@telora/daemon 0.22.137 → 0.22.144

package/dist/completion/review-exit-deps.js

@@ -1,5 +1,6 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: packages/daemon/src/integration/failed-verdict-review-exit-respawn-regression.test.ts
+// Pinned by: packages/daemon/src/completion/review-coverage-seam.test.ts,
+//   packages/daemon/src/integration/failed-verdict-review-exit-respawn-regression.test.ts
 // PINNED-BY-END
 /**
  * Dependency contract + default wiring for the review-exit phase.
@@ -19,13 +20,14 @@ import { blameLineCommits, listReviewWindowCommits } from '../resolvers/shared/r
 import { getActiveFocuses } from '../queries/focus-discovery.js';
 import { clearPendingReviewDirective, hasPendingSpawnDirective } from '../directive/directive-queue.js';
 import { emitLoopTrigger } from '../loops/index.js';
-import { getFocusDeliveries, getFocusIssues, clearReviewRequestedAt, setReviewedThroughSha, setReviewCycleCount, setReviewHandoffCount, getFocusReviewReportForSession, getFocusReviewFiledIssueIds, } from '../queries/focuses.js';
+import { getFocusDeliveries, getFocusIssues, clearReviewRequestedAt, setReviewCycleCount, setReviewHandoffCount, getFocusReviewReportForSession, getFocusReviewFiledIssueIds, } from '../queries/focuses.js';
 import { resolveReviewCycleCap, resolveReviewHandoffCap } from '../verify/stall-detector-config.js';
 import { getDeliveryIssues, rehomeIssueToDelivery } from '../queries/issues.js';
 import { createEscalation, hasOpenFocusEscalation, hasOpenEscalationForDelivery, resolveOpenFocusEscalationsOfKind, resolveConvergedFocusEscalations } from '../queries/escalations.js';
 import { findOpenOperatorHoldForDelivery } from '../queries/holds.js';
 import { listOpenShortfallProposalIds } from '../queries/reality-tree.js';
 import { commitGateSeams } from '../verify/commit-gate-configured.js';
+import { stampReviewCoverage } from './review-coverage-shas.js';
 import { writeReviewAutoApproval } from './review-auto-approval-record.js';
 import { writeReviewCensus } from './review-census-record.js';
 import { fileReworkForFailedVerdict } from '../verify/verification-rework-issue.js';
@@ -42,7 +44,11 @@ export const defaultReviewExitDeps = {
     clearReviewRequestedAt,
     fileReworkForFailedVerdict: (focusId, verdict) => fileReworkForFailedVerdict(focusId, verdict),
     clearPendingReviewDirective,
-    setReviewedThroughSha,
+    // The watermark write goes through the coverage stamp, so the range the
+    // watermark stands for is recorded with it (Bug TEL-10): the edge create
+    // gate has no repository and would otherwise hold every delivery that
+    // merged before the reviewed tip, with no event able to release it.
+    setReviewedThroughSha: stampReviewCoverage,
     setReviewCycleCount,
     resolveReviewCycleCap,
     setReviewHandoffCount,

package/dist/completion/review-exit-deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"review-exit-deps.js","sourceRoot":"","sources":["../../src/completion/review-exit-deps.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mGAAmG;AACnG,gBAAgB;AAEhB;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChI,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAA2B,MAAM,8CAA8C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AACxL,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAEtE,OAAO,EAAE,uBAAuB,EAA2B,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAqB,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AA+GpF,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC;IACzE,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;IACzD,sBAAsB;IACtB,0BAA0B,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC;IAC9F,2BAA2B;IAC3B,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IACrB,qBAAqB;IACrB,uBAAuB;IACvB,2BAA2B,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAC9C,iCAAiC,CAAC,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,KAAK,CAAC;IAChG,gCAAgC;IAChC,sBAAsB;IACtB,4BAA4B;IAC5B,+BAA+B;IAC/B,GAAG,eAAe;IAClB,qBAAqB;IACrB,uBAAuB,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IACD,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,CAAC;IACD,sBAAsB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI;IACvG,gBAAgB;IAChB,4BAA4B;IAC5B,wBAAwB;IACxB,eAAe;IACf,8BAA8B;IAC9B,2BAA2B;IAC3B,gBAAgB;CACjB,CAAC"}
+{"version":3,"file":"review-exit-deps.js","sourceRoot":"","sources":["../../src/completion/review-exit-deps.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,0EAA0E;AAC1E,0FAA0F;AAC1F,gBAAgB;AAEhB;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChI,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAA2B,MAAM,8CAA8C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AACxL,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAA2B,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAqB,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AA4HpF,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC;IACzE,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;IACzD,sBAAsB;IACtB,0BAA0B,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC;IAC9F,2BAA2B;IAC3B,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,qBAAqB,EAAE,mBAAmB;IAC1C,mBAAmB;IACnB,qBAAqB;IACrB,qBAAqB;IACrB,uBAAuB;IACvB,2BAA2B,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAC9C,iCAAiC,CAAC,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,KAAK,CAAC;IAChG,gCAAgC;IAChC,sBAAsB;IACtB,4BAA4B;IAC5B,+BAA+B;IAC/B,GAAG,eAAe;IAClB,qBAAqB;IACrB,uBAAuB,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IACD,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,CAAC;IACD,sBAAsB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI;IACvG,gBAAgB;IAChB,4BAA4B;IAC5B,wBAAwB;IACxB,eAAe;IACf,8BAA8B;IAC9B,2BAA2B;IAC3B,gBAAgB;CACjB,CAAC"}

package/dist/delivery/delivery-review-coverage.d.ts

@@ -0,0 +1,200 @@
+/**
+ * Per-delivery review-coverage classifier -- the NODE MIRROR of the canonical
+ * Deno module `supabase/functions/_shared/delivery-review-coverage.ts`.
+ *
+ * WHY A MIRROR AND NOT AN IMPORT. The canonical lives in the Deno edge tree so
+ * the product-api create gate can refuse a delivery presumed to be residue of
+ * unreviewed work. The daemon is Node: it cannot import that file at runtime
+ * (the build emits from `src/` with NodeNext resolution, so a `.ts` specifier
+ * outside rootDir does not survive `tsc`), and the file cannot move into a
+ * workspace package because Deno cannot import one. The repo's generated-mirror
+ * machinery (`scripts/shared-mirror-manifest.json`) would be the right home if
+ * the canonical sat in `src/lib` -- it generates INTO this package already (see
+ * `drift/artifact-ref-shape.ts`) -- but its contract is one hand-edited
+ * canonical in `src/lib` with every other copy generated, and this algorithm
+ * landed hand-edited in the Deno tree. So the two copies are held in agreement
+ * BEHAVIOURALLY instead, by `delivery-review-coverage-parity.test.ts`, which
+ * runs both implementations over a case matrix covering every reason branch and
+ * fails on the first disagreement. Change one, change both, or that test goes
+ * red.
+ *
+ * WHAT IT ANSWERS. Has the delivery that produced a fact on the focus branch
+ * been through focus review? There is no per-delivery review linkage in the
+ * schema (`focus_reviews` is focus-altitude; `reviewed_through_sha` is a branch
+ * position; no delivery column names a review), so coverage is RECONSTRUCTED: a
+ * delivery's merge commit differenced against the reviewed range, with a
+ * timestamp fallback for rows carrying no merge sha.
+ *
+ * FAILS CLOSED. Every undecidable input classifies 'unreviewed', never
+ * 'reviewed'. A false 'unreviewed' costs a hold the caller can clear in one
+ * attributed step; a false 'reviewed' silently re-opens the hole.
+ *
+ * ONLY MONOTONE FACTS CROSS THE RUNTIME SEAM. The covered-sha set and the
+ * branch committed-work reading are both resolved by the daemon and read by a
+ * gate with no repository. A written-down fact is worth only what it is still
+ * worth when it is read, so the module accepts one whose truth can only GROW
+ * (a reviewed range widens; a commit that exists keeps existing) and refuses
+ * one that can lapse. "No commits for this delivery" is the lapsing kind: when
+ * the daemon cannot write, every stored input is frozen at its pre-residue
+ * value, so a rule over stored state answers as it did before the residue
+ * existed. Enforced in `resolveBranchWorkEvidence`.
+ *
+ * NO GIT AND NO I/O. Pure and dependency-free: the caller owns the repo and
+ * supplies the covered-sha set.
+ *
+ * @module delivery/delivery-review-coverage
+ */
+/**
+ * Where a delivery's work stands relative to focus review.
+ *
+ *   'reviewed'    -- covered by a COMPLETED focus review (covered, not
+ *                    approved: a gaps_found review covers the range it read).
+ *   'unreviewed'  -- on the branch (or possibly so) with no completed review
+ *                    over it. Also the resting place of every undecidable input.
+ *   'no_work_yet' -- nothing exists that could BE residue.
+ */
+export type DeliveryReviewCoverage = 'reviewed' | 'unreviewed' | 'no_work_yet';
+/**
+ * WHY a delivery landed in its bucket. Carried so a refusal (or a rendered
+ * context section) can explain itself without re-deriving the decision, and so
+ * tests pin the BRANCH taken rather than only the verdict.
+ */
+export type DeliveryReviewCoverageReason = 
+/** No merge commit, no coding history, and a pre-work status: nothing exists. */
+'no_work_produced'
+/** The focus has never completed a review, so nothing on it can be covered. */
+ | 'focus_never_reviewed'
+/** Merge commit present and inside the caller-supplied covered range. */
+ | 'merge_sha_covered'
+/** Merge commit present and NOT in the covered range (landed after the review). */
+ | 'merge_sha_not_covered'
+/** No merge sha, but the delivery was terminal before the review completed. */
+ | 'terminal_before_review'
+/** No merge sha and the delivery moved after the review completed. */
+ | 'settled_after_review'
+/** No merge sha and the delivery is not terminal, so the review cannot have finished judging it. */
+ | 'not_terminal'
+/** A timestamp needed to decide was absent or unparseable -- fail closed. */
+ | 'undecidable_timestamp';
+export interface DeliveryReviewCoverageResult {
+    coverage: DeliveryReviewCoverage;
+    reason: DeliveryReviewCoverageReason;
+}
+/** A delivery reference shaped for a refusal or a rendered listing. */
+export interface DeliveryReviewRef {
+    id: string;
+    name: string;
+}
+/**
+ * One delivery row (`org_nodes` where `type = 'delivery'`), projected to the
+ * fields that bear on review coverage.
+ */
+export interface DeliveryReviewInput extends DeliveryReviewRef {
+    /** org_nodes.execution_status. May be null on a malformed row. */
+    executionStatus: string | null | undefined;
+    /** org_nodes.merge_commit_sha -- present => the sha path decides. */
+    mergeCommitSha: string | null | undefined;
+    /**
+     * org_nodes.auto_approved_at. DELIBERATELY NEVER CONSULTED. Auto-approval is
+     * the daemon closing a verify delivery whose review team left NO focus_reviews
+     * row -- precisely the population with no review behind it. Declared so a
+     * reader learns it was considered and rejected, not forgotten.
+     */
+    autoApprovedAt: string | null | undefined;
+    /**
+     * org_nodes.updated_at (ISO-8601). Only ever used to prove a delivery SETTLED
+     * BEFORE a review, never that it changed after one in a way that matters.
+     */
+    updatedAt: string | null | undefined;
+    /**
+     * org_nodes.iteration_count. Non-zero means the delivery has been round the
+     * coding cycle, so a re-queued `queued` status understates it.
+     */
+    iterationCount?: number | null;
+    /**
+     * Caller-supplied BRANCH EVIDENCE about the delivery's committed work
+     * (commits on the branch bearing its trailer). The row cannot carry it: a
+     * fast-forward merge-back leaves commits with no `merge_commit_sha`, so only
+     * a caller holding the repo can see them.
+     *
+     * POSITIVE ONLY. `true` makes the row work-bearing; `false` and `undefined`
+     * are the same to this module and neither releases anything. Presence of a
+     * commit is monotone and survives being written down; absence is a claim
+     * about an instant and does not. See `resolveBranchWorkEvidence` for why two
+     * earlier attempts to transport the absence claim (three-valuedness, then a
+     * dated reading) both failed on the same structural fact.
+     */
+    hasCommittedWork?: boolean | undefined;
+}
+/**
+ * Read a STORED branch-work reading (`product_focuses.branch_work_delivery_ids`)
+ * as `hasCommittedWork` for one delivery. Membership -> `true`; EVERYTHING
+ * else -> `undefined`. A stored reading can only ADD a hold, never release
+ * one, at any age.
+ *
+ * WHY NO RELEASING ANSWER SURVIVES. An empty reading used to release: "a
+ * repository was searched and this delivery has no commits". It was fenced
+ * first by three-valuedness (NULL is not `[]`), then by a stamp and a
+ * freshness window. Both broke on one fact: the daemon's retraction of a
+ * reading it has just disproved is itself a WRITE, so it is missing in exactly
+ * the failure that calls for it -- and when no write can land, every durable
+ * input here is frozen at its pre-residue value, so a rule over stored state
+ * returns what it returned before the work existed. Only a clock could
+ * separate the two, and a clock releases knowingly for a while, which is a
+ * delay, not a gate.
+ *
+ * So a cancelled, unmerged, never-re-iterated delivery is HELD until a
+ * completed review covers it (cancelled is terminal, so the timestamp fallback
+ * discharges it) or a caller declares a new root cause. Conservative, not a
+ * freeze. A caller that read the branch in the same act as its decision is not
+ * in this position and does not come through here.
+ */
+export declare function resolveBranchWorkEvidence(deliveryIds: readonly string[] | null | undefined, deliveryId: string): true | undefined;
+/** The focus-altitude review state, resolved by the caller. */
+export interface FocusReviewCoverageInput {
+    /**
+     * product_focuses.reviewed_through_sha -- the focus-branch tip a COMPLETED
+     * review covered. Null/blank means no completed review has ever happened.
+     */
+    reviewedThroughSha: string | null | undefined;
+    /**
+     * completed_at of the most recent COMPLETED focus review (ISO-8601). An
+     * in-flight review must NOT be passed here: a review still running has
+     * judged nothing.
+     */
+    latestCompletedReviewAt: string | null | undefined;
+    /**
+     * The commit shas the completed review(s) covered, resolved by the caller
+     * because THIS MODULE DOES NO GIT AND NO I/O. The daemon resolves it live by
+     * ANCESTRY against the watermark; the edge, which has no repository, reads
+     * the set the daemon persisted (product_focuses.reviewed_through_shas). A
+     * delivery that merged inside the reviewed range was read by that review as
+     * surely as the tip commit. Absent or empty is not an error and not an
+     * invitation to guess -- every merge-sha-bearing delivery simply fails to
+     * match and classifies 'unreviewed'.
+     */
+    coveredShas?: ReadonlySet<string> | readonly string[];
+}
+/**
+ * Classify one delivery against its focus's review state.
+ *
+ * Decision order (each clause short-circuits):
+ *   1. produced nothing                  -> 'no_work_yet'. The only clause
+ *                                           that concludes no residue can
+ *                                           exist, and it reads the row's OWN
+ *                                           columns -- never a third party's
+ *                                           observation of a branch.
+ *   2. no completed review on the focus  -> 'unreviewed' (the watermark rule).
+ *   3. merge sha present                 -> covered-set membership decides.
+ *   4. no merge sha                      -> the timestamp fallback decides.
+ *
+ * `autoApprovedAt` appears in NO clause; see its field doc.
+ */
+export declare function classifyDeliveryReviewCoverage(delivery: DeliveryReviewInput, focus: FocusReviewCoverageInput): DeliveryReviewCoverageResult;
+/**
+ * The deliveries on a focus whose work has NOT been through focus review,
+ * returned as `{id, name}` refs. Input order is preserved; only the two fields
+ * a message needs are returned.
+ */
+export declare function unreviewedDeliveriesOnFocus(deliveries: readonly DeliveryReviewInput[], focus: FocusReviewCoverageInput): DeliveryReviewRef[];
+//# sourceMappingURL=delivery-review-coverage.d.ts.map

package/dist/delivery/delivery-review-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-review-coverage.d.ts","sourceRoot":"","sources":["../../src/delivery/delivery-review-coverage.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC;AAE/E;;;;GAIG;AACH,MAAM,MAAM,4BAA4B;AACtC,iFAAiF;AAC/E,kBAAkB;AACpB,+EAA+E;GAC7E,sBAAsB;AACxB,yEAAyE;GACvE,mBAAmB;AACrB,mFAAmF;GACjF,uBAAuB;AACzB,+EAA+E;GAC7E,wBAAwB;AAC1B,sEAAsE;GACpE,sBAAsB;AACxB,oGAAoG;GAClG,cAAc;AAChB,6EAA6E;GAC3E,uBAAuB,CAAC;AAE5B,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,sBAAsB,CAAC;IACjC,MAAM,EAAE,4BAA4B,CAAC;CACtC;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,kEAAkE;IAClE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,qEAAqE;IACrE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C;;;;;OAKG;IACH,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C;;;OAGG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACxC;AAOD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EACjD,UAAU,EAAE,MAAM,GACjB,IAAI,GAAG,SAAS,CAQlB;AAED,+DAA+D;AAC/D,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACnD;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;CACvD;AAuFD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,wBAAwB,GAC9B,4BAA4B,CAyC9B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,SAAS,mBAAmB,EAAE,EAC1C,KAAK,EAAE,wBAAwB,GAC9B,iBAAiB,EAAE,CAQrB"}

package/dist/delivery/delivery-review-coverage.js

@@ -0,0 +1,192 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/delivery/delivery-review-coverage-parity.test.ts
+// PINNED-BY-END
+/** Trim an id for comparison; the column is text[] and may carry padding. */
+function normalizeId(id) {
+    return typeof id === 'string' ? id.trim() : '';
+}
+/**
+ * Read a STORED branch-work reading (`product_focuses.branch_work_delivery_ids`)
+ * as `hasCommittedWork` for one delivery. Membership -> `true`; EVERYTHING
+ * else -> `undefined`. A stored reading can only ADD a hold, never release
+ * one, at any age.
+ *
+ * WHY NO RELEASING ANSWER SURVIVES. An empty reading used to release: "a
+ * repository was searched and this delivery has no commits". It was fenced
+ * first by three-valuedness (NULL is not `[]`), then by a stamp and a
+ * freshness window. Both broke on one fact: the daemon's retraction of a
+ * reading it has just disproved is itself a WRITE, so it is missing in exactly
+ * the failure that calls for it -- and when no write can land, every durable
+ * input here is frozen at its pre-residue value, so a rule over stored state
+ * returns what it returned before the work existed. Only a clock could
+ * separate the two, and a clock releases knowingly for a while, which is a
+ * delay, not a gate.
+ *
+ * So a cancelled, unmerged, never-re-iterated delivery is HELD until a
+ * completed review covers it (cancelled is terminal, so the timestamp fallback
+ * discharges it) or a caller declares a new root cause. Conservative, not a
+ * freeze. A caller that read the branch in the same act as its decision is not
+ * in this position and does not come through here.
+ */
+export function resolveBranchWorkEvidence(deliveryIds, deliveryId) {
+    if (deliveryIds === null || deliveryIds === undefined)
+        return undefined;
+    const target = normalizeId(deliveryId);
+    if (target === '')
+        return undefined;
+    for (const id of deliveryIds) {
+        if (normalizeId(id) === target)
+            return true;
+    }
+    return undefined;
+}
+/**
+ * Statuses that PROVE a delivery has produced nothing yet. `queued` is proof
+ * only when `iterationCount` is absent or zero (the re-iteration back-path
+ * returns work-bearing deliveries to `queued`), which is why the two signals
+ * are read together in `isWorkBearing`.
+ */
+const PRE_WORK_EXECUTION_STATUSES = new Set([
+    'draft',
+    'planning',
+    'queued',
+]);
+/**
+ * The statuses from which "the review finished judging this" can be inferred
+ * WITHOUT a merge sha: the delivery has STOPPED MOVING. `done` ends the main
+ * path; `cancelled` is the abandoned exit and accrues no further work.
+ *
+ * `cancelled` is load-bearing, and more so since the workless-cancellation
+ * carve-out was removed: EVERY cancelled delivery with no merge sha now
+ * reaches this fallback. Excluded, each would be `'not_terminal'` forever, and
+ * since it can never reach `done` that hold could never discharge -- a
+ * permanent hold is a freeze, not a gate. `verify` and `paused` stay excluded
+ * on purpose: nothing positions their work in the reviewed range and they can
+ * still accrue more.
+ */
+const TERMINAL_EXECUTION_STATUSES = new Set(['done', 'cancelled']);
+/** Trim to a comparable status token; a non-string status becomes ''. */
+function normalizeStatus(status) {
+    return typeof status === 'string' ? status.trim() : '';
+}
+/**
+ * Trim and lower-case a sha, or null when there is nothing usable. Matching is
+ * EXACT after normalization -- prefix matching would turn a caller's formatting
+ * choice into a silent 'reviewed'.
+ */
+function normalizeSha(sha) {
+    if (typeof sha !== 'string')
+        return null;
+    const trimmed = sha.trim().toLowerCase();
+    return trimmed.length > 0 ? trimmed : null;
+}
+/** Normalize the caller's covered-sha collection (Set or array) to a lookup set. */
+function toShaSet(shas) {
+    if (shas === undefined)
+        return new Set();
+    const out = new Set();
+    for (const sha of shas) {
+        const normalized = normalizeSha(sha);
+        if (normalized !== null)
+            out.add(normalized);
+    }
+    return out;
+}
+/**
+ * Parse an ISO-8601 timestamp to epoch ms, or null when absent/unparseable.
+ * Null routes to the fail-closed branch: coercing to 0 would read as "settled
+ * long before the review".
+ */
+function parseTimestamp(value) {
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    if (trimmed.length === 0)
+        return null;
+    const ms = Date.parse(trimmed);
+    return Number.isNaN(ms) ? null : ms;
+}
+/**
+ * Has this delivery produced anything that could be residue? Evidence, in
+ * order: a merge commit, a caller assertion, a non-zero iteration count, its
+ * status. An UNRECOGNISED or absent status counts as work-bearing -- fail
+ * closed.
+ */
+function isWorkBearing(delivery) {
+    if (normalizeSha(delivery.mergeCommitSha) !== null)
+        return true;
+    if (delivery.hasCommittedWork === true)
+        return true;
+    if (hasIterated(delivery))
+        return true;
+    return !PRE_WORK_EXECUTION_STATUSES.has(normalizeStatus(delivery.executionStatus));
+}
+/** Has the delivery been round the coding cycle at least once? */
+function hasIterated(delivery) {
+    return typeof delivery.iterationCount === 'number' && delivery.iterationCount > 0;
+}
+/**
+ * Classify one delivery against its focus's review state.
+ *
+ * Decision order (each clause short-circuits):
+ *   1. produced nothing                  -> 'no_work_yet'. The only clause
+ *                                           that concludes no residue can
+ *                                           exist, and it reads the row's OWN
+ *                                           columns -- never a third party's
+ *                                           observation of a branch.
+ *   2. no completed review on the focus  -> 'unreviewed' (the watermark rule).
+ *   3. merge sha present                 -> covered-set membership decides.
+ *   4. no merge sha                      -> the timestamp fallback decides.
+ *
+ * `autoApprovedAt` appears in NO clause; see its field doc.
+ */
+export function classifyDeliveryReviewCoverage(delivery, focus) {
+    const status = normalizeStatus(delivery.executionStatus);
+    const mergeSha = normalizeSha(delivery.mergeCommitSha);
+    if (!isWorkBearing(delivery)) {
+        return { coverage: 'no_work_yet', reason: 'no_work_produced' };
+    }
+    // The watermark rule: `reviewed_through_sha` is null until a review COMPLETES,
+    // so a null here is proof no review has finished -- and proof beats every
+    // per-delivery signal below it.
+    if (normalizeSha(focus.reviewedThroughSha) === null) {
+        return { coverage: 'unreviewed', reason: 'focus_never_reviewed' };
+    }
+    if (mergeSha !== null) {
+        return toShaSet(focus.coveredShas).has(mergeSha)
+            ? { coverage: 'reviewed', reason: 'merge_sha_covered' }
+            : { coverage: 'unreviewed', reason: 'merge_sha_not_covered' };
+    }
+    // Timestamp fallback: strictly weaker than the sha path, so it concludes
+    // 'reviewed' only from the conjunction of a completed review, a terminal
+    // status, and a last write no later than that review.
+    const reviewCompletedAtMs = parseTimestamp(focus.latestCompletedReviewAt);
+    if (reviewCompletedAtMs === null) {
+        return { coverage: 'unreviewed', reason: 'undecidable_timestamp' };
+    }
+    if (!TERMINAL_EXECUTION_STATUSES.has(status)) {
+        return { coverage: 'unreviewed', reason: 'not_terminal' };
+    }
+    const updatedAtMs = parseTimestamp(delivery.updatedAt);
+    if (updatedAtMs === null) {
+        return { coverage: 'unreviewed', reason: 'undecidable_timestamp' };
+    }
+    return updatedAtMs <= reviewCompletedAtMs
+        ? { coverage: 'reviewed', reason: 'terminal_before_review' }
+        : { coverage: 'unreviewed', reason: 'settled_after_review' };
+}
+/**
+ * The deliveries on a focus whose work has NOT been through focus review,
+ * returned as `{id, name}` refs. Input order is preserved; only the two fields
+ * a message needs are returned.
+ */
+export function unreviewedDeliveriesOnFocus(deliveries, focus) {
+    const unreviewed = [];
+    for (const delivery of deliveries) {
+        if (classifyDeliveryReviewCoverage(delivery, focus).coverage === 'unreviewed') {
+            unreviewed.push({ id: delivery.id, name: delivery.name });
+        }
+    }
+    return unreviewed;
+}
+//# sourceMappingURL=delivery-review-coverage.js.map

package/dist/delivery/delivery-review-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-review-coverage.js","sourceRoot":"","sources":["../../src/delivery/delivery-review-coverage.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,kFAAkF;AAClF,gBAAgB;AAwIhB,6EAA6E;AAC7E,SAAS,WAAW,CAAC,EAA6B;IAChD,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAiD,EACjD,UAAkB;IAElB,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,WAAW,CAAC,EAAE,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA4BD;;;;;GAKG;AACH,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IAC/D,OAAO;IACP,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAExF,yEAAyE;AACzE,SAAS,eAAe,CAAC,MAAiC;IACxD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAA8B;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,IAAyD;IACzE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,GAAG,EAAU,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAgC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,QAA6B;IAClD,IAAI,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,QAAQ,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,WAAW,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,QAA6B;IAChD,OAAO,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAA6B,EAC7B,KAA+B;IAE/B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAEvD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACjE,CAAC;IAED,+EAA+E;IAC/E,0EAA0E;IAC1E,gCAAgC;IAChC,IAAI,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9C,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE;YACvD,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClE,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,cAAc,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1E,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,WAAW,IAAI,mBAAmB;QACvC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE;QAC5D,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAA0C,EAC1C,KAA+B;IAE/B,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,8BAA8B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9E,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/queries/focus-branch-work-evidence.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The branch committed-work evidence write.
+ *
+ * The delivery ROW cannot carry this fact. A fast-forward merge-back records
+ * no `merge_commit_sha`, and a cancelled delivery's commits sit on the focus
+ * branch with nothing on the row naming them -- so only a caller holding the
+ * repository can see that the work exists. The daemon is that caller; the
+ * product-api delivery-create residue gate, which must ENFORCE on the same
+ * fact, runs on an edge runtime with no repository at all.
+ *
+ * So the side that can see it writes it down, through the same
+ * `daemon_update_focus_status` seam the review-coverage watermark uses
+ * (`focus-review-watermark.ts`). Its own module for the same two reasons that
+ * one has: it is a distinct fact with a distinct fail-closed direction, and
+ * `queries/focuses.ts` sits at the file-size ceiling.
+ *
+ * ONE DIRECTION, AND THEREFORE ONE FUNCTION. This module used to have a pair:
+ * a write and a retraction, because a stored reading could RELEASE a hold and
+ * a reading that turned out to be wrong had to be taken back. The retraction
+ * is a WRITE, so it was missing in exactly the failure it existed for -- the
+ * write channel being down -- and dating the reading only bounded how long
+ * the wrong answer stood. The gate now reads a stored reading POSITIVELY only
+ * (`supabase/functions/_shared/delivery-review-coverage.ts` ->
+ * `resolveBranchWorkEvidence`): ids
+ * add holds, their absence grants nothing. With nothing to take back there is
+ * nothing to retract, so the retraction is gone rather than made reliable.
+ *
+ * @module queries/focus-branch-work-evidence
+ */
+import { type CallApiDeps } from './shared.js';
+/**
+ * Record WHICH of a focus's deliveries have commits on the focus branch
+ * (product_focuses.branch_work_delivery_ids), as proved by a
+ * `Telora-Delivery` trailer search in the focus's repository.
+ *
+ * NEVER MARKS ANYTHING REVIEWED, AND NEVER RELEASES ANYTHING. An id in this
+ * set makes a delivery work-bearing, and therefore holdable by the residue
+ * gate under the normal coverage rules. An id that is absent from it asserts
+ * nothing at all: the gate treats a stored reading as positive-only, because
+ * "the branch carries no commits for this delivery" is true of an INSTANT and
+ * this value is read minutes or hours later, by a runtime that cannot check.
+ *
+ * CALL ONLY WHEN THE BRANCH WAS ACTUALLY READ, and mean it -- the whole array
+ * replaces the stored one. An empty array is therefore a WITHDRAWAL of every
+ * hold the previous reading was carrying, which is the dangerous direction: a
+ * caller that could not look must call nothing at all, never this with `[]`.
+ * `resolvers/focus-review-coverage.ts` is the production caller and holds that
+ * precondition.
+ *
+ * `deps` is the product-api seam (queries/shared.ts CallApiDeps): production
+ * passes nothing, a test injects a fake client rather than mock.module-ing the
+ * ambient one.
+ */
+export declare function setBranchWorkDeliveryIds(focusId: string, deliveryIds: readonly string[], deps?: CallApiDeps): Promise<void>;
+//# sourceMappingURL=focus-branch-work-evidence.d.ts.map

package/dist/queries/focus-branch-work-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"focus-branch-work-evidence.d.ts","sourceRoot":"","sources":["../../src/queries/focus-branch-work-evidence.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAW,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/queries/focus-branch-work-evidence.js

@@ -0,0 +1,65 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/completion/review-coverage-seam.test.ts,
+//   packages/daemon/src/queries/focus-branch-work-evidence.test.ts,
+//   packages/daemon/src/resolvers/focus-review-coverage.test.ts
+// PINNED-BY-END
+/**
+ * The branch committed-work evidence write.
+ *
+ * The delivery ROW cannot carry this fact. A fast-forward merge-back records
+ * no `merge_commit_sha`, and a cancelled delivery's commits sit on the focus
+ * branch with nothing on the row naming them -- so only a caller holding the
+ * repository can see that the work exists. The daemon is that caller; the
+ * product-api delivery-create residue gate, which must ENFORCE on the same
+ * fact, runs on an edge runtime with no repository at all.
+ *
+ * So the side that can see it writes it down, through the same
+ * `daemon_update_focus_status` seam the review-coverage watermark uses
+ * (`focus-review-watermark.ts`). Its own module for the same two reasons that
+ * one has: it is a distinct fact with a distinct fail-closed direction, and
+ * `queries/focuses.ts` sits at the file-size ceiling.
+ *
+ * ONE DIRECTION, AND THEREFORE ONE FUNCTION. This module used to have a pair:
+ * a write and a retraction, because a stored reading could RELEASE a hold and
+ * a reading that turned out to be wrong had to be taken back. The retraction
+ * is a WRITE, so it was missing in exactly the failure it existed for -- the
+ * write channel being down -- and dating the reading only bounded how long
+ * the wrong answer stood. The gate now reads a stored reading POSITIVELY only
+ * (`supabase/functions/_shared/delivery-review-coverage.ts` ->
+ * `resolveBranchWorkEvidence`): ids
+ * add holds, their absence grants nothing. With nothing to take back there is
+ * nothing to retract, so the retraction is gone rather than made reliable.
+ *
+ * @module queries/focus-branch-work-evidence
+ */
+import { callApi } from './shared.js';
+/**
+ * Record WHICH of a focus's deliveries have commits on the focus branch
+ * (product_focuses.branch_work_delivery_ids), as proved by a
+ * `Telora-Delivery` trailer search in the focus's repository.
+ *
+ * NEVER MARKS ANYTHING REVIEWED, AND NEVER RELEASES ANYTHING. An id in this
+ * set makes a delivery work-bearing, and therefore holdable by the residue
+ * gate under the normal coverage rules. An id that is absent from it asserts
+ * nothing at all: the gate treats a stored reading as positive-only, because
+ * "the branch carries no commits for this delivery" is true of an INSTANT and
+ * this value is read minutes or hours later, by a runtime that cannot check.
+ *
+ * CALL ONLY WHEN THE BRANCH WAS ACTUALLY READ, and mean it -- the whole array
+ * replaces the stored one. An empty array is therefore a WITHDRAWAL of every
+ * hold the previous reading was carrying, which is the dangerous direction: a
+ * caller that could not look must call nothing at all, never this with `[]`.
+ * `resolvers/focus-review-coverage.ts` is the production caller and holds that
+ * precondition.
+ *
+ * `deps` is the product-api seam (queries/shared.ts CallApiDeps): production
+ * passes nothing, a test injects a fake client rather than mock.module-ing the
+ * ambient one.
+ */
+export async function setBranchWorkDeliveryIds(focusId, deliveryIds, deps = {}) {
+    await (deps.callApi ?? callApi)('daemon_update_focus_status', {
+        focusId,
+        fields: { branchWorkDeliveryIds: [...deliveryIds] },
+    });
+}
+//# sourceMappingURL=focus-branch-work-evidence.js.map

package/dist/queries/focus-branch-work-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"focus-branch-work-evidence.js","sourceRoot":"","sources":["../../src/queries/focus-branch-work-evidence.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,0EAA0E;AAC1E,oEAAoE;AACpE,gEAAgE;AAChE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAe,EACf,WAA8B,EAC9B,OAAoB,EAAE;IAEtB,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,4BAA4B,EAAE;QAC5D,OAAO;QACP,MAAM,EAAE,EAAE,qBAAqB,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE;KACpD,CAAC,CAAC;AACL,CAAC"}