@tacuchi/agent-workflow-cli 25.6.1 → 25.8.0

package/dist/application/flow/submit.js

@@ -25,12 +25,12 @@ import { authorizeEffects, touchesTheWorld, } from "../../domain/capability/effe
 import { AttemptLedger } from "../../domain/capability/protocol.js";
 import { DEFAULT_CORE_DOCS_CANON, coreDocumentKindForPath } from "../../domain/docs-canon.js";
 import { claimedSeal, parseFlowAnswer, spendsAttempt, } from "../../domain/flow/answer.js";
-import { FIX_PREVIEW_TRANSITION, SETTLEMENT_READINGS, actionOf, alternativesOf, approvalGrantOf, effectsOf, internalActionOf, isRouteEvaluation, proposalContractOf, publishApprovalOf, routeControlOf, scopesSources, } from "../../domain/flow/authority.js";
+import { FIX_PREVIEW_TRANSITION, SETTLEMENT_READINGS, actionOf, alternativesOf, approvalGrantOf, effectsOf, internalActionOf, isRouteEvaluation, occurrenceAt, proposalContractOf, publishApprovalOf, reentryOf, routeControlOf, scopesSources, } from "../../domain/flow/authority.js";
 import { effectApprovalDigest } from "../../domain/flow/authorization.js";
 import { PAUSE_LABEL, STOP_LABEL, stepOf, } from "../../domain/flow/directive.js";
-import { executionVerdict } from "../../domain/flow/execution-result.js";
+import { batchCreditVerdict, executionVerdict, } from "../../domain/flow/execution-result.js";
 import { ROUTE_ACCEPT_LABEL, ROUTE_ADJUST_LABEL, isRouteDisposition, } from "../../domain/flow/route.js";
-import { applyTransition, checkAgainstJourney, currentBatchIteration, restatesLastEvent, settlementAmbiguous, withApproval, withAttempt, withBoundary, withContinuation, withDecisionPreparation, withEvent, withFixPreview, withHandoff, withObservation, withPlanExecBatchStageForTransition, withProposal, withRouteDecisions, withRouteProposal, withScope, withSelectedChoice, withSettlementDeclarations, } from "../../domain/flow/run-state.js";
+import { applyTransition, checkAgainstJourney, iterationOf, restartInvocation, restatesLastEvent, sameIteration, settlementAmbiguous, withApproval, withAttempt, withBoundary, withContinuation, withDecisionPreparation, withEvent, withFixPreview, withHandoff, withObservation, withPlanExecBatchCredit, withPlanExecBatchStageForTransition, withProposal, withReentry, withRouteDecisions, withRouteProposal, withScope, withSelectedChoice, withSettlementDeclarations, } from "../../domain/flow/run-state.js";
 import { withSpecBaseline } from "../../domain/lineage.js";
 import { destinationsOf, observedEffects, sealProposal } from "../../domain/proposal.js";
 import { baseDigest } from "../../domain/proposal.js";
@@ -38,19 +38,19 @@ import { reservationMarker } from "../../domain/reservation.js";
 import { checkSafeRelativePath } from "../../domain/safe-path.js";
 import { resolveCoreDocsCanon } from "../docs-canon-service.js";
 import { readWorkspaceBlock } from "../parsers/project-block.js";
-import { functionalSpecDigest } from "../parsers/spec-functional.js";
 import { parseDerivedFromPath, parseSpecRelation } from "../parsers/spec-relation.js";
 import { resolveWorkspaceRootFrom } from "../paths-service.js";
 import { commitStoredPlanExecDecision, preparePlanExecDecision, } from "../plan-exec-decision-service.js";
+import { planBoundaryAction, planGrammarAtEntry, planGrammarAtPublication, } from "../plan-lint-service.js";
 import { semanticDigest } from "../semantic-operation/protocol.js";
 import { resolveSessionTarget } from "../session-resolver.js";
-import { sourceAliasesOfPlan, validatePlanSourceBoundary, validateSourceBoundedSemantics, } from "../source-boundary-policy.js";
-import { actionDigest, advanceFlowRun, directiveFor, effectsOfTransition, resolveBoundary, } from "./advance.js";
-import { observeCheckout, withObservedCheckouts } from "./checkout-observation.js";
+import { sourceAliasesOfPlan, } from "../source-boundary-policy.js";
+import { actionDigest, advanceFlowRun, awaitingCliRerun, directiveFor, effectsOfTransition, resolveBoundary, } from "./advance.js";
+import { observeCheckout, observeScopedFingerprints, withObservedCheckouts, } from "./checkout-observation.js";
 import { resolveCheckoutCandidates } from "./checkout-observation.js";
 import { driveInternalActions } from "./internal-drive.js";
 import { journeyForRun } from "./run-journey.js";
-import { applyUnderLock, locateRun } from "./run-state-service.js";
+import { applyUnderLock, locateRun, readRun } from "./run-state-service.js";
 export async function submitFlow(fs, paths, input) {
     const canon = await resolveCoreDocsCanon(fs, paths);
     if (!canon.ok) {
@@ -119,125 +119,79 @@ export async function submitFlow(fs, paths, input) {
 }
 async function observe(fs, paths, raw, session, git) {
     const root = await resolveWorkspaceRootFrom(fs, paths);
+    const plans = await observePlanArtifacts(fs, paths, raw);
     return {
         root,
         destinations: await observeDestinations(fs, paths, raw),
         scope: await observeScope(fs, paths, raw),
-        plans: await observePlanEvidence(fs, paths, raw),
+        plans: plans.evidence,
         checkouts: await observeCheckouts(fs, paths, session, git),
-        baselines: await observeSpecBaselines(fs, paths, raw),
+        scoped: await observeBatchSources(fs, paths, session, git),
+        baselines: plans.baselines,
     };
 }
 /**
- * The baseline one plan document seals, or `null` when it cannot seal one.
- *
- * What gets sealed is the spec's FUNCTIONAL digest, not its exact bytes: a plan
- * derives from what the spec promises, so a later comma or a rewrapped
- * paragraph must not turn this plan divergent and make it uncloseable.
- *
- * Every `null` here is a plan that stays UNSEALED, which is a legitimate
- * reading: no `Derived from` path, two contradictory ones, a path that escapes
- * the workspace, or a spec nobody can read. None of them is an error — a wrong
- * seal would be.
+ * The scoped fingerprints a phase validation is judged against, read before the
+ * lock like every other observation. The run read here only decides WHETHER to
+ * measure: the decision under the lock re-reads it, and a run that moved in
+ * between answers a different seal and is refused as stale anyway.
  */
-async function baselineOfPlan(fs, root, content, specDir) {
-    const specPath = parseDerivedFromPath(content, specDir);
-    if (specPath === null || !checkSafeRelativePath(specPath).ok)
-        return null;
-    const relation = parseSpecRelation(content, specDir);
-    if (relation.status !== "declared")
-        return null;
-    try {
-        const specText = await fs.readText(join(root, specPath));
-        return { path: specPath, number: relation.number, digest: functionalSpecDigest(specText) };
-    }
-    catch {
+async function observeBatchSources(fs, paths, session, git) {
+    if (git === undefined)
         return null;
-    }
+    // With a reader present, "not measured" is an empty map and never `null`: the
+    // judgment then finds every source unobservable and refuses, instead of
+    // skipping the one comparison the phase validation exists for.
+    const read = await readRun(fs, locateRun(paths, session));
+    if (!read.ok || read.state.boundary !== PHASE_VALIDATION || read.state.scope === null) {
+        return {};
+    }
+    const observed = await observeScopedFingerprints(fs, git, paths, session, read.state.scope.sources);
+    return observed.ok ? observed.base : {};
 }
+const PHASE_VALIDATION = "plan-exec.validation-execution";
 /**
- * For every PLAN artifact in the payload, the exact spec bytes it was derived
- * from — read here, never taken from the sender.
+ * Judge the plan bytes a proposal is carrying, and derive the seal each one gets.
  *
- * A digest supplied by whoever wrote the document would prove only that they
- * typed something; the point of the seal is that publication computed it from
- * the file the plan names. A plan whose `Derived from` is absent or
- * contradictory yields nothing, and publication then writes no seal — an
- * unsealed plan is a legitimate diagnostic, a wrong seal is not.
- */
-async function observeSpecBaselines(fs, paths, raw) {
-    const out = new Map();
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return out;
-    }
-    const artifacts = parsed?.artifacts;
-    if (!Array.isArray(artifacts) || artifacts.length === 0)
-        return out;
-    const canon = await resolveCoreDocsCanon(fs, paths);
-    // An unreadable canon cannot tell a plan from anything else. Sealing on a
-    // guess would stamp a baseline into whatever the payload happened to carry.
-    if (!canon.ok)
-        return out;
-    const root = await resolveWorkspaceRootFrom(fs, paths);
-    for (const entry of artifacts) {
-        const path = entry?.path;
-        const content = entry?.content;
-        if (typeof path !== "string" || typeof content !== "string")
-            continue;
-        const relative = path.trim();
-        if (out.has(relative))
-            continue;
-        if (coreDocumentKindForPath(relative, canon.canon) !== "plan")
-            continue;
-        const baseline = await baselineOfPlan(fs, root, content, canon.canon.spec);
-        if (baseline !== null)
-            out.set(relative, baseline);
-    }
-    return out;
-}
-/**
- * Run the source-boundary policy over the plan bytes a proposal is carrying.
- *
- * The same judgment the execution entry makes, one moment earlier — over the
- * artifact's content instead of a file on disk — so a plan accepted when it
- * closes cannot be rejected for the same cause when somebody tries to run it.
- * Nothing is read when the payload carries no artifact.
+ * The grammar half is the same judgment the execution entry makes, one moment
+ * earlier — over the artifact's content instead of a file on disk — so a plan
+ * accepted when it closes cannot be rejected for the same cause when somebody
+ * tries to run it. When the WORKSPACE block cannot be read, only the SEMANTIC
+ * half runs: answering an unreadable block with "that alias does not exist"
+ * would reject a plan for something the plan did not do.
  *
- * When the WORKSPACE block cannot be read, only the SEMANTIC half runs. The
- * clause-level judgment needs no alias table, and answering an unreadable block
- * with "that alias does not exist" would reject a plan for something the plan
- * did not do.
+ * The lineage half runs in the same stage, so one refusal carries both. The seal
+ * is computed here from the spec the header names — never taken from the sender,
+ * whose digest would prove only that they typed something — and a plan that
+ * declares neither a lineage nor `> Standalone:` is refused instead of published
+ * without a seal. Nothing is read when the payload carries no artifact.
  */
-async function observePlanEvidence(fs, paths, raw) {
+async function observePlanArtifacts(fs, paths, raw) {
+    const evidence = [];
+    const baselines = new Map();
     const proposed = proposedArtifacts(raw);
     if (proposed.length === 0)
-        return [];
+        return { evidence, baselines };
     const canon = await resolveCoreDocsCanon(fs, paths);
-    // An unreadable canon cannot tell a plan from anything else, and judging a
-    // spec's prose by the plan's closure rule would reject what it never promised.
+    // An unreadable canon cannot tell a plan from anything else: judging a spec's
+    // prose by the plan's closure rule, or sealing on a guess, would both act on
+    // whatever the payload happened to carry.
     if (!canon.ok)
-        return [];
+        return { evidence, baselines };
     const root = await resolveWorkspaceRootFrom(fs, paths);
     const block = await readWorkspaceBlock(fs, root, paths.blockMarkers());
     const declared = block === null ? null : block.fuentes.map((source) => source.alias);
-    const out = [];
     for (const artifact of proposed) {
         if (!checkSafeRelativePath(artifact.path).ok)
             continue;
         if (coreDocumentKindForPath(artifact.path, canon.canon) !== "plan")
             continue;
-        out.push({
-            path: artifact.path,
-            failures: declared === null
-                ? validateSourceBoundedSemantics(artifact.content)
-                : validatePlanSourceBoundary(artifact.content, declared),
-        });
+        const { failures, seal } = await planGrammarAtPublication(fs, root, artifact.content, declared, canon.canon.spec);
+        if (seal.status === "sealed")
+            baselines.set(artifact.path, seal.baseline);
+        evidence.push({ path: artifact.path, failures });
     }
-    return out;
+    return { evidence, baselines };
 }
 /** The `path`/`content` pairs a payload proposes, read as data and judged by nobody. */
 function proposedArtifacts(raw) {
@@ -322,7 +276,7 @@ async function observeScope(fs, paths, raw) {
         declared,
         plan,
         sources: sourceAliasesOfPlan(text),
-        boundary_failures: validatePlanSourceBoundary(text, declared ?? []),
+        boundary_failures: planGrammarAtEntry(text, declared),
         plan_error: null,
     };
 }
@@ -444,6 +398,24 @@ async function decide(fs, paths, state, input, snapshot) {
     const resend = resendCheck(state, resolved, cost);
     if (resend !== null)
         return resend;
+    // The one re-run of an exhausted internal boundary belongs to the CLI: an
+    // external answer here would be the fourth try the cap exists to refuse.
+    if (awaitingCliRerun(state, resolved.stopped)) {
+        return reject(state, resolved, `'${resolved.stopped.id}' agotó sus intentos y la vuelve a correr el CLI, no un llamador`, {
+            code: "FLOW_ANSWER_NOT_EXPECTED",
+            action: "corré 'aw flow advance': el CLI corre una vez más la operación interna y, si reconoce su efecto, avanza sin cobrar",
+        });
+    }
+    // An internal action is credited only by the driver that ran it: that is what
+    // leaves its `executed` event in the trace. A result from outside, however well
+    // formed, is a claim nobody verified — and applying it used to publish nothing
+    // while marking the step done.
+    if (resolved.kind === "execution" && internalActionOf(resolved.stopped) !== null) {
+        return reject(state, resolved, `'${resolved.stopped.id}' la ejecuta el CLI: un resultado externo no la acredita`, {
+            code: "FLOW_INTERNAL_ACTION_EXTERNAL_RESULT",
+            action: `corré 'aw flow advance --session ${state.session}': el CLI corre la operación y la acredita; si la corrida no sale de esta frontera, '${restartInvocation(state.session)}' la destraba`,
+        }, cost);
+    }
     // The action the run is waiting on is the one that was EMITTED, and the seal
     // would already refuse a result about any other. What the persisted digest adds
     // is the diagnosis: when the two differ, the invocation changed underneath a run
@@ -453,7 +425,7 @@ async function decide(fs, paths, state, input, snapshot) {
     if (drifted !== null)
         return drifted;
     // 2 · The boundary in force decides what is admissible.
-    const admissible = admit(state, resolved, resolved.stopped, input, cost, snapshot.checkouts);
+    const admissible = admit(state, resolved, resolved.stopped, input, cost, snapshot.checkouts, snapshot.scoped);
     if ("decision" in admissible)
         return admissible.decision;
     const parsed = admissible;
@@ -467,7 +439,12 @@ async function decide(fs, paths, state, input, snapshot) {
     if (route.kind === "adjust") {
         return adjustRouteProposal(state, journey);
     }
-    const routed = route.kind === "accept" ? withRouteDecisions(state, route.decisions) : state;
+    const accepted = route.kind === "accept" ? withRouteDecisions(state, route.decisions) : state;
+    // Sealed with the transition it earned, in the same state publication: a batch
+    // is never seen validated without the proofs that validated it.
+    const routed = parsed.credit === undefined
+        ? accepted
+        : withPlanExecBatchCredit(accepted, parsed.credit.batch, parsed.credit.proofs);
     // The registry, not the Spanish consequence text, owns what a selected
     // alternative does. A handoff must stop before any later plan-exec row can
     // mark work, validate or commit; a decision selection is durably recorded
@@ -561,9 +538,12 @@ async function decide(fs, paths, state, input, snapshot) {
     if (preview.preview !== null) {
         selectedState = withFixPreview(selectedState, preview.preview);
     }
+    // A redraft recorded by `grantOf` inserted rows after this boundary, so the
+    // transition is applied against the journey as it now reads.
+    const walked = journeyForRun(selectedState);
     const outcome = holds
-        ? holdAfterApproval(selectedState, journey, identity)
-        : applyAndAdvance(selectedState, journey, resolved.stopped, identity, parsed.answer);
+        ? holdAfterApproval(selectedState, walked, identity)
+        : applyAndAdvance(selectedState, walked, resolved.stopped, identity, parsed.answer);
     return standalone === null ? outcome : withStandaloneGuidance(outcome, standalone);
 }
 /**
@@ -738,17 +718,28 @@ function routeAnswer(state, stopped, journey, answer) {
                 },
             };
         }
+        const { decision, control } = configuredControl;
+        const consequence = control.consequences[raw.disposition];
+        if (consequence === undefined) {
+            return {
+                kind: "failure",
+                failure: {
+                    code: "FLOW_ROUTE_HARD_GATE",
+                    message: `'${raw.transition}' no admite '${raw.disposition}': el registro no deja que una ruta la saltee`,
+                    action: "declará apply o substitute para ese control; la evidencia que acredita el paso no se omite",
+                },
+            };
+        }
         const substitution = routeSubstitution(raw.disposition, raw.substitution);
         if ("failure" in substitution)
             return { kind: "failure", failure: substitution.failure };
-        const { decision, control } = configuredControl;
         controls.push({
             transition: decision.id,
             title: decision.title,
             disposition: raw.disposition,
             recommendation: control.recommendation,
             alternatives: control.consequences,
-            consequence: control.consequences[raw.disposition],
+            consequence,
             risk: control.risk,
             reason: raw.reason.trim(),
             substitution: substitution.value,
@@ -1275,11 +1266,11 @@ async function registerSelectedDecision(fs, paths, state, snapshot, resolved, co
  * run that merely advanced would be indistinguishable from one that never decided.
  */
 function standaloneDecisionEvent(state, transition, record) {
-    const batchIteration = currentBatchIteration(state, transition);
+    const rowIteration = iterationOf(state, transition);
     return {
         kind: "executed",
         transition,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
         operation: "plan-exec.standalone-decision",
         summary: record.decision,
         output_digest: record.digest,
@@ -1322,36 +1313,6 @@ function withStandaloneGuidance(decision, record) {
 function invalidScope(message, action) {
     return { code: "FLOW_SCOPE_INVALID", message, action };
 }
-/**
- * What to do about a source-boundary failure, said at the moment it was found.
- *
- * One generic sentence used to answer all five codes, and it was wrong twice
- * over: it sent somebody to declare sources that were already declared, and it
- * sent a sentence of prose to a refinement. Structure goes to the refinement
- * that owns it; a clause that names no observable check is a phrase to fix where
- * it is being written, and at a save proposal nothing is even saved yet.
- */
-function planBoundaryAction(code, moment) {
-    const then = moment === "proposal"
-        ? "corregilo en los bytes y volvé a proponer la vista previa"
-        : "corregilo con /w:plan-refine antes de volver a entrar a ejecución";
-    switch (code) {
-        case "PLAN_SOURCE_BOUNDARY_MISSING":
-            return `falta la declaración estructural: '> Límite de ejecución: checkout' bajo el título y '> Fuentes:' en cada fase — ${then}`;
-        case "PLAN_SOURCE_UNKNOWN":
-            return `ese alias no está en la tabla Fuentes del bloque WORKSPACE: declaralo ahí, o usá uno de los que ya están — ${then}`;
-        case "PLAN_TASK_SOURCE_OUTSIDE_PHASE":
-            return `la fuente de una tarea es un subconjunto de la de su fase: ajustá una de las dos — ${then}`;
-        case "PLAN_SOURCE_EXTERNAL_CLOSURE":
-            return `una cláusula de cierre no puede apoyarse en una superficie externa: llevá esa comprobación a '## Handoff operativo' y dejá en la cláusula una del checkout — ${then}`;
-        case "PLAN_SOURCE_LOCAL_PROOF_MISSING":
-            return moment === "proposal"
-                ? "nombrá en esa cláusula el comando, el archivo o la ruta que produce la comprobación, y volvé a proponer la vista previa"
-                : "es una frase del documento y no su estructura: nombrá en esa cláusula el comando, el archivo o la ruta que produce la comprobación";
-        default:
-            return then;
-    }
-}
 /**
  * The closure-evidence gate, run BEFORE the preview is sealed.
  *
@@ -1370,10 +1331,14 @@ function planEvidenceFrom(stopped, answer, observed) {
         const failure = plan.failures[0];
         if (failure === undefined)
             continue;
+        // Grammar and lineage travel together: whoever fixes the first cause
+        // should not learn of the header on the next attempt.
+        const lineage = plan.failures.find((candidate) => candidate !== failure && candidate.code === "PLAN_LINEAGE_UNSEALED");
+        const also = lineage === undefined ? "" : ` · además: ${lineage.message}`;
         return {
             failure: {
                 code: failure.code,
-                message: `'${plan.path}': ${failure.message}`,
+                message: `'${plan.path}': ${failure.message}${also}`,
                 action: planBoundaryAction(failure.code, "proposal"),
             },
         };
@@ -1415,25 +1380,27 @@ function sealFrom(state, stopped, answer, snapshot, baselines) {
     const artifacts = answer.artifacts.map((artifact) => {
         const seen = snapshot.get(artifact.path);
         const baseline = baselines.get(artifact.path);
+        /**
+         * Completing THIS run's reservation replaces no document.
+         *
+         * The file is there because this run put it there to hold the number, and
+         * nothing was ever published into it — so the write is additive in the only
+         * sense the classes measure, and the preview says so: `overwrite: false`,
+         * `reserved: true`. A destination that exists for any other reason stays an
+         * overwrite, which is what keeps a save row declaring only `local_additive`
+         * from reaching a real plan.
+         */
+        const reserved = seen?.exists === true && seen.digest === reservation;
         return {
             path: artifact.path,
             // Publication seals the baseline into the very bytes it is about to
             // propose, so preview, approval and write cover it as one thing.
             content: baseline === undefined ? artifact.content : withSpecBaseline(artifact.content, baseline),
-            overwrite: seen?.exists === true,
-            /**
-             * Completing THIS run's reservation replaces no document.
-             *
-             * The file is there because this run put it there to hold the number, and
-             * nothing was ever published into it — so the write is additive in the only
-             * sense the classes measure: nobody's content is lost. A destination that
-             * exists for any other reason stays `mutate_overwrite`, which is what keeps
-             * a save row declaring only `local_additive` from reaching a real plan.
-             */
-            reserved: seen?.exists === true && seen.digest === reservation,
+            overwrite: seen?.exists === true && !reserved,
+            ...(reserved ? { reserved: true } : {}),
         };
     });
-    const effects = observedEffects(artifacts.map((a) => ({ overwrite: a.overwrite && !a.reserved })));
+    const effects = observedEffects(artifacts);
     const beyond = effects.filter((effect) => !contract.effects.includes(effect));
     if (beyond.length > 0) {
         return {
@@ -1444,8 +1411,10 @@ function sealFrom(state, stopped, answer, snapshot, baselines) {
             },
         };
     }
+    // The reservation is a base too: the marker has to be the one this run left
+    // when the write lands, or somebody published into the slot in between.
     const bases = artifacts
-        .filter((a) => a.overwrite)
+        .filter((a) => a.overwrite || a.reserved === true)
         .map((a) => ({ path: a.path, digest: snapshot.get(a.path)?.digest ?? "" }));
     const unreadable = bases.filter((base) => base.digest.length === 0);
     if (unreadable.length > 0) {
@@ -1477,6 +1446,26 @@ function sealFrom(state, stopped, answer, snapshot, baselines) {
         })),
     };
 }
+/**
+ * The redraft a confirmation row's alternative asked for, or `null`.
+ *
+ * It unseats any standing proposal and records a reentry from the flow's
+ * authoring row, so the run walks the redraft and its gate again instead of
+ * carrying on to a publication with nothing to publish and a finalize that
+ * closes the session. Independent of whether a proposal is seated: a proposal
+ * the run gave up on is exactly when redrafting matters most.
+ */
+function redraftOf(state, stopped, answer, journey) {
+    const redraft = reentryOf(stopped);
+    if (redraft === null || answer.choice !== redraft.label)
+        return null;
+    return withReentry(withProposal(state, null), {
+        kind: "refine",
+        transition: stopped.id,
+        occurrence: occurrenceAt(journey, state.applied.length),
+        from: redraft.from,
+    });
+}
 /**
  * The grant this answer produced, scoped to what it was given over.
  *
@@ -1491,8 +1480,13 @@ function sealFrom(state, stopped, answer, snapshot, baselines) {
  */
 function grantOf(state, resolved, answer, granted, journey) {
     const stopped = resolved.stopped;
+    if (stopped === null)
+        return state;
+    const redrafted = redraftOf(state, stopped, answer, journey);
+    if (redrafted !== null)
+        return redrafted;
     const proposal = state.proposal;
-    const approve = stopped === null ? null : publishApprovalOf(stopped);
+    const approve = publishApprovalOf(stopped);
     if (approve !== null && proposal !== null) {
         if (answer.choice === approve) {
             return withApproval(state, {
@@ -1501,13 +1495,11 @@ function grantOf(state, resolved, answer, granted, journey) {
                 classes: [...proposal.requires_approval],
             });
         }
-        // Declining unseats the proposal, and that is what makes `Refinar` cost
-        // nothing: the publication downstream finds nothing to publish and is skipped
-        // saying so, instead of stopping to ask for an authorization over bytes the
+        // Declining unseats the proposal: no authorization is asked over bytes the
         // person just turned down.
         return withProposal(state, null);
     }
-    const link = stopped === null ? null : approvalGrantOf(stopped);
+    const link = approvalGrantOf(stopped);
     if (link !== null && answer.choice === link.approve) {
         const target = journey.find((row) => row.id === link.transition);
         // A link to a transition this journey does not walk grants nothing: the
@@ -1538,7 +1530,7 @@ function grantOf(state, resolved, answer, granted, journey) {
  * a payload the boundary's own contract rejects, a decline (a real answer that
  * applies nothing), and an execution result that did not earn its transition.
  */
-function admit(state, resolved, stopped, input, cost, checkouts) {
+function admit(state, resolved, stopped, input, cost, checkouts, scoped) {
     const expectedApproval = resolved.kind === "authorization"
         ? effectApprovalDigest(stopped.id, resolved.authorization?.planned ?? [])
         : null;
@@ -1584,7 +1576,7 @@ function admit(state, resolved, stopped, input, cost, checkouts) {
         return {
             decision: reject(state, resolved, `'${PAUSE_LABEL}': la frontera queda en pie y la corrida retoma acá`, {
                 code: "FLOW_BOUNDARY_PAUSED",
-                action: "escribí el CHECKPOINT con 'aw checkpoint-write', compactá, y volvé con 'aw flow advance' a esta misma frontera",
+                action: `escribí el CHECKPOINT con 'aw checkpoint-write --code ${state.session}', compactá, y volvé con 'aw flow advance --code ${state.session}' a esta misma frontera`,
                 outcome: "needs_input",
             }, cost),
         };
@@ -1601,22 +1593,53 @@ function admit(state, resolved, stopped, input, cost, checkouts) {
     // An execution result has to EARN the transition. Anything short of a completed
     // run with its evidence and its whole effect keeps the boundary standing: the
     // work stays pending, with the recovery the action declared.
-    if (resolved.kind === "execution") {
-        // The row's `effects` are the ceiling and the sealed proposal is what really
-        // happens: demanding an overwrite from a publication that only creates files
-        // would leave the transition pending for an effect nobody could produce.
-        const verdict = executionVerdict(parsed.answer.result, resolved.action, effectsOfTransition(state, stopped), checkouts);
-        if (verdict !== null) {
-            const trace = declaredTrace(state, stopped, resolved, parsed.answer, verdict);
-            return {
-                decision: reject(state, resolved, verdict.message, verdict.detail, {
-                    ...cost,
-                    ...(trace === null ? {} : { trace }),
-                }),
-            };
-        }
+    if (resolved.kind !== "execution")
+        return parsed;
+    return earned(state, resolved, stopped, parsed, cost, checkouts, scoped);
+}
+/** The execution verdict, then — at the phase validation — the batch's own credit. */
+function earned(state, resolved, stopped, parsed, cost, checkouts, scoped) {
+    // The row's `effects` are the ceiling and the sealed proposal is what really
+    // happens: demanding an overwrite from a publication that only creates files
+    // would leave the transition pending for an effect nobody could produce.
+    const verdict = executionVerdict(parsed.answer.result, resolved.action, effectsOfTransition(state, stopped), checkouts);
+    if (verdict !== null) {
+        const trace = declaredTrace(state, stopped, resolved, parsed.answer, verdict);
+        return {
+            decision: reject(state, resolved, verdict.message, verdict.detail, {
+                ...cost,
+                ...(trace === null ? {} : { trace }),
+            }),
+        };
+    }
+    const credited = batchCredit(state, stopped, parsed.answer, resolved, scoped);
+    if (credited === null)
+        return parsed;
+    if (!credited.ok) {
+        return {
+            decision: reject(state, resolved, credited.refusal.message, credited.refusal.detail, cost),
+        };
+    }
+    return { ...parsed, credit: credited.credit };
+}
+/**
+ * The phase validation's own judgment: the batch it closes must bring a proof of
+ * each of its sources, of its own checkout. `null` on every other boundary, and
+ * on a run with no batch standing, where there is nothing to credit.
+ */
+function batchCredit(state, stopped, answer, resolved, scoped) {
+    if (stopped.id !== PHASE_VALIDATION || answer.result === null || state.scope === null) {
+        return null;
     }
-    return parsed;
+    const iteration = state.batch_loop?.iteration ?? null;
+    const batches = state.batches ?? [];
+    const batch = batches.find((entry) => entry.iteration === iteration);
+    if (batch === undefined)
+        return null;
+    const verdict = batchCreditVerdict(answer.result, { batch, batches, sources: state.scope.sources, scoped }, resolved.action?.recovery ?? "");
+    if (!verdict.ok)
+        return verdict;
+    return { ok: true, credit: { batch: batch.id, proofs: verdict.credit } };
 }
 /**
  * The material fact a REFUSED external result still leaves behind — or `null`.
@@ -1638,11 +1661,11 @@ function declaredTrace(state, stopped, resolved, answer, verdict) {
     if (!touchesTheWorld(applied) && verdict.detail.code !== "FLOW_EFFECT_PARTIAL")
         return null;
     const invocation = resolved.action?.invocation;
-    const batchIteration = currentBatchIteration(state, stopped.id);
+    const rowIteration = iterationOf(state, stopped.id);
     return {
         kind: "failed",
         transition: stopped.id,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
         // What was really run, named the way whoever ran it would recognize it: an
         // external execution has no internal operation id to quote.
         operation: invocation === undefined ? stopped.id : [invocation.program, ...invocation.args].join(" "),
@@ -1699,13 +1722,6 @@ function applyAndAdvance(approved, journey, stopped, identity, answer) {
         ? withObservation(approved, observationFor(approved, stopped.id, answer.signals))
         : approved;
     next = withPlanExecBatchStageForTransition(applyTransition(next, stopped.id, effectsOfTransition(next, stopped)), stopped.id);
-    // A published proposal is spent, whoever published it. This is the degraded
-    // path — no internal executor, so the caller ran the write and returned its
-    // result — and leaving the proposal seated would keep a preview of bytes that
-    // are already on disk standing in front of the next boundary.
-    if (internalActionOf(stopped)?.operation === "proposal.publish") {
-        next = withProposal(next, null);
-    }
     next = withAttempt(next, identity);
     // The boundary follows the position, always: handing the engine a state whose
     // boundary still names the transition just applied is exactly the incoherence
@@ -1860,7 +1876,7 @@ function resendCheck(state, resolved, cost) {
     // The twin was refused: this is a retry of the same wrong answer, so it gets
     // the same real diagnosis again and counts toward the cap, which is what
     // eventually degrades the boundary instead of leaving the caller looping.
-    if (twin !== undefined && !state.applied.includes(twin.transition))
+    if (twin !== undefined && twinWasRefused(state, twin))
         return null;
     return reject(state, resolved, "esta respuesta ya se había aplicado: el recorrido no avanza dos veces", {
         code: "FLOW_ANSWER_RESENT",
@@ -1868,6 +1884,19 @@ function resendCheck(state, resolved, cost) {
         outcome: "completed",
     }, cost);
 }
+/**
+ * Whether the attempt a resend matches never advanced anything.
+ *
+ * Its transition missing from `applied` says so. So does its transition being
+ * the boundary still standing at the same iteration: a repeated row (a batch or
+ * a redraft copy) has its id in `applied` from an earlier walk, and that earlier
+ * walk is not this one.
+ */
+function twinWasRefused(state, twin) {
+    if (!state.applied.includes(twin.transition))
+        return true;
+    return (twin.transition === state.boundary && sameIteration(twin, iterationOf(state, twin.transition)));
+}
 /**
  * A rejection, expressed as the recalculated directive.
  *
@@ -1929,7 +1958,7 @@ function reject(state, resolved, message, detail, cost) {
  */
 function attemptIdentity(state, input, seal, transition) {
     const digest = semanticDigest({ payload: input.raw, approval: input.approval });
-    const batchIteration = currentBatchIteration(state, transition);
+    const rowIteration = iterationOf(state, transition);
     const prior = state.attempts.filter((past) => past.invocation_id === seal);
     const twin = prior.find((past) => past.request_digest === digest);
     // The next ordinal, asked with the SAME expression `AttemptLedger.record`
@@ -1953,18 +1982,18 @@ function attemptIdentity(state, input, seal, transition) {
         // The seal moves with the state; the transition does not while the run
         // stands there. It is what the cap counts over.
         transition,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
     };
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function observationFor(state, transition, signals) {
-    const batchIteration = currentBatchIteration(state, transition);
+    const rowIteration = iterationOf(state, transition);
     return {
         transition,
         signals,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
     };
 }
 //# sourceMappingURL=submit.js.map