetCutoverIngressAuthority(valueArg);
+    return value.digest === await computeFleetCutoverIngressAuthorityDigest(value)
+      ? [] : ['fleet cutover ingress authority digest does not match'];
+  } catch { return ['fleet cutover ingress authority must use its exact canonical schema']; }
+};
+
+export const isLegalFleetCutoverPhaseTransition = (
+  fromArg: TClusterRuntimePhase,
+  toArg: TClusterRuntimePhase,
+): boolean => fleetCutoverContract.legalPhaseTransitions[fromArg] === toArg;
+
+export const snapshotFleetCutoverPhaseAdvance = (
+  valueArg: unknown,
+): TFleetCutoverPhaseAdvance => safe(() => {
+  requireNetwork(valueArg !== null && typeof valueArg === 'object');
+  const candidate = valueArg as Record<string, unknown>;
+  const from = literal(['swarm', 'draining', 'switching'] as const, candidate.from);
+  const expectedTo = fleetCutoverContract.legalPhaseTransitions[from];
+  requireNetwork(candidate.to === expectedTo);
+  const extraKeys = from === 'swarm'
+    ? ['coreflowRetirement']
+    : from === 'draining'
+      ? ['swarmQuiescence', 'heldRuntimeSpecs', 'heldVolumeFences']
+      : ['heldRuntimeSpecs', 'heldVolumeFences', 'palletPreparation'];
+  const value = networkRecord(captureNetwork(valueArg), [
+    'mutationId', 'clusterId', 'currentRuntime', 'scope', 'targetSet', 'from', 'to', ...extraKeys,
+  ]);
+  const currentRuntime = runtimeReference(value.currentRuntime);
+  const clusterId = networkId(value.clusterId);
+  const targetSet = targetSetReference(value.targetSet);
+  requireNetwork(currentRuntime.id === clusterId && currentRuntime.phase === from
+    && targetSet.cloudlyClusterId === clusterId);
+  const base: IFleetCutoverPhaseAdvanceBase = {
+    mutationId: networkId(value.mutationId),
+    clusterId,
+    currentRuntime,
+    scope: reference(value.scope),
+    targetSet,
+  };
+  if (from === 'swarm') return {
+    ...base,
+    from,
+    to: 'draining',
+    coreflowRetirement: reference(value.coreflowRetirement),
+  };
+  if (from === 'draining') return {
+    ...base,
+    from,
+    to: 'switching',
+    swarmQuiescence: reference(value.swarmQuiescence),
+    heldRuntimeSpecs: reference(value.heldRuntimeSpecs),
+    heldVolumeFences: reference(value.heldVolumeFences),
+  };
+  return {
+    ...base,
+    from,
+    to: 'pallet',
+    heldRuntimeSpecs: reference(value.heldRuntimeSpecs),
+    heldVolumeFences: reference(value.heldVolumeFences),
+    palletPreparation: reference(value.palletPreparation),
+  };
+});
+
+export const snapshotFleetCutoverRuntimeSpecRelease = (
+  valueArg: unknown,
+): TFleetCutoverRuntimeSpecRelease => safe(() => {
+  requireNetwork(valueArg !== null && typeof valueArg === 'object');
+  const kind = literal(['ingress', 'application'] as const, (valueArg as Record<string, unknown>).kind);
+  const evidenceKey = kind === 'ingress' ? 'emptyPublishedPortsPolicy' : 'ingressAuthority';
+  const value = networkRecord(captureNetwork(valueArg), [
+    'kind', 'mutationId', 'clusterId', 'serviceId', 'expectedSpecRevision', 'runtime', 'scope',
+    evidenceKey,
+  ]);
+  const runtime = runtimeReference(value.runtime);
+  const clusterId = networkId(value.clusterId);
+  requireNetwork(runtime.id === clusterId && runtime.phase === 'pallet');
+  const base = {
+    kind,
+    mutationId: networkId(value.mutationId),
+    clusterId,
+    serviceId: networkId(value.serviceId),
+    expectedSpecRevision: networkCounter(value.expectedSpecRevision),
+    runtime: runtime as TFleetCutoverRuntimeSpecRelease['runtime'],
+    scope: reference(value.scope),
+  };
+  return kind === 'ingress'
+    ? { ...base, kind, emptyPublishedPortsPolicy: reference(value.emptyPublishedPortsPolicy) }
+    : { ...base, kind, ingressAuthority: reference(value.ingressAuthority) };
+});