@tea-agent/loop-agent 0.39.0-beta.1 → 0.39.0-beta.11

package/dist/worker/console/console-update-runtime.js

@@ -0,0 +1,84 @@
+import os from "node:os";
+import { readPackageVersion } from "../../shared/package-metadata.js";
+import { createNpmUpdateClient } from "../../shared/update/npm-client.js";
+import { acquireUpdateLock, updateLockPath } from "../../shared/update/state.js";
+import { readInitRuntimeActivity } from "../observability/init-runtime-activity.js";
+import { performConsoleUpdateAndInit, } from "./console-update-and-init.js";
+import { TERMINAL_OPERATION_STATES } from "./operation-store.js";
+export function createConsoleUpdateExecutor(input) {
+    return async (channel) => {
+        const currentVersion = readPackageVersion(input.packageRoot);
+        if (!currentVersion) {
+            return {
+                state: "failed",
+                errorCode: "PACKAGE_IDENTITY_UNAVAILABLE",
+                errorMessage: "Console package version cannot be proven",
+                maintenance: {
+                    package: { status: "failed", channel },
+                    initialization: { status: "not-run", pendingPaths: [] },
+                    handoff: { status: "not-needed" },
+                },
+            };
+        }
+        const npm = createNpmUpdateClient({
+            currentVersion,
+            packageRoot: input.packageRoot,
+            cwd: input.repoRoot,
+        });
+        return performConsoleUpdateAndInit({
+            currentVersion,
+            preflight: async () => {
+                const [activity, operations] = await Promise.all([
+                    readInitRuntimeActivity(input.repoRoot),
+                    input.operations.list(),
+                ]);
+                if (activity.workerProjectionError ||
+                    activity.activeDagRunIds.length > 0 ||
+                    activity.activeWorkerTasks > 0 ||
+                    activity.activeWorkerBatches > 0) {
+                    return {
+                        ok: false,
+                        code: "ACTIVE_RUNTIME",
+                        message: "active DAG/Worker runtime exists or cannot be proven inactive",
+                    };
+                }
+                if (input.activeChatTurnCount() > 0) {
+                    return {
+                        ok: false,
+                        code: "CHAT_TURN_ACTIVE",
+                        message: "an Operator Chat turn is active",
+                    };
+                }
+                const liveOtherOperation = operations.some((operation) => operation.action !== "consoleUpdateAndInit" &&
+                    !TERMINAL_OPERATION_STATES.has(operation.state));
+                return liveOtherOperation
+                    ? {
+                        ok: false,
+                        code: "OPERATION_ACTIVE",
+                        message: "another Console operation is active",
+                    }
+                    : { ok: true };
+            },
+            acquireLock: () => acquireUpdateLock(updateLockPath(os.homedir())),
+            resolveVersion: (selectedChannel) => npm.distTagVersionCheck(selectedChannel),
+            canAutoInstall: () => npm.canAutoInstall(),
+            installExact: (version, selectedChannel) => npm.installExact(version, selectedChannel),
+            verifyInstalled: (version) => npm.verifyInstalled(version),
+            applySafeInit: async () => {
+                const result = await input.client.runExternal("loop-agent", ["init", "update", "--apply-safe", "--repo-root", input.repoRoot], {
+                    cwd: input.repoRoot,
+                    artifactName: "console-update-safe-init",
+                    timeoutMs: 120_000,
+                });
+                return result.ok
+                    ? { ok: true, pendingPaths: [] }
+                    : {
+                        ok: false,
+                        message: result.stderr || result.stdout || "safe initialization failed",
+                        pendingPaths: [],
+                    };
+            },
+            requestHandoff: async ({ targetVersion }) => input.requestHandoff(targetVersion),
+        }, channel);
+    };
+}

package/dist/worker/console/dag-execution-receipt.js

@@ -35,6 +35,32 @@ import { hashDagBytes, } from "./dag-confirmation.js";
  * framework invocations that don't embed the word "verify".
  */
 export const STRUCTURED_VERIFICATION_COMMAND_RE = /\b(vitest|jest|playwright|cypress|pytest|py-test|go\s+test|cargo\s+test|npm\s+run\s+(lint|typecheck|test|verify)|npm\s+(test|run\s+test)|check-repo\.sh|loop-agent-standard-verify)\b/i;
+/**
+ * Deterministic shell preset keys whose executors are themselves structured
+ * verification/gate materializers: their shell.commands[] is empty and the
+ * preset alone carries the verification authority (hash-bound artifact
+ * gates, evidence validators, report finalize). Mirrors the named-shell
+ * handler registry in shell-executor.ts so preset-only workflows
+ * (frontend-test finalize/reports, backend-test pipeline, verify-evidence
+ * gates) pass the G2 autonomous execution gate without depending on node-id
+ * naming conventions.
+ */
+export const STRUCTURED_VERIFICATION_SHELL_PRESETS = new Set([
+    "frontendTestCaseChecklist",
+    "frontendTestCaseManifest",
+    "frontendTestEvidenceValidation",
+    "frontendTestResultFinalize",
+    "frontendTestL5Report",
+    "frontendTestHtmlReport",
+    "frontendTestReports",
+    "backendTestPipeline",
+    "verifyEvidence",
+    "repairArtifactGate",
+    "jacocoCoverage",
+    "requirementCoverageGate",
+    "jsonArtifactGate",
+    "verdictGate",
+]);
 export const DEFAULT_EXECUTION_RECEIPT_TTL_MS = 30 * 60 * 1000;
 function normalizePathEntry(entry) {
     return entry.trim().replace(/\\/g, "/").replace(/^\.\//, "");
@@ -157,6 +183,13 @@ export function deriveEligibilityFactsFromDagSpec(input) {
             return false;
         if (/verify|verification/i.test(task.id ?? ""))
             return true;
+        // Preset-only verification shells (empty commands[]): the preset key is
+        // the verification authority (frontend-test finalize, backend-test
+        // pipeline, evidence/artifact gates).
+        const shellRecord = task.shell;
+        const hasVerificationPreset = Object.keys(shellRecord).some((key) => STRUCTURED_VERIFICATION_SHELL_PRESETS.has(key));
+        if (hasVerificationPreset)
+            return true;
         const commands = stringList(task.shell.commands);
         return commands.some((command) => STRUCTURED_VERIFICATION_COMMAND_RE.test(command));
     });

package/dist/worker/console/draft-store.js

@@ -1,5 +1,51 @@
 import path from "node:path";
 import { readJsonIfExists, sha256Json, writeSecureJson, } from "./app-data.js";
+/**
+ * 从任意上游载荷安全投影 ledger 摘要（未知形状丢弃，绝不抛错、绝不信任字段外的数据）。
+ * 供 DraftStore / prd-intake-bridge 把 prepare/advance 结果中的 ledger 摘要带入草稿。
+ */
+export function summarizeLedgerPayload(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const record = value;
+    if (record.present !== true)
+        return undefined;
+    const num = (key) => {
+        const raw = record[key];
+        return typeof raw === "number" && Number.isFinite(raw) ? raw : 0;
+    };
+    const gateRaw = record.gateStatus;
+    const gateStatus = gateRaw === "pass" || gateRaw === "fail" || gateRaw === "unknown"
+        ? gateRaw
+        : "unknown";
+    const failureCode = typeof record.failureCode === "string" && record.failureCode
+        ? record.failureCode
+        : null;
+    const rawExclusions = Array.isArray(record.exclusions) ? record.exclusions : [];
+    const exclusions = [];
+    for (const item of rawExclusions) {
+        if (!item || typeof item !== "object")
+            continue;
+        const entry = item;
+        const fragmentId = typeof entry.fragmentId === "string" ? entry.fragmentId : "";
+        const reason = typeof entry.reason === "string" ? entry.reason : "";
+        if (!fragmentId)
+            continue;
+        exclusions.push({ fragmentId, reason });
+    }
+    return {
+        present: true,
+        fragmentCount: num("fragmentCount"),
+        canonicalRequirementCount: num("canonicalRequirementCount"),
+        contextOnlyCount: num("contextOnlyCount"),
+        duplicateCount: num("duplicateCount"),
+        unresolvedCount: num("unresolvedCount"),
+        conflictCount: num("conflictCount"),
+        gateStatus,
+        failureCode,
+        exclusions,
+    };
+}
 function draftPath(appData, taskId) {
     const safe = taskId.replace(/[^a-zA-Z0-9._-]+/g, "_");
     return path.join(appData.drafts, `${safe}.json`);
@@ -86,6 +132,9 @@ export function toCanonicalDraftForCli(draft) {
     if (draft.interviewAssessmentRef) {
         canonical.interviewAssessmentRef = draft.interviewAssessmentRef;
     }
+    // AC-BLOCK-002：canonical draft JSON 绝不携带 ledgerSummary 字段（strict
+    // taskContractDraftSchema 拒绝未知键）。摘要仅留在 prd-intake-bridge 响应与
+    // console-types 的 LedgerSummaryView（UI 视图模型），不进入持久化 draft。
     return canonical;
 }
 export class DraftStore {

package/dist/worker/console/frontend-human-decision-adapter.js

@@ -0,0 +1,19 @@
+import { parseFrontendHumanDecisionProjection } from "../../workflows/dag/frontend-human-decision.js";
+/** Worker/Console persistence seam. Canonical validation and freshness remain in the workflow service. */
+export function createFrontendHumanDecisionAdapter(store) {
+    return {
+        async load(operationId) {
+            const record = await store.get(operationId);
+            if (!record || record.revision === undefined || !record.frontendHumanDecision)
+                return undefined;
+            return { revision: record.revision, projection: parseFrontendHumanDecisionProjection(record.frontendHumanDecision) };
+        },
+        materialize(input) {
+            return store.materializeFrontendHumanDecision(input);
+        },
+        consume(input) {
+            return store.consumeFrontendHumanDecision(input);
+        },
+        initializeSplit: store.initializeFrontendHumanApprovedSplit.bind(store),
+    };
+}

package/dist/worker/console/frontend-split-operation-adapter.js

@@ -0,0 +1,20 @@
+import { FrontendSplitOrchestrator, frontendSplitProjectionSchema, } from "../../workflows/dag/frontend-split-application-service.js";
+/** Worker/Console boundary adapter. All orchestration policy remains canonical. */
+export function createFrontendSplitOperationAdapter(dependencies) {
+    const ports = {
+        load: async (operationId) => {
+            const record = await dependencies.store.get(operationId);
+            return record?.frontendSplit === undefined ? undefined : frontendSplitProjectionSchema.parse(record.frontendSplit);
+        },
+        compareAndSwap: (input) => dependencies.store.compareAndSwapFrontendSplit(input),
+        materialize: async (request) => {
+            const result = await dependencies.materializer.materialize(request);
+            return { taskId: result.taskId, operationId: result.operationId };
+        },
+        schedule: dependencies.schedule,
+        auditStale: dependencies.auditStale,
+        loadChildCloseoutFacts: (input) => dependencies.store.loadChildCloseoutFacts(input),
+        settleAggregate: (input) => dependencies.store.settleFrontendSplitAggregate({ ...input, prepareAggregate: dependencies.prepareAggregate }),
+    };
+    return new FrontendSplitOrchestrator(ports);
+}

package/dist/worker/console/index.js

@@ -11,6 +11,9 @@ export { createClosedResourceLoader, createInterviewResourceLoader, tryActivateT
 export { resolveSiblingLoopAgentBin } from "./sibling-controller.js";
 export { openConsoleAppData, defaultConsoleAppDataRoot } from "./app-data.js";
 export { OperationStore } from "./operation-store.js";
+export { createFrontendSplitOperationAdapter } from "./frontend-split-operation-adapter.js";
+export { createFrontendHumanDecisionAdapter } from "./frontend-human-decision-adapter.js";
+export { FrontendSplitTaskMaterializer } from "../materialize/frontend-split-task-materializer.js";
 export { createOperationEventStore } from "./operation-sse.js";
 export { DagConfirmationStore } from "./dag-confirmation.js";
 export { DraftStore } from "./draft-store.js";

package/dist/worker/console/inspect-split.js

@@ -80,3 +80,21 @@ export function pickInspectNode(nodes, preferredNodeId) {
     });
     return running ?? nodes[0];
 }
+/**
+ * Terminal DagRun effective/status values (mirrors observe read-model
+ * TERMINAL_RUN_STATUSES). A run that reached one of these states no longer
+ * needs live polling in the console split panel.
+ */
+export const TERMINAL_DAG_RUN_STATUSES = new Set([
+    "finished",
+    "failed",
+    "partial_failed",
+    "superseded",
+    "abandoned",
+]);
+export function isTerminalDagRun(dag) {
+    if (!dag)
+        return false;
+    const status = String(dag.effectiveStatus ?? dag.status ?? "").toLowerCase();
+    return TERMINAL_DAG_RUN_STATUSES.has(status);
+}

package/dist/worker/console/native-directory-picker.js

@@ -0,0 +1,13 @@
+/**
+ * DSH's native directory-picker adapter.
+ *
+ * The published DSH host package uses the modern Win32 IFileOpenDialog in a
+ * dedicated child process (plus osascript/Zenity/KDialog on other platforms),
+ * so the Console does not pay PowerShell startup cost or lose the chooser
+ * behind the browser window.
+ */
+import { pickNativeDirectory, } from "@deepseek-ai/dsh-host-directory-picker-native";
+/** Open the host OS single-folder chooser. Cancellation is a null result. */
+export async function pickNativeWorkspaceDirectory(signal, internals = {}) {
+    return pickNativeDirectory(signal, internals);
+}

package/dist/worker/console/operation-run-facts.js

@@ -13,6 +13,7 @@
  * - A run summary is a projection only: it can never change the terminal
  *   operation state decided by the command envelope/exit facts.
  */
+import { normalizeDagFailureCategory } from "../../shared/dag-failure-category.js";
 import { scrubSecrets } from "./chat/explore-tools.js";
 const RUN_SUMMARY_MAX_NODES = 20;
 const RUN_SUMMARY_MAX_TEXT_CHARS = 600;
@@ -72,7 +73,13 @@ function safeNode(value) {
     const status = boundedRedactedText(rec.status, 100);
     if (!id || !status)
         return undefined;
-    return { id, status };
+    const rawCategory = boundedRedactedText(rec.failureCategory, 200);
+    if (!rawCategory)
+        return { id, status };
+    const category = normalizeDagFailureCategory(rawCategory, status);
+    if (category === "success" || category === "skipped")
+        return { id, status };
+    return { id, status, failureCategory: category };
 }
 /** Independent allowlist projection of a structured run summary. */
 export function safeRunSummaryForProjection(value) {
@@ -117,13 +124,22 @@ export function safeRunSummaryForProjection(value) {
         }
     }
     const verdict = boundedRedactedText(rec.verdict);
-    const failureCategory = boundedRedactedText(rec.failureCategory);
+    const rawFailureCategory = boundedRedactedText(rec.failureCategory, 200);
+    // Normalize the run-level category too (2026-08-23): raw codes like
+    // missing-api-key / nonzero-exit never matched the browser advice table.
+    const failureCategory = rawFailureCategory !== undefined
+        ? normalizeDagFailureCategory(rawFailureCategory, status)
+        : undefined;
     return {
         runId,
         status,
         nodes,
         ...(verdict !== undefined ? { verdict } : {}),
-        ...(failureCategory !== undefined ? { failureCategory } : {}),
+        ...(failureCategory !== undefined &&
+            failureCategory !== "success" &&
+            failureCategory !== "skipped"
+            ? { failureCategory }
+            : {}),
         ...(outOfBounds.length > 0 ? { outOfBounds } : {}),
         ...(next ? { next } : {}),
     };

package/dist/worker/console/operation-store.js

@@ -1,7 +1,11 @@
 import { randomBytes } from "node:crypto";
 import path from "node:path";
+import { assertFrontendSplitProjectionSuccessor, frontendSplitProjectionSchema, } from "../../workflows/dag/frontend-split-application-service.js";
+import { buildFrontendHumanDecisionProjection, consumeFrontendHumanDecision, materializeFrontendHumanDecision, parseFrontendHumanDecisionProjection, parseFrontendHumanDecisionReceipt, } from "../../workflows/dag/frontend-human-decision.js";
+import { buildFrontendSplitAggregateCloseout, computeFrontendSplitDigest, finalizeFrontendSplitAggregate, frontendCommittedFactRefSchema, frontendSplitChildCloseoutFactsSchema, initializeFrontendSplitParent, } from "../../workflows/dag/frontend-split-orchestrator.js";
+import { frontendCloseoutFactsSchema, frontendTestHandoffSchema, } from "../../workflows/dag/frontend-closeout.js";
 import { listJsonFiles, readJsonIfExists, sha256Json, writeSecureJson, } from "./app-data.js";
-export const TERMINAL_OPERATION_STATES = new Set(["succeeded", "failed", "timed-out"]);
+export const TERMINAL_OPERATION_STATES = new Set(["succeeded", "failed", "timed-out", "restarting"]);
 function operationFile(appData, operationId) {
     return path.join(appData.operations, `${operationId}.json`);
 }
@@ -15,16 +19,21 @@ export function computeActionPayloadHash(action, actionParams) {
 export function newOperationId() {
     return `op_${randomBytes(12).toString("hex")}`;
 }
+const sharedWriteChains = new Map();
 export class OperationStore {
     appData;
-    /**
-     * Per-key write lock. Concurrent update/save/create on the same operation
-     * or clientRequestId must not race rename() into the same JSON path
-     * (Windows EPERM) or last-write-wins lost patches.
-     */
-    writeChains = new Map();
+    /** Shared per-store-root, per-key write lock. Multiple OperationStore instances
+     * in one worker process must observe the same CAS critical section. */
+    writeChains;
     constructor(appData) {
         this.appData = appData;
+        const root = path.resolve(appData.operations);
+        let chains = sharedWriteChains.get(root);
+        if (!chains) {
+            chains = new Map();
+            sharedWriteChains.set(root, chains);
+        }
+        this.writeChains = chains;
     }
     serialize(key, op) {
         const prev = this.writeChains.get(key) ?? Promise.resolve();
@@ -66,6 +75,7 @@ export class OperationStore {
                 payloadHash,
                 state: "queued",
                 createdAt: now,
+                revision: 1,
                 taskId: input.taskId,
                 cliArgs: input.cliArgs,
                 ...(input.externalCommand
@@ -77,11 +87,61 @@ export class OperationStore {
             return { kind: "created", operation };
         });
     }
+    /**
+     * Idempotently materialize a split child/integration operation with a
+     * caller-specified deterministic operationId (from the split manifest).
+     * Unlike create() (random op_<hex> id) and save/update (no create), this is
+     * the durable cross-restart idempotency boundary for the production
+     * FrontendSplitTaskMaterializer backend: an existing operation file with the
+     * same taskId + payloadHash is returned as {created:false}; any drift fails
+     * closed instead of overwriting or silently diverging.
+     */
+    async ensureSplitMaterializedOperation(input) {
+        return this.serialize(input.operationId, async () => {
+            const existing = await this.get(input.operationId);
+            if (existing) {
+                if (existing.taskId !== input.taskId ||
+                    existing.payloadHash !== input.payloadHash) {
+                    throw new Error("frontend split operation materialization payload drift");
+                }
+                return { operation: existing, created: false };
+            }
+            const now = new Date().toISOString();
+            const operation = {
+                schemaVersion: 1,
+                operationId: input.operationId,
+                clientRequestId: `split:${input.operationId}`,
+                action: input.action,
+                actionParams: input.actionParams,
+                payloadHash: input.payloadHash,
+                state: "queued",
+                createdAt: now,
+                revision: 1,
+                taskId: input.taskId,
+                ...(input.cliArgs ? { cliArgs: input.cliArgs } : {}),
+            };
+            await writeSecureJson(operationFile(this.appData, input.operationId), operation);
+            return { operation, created: true };
+        });
+    }
     async get(operationId) {
         return readJsonIfExists(operationFile(this.appData, operationId));
     }
     async save(operation) {
         return this.serialize(operation.operationId, async () => {
+            const current = await this.get(operation.operationId);
+            if (current?.revision !== undefined && operation.revision !== current.revision)
+                throw new Error("operation revision may not be changed by save");
+            if (operation.frontendHumanDecision !== undefined || current?.frontendHumanDecision !== undefined) {
+                if (!current || JSON.stringify(operation) !== JSON.stringify(current))
+                    throw new Error("human-decision projection may only be mutated by canonical CAS");
+                return current;
+            }
+            if (operation.frontendSplit !== undefined || current?.frontendSplit !== undefined) {
+                if (!current || JSON.stringify(operation) !== JSON.stringify(current))
+                    throw new Error("split projection may only be mutated by compareAndSwapFrontendSplit");
+                return current;
+            }
             await writeSecureJson(operationFile(this.appData, operation.operationId), operation);
             return operation;
         });
@@ -92,6 +152,10 @@ export class OperationStore {
             if (!current) {
                 throw new Error(`operation not found: ${operationId}`);
             }
+            if ("frontendHumanDecision" in patch || (current.frontendHumanDecision !== undefined && ("state" in patch || "frontendExecution" in patch)))
+                throw new Error("human-decision projection may only be mutated by canonical CAS");
+            if ("frontendSplit" in patch || "revision" in patch || (current.frontendSplit !== undefined && ("state" in patch || "frontendExecution" in patch)))
+                throw new Error("split projection may only be mutated by compareAndSwapFrontendSplit");
             const next = {
                 ...current,
                 ...patch,
@@ -106,6 +170,162 @@ export class OperationStore {
             return next;
         });
     }
+    async materializeFrontendHumanDecision(input) {
+        return this.serialize(input.operationId, async () => {
+            const current = await this.get(input.operationId);
+            if (!current || current.revision === undefined || current.revision !== input.expectedRecordRevision) {
+                const fallback = current?.frontendHumanDecision ?? buildFrontendHumanDecisionProjection({ status: "active", operationId: input.operationId, runId: input.envelope.runId, revision: Math.max(1, input.expectedRecordRevision) });
+                return { outcome: "rejected", reason: "record revision conflict or legacy record", projection: fallback };
+            }
+            const projection = current.frontendHumanDecision ?? buildFrontendHumanDecisionProjection({ status: "active", operationId: current.operationId, runId: input.envelope.runId, revision: current.revision });
+            const result = materializeFrontendHumanDecision({ projection, envelope: input.envelope, expectedRecordRevision: input.expectedRecordRevision, expectedProjectionDigest: input.expectedProjectionDigest });
+            if (result.outcome !== "applied")
+                return result;
+            const record = { ...current, revision: result.projection.revision, frontendHumanDecision: result.projection, state: "running" };
+            await writeSecureJson(operationFile(this.appData, current.operationId), record);
+            return result;
+        });
+    }
+    async consumeFrontendHumanDecision(input) {
+        return this.serialize(input.operationId, async () => {
+            const current = await this.get(input.operationId);
+            if (!current || current.revision === undefined || !current.frontendHumanDecision) {
+                const fallback = buildFrontendHumanDecisionProjection({ status: "active", operationId: input.operationId, runId: input.receipt.runId, revision: Math.max(1, input.expectedRecordRevision) });
+                return { outcome: "rejected", reason: "record has no mutable human-decision projection", projection: fallback };
+            }
+            const projection = parseFrontendHumanDecisionProjection(current.frontendHumanDecision);
+            if (current.revision !== input.expectedRecordRevision)
+                return { outcome: "rejected", reason: "record revision conflict", projection };
+            const result = consumeFrontendHumanDecision({ projection, receipt: input.receipt, expectedRecordRevision: input.expectedRecordRevision, expectedProjectionDigest: input.expectedProjectionDigest, currentTargetDigest: input.currentTargetDigest, now: input.now });
+            if (result.outcome !== "applied")
+                return result;
+            const record = { ...current, revision: result.projection.revision, frontendHumanDecision: result.projection };
+            await writeSecureJson(operationFile(this.appData, current.operationId), record);
+            return result;
+        });
+    }
+    async initializeFrontendHumanApprovedSplit(input) {
+        return this.serialize(input.operationId, async () => {
+            const current = await this.get(input.operationId);
+            const fallback = current?.frontendHumanDecision ?? buildFrontendHumanDecisionProjection({ status: "active", operationId: input.operationId, runId: input.receipt.runId, revision: Math.max(1, input.expectedRecordRevision) });
+            if (!current || current.revision === undefined || current.revision !== input.expectedRecordRevision || !current.frontendHumanDecision || !current.frontendExecution || current.frontendSplit)
+                return { outcome: "rejected", reason: "record is not an authoritative pending single-task split", projection: fallback };
+            const humanProjection = parseFrontendHumanDecisionProjection(current.frontendHumanDecision);
+            if (humanProjection.status !== "blocked-human" || humanProjection.envelope.kind !== "split-materialization-approval" || humanProjection.digest !== input.expectedProjectionDigest)
+                return { outcome: "rejected", reason: "pending split envelope conflict", projection: humanProjection };
+            const receipt = parseFrontendHumanDecisionReceipt(input.receipt);
+            if (receipt.kind !== "split-materialization-approval")
+                return { outcome: "rejected", reason: "receipt is not a split approval", projection: humanProjection };
+            if (JSON.stringify(current.frontendExecution) !== JSON.stringify(input.execution) || input.execution.kind !== "single-task")
+                return { outcome: "rejected", reason: "single-task execution conflict", projection: humanProjection };
+            const consumed = consumeFrontendHumanDecision({ projection: humanProjection, receipt, expectedRecordRevision: input.expectedRecordRevision, expectedProjectionDigest: input.expectedProjectionDigest, currentTargetDigest: input.currentTargetDigest, now: input.now });
+            if (consumed.outcome !== "applied")
+                return consumed;
+            const initialized = initializeFrontendSplitParent({
+                execution: input.execution,
+                manifest: input.manifest,
+                expectedOperationRevision: input.execution.operationRevision,
+                successorOperationRevision: consumed.projection.revision,
+                envelopeTargetDigest: humanProjection.envelope.targetDigest,
+                activeWriterOperationId: input.activeWriterOperationId,
+                activeProviderOperationId: input.activeProviderOperationId,
+                authorization: { mode: "human", envelope: humanProjection.envelope, receipt },
+            });
+            if (initialized.outcome !== "applied")
+                return { outcome: "rejected", reason: initialized.reason, projection: humanProjection };
+            const splitProjection = frontendSplitProjectionSchema.parse({ revision: consumed.projection.revision, execution: initialized.execution, manifest: input.manifest, parent: initialized.parent });
+            const { frontendExecution: _singleTask, ...withoutSingleTask } = current;
+            const record = { ...withoutSingleTask, revision: consumed.projection.revision, frontendHumanDecision: consumed.projection, frontendSplit: splitProjection, state: "running" };
+            await writeSecureJson(operationFile(this.appData, current.operationId), record);
+            return { outcome: "applied", projection: splitProjection, humanDecision: consumed.projection };
+        });
+    }
+    async compareAndSwapFrontendSplit(input) {
+        return this.serialize(input.operationId, async () => {
+            const current = await this.get(input.operationId);
+            if (!current || current.revision === undefined || current.revision !== input.expectedRevision)
+                return { outcome: "conflict" };
+            const currentProjection = current.frontendSplit;
+            if (currentProjection) {
+                if (currentProjection.execution.digest !== input.expectedExecutionDigest || currentProjection.parent.digest !== input.expectedParentDigest)
+                    return { outcome: "conflict" };
+            }
+            else if (input.expectedExecutionDigest || input.expectedParentDigest)
+                return { outcome: "conflict" };
+            const next = currentProjection
+                ? assertFrontendSplitProjectionSuccessor(currentProjection, input.next)
+                : frontendSplitProjectionSchema.parse(input.next);
+            if (next.revision !== current.revision + 1 || next.parent.operationId !== input.operationId)
+                throw new Error("split CAS next revision or operation binding mismatch");
+            const state = next.parent.operationState === "success" ? "succeeded" : next.parent.operationTerminal !== undefined ? "failed" : current.state;
+            const record = { ...current, revision: next.revision, frontendSplit: next, state };
+            await writeSecureJson(operationFile(this.appData, input.operationId), record);
+            return { outcome: "applied", projection: next };
+        });
+    }
+    async loadChildCloseoutFacts(input) {
+        const factsDir = input.closeoutRef.ref;
+        const facts = await readJsonIfExists(path.join(factsDir, "frontend-closeout-facts.json"));
+        if (facts === undefined)
+            return frontendSplitChildCloseoutFactsSchema.parse({ childId: input.childId, residualRisks: [], frontendTestHandoffRef: undefined });
+        const parsedFacts = frontendCloseoutFactsSchema.parse(facts);
+        if (computeFrontendSplitDigest(parsedFacts) !== input.closeoutRef.digest)
+            throw new Error(`child closeout facts digest mismatch: ${input.childId}`);
+        const handoff = await readJsonIfExists(path.join(factsDir, "frontend-test-handoff.json"));
+        const frontendTestHandoffRef = handoff === undefined ? undefined : computeFrontendSplitDigest(frontendTestHandoffSchema.parse(handoff));
+        return frontendSplitChildCloseoutFactsSchema.parse({ childId: input.childId, residualRisks: parsedFacts.residualRisks ?? [], frontendTestHandoffRef });
+    }
+    async settleFrontendSplitAggregate(input) {
+        return this.serialize(input.operationId, async () => {
+            const record = await this.get(input.operationId);
+            if (!record || record.revision === undefined || record.revision !== input.expectedRevision || !record.frontendSplit)
+                return { outcome: "conflict" };
+            const authoritative = frontendSplitProjectionSchema.parse(record.frontendSplit);
+            if (authoritative.parent.operationId !== input.operationId
+                || authoritative.revision !== input.expectedRevision
+                || authoritative.execution.digest !== input.expectedExecutionDigest
+                || authoritative.parent.digest !== input.expectedParentDigest
+                || authoritative.manifest.digest !== input.expectedManifestDigest
+                || authoritative.candidateBinding?.digest !== input.expectedCandidateBindingDigest
+                || authoritative.integrationBinding?.digest !== input.expectedIntegrationBindingDigest)
+                return { outcome: "conflict" };
+            if (!authoritative.candidateBinding)
+                return { outcome: "conflict" };
+            const expectedAggregate = buildFrontendSplitAggregateCloseout(authoritative.parent, authoritative.manifest, authoritative.candidateBinding, authoritative.integrationBinding, input.childCloseoutFacts);
+            if (JSON.stringify(expectedAggregate) !== JSON.stringify(input.aggregate))
+                return { outcome: "conflict" };
+            const transaction = await input.prepareAggregate({
+                operationId: authoritative.parent.operationId,
+                aggregate: expectedAggregate,
+            });
+            try {
+                const committedRef = frontendCommittedFactRefSchema.parse(transaction.committedRef);
+                const finalized = finalizeFrontendSplitAggregate(authoritative.parent, expectedAggregate, committedRef);
+                const next = assertFrontendSplitProjectionSuccessor(authoritative, { ...authoritative, revision: authoritative.revision + 1, parent: finalized.parent, execution: finalized.execution, aggregateCloseout: { value: expectedAggregate, committedRef } });
+                const nextRecord = { ...record, revision: next.revision, frontendSplit: next, state: "succeeded" };
+                await transaction.commit({
+                    parentRecordPath: operationFile(this.appData, record.operationId),
+                    parentRecord: nextRecord,
+                });
+                return { outcome: "applied", projection: next };
+            }
+            catch (error) {
+                await transaction.rollback();
+                throw error;
+            }
+        });
+    }
+    async initializeFrontendSplit(expectedRevision, projectionValue) {
+        const projection = frontendSplitProjectionSchema.parse(projectionValue);
+        return this.serialize(projection.parent.operationId, async () => {
+            const current = await this.get(projection.parent.operationId);
+            if (!current || current.revision === undefined || current.revision !== expectedRevision || current.frontendSplit !== undefined || projection.revision !== expectedRevision + 1)
+                return { outcome: "conflict" };
+            const record = { ...current, revision: projection.revision, frontendSplit: projection };
+            await writeSecureJson(operationFile(this.appData, current.operationId), record);
+            return { outcome: "applied", projection };
+        });
+    }
     async list() {
         const files = await listJsonFiles(this.appData.operations);
         const ops = [];