@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/packages/cases/case-migration-model.mjs

@@ -6,6 +6,8 @@ import { normalizeCase } from "./case-record-operations.mjs";
 import { normalizeCaseObjective } from "./case-incident-context.mjs";
 import { normalizeDomain } from "../evidence/domain-name.mjs";
 import { mergeImportedEvidenceHistory, normalizeEvidenceHistory } from "./case-evidence-model.mjs";
+import { assertCaseCollectionReceiptAudience } from "./case-record-projection.mjs";
+import { readCaseCheckpointReceipts, mergeCaseCheckpointReceipts } from "./case-checkpoint-receipts.mjs";
 import { CASE_REPORT_SCHEMA, PUBLIC_CASE_SCHEMA_VERSION, PUBLISHED_V2_3_CASE_SCHEMA_VERSION, INCIDENT_CASE_SCHEMA_VERSION, caseReportVersionMatchesCase, CLI_CASE_PACK_CURRENT_REDACTION_KEYS, CLI_CASE_PACK_INTEGRITY_KEYS, CLI_CASE_PACK_LIMITATIONS, CLI_CASE_PACK_PACKET_KEYS, CLI_CASE_PACK_PUBLIC_REPORT_KEYS, CLI_CASE_PACK_REPORT_KEYS, CLI_CASE_PACK_ROOT_KEYS, CLI_CASE_PACK_SCHEMA, CLI_CASE_PACK_VERSION, } from "../contracts/case-portability.mjs";
 import { canonicalArtifactJsonV2 } from "../evidence/artifact-integrity.mjs";
 import { readCaseAttachments, mergeCaseAttachments } from "./case-attachment-model.mjs";
@@ -242,6 +244,7 @@ function extractImportPatch(raw, importedVersion) {
             caseDomain: domain,
         }),
         evidencePins,
+        checkpointCollectionReceipts: readCaseCheckpointReceipts(record.checkpointCollectionReceipts, evidencePins, importedVersion),
         decisions,
         actions,
         assertions,
@@ -297,6 +300,7 @@ function caseFromPatch(patch, now) {
         source: patch.source ?? DEFAULT_SOURCE,
         evidenceHistory: patch.evidenceHistory,
         evidencePins: patch.evidencePins,
+        ...(patch.checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts: patch.checkpointCollectionReceipts }),
         decisions: patch.decisions,
         actions: patch.actions,
         assertions: patch.assertions,
@@ -327,6 +331,7 @@ function applyImportPatch(local, patch) {
     const historySelection = mergeImportedEvidenceHistory(local.evidenceHistory, patch.evidenceHistory, local.domain);
     const pinSelection = retainLocalAuthoredRecords(local.evidencePins, patch.evidencePins, MAX_CASE_EVIDENCE_PINS);
     const evidencePins = normalizeCaseEvidencePins(pinSelection.records, fallback);
+    const checkpointCollectionReceipts = mergeCaseCheckpointReceipts(local, patch, evidencePins);
     const pinIds = new Set(evidencePins.map((item) => item.id));
     const actions = mergeCaseActions(local.actions, patch.actions, fallback, pinIds);
     const assertionSelection = retainLocalAuthoredRecords(local.assertions, patch.assertions, MAX_CASE_ASSERTIONS);
@@ -351,8 +356,9 @@ function applyImportPatch(local, patch) {
         + assertionSelection.omitted
         + trailSelection.omitted
         + sightingSelection.omitted;
+    const { checkpointCollectionReceipts: _previousReceipts, ...localFields } = local;
     return { record: {
-            ...local,
+            ...localFields,
             title: patch.title !== undefined && importNewer ? patch.title : local.title ?? '',
             status: patch.status !== undefined && importNewer ? patch.status : local.status,
             disposition: patch.disposition !== undefined && importNewer ? patch.disposition : local.disposition,
@@ -361,6 +367,7 @@ function applyImportPatch(local, patch) {
             source: patch.source !== undefined && importNewer ? patch.source : local.source,
             evidenceHistory: historySelection.records,
             evidencePins,
+            ...(checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts }),
             decisions,
             actions,
             assertions,
@@ -465,6 +472,7 @@ function caseCollectionImportEnvelope(importedRaw) {
         || caseTimestampOrNull(root.exportedAt) !== root.exportedAt) {
         throw new Error('The WHOISleuth CLI Case-pack envelope is invalid.');
     }
+    assertCaseCollectionReceiptAudience(root, audience);
     for (const reportValue of reports) {
         const report = objectRecord(reportValue);
         assertOnlyEnvelopeKeys(report, rootVersion === PUBLIC_CASE_SCHEMA_VERSION ? CLI_CASE_PACK_PUBLIC_REPORT_KEYS : CLI_CASE_PACK_REPORT_KEYS, 'CLI Case-pack report');

package/packages/cases/case-object-coverage.mjs

@@ -0,0 +1,119 @@
+import { retainedCaseResponseObjects, sameCaseResponseObject, } from "./case-response-object.mjs";
+import { correctionDelivery } from "./case-packet-correction.mjs";
+export function caseIncidentObjects(record) {
+    const objects = new Map();
+    const explicit = retainedCaseResponseObjects(record);
+    for (const target of record.workflowMetadata?.incidentTargets ?? []) {
+        const matching = explicit.filter((object) => object.incidentTargetId === target.id && object.identifier === target.url);
+        for (const object of matching.length
+            ? matching
+            : [{ kind: 'other', identifier: target.url, incidentTargetId: target.id }])
+            objects.set(JSON.stringify(object), { target, object, targetRetained: true });
+    }
+    for (const object of explicit)
+        if (!objects.has(JSON.stringify(object)))
+            objects.set(JSON.stringify(object), {
+                object,
+                targetRetained: false,
+                target: {
+                    id: object.incidentTargetId ?? `${object.kind}-${object.identifier}`,
+                    url: object.identifier,
+                    state: 'open',
+                    createdAt: record.createdAt ?? '',
+                    updatedAt: record.updatedAt ?? '',
+                },
+            });
+    return [...objects.values()];
+}
+export function buildCaseIncidentCoverage(record) {
+    return caseIncidentObjects(record).map(({ target, object, targetRetained }) => {
+        const contexts = (record.actions ?? [])
+            .map((action) => ({
+            action,
+            currentlyBound: Boolean(action.responseObjects?.some((bound) => sameCaseResponseObject(bound, object))),
+            events: action.history.filter((event) => event.responseObjects?.some((bound) => sameCaseResponseObject(bound, object))),
+        }))
+            .filter((context) => context.currentlyBound || context.events.length);
+        const actions = contexts
+            .filter((context) => context.currentlyBound)
+            .map((context) => context.action);
+        const responseContexts = contexts.map(({ action, currentlyBound, events }) => {
+            let correction = null;
+            if (currentlyBound && action.correction) {
+                let linkAvailable = false;
+                try {
+                    linkAvailable = Boolean(correctionDelivery(record.actions ?? [], action));
+                }
+                catch {
+                    /* Historical linkage can be unavailable; the draft is not re-authorised here. */
+                }
+                correction = {
+                    purpose: action.correction.purpose,
+                    originActionId: action.originActionId,
+                    deliveryEventId: action.correction.deliveryEventId,
+                    packetDigestSha256: action.correction.packetDigestSha256,
+                    packetVersion: action.correction.packetVersion,
+                    linkAvailable,
+                };
+            }
+            return {
+                actionId: action.id,
+                type: action.type,
+                recipient: action.recipient,
+                contactSource: action.contactSource,
+                routeObservedAt: action.routeObservedAt,
+                routeReviewAfter: action.routeReviewAfter,
+                contactLimitations: action.contactLimitations,
+                metadataUpdatedAt: action.metadataUpdatedAt,
+                currentState: action.state,
+                currentlyBound,
+                historyOmitted: action.historyOmitted,
+                historyLimitations: action.historyLimitations,
+                reviewEvents: events.filter((event) => event.sourceClass === 'analyst' &&
+                    (event.nextState === 'reviewed' || event.nextState === 'authorised')),
+                // A repeated submitted-state update alone does not establish another delivery.
+                deliveryEvents: events.filter((event) => event.sourceClass === 'analyst' &&
+                    event.nextState === 'submitted' &&
+                    (event.previousState === 'authorised' || Boolean(event.packetReceipt))),
+                correction,
+            };
+        });
+        const responseEvents = contexts.flatMap(({ action, events }) => events
+            .filter((event) => event.providerOutcome || event.objectOutcome || event.nextState === 'acknowledged')
+            .map((event) => ({
+            actionId: action.id,
+            eventId: event.id,
+            state: event.nextState,
+            outcome: event.objectOutcome ?? event.providerOutcome,
+            occurredAt: event.occurredAt,
+            sourceClass: event.sourceClass,
+            applied: event.applied,
+            provenance: event.provenance,
+            reference: event.reference,
+        })));
+        const reviews = (record.observedEffects?.reviews ?? []).filter((review) => sameCaseResponseObject(review.responseObject, object));
+        const latestAt = Math.max(...reviews.map((review) => Date.parse(review.observedAt)));
+        const latest = reviews.filter((review) => Date.parse(review.observedAt) === latestAt);
+        return {
+            target,
+            targetRetained,
+            responseObject: object,
+            hostname: object.kind === 'domain' || object.kind === 'hostname'
+                ? object.identifier
+                : new URL(object.identifier).hostname,
+            actionCoverage: actions.length ? 'bound' : 'unknown',
+            actionIds: actions.map((action) => action.id),
+            responseContexts,
+            providerEvents: responseEvents.filter((event) => event.applied),
+            unappliedProviderEvents: responseEvents.filter((event) => !event.applied),
+            observationCoverage: !reviews.length
+                ? 'unknown'
+                : new Set(latest.map((review) => `${review.state}\u0000${review.objectOutcome ?? ''}`))
+                    .size > 1
+                    ? 'ambiguous'
+                    : 'available',
+            reviews,
+            closures: (record.closures?.records ?? []).filter((closure) => sameCaseResponseObject(closure.responseObject, object)),
+        };
+    });
+}

package/packages/cases/case-packet-correction.mjs

@@ -0,0 +1,106 @@
+// Local delivery linkage, not authentication, external acceptance or nonrepudiation.
+import { array, enumeration, exact, HEX_DIGEST_RE, iso, text } from "../evidence/artifact-structure.mjs";
+import { assertWorkspaceInputGraph } from "../workspace/hostile-input.mjs";
+import { MAX_DECISION_PIN_REFERENCES, MAX_RESPONSE_RATIONALE_LENGTH, MAX_RESPONSE_RECIPIENT_LENGTH, SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS } from "../contracts/case-portability.mjs";
+import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
+import { readCaseResponseObjects, sameCaseResponseObject } from "./case-response-object.mjs";
+import { RESPONSE_PACKET_PROFILE_IDS } from "./case-response-packet-vocabulary.mjs";
+export const CASE_DELIVERY_RECEIPT_LIMITATION = 'This retained local receipt identifies canonical packet JSON and analyst-recorded delivery, not delivered message or PDF bytes, external receipt, factual truth, authorship authentication or provider acceptance.';
+const id = (value, label) => {
+    const result = text(value, label, 64);
+    if (!/^[A-Za-z0-9_-]{1,64}$/u.test(result))
+        throw new TypeError(`${label} is invalid.`);
+    return result;
+};
+const digest = (value) => {
+    if (typeof value !== 'string' || !HEX_DIGEST_RE.test(value))
+        throw new TypeError('Select an exact recorded packet digest.');
+    return value;
+};
+const packetVersion = (value) => {
+    if (!SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS.some(version => version === value))
+        throw new TypeError('The recorded packet version is unsupported.');
+    return value;
+};
+const statement = (value, label, required = true) => {
+    const result = text(value, label, MAX_RESPONSE_RATIONALE_LENGTH, !required).trim();
+    if (required && !result)
+        throw new TypeError(`${label} is required.`);
+    return result;
+};
+export function readCaseDeliveryPacketReceipt(value) {
+    if (value === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(value, 'Delivery packet receipt');
+    const row = exact(value, ['version', 'caseId', 'actionId', 'target', 'packetDigestSha256', 'packetVersion', 'packetGeneratedAt', 'recipient', 'profile', 'responseObjects'], 'Delivery packet receipt');
+    if (row.version !== 1)
+        throw new TypeError('The delivery receipt version is unsupported.');
+    const target = text(row.target, 'Receipt target', 253);
+    if (!isValidAsciiHostname(target) || target !== target.toLowerCase())
+        throw new TypeError('The delivery receipt target is invalid.');
+    iso(row.packetGeneratedAt, 'Packet generation time');
+    const recipient = text(row.recipient, 'Receipt recipient', MAX_RESPONSE_RECIPIENT_LENGTH).trim();
+    if (!recipient)
+        throw new TypeError('The receipt recipient is required.');
+    const responseObjects = readCaseResponseObjects(row.responseObjects);
+    if (!responseObjects?.length)
+        throw new TypeError('The receipt requires an explicit nonempty delivered object scope.');
+    return Object.freeze({ version: 1, caseId: id(row.caseId, 'Receipt Case'), actionId: id(row.actionId, 'Receipt action'), target,
+        packetDigestSha256: digest(row.packetDigestSha256), packetVersion: packetVersion(row.packetVersion), packetGeneratedAt: row.packetGeneratedAt,
+        recipient, profile: enumeration(row.profile, RESPONSE_PACKET_PROFILE_IDS, 'Receipt audience'), responseObjects });
+}
+export function readCasePacketCorrection(value) {
+    if (value === undefined)
+        return undefined;
+    assertWorkspaceInputGraph(value, 'Packet correction');
+    const row = exact(value, ['version', 'purpose', 'deliveryEventId', 'packetDigestSha256', 'packetVersion', 'reason', 'previousStatement', 'correctedStatement', 'evidencePinIds', 'profile'], 'Packet correction');
+    if (row.version !== 1)
+        throw new TypeError('The correction version is unsupported.');
+    const purpose = enumeration(row.purpose, ['correction', 'retraction_request'], 'Correction purpose');
+    const pins = array(row.evidencePinIds, 'Correction evidence', MAX_DECISION_PIN_REFERENCES).map(value => id(value, 'Correction pin'));
+    if (!pins.length || new Set(pins).size !== pins.length)
+        throw new TypeError('Select distinct retained correction evidence pins.');
+    return Object.freeze({ version: 1, purpose, deliveryEventId: id(row.deliveryEventId, 'Original delivery event'),
+        packetDigestSha256: digest(row.packetDigestSha256), packetVersion: packetVersion(row.packetVersion),
+        reason: statement(row.reason, 'Correction reason'), previousStatement: statement(row.previousStatement, 'Previous statement'),
+        correctedStatement: statement(row.correctedStatement, 'Corrected statement', purpose === 'correction'),
+        evidencePinIds: Object.freeze(pins), profile: enumeration(row.profile, RESPONSE_PACKET_PROFILE_IDS, 'Correction audience') });
+}
+export function assertDeliveryPacketReceipt(receipt, event, actionId) {
+    if (!receipt)
+        return;
+    if (receipt.actionId !== actionId || !['authorised', 'submitted'].includes(event.previousState ?? '') || event.nextState !== 'submitted' || event.sourceClass !== 'analyst'
+        || event.reference !== `response-packet-sha256:${receipt.packetDigestSha256}`
+        || JSON.stringify(event.responseObjects ?? []) !== JSON.stringify(receipt.responseObjects)
+        || (event.occurredAt && Date.parse(event.occurredAt) < Date.parse(receipt.packetGeneratedAt)))
+        throw new TypeError('The packet receipt must match its exact analyst-recorded delivery and object scope.');
+}
+export function correctionDelivery(actions, action, context) {
+    const correction = action.correction;
+    if (!correction)
+        return null;
+    const original = actions.find(item => item.id === action.originActionId);
+    const event = original?.history.find(item => item.id === correction.deliveryEventId);
+    const receipt = event?.packetReceipt;
+    if (!original || !event?.applied || !receipt)
+        throw new TypeError('An exact-linked correction requires the retained receipt of the explicitly selected delivery. Legacy digest-only or omitted receipts cannot authorise it.');
+    assertDeliveryPacketReceipt(receipt, event, original.id);
+    if (receipt.recipient === '[redacted]' || action.recipient === '[redacted]' || receipt.recipient !== action.recipient
+        || original.recipient !== receipt.recipient || correction.profile !== receipt.profile
+        || correction.packetDigestSha256 !== receipt.packetDigestSha256 || correction.packetVersion !== receipt.packetVersion
+        || !action.responseObjects?.length || action.responseObjects.some(object => !receipt.responseObjects.some(previous => sameCaseResponseObject(previous, object))))
+        throw new TypeError('Correction recipient, version, digest, audience and object subset must match the selected delivered packet.');
+    if (context && (receipt.caseId !== context.caseId || receipt.target !== context.target || (context.profile && context.profile !== correction.profile)
+        || (context.selectedPinIds && correction.evidencePinIds.some(pin => !context.selectedPinIds.has(pin)))))
+        throw new TypeError('Review the current Case target, audience and every retained correction pin before preparation.');
+    return { original, event, receipt };
+}
+/** Called only with the exact completed packet; never uses a later editable draft. */
+export function deliveryReceiptForPacket(packet) {
+    const action = packet.escalationHistory.find(action => action.actionId === packet.actionBinding.selectedActionId);
+    if (!action || !packet.recipientRoute || packet.authorisation.status !== 'authorised' || !action.responseObjects?.length)
+        throw new TypeError('A retained exact receipt requires an authorised action-bound packet with explicit object scope.');
+    return readCaseDeliveryPacketReceipt({ version: 1, caseId: packet.case.id, actionId: action.actionId, target: packet.case.domain,
+        packetDigestSha256: packet.integrity.digestSha256, packetVersion: packet.schemaVersion, packetGeneratedAt: packet.generatedAt,
+        recipient: packet.recipientRoute.contact, profile: packet.profile.id, responseObjects: action.responseObjects });
+}

package/packages/cases/case-recheck-model.mjs

@@ -1,6 +1,7 @@
 import { isValidAsciiHostname } from "../contracts/domain-name.mjs";
 import { INCIDENT_CASE_SCHEMA_VERSION, MAX_RESPONSE_RATIONALE_LENGTH, } from "../contracts/case-portability.mjs";
-import { enumeration, exact, text } from "../evidence/artifact-structure.mjs";
+import { enumeration, exactOptional, text } from "../evidence/artifact-structure.mjs";
+import { readCaseResponseObject, sameCaseResponseObject } from "./case-response-object.mjs";
 import { casePinHasCompleteObservation } from "./case-evidence-quality.mjs";
 export const CASE_RECHECK_CONDITIONS = Object.freeze({
     unknown: 'Not established',
@@ -13,7 +14,7 @@ function reference(value, label) {
         throw new TypeError(`${label} is invalid.`);
     return id;
 }
-function contextFields(item) {
+function contextFields(item, sourceVersion) {
     const targetHostname = text(item.targetHostname, 'Recheck target hostname', 253);
     if (targetHostname !== targetHostname.toLowerCase() || !isValidAsciiHostname(targetHostname)) {
         throw new TypeError('Use one normalised hostname for the recheck target, without a path or query.');
@@ -21,10 +22,16 @@ function contextFields(item) {
     const conditions = text(item.conditions, 'Recheck comparison conditions', MAX_RESPONSE_RATIONALE_LENGTH);
     if (!conditions.trim())
         throw new TypeError('Describe the conditions needed to compare the observations.');
+    const responseObject = readCaseResponseObject(item.responseObject, sourceVersion);
+    if (responseObject && (responseObject.kind === 'domain' || responseObject.kind === 'hostname'
+        ? responseObject.identifier : new URL(responseObject.identifier).hostname) !== targetHostname) {
+        throw new TypeError('The recheck target hostname must match the exact object snapshot.');
+    }
     return Object.freeze({
         targetHostname,
         conditions,
         baselinePinId: item.baselinePinId === null ? null : reference(item.baselinePinId, 'Recheck baseline pin'),
+        ...(responseObject ? { responseObject } : {}),
     });
 }
 /** Optional current-format context; historical records have no invented question. */
@@ -33,19 +40,19 @@ export function readCaseRecheckContext(value, sourceVersion) {
         return undefined;
     if (sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION)
         throw new TypeError('This Case format cannot contain structured recheck questions.');
-    return contextFields(exact(value, ['targetHostname', 'baselinePinId', 'conditions'], 'Recheck question context'));
+    return contextFields(exactOptional(value, ['targetHostname', 'baselinePinId', 'conditions'], ['responseObject'], 'Recheck question context'), sourceVersion);
 }
 export function readCaseRecheckAnswerContext(value, sourceVersion) {
     if (value === undefined)
         return undefined;
     if (sourceVersion != null && sourceVersion < INCIDENT_CASE_SCHEMA_VERSION)
         throw new TypeError('This Case format cannot contain structured recheck answers.');
-    const item = exact(value, ['targetHostname', 'baselinePinId', 'conditions', 'questionId', 'question', 'conditionsMatch'], 'Recheck answer context');
+    const item = exactOptional(value, ['targetHostname', 'baselinePinId', 'conditions', 'questionId', 'question', 'conditionsMatch'], ['responseObject'], 'Recheck answer context');
     const question = text(item.question, 'Recheck question', MAX_RESPONSE_RATIONALE_LENGTH);
     if (!question.trim())
         throw new TypeError('A recheck answer requires its original question.');
     return Object.freeze({
-        ...contextFields(item),
+        ...contextFields(item, sourceVersion),
         questionId: reference(item.questionId, 'Recheck question ID'),
         question,
         conditionsMatch: enumeration(item.conditionsMatch, Object.keys(CASE_RECHECK_CONDITIONS), 'Recheck condition comparison'),
@@ -92,6 +99,10 @@ const RECHECK_COMPARISON_MESSAGES = {
     later_observation_needed: 'A later source observation is needed; reviewing the baseline again is not a recheck.',
     baseline_target_mismatch: 'The baseline concerns a different hostname.',
     different_field_or_source: 'The observations use different fields or sources.',
+    missing_object_baseline: 'An object-specific baseline is required for this exact-object comparison.',
+    baseline_object_mismatch: 'The baseline does not explicitly concern this same object.',
+    current_object_mismatch: 'The current observation does not explicitly concern this same object.',
+    incomplete_object_baseline: 'The exact-object baseline must be a complete source observation.',
 };
 /** Admissibility depends on these reasons, not on presentation warnings. */
 export function caseRecheckComparisonBlockers(context, pins, current) {
@@ -102,6 +113,16 @@ export function caseRecheckComparisonBlockers(context, pins, current) {
             : 'unconfirmed_conditions');
     }
     const baseline = pins.find((pin) => pin.id === context.baselinePinId);
+    if (context.responseObject) {
+        if (!baseline)
+            blockers.push('missing_object_baseline');
+        else if (!sameCaseResponseObject(baseline.responseObject, context.responseObject))
+            blockers.push('baseline_object_mismatch');
+        if (baseline && !casePinHasCompleteObservation(baseline))
+            blockers.push('incomplete_object_baseline');
+        if (!current || !sameCaseResponseObject(current.responseObject, context.responseObject))
+            blockers.push('current_object_mismatch');
+    }
     if (context.baselinePinId && !baseline)
         blockers.push('missing_baseline');
     if (current) {
@@ -147,3 +168,12 @@ export function assertRecheckNonReproduction(state, context, completeness, pins,
         throw new Error('Not reproduced requires a complete observation under comparable conditions. Record unavailable or describe the limited observation instead.');
     }
 }
+export const COMPARATIVE_CASE_OBJECT_OUTCOMES = Object.freeze(['removed', 'restricted', 'suspended', 'delisted', 'transferred', 'restored']);
+/** Technical state changes need an exact-object baseline; procedural dispute is distinct. */
+export function assertCaseObjectObservationOutcome(outcome, context, completeness, pins, current, observedAt) {
+    if (!outcome || !COMPARATIVE_CASE_OBJECT_OUTCOMES.includes(outcome))
+        return;
+    if (!context?.responseObject)
+        throw new TypeError('An independent object state change requires a saved exact-object baseline question and comparable evidence.');
+    assertRecheckNonReproduction('not_reproduced', context, completeness, pins, current, observedAt);
+}

package/packages/cases/case-record-operations.mjs

@@ -3,14 +3,17 @@
 import { normalizeCaseObjective, parseIncidentUrlContext, } from "./case-incident-context.mjs";
 import { selectExistingCase } from "./case-selection.mjs";
 import { emptyCaseWorkflowMetadata, updateCaseWorkflowMetadata } from "./case-workflow-metadata.mjs";
+import { assertCaseResponseObject, readCaseResponseObject, readCaseResponseObjects, sameCaseResponseObject } from "./case-response-object.mjs";
+import { correctionDelivery, readCasePacketCorrection, readCaseDeliveryPacketReceipt } from "./case-packet-correction.mjs";
 import { readCaseWorkflowFields } from "./case-workflow-migration.mjs";
 import { appendCaseAction, appendCaseAssertion, appendCaseClosure, appendCaseDecision, appendCaseEvidencePin, appendCaseEvidencePins, appendCaseManualTrailEvent, appendCaseObservedEffectReview, appendCaseSighting, buildCaseClosureLinkContext, normalizeCaseActions, normalizeCaseAssertions, normalizeCaseClosureHistory, normalizeCaseDecisions, normalizeCaseEvidencePins, normalizeCaseManualTrail, normalizeCaseObservedEffectHistory, normalizeCaseSightings, updateCaseAction, updateCaseAssertion, } from "./case-response-model.mjs";
 import { MAX_CASES, MAX_NOTES_PER_CASE, } from "./case-record-contracts.mjs";
 import { MAX_CASE_OBJECTIVE_LENGTH, MAX_RESPONSE_VALUE_LENGTH } from "../contracts/case-portability.mjs";
 import { caseRecordVersionInput } from "./case-record-version-input.mjs";
+import { readCaseCheckpointReceipts, mergeCaseCheckpointReceipts } from "./case-checkpoint-receipts.mjs";
 import { readCaseAttachments } from "./case-attachment-model.mjs";
 import { readCaseEvidenceLinks, appendCaseEvidenceLink, withdrawCaseEvidenceLink } from "./case-evidence-links.mjs";
-import { assertCurrentRecheckQuestion, assertRecheckNonReproduction, readCaseRecheckAnswerContext } from "./case-recheck-model.mjs";
+import { assertCurrentRecheckQuestion, assertRecheckNonReproduction, assertCaseObjectObservationOutcome, readCaseRecheckAnswerContext } from "./case-recheck-model.mjs";
 import { caseDispositionSupportsDefensiveResponse, caseStatusIsClosed, caseStatusOptionsForDirectEdit, caseStatusRequiresClosure, isReviewedCaseDisposition, } from "./case-record-decisions.mjs";
 import { DEFAULT_EVIDENCE_SOURCE, EVIDENCE_SOURCE_SET, caseTimestampOrNull, deterministicId, makeId, normalizeDisposition, normalizeDomain, normalizeNoteBody, normalizeReviewReasonCode, normalizeNotes, normalizeSource, normalizeStatus, normalizeTags, objectRecord, safeId, } from "./case-record-core.mjs";
 import { assertCaseBrandProfileIds, normalizeCaseBrandProfileIds, } from "./case-brand-profile-references.mjs";
@@ -64,8 +67,14 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
     const createdAt = existing ? existing.createdAt : caseTimestampOrNull(record.createdAt, sourceVersion) || now;
     const updatedAt = caseTimestampOrNull(record.updatedAt, sourceVersion) || createdAt;
     const evidencePins = normalizeCaseEvidencePins(record.evidencePins, updatedAt, timestampOptions);
+    const checkpointCollectionReceipts = readCaseCheckpointReceipts(record.checkpointCollectionReceipts, evidencePins, sourceVersion);
     const pinIds = new Set(evidencePins.map((item) => item.id));
     const actions = normalizeCaseActions(record.actions, updatedAt, { ...timestampOptions, validEvidencePinIds: pinIds });
+    for (const action of actions)
+        for (const event of action.history)
+            if (event.packetReceipt
+                && (event.packetReceipt.caseId !== record.id || event.packetReceipt.target !== domain))
+                throw new TypeError('The packet receipt belongs to a different Case or target.');
     const assertions = normalizeCaseAssertions(record.assertions, updatedAt, pinIds, timestampOptions);
     const sightings = normalizeCaseSightings(record.sightings, updatedAt, pinIds, timestampOptions);
     const sightingIds = new Set(sightings.map((item) => item.id));
@@ -80,7 +89,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
         domain,
         title: normalizeCaseObjective(record.title),
         status: caseStatusRequiresClosure(normalizedStatus)
-            && closures.records.length === 0 && !closures.preV13HistoryUnavailable
+            && !closures.records.some(closure => closure.responseObject === undefined) && !closures.preV13HistoryUnavailable
             ? 'reviewing'
             : normalizedStatus,
         disposition: normalizeDisposition(record.disposition),
@@ -91,6 +100,7 @@ export function normalizeCase(raw, existing, nowIso, sourceVersion) {
         source: normalizeSource(record.source),
         evidenceHistory: normalizeCaseEvidence(record, domain, createdAt, updatedAt, now, sourceVersion),
         evidencePins,
+        ...(checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts }),
         decisions: normalizeCaseDecisions(record.decisions, updatedAt, pinIds, timestampOptions),
         actions,
         assertions,
@@ -117,6 +127,13 @@ export function createCase(input, nowIso) {
         throw new Error('A valid domain is required to open a case.');
     const noteBody = normalizeNoteBody(input.note);
     const source = normalizeSource(input.source);
+    const workflowMetadata = updateCaseWorkflowMetadata(emptyCaseWorkflowMetadata(), input, domain, now);
+    const scopedCase = { domain, workflowMetadata };
+    for (const raw of [input.evidencePin, ...(Array.isArray(input.evidencePins) ? input.evidencePins : []), input.observedEffectReview, input.closure])
+        assertCaseResponseObject(readCaseResponseObject(objectRecord(raw).responseObject), scopedCase);
+    for (const object of readCaseResponseObjects(objectRecord(input.action).responseObjects) ?? [])
+        assertCaseResponseObject(object, scopedCase);
+    assertCaseResponseObject(readCaseResponseObject(objectRecord(objectRecord(input.assertion).recheck).responseObject), scopedCase);
     const evidencePins = input.evidencePins !== undefined
         ? appendCaseEvidencePins([], input.evidencePins, now)
         : input.evidencePin !== undefined
@@ -126,6 +143,7 @@ export function createCase(input, nowIso) {
     const actions = input.action !== undefined
         ? appendCaseAction([], input.action, now)
         : [];
+    const checkpointCollectionReceipts = readCaseCheckpointReceipts(input.checkpointCollectionReceipts, evidencePins);
     const assertions = input.assertion !== undefined
         ? appendCaseAssertion([], input.assertion, now)
         : [];
@@ -137,13 +155,19 @@ export function createCase(input, nowIso) {
         ? appendCaseObservedEffectReview(normalizeCaseObservedEffectHistory(undefined, now), input.observedEffectReview, now, pinIds, new Set(sightings.map((item) => item.id)))
         : normalizeCaseObservedEffectHistory(undefined, now);
     for (const review of observedEffects.reviews) {
+        const pin = evidencePins.find(item => item.id === review.evidencePinId);
+        if (review.responseObject && pin && !sameCaseResponseObject(review.responseObject, pin.responseObject))
+            throw new TypeError('The selected observation evidence does not explicitly concern this exact object.');
+        if (review.responseObject && review.state === 'not_reproduced' && !review.recheck)
+            throw new TypeError('Object-specific non-reproduction requires a saved baseline question and comparable evidence.');
+        assertCaseObjectObservationOutcome(review.objectOutcome, review.recheck, review.completeness, evidencePins, pin, review.observedAt);
         if (!review.recheck)
             continue;
         assertCurrentRecheckQuestion(review.recheck, assertions);
         assertRecheckNonReproduction(review.state, review.recheck, review.completeness, evidencePins, evidencePins.find(pin => pin.id === review.evidencePinId), review.observedAt);
     }
     const closures = input.closure !== undefined
-        ? appendCaseClosure(normalizeCaseClosureHistory(undefined, now), input.closure, now, observedEffects, actions)
+        ? appendCaseClosure(normalizeCaseClosureHistory(undefined, now), input.closure, now, observedEffects, actions, evidencePins)
         : normalizeCaseClosureHistory(undefined, now);
     if (caseStatusRequiresClosure(normalizeStatus(input.status)) && input.closure === undefined) {
         throw new Error('Opening a resolved case requires a deliberate closure reason and its linked review context.');
@@ -152,12 +176,12 @@ export function createCase(input, nowIso) {
         id: makeId(),
         domain,
         title: normalizeCaseObjective(input.title),
-        status: input.closure !== undefined ? 'resolved' : normalizeStatus(input.status),
+        status: input.closure !== undefined && objectRecord(input.closure).responseObject === undefined ? 'resolved' : normalizeStatus(input.status),
         disposition: normalizeDisposition(input.disposition),
         reviewReasonCode: normalizeReviewReasonCode(input.reviewReasonCode),
         brandProfileIds: input.brandProfileIds === undefined ? [] : assertCaseBrandProfileIds(input.brandProfileIds),
         tags: normalizeTags(input.tags),
-        workflowMetadata: updateCaseWorkflowMetadata(emptyCaseWorkflowMetadata(), input, domain, now),
+        workflowMetadata,
         notes: noteBody ? [{ id: makeId(), body: noteBody, createdAt: now }] : [],
         source,
         evidenceHistory: normalizeEvidenceHistory(input.evidence ? [input.evidence] : [], {
@@ -166,6 +190,7 @@ export function createCase(input, nowIso) {
             caseDomain: domain,
         }),
         evidencePins,
+        ...(checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts }),
         decisions: input.decision !== undefined
             ? appendCaseDecision([], input.decision, now)
             : [],
@@ -246,6 +271,21 @@ export function updateCase(cases, id, patch, nowIso) {
     const current = cases[index];
     if (!current)
         throw new Error('That case no longer exists.');
+    if (patch.expectedResponseContext !== undefined && patch.expectedResponseContext !== JSON.stringify(current))
+        throw new TypeError('The Case response context changed after preview. Review the current delivery, scope and evidence before creating this draft.');
+    const workflowMetadata = updateCaseWorkflowMetadata(current.workflowMetadata
+        ?? readCaseWorkflowFields(current, current.domain, current.assertions).workflowMetadata, patch, current.domain, now);
+    const scopedCase = { ...current, workflowMetadata };
+    for (const raw of [patch.evidencePin, ...(Array.isArray(patch.evidencePins) ? patch.evidencePins : []), patch.observedEffectReview, patch.closure]) {
+        assertCaseResponseObject(readCaseResponseObject(objectRecord(raw).responseObject), scopedCase);
+    }
+    for (const raw of [patch.action, patch.actionUpdate, objectRecord(patch.actionUpdate).transition]) {
+        for (const object of readCaseResponseObjects(objectRecord(raw).responseObjects) ?? [])
+            assertCaseResponseObject(object, scopedCase);
+    }
+    for (const raw of [patch.assertion, patch.assertionUpdate, patch.observedEffectReview]) {
+        assertCaseResponseObject(readCaseResponseObject(objectRecord(objectRecord(raw).recheck).responseObject), scopedCase);
+    }
     if (patch.evidenceLink !== undefined && patch.evidenceLinkWithdrawal !== undefined)
         throw new TypeError('Record or withdraw one evidence relationship at a time.');
     if (patch.title !== undefined && patch.expectedTitle !== undefined && patch.expectedTitle !== (current.title ?? '')) {
@@ -283,7 +323,23 @@ export function updateCase(cases, id, patch, nowIso) {
     if (patch.evidencePin !== undefined) {
         evidencePins = appendCaseEvidencePin(evidencePins, patch.evidencePin, now);
     }
+    const previousPinIds = new Set(current.evidencePins.map(pin => pin.id));
+    const checkpointCollectionReceipts = mergeCaseCheckpointReceipts(current, {
+        evidencePins: evidencePins.filter(pin => !previousPinIds.has(pin.id)),
+        checkpointCollectionReceipts: patch.checkpointCollectionReceipts,
+    }, evidencePins);
     const pinIds = new Set(evidencePins.map((item) => item.id));
+    const correctionInput = patch.action !== undefined ? objectRecord(patch.action) : patch.actionUpdate !== undefined
+        ? { ...current.actions.find(action => action.id === objectRecord(patch.actionUpdate).id), ...objectRecord(patch.actionUpdate) } : null;
+    if (correctionInput?.correction !== undefined)
+        correctionDelivery(current.actions, {
+            originActionId: typeof correctionInput.originActionId === 'string' ? correctionInput.originActionId : null,
+            recipient: typeof correctionInput.recipient === 'string' ? correctionInput.recipient : '',
+            responseObjects: readCaseResponseObjects(correctionInput.responseObjects), correction: readCasePacketCorrection(correctionInput.correction),
+        }, { caseId: current.id, target: current.domain, selectedPinIds: pinIds });
+    const transitionReceipt = readCaseDeliveryPacketReceipt(objectRecord(objectRecord(patch.actionUpdate).transition).packetReceipt);
+    if (transitionReceipt && (transitionReceipt.caseId !== current.id || transitionReceipt.target !== current.domain))
+        throw new TypeError('The packet receipt belongs to a different Case or target.');
     let decisions = current.decisions;
     if (patch.decision !== undefined) {
         decisions = appendCaseDecision(current.decisions, patch.decision, now, pinIds);
@@ -295,6 +351,16 @@ export function updateCase(cases, id, patch, nowIso) {
     if (patch.actionUpdate !== undefined) {
         actions = updateCaseAction(actions, patch.actionUpdate, now, pinIds);
     }
+    if (correctionInput?.correction !== undefined || transitionReceipt) {
+        for (const original of current.actions) {
+            const retained = actions.find(action => action.id === original.id);
+            if (!retained || original.history.some(event => !retained.history.some(next => JSON.stringify(next) === JSON.stringify(event)))
+                || (patch.action !== undefined && JSON.stringify(retained) !== JSON.stringify(original)))
+                throw new TypeError('This linked operation would omit or change historical delivery records within the Case bounds. No correction or receipt was retained.');
+        }
+        if (transitionReceipt && !actions.find(action => action.id === transitionReceipt.actionId)?.history.some(event => JSON.stringify(event.packetReceipt) === JSON.stringify(transitionReceipt)))
+            throw new TypeError('The exact delivery receipt exceeds the retained history bounds. No delivery was recorded.');
+    }
     let assertions = current.assertions;
     if (patch.assertion !== undefined) {
         assertions = appendCaseAssertion(current.assertions, patch.assertion, now, pinIds);
@@ -326,22 +392,28 @@ export function updateCase(cases, id, patch, nowIso) {
             assertCurrentRecheckQuestion(context, assertions);
             assertRecheckNonReproduction(review.state, context, String(review.completeness), evidencePins, evidencePins.find(pin => pin.id === review.evidencePinId), typeof review.observedAt === 'string' ? review.observedAt : null);
         }
+        const responseObject = readCaseResponseObject(review.responseObject);
+        const pin = evidencePins.find(item => item.id === review.evidencePinId);
+        assertCaseObjectObservationOutcome(review.objectOutcome, context, String(review.completeness), evidencePins, pin, typeof review.observedAt === 'string' ? review.observedAt : null);
+        if (responseObject && pin && !sameCaseResponseObject(responseObject, pin.responseObject))
+            throw new TypeError('The selected observation evidence does not explicitly concern this exact object.');
+        if (responseObject && review.state === 'not_reproduced' && !context)
+            throw new TypeError('Object-specific non-reproduction requires a saved baseline question and comparable evidence.');
         observedEffects = appendCaseObservedEffectReview(observedEffects, patch.observedEffectReview, now, pinIds, new Set(sightings.map((item) => item.id)));
     }
     let closures = normalizeCaseClosureHistory(current.closures, current.updatedAt, new Set(observedEffects.reviews.map((item) => item.id)), new Set(actions.map((item) => item.id)), {}, buildCaseClosureLinkContext(observedEffects, actions));
     if (patch.closure !== undefined) {
-        closures = appendCaseClosure(closures, patch.closure, now, observedEffects, actions);
+        closures = appendCaseClosure(closures, patch.closure, now, observedEffects, actions, evidencePins);
     }
     if (caseStatusRequiresClosure(patch.status) && patch.closure === undefined) {
         throw new Error('Resolve this case through the deliberate closure review so the reason and evidence state remain explicit.');
     }
     const record = {
         ...current,
-        workflowMetadata: updateCaseWorkflowMetadata(current.workflowMetadata
-            ?? readCaseWorkflowFields(current, current.domain, current.assertions).workflowMetadata, patch, current.domain, now),
+        workflowMetadata,
         title: patch.title === undefined ? current.title ?? '' : normalizeCaseObjective(patch.title),
         status: patch.closure !== undefined
-            ? 'resolved'
+            ? objectRecord(patch.closure).responseObject !== undefined ? current.status : 'resolved'
             : patch.status !== undefined ? normalizeStatus(patch.status) : current.status,
         disposition: patch.disposition !== undefined ? normalizeDisposition(patch.disposition) : current.disposition,
         reviewReasonCode: patch.reviewReasonCode !== undefined
@@ -354,6 +426,7 @@ export function updateCase(cases, id, patch, nowIso) {
         source,
         evidenceHistory,
         evidencePins,
+        ...(checkpointCollectionReceipts === undefined ? {} : { checkpointCollectionReceipts }),
         ...((patch.evidenceLink !== undefined || patch.evidenceLinkWithdrawal !== undefined) ? {
             evidenceLinks: patch.evidenceLink !== undefined
                 ? appendCaseEvidenceLink(current.evidenceLinks ?? [], patch.evidenceLink, evidencePins, now)
@@ -371,6 +444,8 @@ export function updateCase(cases, id, patch, nowIso) {
         updatedAt: now,
     };
     const next = [...cases];
+    if (checkpointCollectionReceipts === undefined)
+        delete record.checkpointCollectionReceipts;
     next[index] = record;
     return { cases: next, record };
 }
@@ -504,6 +579,7 @@ export function recordCaseRecheckOutcome(cases, id, input, nowIso) {
             observedAt: input.observedAt,
             collectionDepth: input.collectionDepth,
             observationHostname: input.observationHostname,
+            ...(input.responseObject ? { responseObject: input.responseObject } : {}),
             completeness: input.completeness,
             truncated: input.comparisonTruncated === true
                 || (typeof input.comparisonSummary === 'string' && input.comparisonSummary.length > MAX_RESPONSE_VALUE_LENGTH),
@@ -524,6 +600,8 @@ export function recordCaseRecheckOutcome(cases, id, input, nowIso) {
             followUpAt: input.followUpAt,
             limitations: input.limitations,
             ...(input.recheck ? { recheck: input.recheck } : {}),
+            ...(input.responseObject ? { responseObject: input.responseObject } : {}),
+            ...(input.objectOutcome ? { objectOutcome: input.objectOutcome } : {}),
         },
     }, now);
 }