@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/lib/dns-query-coverage.mjs

@@ -0,0 +1,40 @@
+import { exactKeys, requireRecord } from "./bounded-contract-normalizers.mjs";
+const QUERY_KEYS = new Set(['owner', 'type', 'state']);
+/** A positive legacy record proves its own query scope, never another type's absence. */
+export function normaliseDnsQueryCoverage(value, options) {
+    const { label, maximum, state, records } = options;
+    if (options.legacy) {
+        return Object.freeze([...new Map(records.map((record) => [
+                `${record.owner}\u0000${record.type}`,
+                Object.freeze({ owner: record.owner, type: record.type, state }),
+            ])).values()]);
+    }
+    if (!Array.isArray(value) || value.length > maximum)
+        throw new TypeError(`${label} must contain no more than ${maximum} query outcomes.`);
+    const byKey = new Map();
+    for (const [index, raw] of value.entries()) {
+        const path = `${label}[${index}]`;
+        const item = requireRecord(raw, path);
+        exactKeys(item, QUERY_KEYS, path);
+        const owner = options.owner(item.owner, `${path}.owner`);
+        const type = options.type(item.type, `${path}.type`);
+        if (item.state !== 'observed' && item.state !== 'partial' && item.state !== 'unavailable')
+            throw new TypeError(`${path}.state is unsupported.`);
+        if ((state === 'unavailable' && item.state !== 'unavailable') || (state === 'observed' && item.state !== 'observed')) {
+            throw new TypeError(`${path}.state contradicts the snapshot state.`);
+        }
+        const key = `${owner}\u0000${type}`;
+        if (byKey.has(key))
+            throw new TypeError(`${path} duplicates an owner and type.`);
+        byKey.set(key, Object.freeze({ owner, type, state: item.state }));
+    }
+    for (const record of records) {
+        const query = byKey.get(`${record.owner}\u0000${record.type}`);
+        if (!query || query.state === 'unavailable')
+            throw new TypeError(`${label} must declare an observed or partial query for every supplied record.`);
+    }
+    return Object.freeze([...byKey.values()]);
+}
+export function dnsQueryState(queries, owner, type) {
+    return queries.find((query) => query.owner === owner && query.type === type)?.state ?? 'not_queried';
+}

package/lib/domain-assurance.mjs

@@ -243,7 +243,7 @@ function buildRecoveryDependencies(input) {
     };
 }
 const RETIREMENT_CHECKS = Object.freeze([
-    ['autoRenewDisabled', 'Auto-renew is intentionally configured', true],
+    ['autoRenewDisabled', 'Auto-renew is disabled as declared', true],
     ['registrarLockMaintained', 'Registrar lock remains enabled', true],
     ['websiteRetired', 'Web service is retired or intentionally redirected', true],
     ['mailRetired', 'Mail service is retired', true],

package/lib/domain-change-packet.mjs

@@ -5,9 +5,10 @@ import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../packages/evidence/art
 export const DOMAIN_CHANGE_PACKET_INPUT_SCHEMA = 'whoisleuth.domain-change-packet.input';
 export const DOMAIN_CHANGE_PACKET_SCHEMA = 'whoisleuth.domain-change-packet';
 export const DOMAIN_CHANGE_PACKET_INPUT_VERSION = 1;
-export const DOMAIN_CHANGE_PACKET_VERSION = 3;
+export const DOMAIN_CHANGE_PACKET_VERSION = 4;
 export const DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS = Object.freeze({
     2: 1,
+    3: 2,
     [DOMAIN_CHANGE_PACKET_VERSION]: DOMAIN_CHANGE_REVIEW_VERSION,
 });
 export const SUPPORTED_DOMAIN_CHANGE_PACKET_VERSIONS = Object.freeze(Object.keys(DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS).map(Number));
@@ -43,16 +44,10 @@ function changeSummary(before, after) {
     const beforeRows = rows(before);
     const afterRows = rows(after);
     const keys = [...new Set([...beforeRows.keys(), ...afterRows.keys()])].sort();
-    const authorityCollectionComplete = (review) => {
-        const representative = review.authoritativeRecordMatrix[0];
-        return Boolean(representative
-            && representative.observations.length >= 2
-            && representative.observations.every((item) => item.state === 'observed'));
-    };
-    const rowEvidence = (review, row) => {
+    const rowEvidence = (row) => {
         if (!row)
             return Object.freeze({
-                state: authorityCollectionComplete(review) ? 'complete' : 'unavailable',
+                state: 'unavailable',
                 values: Object.freeze([]),
             });
         if (row.observations.some((item) => item.state !== 'observed')) {
@@ -68,13 +63,15 @@ function changeSummary(before, after) {
         });
     };
     const changed = [];
+    const reasons = keys.length > 500 ? ['The comparison exceeds 500 owner and record-type pairs.'] : [];
     for (const key of keys.slice(0, 500)) {
         const left = beforeRows.get(key);
         const right = afterRows.get(key);
         const [owner, type] = key.split('\u0000');
-        const beforeEvidence = rowEvidence(before, left);
-        const afterEvidence = rowEvidence(after, right);
+        const beforeEvidence = rowEvidence(left);
+        const afterEvidence = rowEvidence(right);
         if (beforeEvidence.state !== 'complete' || afterEvidence.state !== 'complete') {
+            reasons.push(`Comparison evidence is incomplete for ${owner} ${type}.`);
             continue;
         }
         if (JSON.stringify(beforeEvidence.values) === JSON.stringify(afterEvidence.values))
@@ -86,7 +83,7 @@ function changeSummary(before, after) {
             afterValues: afterEvidence.values,
         }));
     }
-    return Object.freeze(changed);
+    return Object.freeze({ changed: Object.freeze(changed), reasons: Object.freeze(reasons) });
 }
 export async function buildDomainChangePacket(inputRaw, generatedAtValue = new Date().toISOString()) {
     const input = record(inputRaw, 'Domain change packet input');
@@ -107,11 +104,13 @@ export async function buildDomainChangePacket(inputRaw, generatedAtValue = new D
     const preChange = reviewDomainChange(input.preChange, generatedAt);
     const postChange = reviewDomainChange(input.postChange, generatedAt);
     const assurance = buildDomainAssurance(input.assurance, generatedAt);
+    const comparison = changeSummary(preChange, postChange);
     const assuranceReasons = assurance.result.review.reasons;
     const gateReasons = Object.freeze([
         ...preChange.gate.reasons.map((reason) => `Pre-change evidence: ${reason}`),
         ...postChange.gate.reasons.map((reason) => `Post-change evidence: ${reason}`),
         ...assuranceReasons.map((reason) => `Change plan: ${reason}`),
+        ...comparison.reasons,
     ].slice(0, 100));
     const unsigned = Object.freeze({
         schema: DOMAIN_CHANGE_PACKET_SCHEMA,
@@ -122,7 +121,7 @@ export async function buildDomainChangePacket(inputRaw, generatedAtValue = new D
         state: gateReasons.length ? 'review' : 'ready',
         gate: Object.freeze({ pass: gateReasons.length === 0, reasons: gateReasons }),
         summary: Object.freeze({
-            changedAuthoritativeRecordSets: changeSummary(preChange, postChange),
+            changedAuthoritativeRecordSets: comparison.changed,
             preChangeState: preChange.state,
             postChangeState: postChange.state,
             assuranceState: assurance.result.review.state,

package/lib/domain-change-review.mjs

@@ -1,13 +1,16 @@
 import { exactKeys, requireBoundedString, requireDomainName, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
 import { normaliseRdata } from "./zone-intent-review.mjs";
+import { dnsQueryState, normaliseDnsQueryCoverage } from "./dns-query-coverage.mjs";
 export const DOMAIN_CHANGE_INPUT_SCHEMA = 'whoisleuth.domain-change.input';
-export const DOMAIN_CHANGE_INPUT_VERSION = 1;
+export const DOMAIN_CHANGE_INPUT_VERSION = 2;
+export const SUPPORTED_DOMAIN_CHANGE_INPUT_VERSIONS = Object.freeze([1, DOMAIN_CHANGE_INPUT_VERSION]);
 export const DOMAIN_CHANGE_REVIEW_SCHEMA = 'whoisleuth.domain-change.review';
-export const DOMAIN_CHANGE_REVIEW_VERSION = 2;
+export const DOMAIN_CHANGE_REVIEW_VERSION = 3;
 export const MAX_DOMAIN_CHANGE_VANTAGES = 16;
 export const MAX_DOMAIN_CHANGE_RECORDS = 500;
 const ROOT_KEYS = new Set(['schema', 'version', 'domain', 'authoritySnapshots', 'resolverSnapshots', 'acmeDependencies', 'certificate', 'hsts']);
 const SNAPSHOT_KEYS = new Set(['label', 'source', 'state', 'observedAt', 'records']);
+const COVERED_SNAPSHOT_KEYS = new Set([...SNAPSHOT_KEYS, 'queries']);
 const RECORD_KEYS = new Set(['owner', 'type', 'value', 'ttl']);
 const ACME_KEYS = new Set(['method', 'owner', 'target', 'provider', 'state']);
 const CERTIFICATE_KEYS = new Set(['state', 'observedAt', 'currentSpkiSha256', 'plannedSpkiSha256', 'mustStaple', 'ocspStapled', 'embeddedSctCount']);
@@ -62,13 +65,14 @@ function normaliseRecord(value, apex, label) {
             : (() => { throw new TypeError(`${label}.ttl is outside its supported range.`); })();
     return Object.freeze({ owner: owner(input.owner, apex, `${label}.owner`), type, ttl, ...normaliseValue(type, input.value, `${label}.value`) });
 }
-function normaliseSnapshots(value, apex, label) {
+function normaliseSnapshots(value, apex, label, legacy) {
     if (!Array.isArray(value) || value.length > MAX_DOMAIN_CHANGE_VANTAGES)
         throw new TypeError(`${label} must contain no more than ${MAX_DOMAIN_CHANGE_VANTAGES} snapshots.`);
     let totalRecords = 0;
+    let totalQueries = 0;
     const snapshots = value.map((raw, index) => {
         const item = requireRecord(raw, `${label}[${index}]`);
-        exactKeys(item, SNAPSHOT_KEYS, `${label}[${index}]`);
+        exactKeys(item, legacy ? SNAPSHOT_KEYS : COVERED_SNAPSHOT_KEYS, `${label}[${index}]`);
         const state = evidenceState(item.state, `${label}[${index}].state`);
         if (!Array.isArray(item.records))
             throw new TypeError(`${label}[${index}].records must be an array.`);
@@ -78,12 +82,24 @@ function normaliseSnapshots(value, apex, label) {
         const records = item.records.map((recordValue, recordIndex) => normaliseRecord(recordValue, apex, `${label}[${index}].records[${recordIndex}]`));
         if (state === 'unavailable' && records.length)
             throw new TypeError(`${label}[${index}] cannot contain records when unavailable.`);
+        const queries = normaliseDnsQueryCoverage(item.queries, {
+            legacy, label: `${label}[${index}].queries`, maximum: MAX_DOMAIN_CHANGE_RECORDS - totalQueries, state, records,
+            owner: (value, path) => owner(value, apex, path),
+            type: (value, path) => {
+                const type = text(value, path, 16).toUpperCase();
+                if (!TYPES.has(type))
+                    throw new TypeError(`${path} is unsupported.`);
+                return type;
+            },
+        });
+        totalQueries += queries.length;
         return Object.freeze({
             label: text(item.label, `${label}[${index}].label`, 120),
             source: text(item.source, `${label}[${index}].source`, 240),
             state,
             observedAt: timestamp(item.observedAt, `${label}[${index}].observedAt`),
             records: Object.freeze(records),
+            queries,
         });
     });
     if (new Set(snapshots.map((item) => item.label.toLowerCase())).size !== snapshots.length)
@@ -91,17 +107,18 @@ function normaliseSnapshots(value, apex, label) {
     return Object.freeze(snapshots);
 }
 function snapshotProvenance(snapshot) {
-    return Object.freeze({ label: snapshot.label, source: snapshot.source, state: snapshot.state, observedAt: snapshot.observedAt });
+    return Object.freeze({ label: snapshot.label, source: snapshot.source, state: snapshot.state, observedAt: snapshot.observedAt, queries: snapshot.queries });
 }
 function recordMatrix(snapshots) {
-    const keys = [...new Set(snapshots.flatMap((snapshot) => snapshot.records.map((item) => `${item.owner}\u0000${item.type}`)))].sort();
+    const keys = [...new Set(snapshots.flatMap((snapshot) => snapshot.queries.map((item) => `${item.owner}\u0000${item.type}`)))].sort();
     return Object.freeze(keys.map((key) => {
         const [recordOwner, type] = key.split('\u0000');
         const observations = snapshots.map((snapshot) => {
             const matches = snapshot.records.filter((item) => item.owner === recordOwner && item.type === type);
             const ttls = matches.map((item) => item.ttl).filter((ttl) => ttl !== null);
             return Object.freeze({
-                ...snapshotProvenance(snapshot),
+                label: snapshot.label, source: snapshot.source, observedAt: snapshot.observedAt,
+                state: dnsQueryState(snapshot.queries, recordOwner, type),
                 values: Object.freeze([...new Set(matches.map((item) => item.value))].sort()),
                 ttlRange: ttls.length ? Object.freeze({
                     minimum: Math.min(...ttls),
@@ -114,13 +131,14 @@ function recordMatrix(snapshots) {
         return Object.freeze({
             owner: recordOwner,
             type,
-            state: complete.length < 2 ? 'insufficient' : signatures.size === 1 ? 'aligned' : 'different',
+            state: complete.length < 2 || complete.length !== observations.length ? 'insufficient' : signatures.size === 1 ? 'aligned' : 'different',
             observations: Object.freeze(observations),
         });
     }));
 }
 function reviewDnssecAutomation(matrix) {
-    const automation = matrix.filter((row) => row.type === 'CDS' || row.type === 'CDNSKEY' || row.type === 'CSYNC');
+    const automation = matrix.filter((row) => ['CDS', 'CDNSKEY', 'CSYNC'].includes(row.type)
+        && row.observations.some((item) => item.values.length > 0));
     const byType = (type) => automation.find((row) => row.type === type);
     const cds = byType('CDS');
     const cdnskey = byType('CDNSKEY');
@@ -238,12 +256,12 @@ function serviceInventory(snapshots) {
 }
 export function reviewDomainChange(inputRaw, generatedAtValue = new Date().toISOString()) {
     const input = requireRecord(inputRaw, 'Domain change input');
-    if (input.schema !== DOMAIN_CHANGE_INPUT_SCHEMA || input.version !== DOMAIN_CHANGE_INPUT_VERSION)
-        throw new TypeError(`Domain change input must use ${DOMAIN_CHANGE_INPUT_SCHEMA} version ${DOMAIN_CHANGE_INPUT_VERSION}.`);
+    if (input.schema !== DOMAIN_CHANGE_INPUT_SCHEMA || !SUPPORTED_DOMAIN_CHANGE_INPUT_VERSIONS.includes(input.version))
+        throw new TypeError(`Domain change input must use ${DOMAIN_CHANGE_INPUT_SCHEMA} version 1 or ${DOMAIN_CHANGE_INPUT_VERSION}.`);
     exactKeys(input, ROOT_KEYS, 'Domain change input');
     const apex = domain(input.domain, 'domain');
-    const authoritySnapshots = normaliseSnapshots(input.authoritySnapshots ?? [], apex, 'authoritySnapshots');
-    const resolverSnapshots = normaliseSnapshots(input.resolverSnapshots ?? [], apex, 'resolverSnapshots');
+    const authoritySnapshots = normaliseSnapshots(input.authoritySnapshots ?? [], apex, 'authoritySnapshots', input.version === 1);
+    const resolverSnapshots = normaliseSnapshots(input.resolverSnapshots ?? [], apex, 'resolverSnapshots', input.version === 1);
     const authorityMatrix = recordMatrix(authoritySnapshots);
     const resolverMatrix = recordMatrix(resolverSnapshots);
     const acmeDependencies = normaliseAcme(input.acmeDependencies ?? [], apex);
@@ -305,7 +323,7 @@ export function reviewDomainChange(inputRaw, generatedAtValue = new Date().toISO
         limitations: Object.freeze([
             'This local review uses only analyst-supplied observations and makes no DNS, HTTP, certificate, certificate-authority, preload-list, or provider request.',
             'Different observations can reflect propagation, caching, split-horizon DNS, resolver policy, or collection timing; they do not establish misconfiguration by themselves.',
-            'Partial or unavailable evidence is never treated as record absence. TXT values are represented only by SHA-256 digests.',
+            'Only an explicitly observed query can establish an empty answer. Unqueried, partial and unavailable record types are not absence; legacy inputs establish scope only for supplied records. TXT values are represented only by SHA-256 digests.',
             'DNSSEC automation readiness describes CDS, CDNSKEY, and CSYNC publication consistency; it does not validate a cryptographic chain or authorise a registry-side change.',
             'HSTS preload state is an analyst-supplied, source-attributed observation and must be refreshed against the nominated source before a change.',
         ]),

package/lib/domain-control-flight-recorder.mjs

@@ -1,7 +1,7 @@
 import { Buffer } from 'node:buffer';
 import { canonicalDomainControlRecords } from "../packages/evidence/domain-control-runtime.mjs";
 import { requireBoundedString, requireDomainName, requireIsoTimestamp, } from "./bounded-contract-normalizers.mjs";
-import { DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS, DOMAIN_CONTROL_FLIGHT_RECORDER_APPROVED_WINDOW_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_EVENT_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_FIELD_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, DOMAIN_CONTROL_FLIGHT_RECORDER_LIMITATIONS, DOMAIN_CONTROL_FLIGHT_RECORDER_OBSERVATION_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_ROOT_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_SCHEMA, DOMAIN_CONTROL_FLIGHT_RECORDER_SUMMARY_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_OBSERVATION_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_FIELD_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_EVENT_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_SUMMARY_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_LIMITATIONS, PUBLIC_MAX_FLIGHT_RECORDER_INPUT_VALUES, PUBLIC_MAX_FLIGHT_RECORDER_VALUES, PUBLIC_MAX_FLIGHT_RECORDER_VALUE_LENGTH, SUPPORTED_DOMAIN_CONTROL_FLIGHT_RECORDER_VERSIONS, DOMAIN_CONTROL_FLIGHT_RECORDER_WINDOW_KEYS, MAX_DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_BYTES, MAX_DOMAIN_CONTROL_FLIGHT_RECORDER_OUTPUT_BYTES, MAX_FLIGHT_RECORDER_FIELDS, MAX_FLIGHT_RECORDER_EVENTS, MAX_FLIGHT_RECORDER_INPUT_VALUES, MAX_FLIGHT_RECORDER_JSON_DEPTH, MAX_FLIGHT_RECORDER_JSON_VALUES, MAX_FLIGHT_RECORDER_OBSERVATIONS, MAX_FLIGHT_RECORDER_SOURCE_LENGTH, MAX_FLIGHT_RECORDER_VALUE_LENGTH, MAX_FLIGHT_RECORDER_VALUES, MAX_FLIGHT_RECORDER_WINDOWS, MAX_FLIGHT_RECORDER_WINDOW_ID_LENGTH, MAX_FLIGHT_RECORDER_WINDOW_REASON_LENGTH, MIN_FLIGHT_RECORDER_OBSERVATIONS, } from "../packages/contracts/domain-control-flight-recorder.mjs";
+import { DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS, DOMAIN_CONTROL_FLIGHT_RECORDER_APPROVED_WINDOW_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_EVENT_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_FIELD_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, DOMAIN_CONTROL_FLIGHT_RECORDER_LIMITATIONS, DOMAIN_CONTROL_FLIGHT_RECORDER_OBSERVATION_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_ROOT_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_SCHEMA, DOMAIN_CONTROL_FLIGHT_RECORDER_SUMMARY_KEYS, DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_OBSERVATION_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_FIELD_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_EVENT_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_SUMMARY_KEYS, PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_LIMITATIONS, SOURCE_TIMED_FLIGHT_RECORDER_EVENT_KEYS, SOURCE_TIMED_FLIGHT_RECORDER_LIMITATIONS, FLIGHT_RECORDER_CHANGE_INTERVAL_KEYS, HISTORICAL_FLIGHT_RECORDER_APPROVED_WINDOW_KEYS, PUBLIC_MAX_FLIGHT_RECORDER_INPUT_VALUES, PUBLIC_MAX_FLIGHT_RECORDER_VALUES, PUBLIC_MAX_FLIGHT_RECORDER_VALUE_LENGTH, SUPPORTED_DOMAIN_CONTROL_FLIGHT_RECORDER_VERSIONS, DOMAIN_CONTROL_FLIGHT_RECORDER_WINDOW_KEYS, MAX_DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_BYTES, MAX_DOMAIN_CONTROL_FLIGHT_RECORDER_OUTPUT_BYTES, MAX_FLIGHT_RECORDER_FIELDS, MAX_FLIGHT_RECORDER_EVENTS, MAX_FLIGHT_RECORDER_INPUT_VALUES, MAX_FLIGHT_RECORDER_JSON_DEPTH, MAX_FLIGHT_RECORDER_JSON_VALUES, MAX_FLIGHT_RECORDER_OBSERVATIONS, MAX_FLIGHT_RECORDER_SOURCE_LENGTH, MAX_FLIGHT_RECORDER_VALUE_LENGTH, MAX_FLIGHT_RECORDER_VALUES, MAX_FLIGHT_RECORDER_WINDOWS, MAX_FLIGHT_RECORDER_WINDOW_ID_LENGTH, MAX_FLIGHT_RECORDER_WINDOW_REASON_LENGTH, MIN_FLIGHT_RECORDER_OBSERVATIONS, } from "../packages/contracts/domain-control-flight-recorder.mjs";
 export { DOMAIN_CONTROL_FLIGHT_RECORDER_FIELDS, DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_SCHEMA, DOMAIN_CONTROL_FLIGHT_RECORDER_SCHEMA, DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION, MAX_FLIGHT_RECORDER_FIELDS, MAX_FLIGHT_RECORDER_OBSERVATIONS, MAX_FLIGHT_RECORDER_VALUES, MAX_FLIGHT_RECORDER_WINDOWS, };
 const ROOT_KEYS = new Set(DOMAIN_CONTROL_FLIGHT_RECORDER_INPUT_KEYS);
 const OBSERVATION_KEYS = new Set(DOMAIN_CONTROL_FLIGHT_RECORDER_OBSERVATION_KEYS);
@@ -378,12 +378,11 @@ function approvedWindow(value, index) {
 function sameValues(left, right) {
     return left.length === right.length && left.every((value, index) => value === right[index]);
 }
-function matchingWindow(windows, domain, field, observedAt) {
-    const time = Date.parse(observedAt);
+function matchingWindow(windows, domain, field, after, by) {
     return windows.find((window) => (window.domain === domain
         && window.fields.includes(field)
-        && Date.parse(window.startsAt) <= time
-        && time <= Date.parse(window.endsAt))) ?? null;
+        && Date.parse(window.startsAt) <= Date.parse(after)
+        && Date.parse(by) <= Date.parse(window.endsAt))) ?? null;
 }
 /** Equal-capture disagreement stays incomplete, independently of input ordering. */
 export function mergeConcurrentDomainControlFields(observations) {
@@ -441,12 +440,22 @@ export function buildDomainControlFlightRecorder(inputRaw, generatedAtValue = ne
         throw new TypeError('Domain control flight-recorder captures cannot be later than generatedAt.');
     }
     const latest = new Map();
+    const lastComplete = new Map();
+    const incompleteSince = new Map();
     const events = [];
     let incompleteFields = 0;
     for (const item of observationTimeline(observations)) {
-        for (const field of item.fields) {
+        const fields = [...item.fields];
+        for (const [key, previous] of latest) {
+            if (key.startsWith(`${item.domain}\u0000`) && !fields.some(field => field.id === previous.field.id)) {
+                fields.push({ id: previous.field.id, source: 'Not supplied in this capture', state: 'unavailable', observedAt: null, values: [] });
+            }
+        }
+        fields.sort((a, b) => ordinalCompare(a.id, b.id));
+        for (const field of fields) {
             const key = `${item.domain}\u0000${field.id}`;
             const previous = latest.get(key);
+            let baseline = lastComplete.get(key);
             let complete = field.state === 'observed' && field.observedAt !== null
                 && Date.parse(field.observedAt) <= Date.parse(item.capturedAt) && item.collectionDepth !== 'unknown';
             const sameContext = previous?.field.source === field.source && previous.collectionDepth === item.collectionDepth;
@@ -458,46 +467,67 @@ export function buildDomainControlFlightRecorder(inputRaw, generatedAtValue = ne
                 : Date.parse(field.observedAt) > Date.parse(item.capturedAt) ? 'The source observation time is later than capture.'
                     : item.collectionDepth === 'unknown' ? 'Collection conditions are unknown or conflicting.'
                         : `The source is ${field.state}.`;
-            if (complete && previous?.complete && (!sameContext
-                || Date.parse(field.observedAt) <= Date.parse(previous.field.observedAt))) {
+            const contextChanged = baseline && field.source !== 'Not supplied in this capture'
+                && (baseline.field.source !== field.source || (item.collectionDepth !== 'unknown' && baseline.collectionDepth !== item.collectionDepth));
+            if (contextChanged) {
+                if (complete) {
+                    complete = false;
+                    limitation = 'The source identity or collection conditions changed.';
+                }
+                lastComplete.delete(key);
+                baseline = undefined;
+            }
+            else if (complete && baseline && Date.parse(field.observedAt) <= Date.parse(baseline.field.observedAt)) {
                 complete = false;
-                limitation = !sameContext ? 'The source identity or collection conditions changed.'
-                    : 'The source observation time did not increase.';
+                limitation = 'The source observation time did not increase.';
             }
             latest.set(key, { field, collectionDepth: item.collectionDepth, complete });
             let kind;
             let explanation;
             let before = [];
             let approved = null;
+            let changeInterval = null;
             if (!complete) {
+                incompleteSince.set(key, (incompleteSince.get(key) ?? 0) + 1);
                 incompleteFields += 1;
                 kind = previous?.complete ? 'collection_change' : 'incomplete_observation';
                 before = previous?.complete ? previous.field.values : [];
                 explanation = `${limitation} Retained values are incomplete; this is not evidence that a prior value disappeared or changed.`;
             }
+            else if (baseline && !sameValues(baseline.field.values, field.values)) {
+                kind = 'observed_change';
+                before = baseline.field.values;
+                changeInterval = Object.freeze({ after: baseline.field.observedAt, by: field.observedAt, incompleteObservations: incompleteSince.get(key) ?? 0 });
+                approved = matchingWindow(windows, item.domain, field.id, changeInterval.after, changeInterval.by);
+                explanation = `Comparable complete observations contain different values. The change occurred after ${changeInterval.after} and by ${changeInterval.by}; its exact time is unknown.`
+                    + (changeInterval.incompleteObservations ? ` ${changeInterval.incompleteObservations} incomplete observation(s) occurred in this interval.` : '')
+                    + (approved ? ' The recorded approved window contains the entire interval.' : ' No recorded approved window contains the entire interval.');
+            }
             else if (!previous) {
                 kind = 'first_observation';
                 explanation = 'The first complete source-timed value for this field was retained.';
             }
             else if (!previous.complete) {
                 kind = 'recovered';
-                explanation = 'A complete source-timed value is available after an incomplete observation; this does not establish a value change.';
+                explanation = baseline
+                    ? 'The recovered complete value matches the last comparable complete observation. Intervening changes during the incomplete interval remain unknown.'
+                    : 'A complete source-timed value is available after an incomplete observation; this does not establish a value change.';
             }
             else {
-                if (sameValues(previous.field.values, field.values))
-                    continue;
-                kind = 'observed_change';
-                before = previous.field.values;
-                approved = matchingWindow(windows, item.domain, field.id, field.observedAt);
-                explanation = approved
-                    ? 'Two complete observations from the same source changed during the recorded change window.'
-                    : 'Two complete observations from the same source, with increasing source times, contain different values.';
+                lastComplete.set(key, { field, collectionDepth: item.collectionDepth, complete });
+                incompleteSince.delete(key);
+                continue;
+            }
+            if (complete) {
+                lastComplete.set(key, { field, collectionDepth: item.collectionDepth, complete });
+                incompleteSince.delete(key);
             }
             events.push(Object.freeze({
                 id: `${item.domain}:${field.id}:${item.capturedAt}:${events.length + 1}`,
                 domain: item.domain, field: field.id, observedAt: field.observedAt, capturedAt: item.capturedAt,
                 kind, state: complete ? 'observed' : 'partial', before: Object.freeze([...before]), after: field.values,
-                source: field.source, approvedWindow: approved ? Object.freeze({ id: approved.id, reason: approved.reason }) : null,
+                source: field.source, approvedWindow: approved ? Object.freeze({ id: approved.id, reason: approved.reason, startsAt: approved.startsAt, endsAt: approved.endsAt }) : null,
+                collectionDepth: item.collectionDepth, changeInterval,
                 explanation,
             }));
         }
@@ -560,6 +590,7 @@ export function validateDomainControlFlightRecorderDocument(value) {
         throw new TypeError(`Domain control flight-recorder document must use ${DOMAIN_CONTROL_FLIGHT_RECORDER_SCHEMA} supported version ${SUPPORTED_DOMAIN_CONTROL_FLIGHT_RECORDER_VERSIONS.join(' or ')}.`);
     }
     const legacy = root.version === PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION;
+    const intervalVersion = root.version === DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION;
     const generatedAt = requireIsoTimestamp(root.generatedAt, 'Domain control flight-recorder document generatedAt');
     if (generatedAt !== root.generatedAt) {
         throw new TypeError('Domain control flight-recorder document generatedAt must use its canonical timestamp form.');
@@ -591,10 +622,13 @@ export function validateDomainControlFlightRecorderDocument(value) {
     };
     const seenIds = new Set();
     const latest = new Map();
+    const lastComplete = new Map();
+    const incompleteSince = new Map();
     let lastCapture = -Infinity;
     const events = eventInput.map((eventValue, index) => {
         const label = `Domain control flight-recorder document event ${index + 1}`;
-        const event = exactRecord(eventValue, legacy ? new Set(PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_EVENT_KEYS) : EVENT_KEYS, label);
+        const event = exactRecord(eventValue, legacy ? new Set(PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_EVENT_KEYS)
+            : intervalVersion ? EVENT_KEYS : new Set(SOURCE_TIMED_FLIGHT_RECORDER_EVENT_KEYS), label);
         const eventDomain = requireDomainName(event.domain, `${label}.domain`);
         if (eventDomain !== event.domain || !domains.includes(eventDomain)) {
             throw new TypeError(`${label}.domain must be present in the document domain list.`);
@@ -624,20 +658,44 @@ export function validateDomainControlFlightRecorderDocument(value) {
         if (!legacy && expectedState === 'observed' && (observedAt === null || Date.parse(observedAt) > Date.parse(capturedAt))) {
             throw new TypeError(`${label} cannot claim a complete observation without a source time at or before capture.`);
         }
+        const collectionDepth = intervalVersion ? event.collectionDepth : undefined;
+        if (intervalVersion && (collectionDepth !== 'deep' && collectionDepth !== 'fast' && collectionDepth !== 'unknown'
+            || expectedState === 'observed' && collectionDepth === 'unknown')) {
+            throw new TypeError(`${label} has invalid collection conditions.`);
+        }
         const before = exactRecorderValues(event.before, `${label}.before`, legacy, event.field, expectedState === 'observed');
         const after = exactRecorderValues(event.after, `${label}.after`, legacy, event.field, expectedState === 'observed');
         if (((event.kind === 'first_observation' || event.kind === 'recovered') && before.length)
             || (legacy && event.kind === 'collection_change' && after.length)) {
             throw new TypeError(`${label} before/after values are inconsistent.`);
         }
+        let changeInterval = null;
+        if (intervalVersion && event.changeInterval !== null) {
+            const interval = exactRecord(event.changeInterval, new Set(FLIGHT_RECORDER_CHANGE_INTERVAL_KEYS), `${label}.changeInterval`);
+            const after = requireIsoTimestamp(interval.after, `${label}.changeInterval.after`);
+            const by = requireIsoTimestamp(interval.by, `${label}.changeInterval.by`);
+            if (kind !== 'observed_change' || after !== interval.after || by !== interval.by || by !== observedAt || Date.parse(after) >= Date.parse(by)) {
+                throw new TypeError(`${label} has an inconsistent change interval.`);
+            }
+            changeInterval = Object.freeze({ after, by, incompleteObservations: exactRecorderInteger(interval.incompleteObservations, 0, MAX_FLIGHT_RECORDER_OBSERVATIONS, `${label}.changeInterval.incompleteObservations`) });
+        }
+        if (intervalVersion && (kind === 'observed_change') !== (changeInterval !== null))
+            throw new TypeError(`${label} must retain its change interval.`);
         let approvedWindow = null;
         if (event.approvedWindow !== null) {
             if (event.kind !== 'observed_change')
                 throw new TypeError(`${label}.approvedWindow is inconsistent.`);
-            const window = exactRecord(event.approvedWindow, EVENT_APPROVED_WINDOW_KEYS, `${label}.approvedWindow`);
+            const window = exactRecord(event.approvedWindow, intervalVersion ? EVENT_APPROVED_WINDOW_KEYS : new Set(HISTORICAL_FLIGHT_RECORDER_APPROVED_WINDOW_KEYS), `${label}.approvedWindow`);
+            const startsAt = intervalVersion ? requireIsoTimestamp(window.startsAt, `${label}.approvedWindow.startsAt`) : undefined;
+            const endsAt = intervalVersion ? requireIsoTimestamp(window.endsAt, `${label}.approvedWindow.endsAt`) : undefined;
+            if (intervalVersion && (!changeInterval || startsAt !== window.startsAt || endsAt !== window.endsAt
+                || Date.parse(startsAt) > Date.parse(changeInterval.after) || Date.parse(endsAt) < Date.parse(changeInterval.by))) {
+                throw new TypeError(`${label}.approvedWindow does not contain the change interval.`);
+            }
             approvedWindow = Object.freeze({
                 id: exactRecorderText(window.id, `${label}.approvedWindow.id`, MAX_FLIGHT_RECORDER_WINDOW_ID_LENGTH),
                 reason: exactRecorderText(window.reason, `${label}.approvedWindow.reason`, MAX_FLIGHT_RECORDER_WINDOW_REASON_LENGTH),
+                ...(intervalVersion ? { startsAt: startsAt, endsAt: endsAt } : {}),
             });
             kindCounts.approved_change += 1;
         }
@@ -655,16 +713,33 @@ export function validateDomainControlFlightRecorderDocument(value) {
             source: exactRecorderText(event.source, `${label}.source`, MAX_FLIGHT_RECORDER_SOURCE_LENGTH),
             approvedWindow,
             explanation: exactRecorderText(event.explanation, `${label}.explanation`, legacy ? PUBLIC_MAX_FLIGHT_RECORDER_VALUE_LENGTH : MAX_FLIGHT_RECORDER_VALUE_LENGTH),
+            ...(intervalVersion ? { collectionDepth: collectionDepth, changeInterval } : {}),
         });
         if (!legacy) {
-            const previous = latest.get(`${eventDomain}\u0000${event.field}`);
+            const key = `${eventDomain}\u0000${event.field}`;
+            const previous = intervalVersion ? lastComplete.get(key) : latest.get(key);
             if (seenIds.has(result.id) || (kind === 'observed_change' && (!previous || previous.state !== 'observed'
                 || previous.source !== result.source || Date.parse(previous.observedAt) >= Date.parse(result.observedAt)
-                || !sameValues(previous.after, before) || sameValues(before, after)))) {
+                || !sameValues(previous.after, before) || sameValues(before, after)
+                || intervalVersion && (previous.collectionDepth !== result.collectionDepth || !changeInterval
+                    || Date.parse(changeInterval.after) < Date.parse(previous.observedAt)
+                    || changeInterval.incompleteObservations !== (incompleteSince.get(key) ?? 0))))) {
                 throw new TypeError(`${label} has a duplicate identity or an unsupported observed-change claim.`);
             }
             seenIds.add(result.id);
-            latest.set(`${eventDomain}\u0000${event.field}`, result);
+            latest.set(key, result);
+            if (intervalVersion) {
+                if (expectedState === 'observed') {
+                    lastComplete.set(key, result);
+                    incompleteSince.delete(key);
+                }
+                else {
+                    incompleteSince.set(key, (incompleteSince.get(key) ?? 0) + 1);
+                    if (previous && result.source !== 'Not supplied in this capture'
+                        && (previous.source !== result.source || result.collectionDepth !== 'unknown' && previous.collectionDepth !== result.collectionDepth))
+                        lastComplete.delete(key);
+                }
+            }
         }
         return result;
     });
@@ -685,14 +760,15 @@ export function validateDomainControlFlightRecorderDocument(value) {
             throw new TypeError('Domain control flight-recorder document summary is inconsistent.');
         }
     }
-    const limitations = legacy ? PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_LIMITATIONS : DOMAIN_CONTROL_FLIGHT_RECORDER_LIMITATIONS;
+    const limitations = legacy ? PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_LIMITATIONS
+        : intervalVersion ? DOMAIN_CONTROL_FLIGHT_RECORDER_LIMITATIONS : SOURCE_TIMED_FLIGHT_RECORDER_LIMITATIONS;
     const limitationsInput = boundedDataArray(root.limitations, 'Domain control flight-recorder document limitations', limitations.length, limitations.length);
     if (limitationsInput.some((item, index) => item !== limitations[index])) {
         throw new TypeError('Domain control flight-recorder document limitations are invalid.');
     }
     const document = Object.freeze({
         schema: DOMAIN_CONTROL_FLIGHT_RECORDER_SCHEMA,
-        version: legacy ? PUBLIC_DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION : DOMAIN_CONTROL_FLIGHT_RECORDER_VERSION,
+        version: root.version,
         generatedAt,
         domains: Object.freeze(domains),
         observationCount,

package/lib/domain-control-manifest.mjs

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { domainToASCII } from 'node:url';
 import { canonicalArtifactJsonFor, } from "../packages/evidence/artifact-integrity.mjs";
 import { DOMAIN_CONTROL_MANIFEST_CURRENT_CANONICALIZATION, DOMAIN_CONTROL_MANIFEST_INPUT_SCHEMA, DOMAIN_CONTROL_MANIFEST_VERSION, DOMAIN_CONTROL_MANIFEST_SCHEMA, DOMAIN_CONTROL_TEXT_INPUT_BOUND_FACTOR, MAX_DOMAIN_CONTROL_CAA_PRESENTATION_LENGTH, MAX_CANONICAL_DOMAIN_CONTROL_RECORDS, MAX_CURRENT_DOMAIN_CONTROL_RECORDS, DOMAIN_CONTROL_RECORD_LIST_FIELDS, DOMAIN_CONTROL_RECORD_MODE_OPTIONS, PUBLIC_DOMAIN_CONTROL_MANIFEST_VERSION, MAX_DOMAIN_CONTROL_DS_PRESENTATION_LENGTH, MAX_DOMAIN_CONTROL_INPUT_RECORDS, MAX_DOMAIN_CONTROL_MANIFEST_ENTRIES, MAX_DOMAIN_CONTROL_TIMESTAMP_LENGTH, } from "../packages/contracts/domain-control-manifest.mjs";
-import { DOMAIN_CONTROL_REVIEW_FIELDS, DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, DOMAIN_CONTROL_REVIEW_COUNT_KEYS, DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_LIMITATIONS, DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS, DOMAIN_CONTROL_REVIEW_ROOT_KEYS, DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION, SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS, PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS, PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH, } from "../packages/contracts/domain-control-review.mjs";
+import { DOMAIN_CONTROL_REVIEW_FIELDS, DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, DOMAIN_CONTROL_REVIEW_COUNT_KEYS, DOMAIN_CONTROL_REVIEW_DOMAIN_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_KEYS, DOMAIN_CONTROL_REVIEW_INPUT_SCHEMA, DOMAIN_CONTROL_REVIEW_LIMITATIONS, domainControlReviewCountKeys, domainControlReviewLimitations, DOMAIN_CONTROL_REVIEW_MANIFEST_SUMMARY_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_FIELD_KEYS, DOMAIN_CONTROL_REVIEW_OBSERVATION_KEYS, DOMAIN_CONTROL_REVIEW_ROOT_KEYS, DOMAIN_CONTROL_REVIEW_SCHEMA, DOMAIN_CONTROL_REVIEW_VERSION, PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION, SUPPORTED_DOMAIN_CONTROL_REVIEW_VERSIONS, PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, MAX_DOMAIN_CONTROL_REVIEW_SOURCE_LENGTH, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH, } from "../packages/contracts/domain-control-review.mjs";
 import { assertDomainControlManifestByteBudget, buildUnsignedDomainControlManifest, canonicalDomainControlRecordList, domainControlRecordMode, domainControlEvidenceAdmission, normalizeDomainControlManifestDocument, } from "../packages/evidence/domain-control-runtime.mjs";
 import { exactKeys } from "./bounded-contract-normalizers.mjs";
 import { normalizeExplicitIsoTimestamp, normalizeLegacyIsoTimestamp } from "../packages/evidence/observation.mjs";
@@ -323,28 +323,36 @@ function renewalComparison(entry, now) {
         });
     const due = Date.parse(entry.renewalReviewAt) <= Date.parse(now);
     return Object.freeze({
-        field: 'renewalReviewAt', state: due ? 'due' : 'aligned', desired: Object.freeze([entry.renewalReviewAt]), observed: Object.freeze([]), source: null, observedAt: null,
+        field: 'renewalReviewAt', state: due ? 'due' : 'not_due', desired: Object.freeze([entry.renewalReviewAt]), observed: Object.freeze([]), source: null, observedAt: null,
         explanation: due ? 'The configured renewal review date is due.' : 'The configured renewal review date is still in the future.',
         expectation: 'expect_records',
     });
 }
-function aggregateComparisonState(comparisons, legacy = false) {
-    if (comparisons.some((item) => item.state === 'drift' || item.state === 'due'))
+function aggregateComparisonState(comparisons, version = DOMAIN_CONTROL_REVIEW_VERSION) {
+    if (comparisons.some((item) => item.state === 'drift' || (version < 3 && item.state === 'due')))
         return 'drift';
     if (comparisons.some((item) => ['partial', 'unavailable', 'unsupported'].includes(item.state)))
         return 'partial';
-    if (legacy || comparisons.some((item) => item.state === 'aligned'))
+    if (comparisons.some((item) => item.state === 'due'))
+        return 'due';
+    if (version === 1 || comparisons.some((item) => item.state === 'aligned'))
         return 'aligned';
-    return comparisons.some((item) => item.state === 'observed') ? 'observed' : 'not_configured';
+    if (comparisons.some((item) => item.state === 'observed'))
+        return 'observed';
+    return comparisons.some((item) => item.state === 'not_due') ? 'not_due' : 'not_configured';
 }
-function aggregateDomainState(domains, legacy = false) {
+function aggregateDomainState(domains, version = DOMAIN_CONTROL_REVIEW_VERSION) {
     if (domains.some((item) => item.state === 'drift'))
         return 'drift';
     if (domains.some((item) => item.state === 'partial'))
         return 'partial';
-    if (legacy || domains.some((item) => item.state === 'aligned'))
+    if (domains.some((item) => item.state === 'due'))
+        return 'due';
+    if (version === 1 || domains.some((item) => item.state === 'aligned'))
         return 'aligned';
-    return domains.some((item) => item.state === 'observed') ? 'observed' : 'not_configured';
+    if (domains.some((item) => item.state === 'observed'))
+        return 'observed';
+    return domains.some((item) => item.state === 'not_due') ? 'not_due' : 'not_configured';
 }
 export function reviewDomainControlManifest(input, generatedAtValue = new Date().toISOString()) {
     const source = record(input);
@@ -405,10 +413,10 @@ export function validateDomainControlReviewDocument(value) {
         throw new TypeError(`Domain control review document must use ${DOMAIN_CONTROL_REVIEW_SCHEMA} version ${DOMAIN_CONTROL_REVIEW_VERSION}.`);
     }
     const legacy = root.version === PUBLIC_DOMAIN_CONTROL_REVIEW_VERSION;
-    const countKeys = legacy ? PUBLIC_DOMAIN_CONTROL_REVIEW_COUNT_KEYS : DOMAIN_CONTROL_REVIEW_COUNT_KEYS;
+    const countKeys = domainControlReviewCountKeys(root.version);
     const comparisonKeys = legacy ? new Set(PUBLIC_DOMAIN_CONTROL_REVIEW_COMPARISON_KEYS) : REVIEW_COMPARISON_KEYS;
     const recordMaximum = legacy ? MAX_CANONICAL_DOMAIN_CONTROL_RECORDS : MAX_DOMAIN_CONTROL_RECORDS;
-    const limitations = legacy ? PUBLIC_DOMAIN_CONTROL_REVIEW_LIMITATIONS : DOMAIN_CONTROL_REVIEW_LIMITATIONS;
+    const limitations = domainControlReviewLimitations(root.version);
     const generatedAt = exactReviewTimestamp(root.generatedAt, 'Domain control review document generatedAt');
     const manifestInput = exactReviewRecord(root.manifest, REVIEW_MANIFEST_KEYS, 'Domain control review document manifest');
     const manifestGeneratedAt = exactReviewTimestamp(manifestInput.generatedAt, 'Domain control review document manifest generatedAt');
@@ -492,16 +500,16 @@ export function validateDomainControlReviewDocument(value) {
                     || (expectation === 'unconfigured' && (state !== 'not_configured' || observed.length || source !== null || observedAt !== null))
                     || (state === 'not_configured' && expectation !== 'unconfigured')
                     || (state === 'observed' && expectation !== 'observe_only')
-                    || (['aligned', 'drift', 'due'].includes(state) && ['unconfigured', 'observe_only'].includes(expectation))) {
+                    || (['aligned', 'drift', 'due', 'not_due'].includes(state) && ['unconfigured', 'observe_only'].includes(expectation))) {
                     throw new TypeError('Domain control review comparison expectation is inconsistent.');
                 }
                 if (expectedField === 'renewalReviewAt' && expectation === 'expect_records') {
                     if (desired.length !== 1 || normalizeExplicitIsoTimestamp(desired[0]) !== desired[0]
-                        || state !== (Date.parse(desired[0]) <= Date.parse(generatedAt) ? 'due' : 'aligned'))
+                        || state !== (Date.parse(desired[0]) <= Date.parse(generatedAt) ? 'due' : root.version === 2 ? 'aligned' : 'not_due'))
                         throw new TypeError('Domain control renewal review state is inconsistent.');
                 }
-                else if (state === 'due')
-                    throw new TypeError('Only renewal review dates can be due.');
+                else if (state === 'due' || state === 'not_due')
+                    throw new TypeError('Only renewal review dates can be due or not due.');
                 if (expectedField !== 'renewalReviewAt' && ['aligned', 'drift', 'observed'].includes(state)) {
                     if (!source || domainControlEvidenceAdmission(observedAt, generatedAt))
                         throw new TypeError('Domain control review requires current source timing for a conclusive comparison.');
@@ -521,7 +529,7 @@ export function validateDomainControlReviewDocument(value) {
                 ...(expectation !== undefined ? { expectation } : {}),
             });
         });
-        const expectedState = aggregateComparisonState(comparisons, legacy);
+        const expectedState = aggregateComparisonState(comparisons, root.version);
         if (item.state !== expectedState) {
             throw new TypeError(`Domain control review document domain ${domainIndex + 1} state is inconsistent.`);
         }
@@ -535,7 +543,7 @@ export function validateDomainControlReviewDocument(value) {
             throw new TypeError('Domain control review document counts are inconsistent.');
         }
     }
-    const expectedState = expired ? 'expired' : aggregateDomainState(domains, legacy);
+    const expectedState = expired ? 'expired' : aggregateDomainState(domains, root.version);
     if (root.state !== expectedState)
         throw new TypeError('Domain control review document state is inconsistent.');
     const ignoredObservationCount = exactReviewInteger(root.ignoredObservationCount, MAX_DOMAIN_CONTROL_REVIEW_OBSERVATIONS, 'Domain control review document ignored observation count');