@telora/daemon 0.22.189 → 0.22.226

package/dist/verify/parked-shortfall-reuse.d.ts

@@ -0,0 +1,194 @@
+/**
+ * A PARKED shortfall is REUSED, not re-judged, while its commit set and its
+ * rulings are unchanged.
+ *
+ * WHY. The verify gate already works this way about the SUITE: a commit whose
+ * verdict is recorded is not run again (verify/verification-commit-sharing.ts
+ * readReusableVerdict). The RECONCILIATION did not: the engine called
+ * `authorTargetRestatements` -- a ~28s `claude --print` one-shot -- on every
+ * dispatch whose gate verdict was passed, and consulted the delivery's shortfall
+ * park only afterwards, in routing. So however a parked delivery reached dispatch
+ * it paid a model call to re-derive a shortfall the park already records by commit
+ * set and signature. Measured 2026-09-24: delivery 8ae80225, parked at 06:25Z on
+ * commit set `15:2b25de49`, made ~30 reconciliation calls (median 28s) between
+ * 06:08Z and 06:54Z at an unchanged HEAD; the one at 06:50Z failed with
+ * "verify-reconciliation: model unavailable (auth)", proving each dispatch really
+ * was calling the model. A sibling delivery closed the re-dispatch path that fed
+ * that loop; this module bounds the COST of any re-dispatch path, including ones
+ * not yet found.
+ *
+ * WHAT IS REUSED. Not a cached verdict -- the park's OWN record. The gaps are
+ * rebuilt VERBATIM from the shortfall detail standing on the same gate_state
+ * (`shortfallReconciliation.shortfalls`: declared / achieved / reason /
+ * diffCitation as the judging pass wrote them), and the rebuild is accepted only
+ * when it reproduces the park's own signature (`sameShortfallSignature`). So the
+ * routing that follows is the routing a fresh IDENTICAL judgement would produce:
+ * the same demotion to 'failed', the same park re-hold with its original
+ * `parkedAt`, the same cause-keyed escalation (already deduped in
+ * verify/shortfall-park-escalation.ts, so nothing is re-filed) and the same
+ * gate_state detail. What it does NOT do is call the model.
+ *
+ * WHEN IT IS REFUSED -- every one of these judges instead, so the reuse can only
+ * ever remove a model call, never a judgement:
+ *   - no standing park refusing re-work (verify/shortfall-park.ts
+ *     shortfallParkRefusingRework: a park on a delivery in verify);
+ *   - the CURRENT commit set could not be read, or differs from the park's, or
+ *     the park itself recorded none. A null fingerprint means the read FAILED and
+ *     must never match;
+ *   - the CURRENT rulings fingerprint could not be read, or differs from the
+ *     park's, or the PARK carries none. A park's fingerprint is PRESENT exactly
+ *     when the judgement that recorded it could READ the rulings: '' is a
+ *     succeeded read of an empty set ("no ruling was in force"), and the field is
+ *     absent only where the read FAILED (shortfall-park.ts classifyShortfallPark).
+ *     So an absent one is a park whose ruling history is UNKNOWN and is refused
+ *     ('park-rulings-unknown') rather than coerced to '' -- coercing it would let
+ *     a park recorded while the rulings were unreadable be answered from after a
+ *     later successful EMPTY read, as though the unknown had been known-empty.
+ *     The recorder is why this can be strict: the previous cycle read an absent
+ *     fingerprint as '' because requiring presence would otherwise have made the
+ *     reuse inert for the measured incident (an ordinary no-rulings park wrote no
+ *     field at all). With the recorder fixed there is no such dilemma -- a
+ *     known-empty park records '' and reuses, an unknown one judges. A park
+ *     WRITTEN BY THE OLD RECORDER carries no field even where the rulings were
+ *     readable and empty: it refuses ONCE, that judgement re-holds it carrying
+ *     '', and reuse resumes -- the one reconciliation after recovery, no more.
+ *     Any ruling landing since (an operator row, or an approving review's node
+ *     verdict arriving through the same reader as `ruledByKind: 'review'`)
+ *     changes the fingerprint and re-judges exactly once, after which the park
+ *     carries the new fingerprint and matches again;
+ *   - the gate_state carries an AWAITED-MODEL hold (`modelUnavailable`,
+ *     verify/verification-model-unavailable-hold.ts). A park is never WRITTEN by
+ *     that path -- the engine routes no shortfall when the model was not reached
+ *     -- but a later tick can leave the hold standing beside a park, and then the
+ *     last thing that happened to this delivery was a non-judgement. The hold
+ *     exists precisely so the next tick re-judges the same commit, so this
+ *     refuses rather than answering from a record the hold sits on top of. It is
+ *     self-clearing: the first reconciliation that renders rebuilds gate_state
+ *     without it, and reuse resumes on the tick after;
+ *   - the gaps cannot be rebuilt from the standing detail, or the rebuild does
+ *     not reproduce the park's signature (a legacy park, or a writer that
+ *     replaced the live detail). One judgement re-establishes the detail;
+ *   - the rebuilt gaps look like a FAILED reconciliation rather than a judgement:
+ *     a non-ModelUnavailable throw is signed as a whole-injection shortfall
+ *     (classifyReconciliationThrow), which names the INJECTION node and carries
+ *     the '(unknown -- reconciliation failed)' declared statement. That is an
+ *     error, not a verdict, so it is re-attempted rather than reused.
+ *
+ * WHAT STAYS REACHABLE, AND WHAT DOES NOT. The engine resolves the delivery's
+ * evidence before asking this: those are git and record reads every dispatch pays
+ * anyway, and leaving them unconditional keeps the pass path one shape. Their
+ * instrument-fault branch is then unreachable on a reused dispatch, on purpose --
+ * it routes the delivery to bounded RE-WORK, which is exactly what a standing park
+ * refuses (shortfallParkRefusingRework), so a blind bundle on a parked delivery
+ * must re-hold the park rather than send it back to coding. Everything after the
+ * reconciliation is reached exactly as a fresh judgement reaches it: the inward
+ * shortfall drift, the routing, the park's escalation, the recorded-targets report
+ * (left untouched -- a reused dispatch learned nothing new about arm coverage).
+ *
+ * WHAT IT DELIBERATELY DOES NOT WIDEN. Reuse is keyed on exactly the two facts
+ * the park's own release rule is keyed on (shortfall-park.ts
+ * isShortfallParkReleased: the commit set and the rulings fingerprint). Anything
+ * that does not release the park does not release the reuse either -- the park
+ * already governs whether such a delivery is judged at all, and a second,
+ * differently-keyed opinion here would be a way for the two to disagree.
+ *
+ * The DECISION is pure (decideParkedShortfallReuse) and takes the facts; only
+ * resolveParkedShortfallReuse reads them, through the engine's dep seam.
+ *
+ * @module verify/parked-shortfall-reuse
+ */
+import { type ShortfallPark } from './shortfall-park.js';
+import type { DeliveryGateRecord } from '../queries/deliveries.js';
+import type { ShortfallReconciliationDetail } from '../queries/delivery-gate-state.js';
+import type { PendingVerification } from '../queries/verification.js';
+import type { RuledReconciliation, ShortfallRulingsReader } from './shortfall-rulings.js';
+import type { TargetShortfall } from './verify-restatement.js';
+/** Why a dispatch judged instead of reusing the park. Named so the log says which fact refused. */
+export type ParkReuseRefusal = 'no-park' | 'awaiting-model' | 'park-commit-set-unknown' | 'commit-set-unknown' | 'commit-set-changed' | 'park-rulings-unknown' | 'rulings-unknown' | 'rulings-changed' | 'gaps-not-reconstructable' | 'not-a-judgement';
+/** What a dispatch knows about the delivery's park before it would call the model. */
+export interface ParkedShortfallFacts {
+    /** The standing park that refuses re-work (shortfallParkRefusingRework), or null. */
+    park: ShortfallPark | null;
+    /** The shortfall detail standing on the same gate_state -- the judged gaps, verbatim. */
+    detail: ShortfallReconciliationDetail | null;
+    /** True when the same gate_state carries the awaited-model hold. */
+    awaitingModel: boolean;
+    /** The delivery's CURRENT commit-set fingerprint; null when it could not be read. */
+    commitSet: string | null;
+    /** The delivery's CURRENT rulings fingerprint; null when it could not be read. */
+    rulingsFingerprint: string | null;
+    /** The injection this dispatch judges (a gap naming it is a failed reconciliation). */
+    injectionNodeId: string;
+}
+/** Reuse the park's judgement, or judge afresh (and why). */
+export type ParkedShortfallDecision = {
+    reuse: true;
+    park: ShortfallPark;
+    shortfalls: TargetShortfall[];
+    rulingsFingerprint: string;
+} | {
+    reuse: false;
+    refusal: ParkReuseRefusal;
+};
+/**
+ * The park's gaps, rebuilt VERBATIM from the standing shortfall detail; null when
+ * they cannot be. Accepted only when the detail's node set is a BIJECTION with
+ * the park's -- no node missing and none extra -- AND the rebuild re-hashes to
+ * the park's own signature, so the routing that follows re-holds THIS park
+ * rather than opening a new one, and routes exactly what a fresh judgement would.
+ * Pure.
+ */
+export declare function reconstructParkedShortfalls(park: ShortfallPark, detail: ShortfallReconciliationDetail | null): TargetShortfall[] | null;
+/**
+ * Decide whether this dispatch may answer from the park instead of calling the
+ * model (see the module header for each refusal). Pure: every fact is supplied,
+ * and every unknown fact refuses.
+ */
+export declare function decideParkedShortfallReuse(facts: ParkedShortfallFacts): ParkedShortfallDecision;
+/** The seams the reuse reads its facts through; each absent one simply judges. */
+export interface ParkedShortfallReuseDeps {
+    /**
+     * The delivery's execution_status + gate_state as the last writer left them
+     * (queries/deliveries.ts getDeliveryGateRecord -- the read
+     * routeShortfallOutcome's prior-state read uses). Absent: no park is read and
+     * every dispatch judges, exactly as before this module existed.
+     */
+    readDeliveryGateRecord?: (deliveryId: string) => Promise<DeliveryGateRecord | null>;
+    /**
+     * The identities of the delivery's own trailered commits at the commit this
+     * dispatch judged (verify/delivery-commit-set.ts), fingerprinted here with
+     * commitSetFingerprint -- the same pair routeShortfallOutcome's
+     * `resolveCommitSet` goes through, so the two fingerprints are comparable by
+     * construction. null when git could not answer.
+     */
+    resolveDeliveryCommitSet?: (v: PendingVerification, judgedSha: string | null) => Promise<string[] | null> | string[] | null;
+    /** The delivery's active rulings (queries/shortfall-rulings.ts), read for their fingerprint. */
+    readShortfallRulings?: ShortfallRulingsReader;
+}
+/**
+ * A reused park, shaped as the ruled reconciliation the engine already routes:
+ * no restatements (a held gate flips nothing), no honored ruling (the ruling set
+ * is unchanged, so it cleared these gaps at park time or not at all) and nothing
+ * withheld.
+ */
+export interface ParkedShortfallReuse extends RuledReconciliation {
+    rulingsFingerprint: string;
+    park: ShortfallPark;
+}
+/**
+ * Whether a park stands on this delivery whose facts are ALL unchanged -- the
+ * question every re-selection path asks before dropping a run mark.
+ *
+ * TRUE means re-selecting it would re-derive exactly what the park already
+ * records, so the path declines. FALSE means the park is absent, its facts moved
+ * (a new commit, a new ruling), or SOMETHING IS UNKNOWN -- and unknown must
+ * re-select, never suppress: this gate may only ever remove a re-selection it can
+ * PROVE is pointless. Never throws.
+ */
+export declare function parkHoldsOnUnchangedFacts(v: PendingVerification, judgedSha: string | null, deps: ParkedShortfallReuseDeps): Promise<boolean>;
+/**
+ * The park this dispatch may answer from instead of calling the model, or null to
+ * judge. Never throws: every read failure refuses.
+ */
+export declare function resolveParkedShortfallReuse(v: PendingVerification, judgedSha: string | null, deps: ParkedShortfallReuseDeps): Promise<ParkedShortfallReuse | null>;
+//# sourceMappingURL=parked-shortfall-reuse.d.ts.map

package/dist/verify/parked-shortfall-reuse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parked-shortfall-reuse.d.ts","sourceRoot":"","sources":["../../src/verify/parked-shortfall-reuse.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAEH,OAAO,EAAqD,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAe/D,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,gBAAgB,GAChB,yBAAyB,GACzB,oBAAoB,GACpB,oBAAoB,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,0BAA0B,GAC1B,iBAAiB,CAAC;AAEtB,sFAAsF;AACtF,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,yFAAyF;IACzF,MAAM,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAC7C,oEAAoE;IACpE,aAAa,EAAE,OAAO,CAAC;IACvB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kFAAkF;IAClF,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,6DAA6D;AAC7D,MAAM,MAAM,uBAAuB,GAC/B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,eAAe,EAAE,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/F;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAMhD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAC3C,eAAe,EAAE,GAAG,IAAI,CAoC1B;AAQD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,oBAAoB,GAAG,uBAAuB,CAkB/F;AAED,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpF;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5H,gGAAgG;IAChG,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;CAC/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,aAAa,CAAC;CACrB;AAqED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,CAAC,EAAE,mBAAmB,EACtB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,CAAC,EAAE,mBAAmB,EACtB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAyBtC"}

package/dist/verify/parked-shortfall-reuse.js

@@ -0,0 +1,310 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/commit-verdict-pull.test.ts,
+//   packages/daemon/src/verify/explicit-row-selection.test.ts,
+//   packages/daemon/src/verify/parked-shortfall-reuse.test.ts
+// PINNED-BY-END
+/**
+ * A PARKED shortfall is REUSED, not re-judged, while its commit set and its
+ * rulings are unchanged.
+ *
+ * WHY. The verify gate already works this way about the SUITE: a commit whose
+ * verdict is recorded is not run again (verify/verification-commit-sharing.ts
+ * readReusableVerdict). The RECONCILIATION did not: the engine called
+ * `authorTargetRestatements` -- a ~28s `claude --print` one-shot -- on every
+ * dispatch whose gate verdict was passed, and consulted the delivery's shortfall
+ * park only afterwards, in routing. So however a parked delivery reached dispatch
+ * it paid a model call to re-derive a shortfall the park already records by commit
+ * set and signature. Measured 2026-09-24: delivery 8ae80225, parked at 06:25Z on
+ * commit set `15:2b25de49`, made ~30 reconciliation calls (median 28s) between
+ * 06:08Z and 06:54Z at an unchanged HEAD; the one at 06:50Z failed with
+ * "verify-reconciliation: model unavailable (auth)", proving each dispatch really
+ * was calling the model. A sibling delivery closed the re-dispatch path that fed
+ * that loop; this module bounds the COST of any re-dispatch path, including ones
+ * not yet found.
+ *
+ * WHAT IS REUSED. Not a cached verdict -- the park's OWN record. The gaps are
+ * rebuilt VERBATIM from the shortfall detail standing on the same gate_state
+ * (`shortfallReconciliation.shortfalls`: declared / achieved / reason /
+ * diffCitation as the judging pass wrote them), and the rebuild is accepted only
+ * when it reproduces the park's own signature (`sameShortfallSignature`). So the
+ * routing that follows is the routing a fresh IDENTICAL judgement would produce:
+ * the same demotion to 'failed', the same park re-hold with its original
+ * `parkedAt`, the same cause-keyed escalation (already deduped in
+ * verify/shortfall-park-escalation.ts, so nothing is re-filed) and the same
+ * gate_state detail. What it does NOT do is call the model.
+ *
+ * WHEN IT IS REFUSED -- every one of these judges instead, so the reuse can only
+ * ever remove a model call, never a judgement:
+ *   - no standing park refusing re-work (verify/shortfall-park.ts
+ *     shortfallParkRefusingRework: a park on a delivery in verify);
+ *   - the CURRENT commit set could not be read, or differs from the park's, or
+ *     the park itself recorded none. A null fingerprint means the read FAILED and
+ *     must never match;
+ *   - the CURRENT rulings fingerprint could not be read, or differs from the
+ *     park's, or the PARK carries none. A park's fingerprint is PRESENT exactly
+ *     when the judgement that recorded it could READ the rulings: '' is a
+ *     succeeded read of an empty set ("no ruling was in force"), and the field is
+ *     absent only where the read FAILED (shortfall-park.ts classifyShortfallPark).
+ *     So an absent one is a park whose ruling history is UNKNOWN and is refused
+ *     ('park-rulings-unknown') rather than coerced to '' -- coercing it would let
+ *     a park recorded while the rulings were unreadable be answered from after a
+ *     later successful EMPTY read, as though the unknown had been known-empty.
+ *     The recorder is why this can be strict: the previous cycle read an absent
+ *     fingerprint as '' because requiring presence would otherwise have made the
+ *     reuse inert for the measured incident (an ordinary no-rulings park wrote no
+ *     field at all). With the recorder fixed there is no such dilemma -- a
+ *     known-empty park records '' and reuses, an unknown one judges. A park
+ *     WRITTEN BY THE OLD RECORDER carries no field even where the rulings were
+ *     readable and empty: it refuses ONCE, that judgement re-holds it carrying
+ *     '', and reuse resumes -- the one reconciliation after recovery, no more.
+ *     Any ruling landing since (an operator row, or an approving review's node
+ *     verdict arriving through the same reader as `ruledByKind: 'review'`)
+ *     changes the fingerprint and re-judges exactly once, after which the park
+ *     carries the new fingerprint and matches again;
+ *   - the gate_state carries an AWAITED-MODEL hold (`modelUnavailable`,
+ *     verify/verification-model-unavailable-hold.ts). A park is never WRITTEN by
+ *     that path -- the engine routes no shortfall when the model was not reached
+ *     -- but a later tick can leave the hold standing beside a park, and then the
+ *     last thing that happened to this delivery was a non-judgement. The hold
+ *     exists precisely so the next tick re-judges the same commit, so this
+ *     refuses rather than answering from a record the hold sits on top of. It is
+ *     self-clearing: the first reconciliation that renders rebuilds gate_state
+ *     without it, and reuse resumes on the tick after;
+ *   - the gaps cannot be rebuilt from the standing detail, or the rebuild does
+ *     not reproduce the park's signature (a legacy park, or a writer that
+ *     replaced the live detail). One judgement re-establishes the detail;
+ *   - the rebuilt gaps look like a FAILED reconciliation rather than a judgement:
+ *     a non-ModelUnavailable throw is signed as a whole-injection shortfall
+ *     (classifyReconciliationThrow), which names the INJECTION node and carries
+ *     the '(unknown -- reconciliation failed)' declared statement. That is an
+ *     error, not a verdict, so it is re-attempted rather than reused.
+ *
+ * WHAT STAYS REACHABLE, AND WHAT DOES NOT. The engine resolves the delivery's
+ * evidence before asking this: those are git and record reads every dispatch pays
+ * anyway, and leaving them unconditional keeps the pass path one shape. Their
+ * instrument-fault branch is then unreachable on a reused dispatch, on purpose --
+ * it routes the delivery to bounded RE-WORK, which is exactly what a standing park
+ * refuses (shortfallParkRefusingRework), so a blind bundle on a parked delivery
+ * must re-hold the park rather than send it back to coding. Everything after the
+ * reconciliation is reached exactly as a fresh judgement reaches it: the inward
+ * shortfall drift, the routing, the park's escalation, the recorded-targets report
+ * (left untouched -- a reused dispatch learned nothing new about arm coverage).
+ *
+ * WHAT IT DELIBERATELY DOES NOT WIDEN. Reuse is keyed on exactly the two facts
+ * the park's own release rule is keyed on (shortfall-park.ts
+ * isShortfallParkReleased: the commit set and the rulings fingerprint). Anything
+ * that does not release the park does not release the reuse either -- the park
+ * already governs whether such a delivery is judged at all, and a second,
+ * differently-keyed opinion here would be a way for the two to disagree.
+ *
+ * The DECISION is pure (decideParkedShortfallReuse) and takes the facts; only
+ * resolveParkedShortfallReuse reads them, through the engine's dep seam.
+ *
+ * @module verify/parked-shortfall-reuse
+ */
+import { commitSetFingerprint, shortfallParkRefusingRework } from './shortfall-park.js';
+import { sameShortfallSignature, shortfallSignature } from './shortfall-repeat.js';
+import { hasModelUnavailableHold } from '../queries/verify-own-holds.js';
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'verification' });
+/**
+ * The declared statement classifyReconciliationThrow
+ * (verify/verification-model-unavailable-hold.ts) signs a FAILED reconciliation
+ * with. Duplicated as a sentinel rather than imported so this module keeps no
+ * edge to the hold module; the structural test beside it (the shortfall names the
+ * INJECTION node, which a judged target never is) stands on its own if the
+ * wording drifts.
+ */
+const RECONCILIATION_FAILED_DECLARED = '(unknown -- reconciliation failed)';
+function lower(id) {
+    return id.trim().toLowerCase();
+}
+/**
+ * The park's gaps, rebuilt VERBATIM from the standing shortfall detail; null when
+ * they cannot be. Accepted only when the detail's node set is a BIJECTION with
+ * the park's -- no node missing and none extra -- AND the rebuild re-hashes to
+ * the park's own signature, so the routing that follows re-holds THIS park
+ * rather than opening a new one, and routes exactly what a fresh judgement would.
+ * Pure.
+ */
+export function reconstructParkedShortfalls(park, detail) {
+    if (!detail || !Array.isArray(detail.shortfalls))
+        return null;
+    const parked = new Set(park.nodeIds.map(lower));
+    const nodesSeen = new Set();
+    const identities = new Set();
+    const gaps = [];
+    for (const s of detail.shortfalls) {
+        if (typeof s?.nodeId !== 'string' || typeof s.declared !== 'string')
+            return null;
+        const id = lower(s.nodeId);
+        // An EXTRA node: the standing detail holds a gap this park does not. Skipping
+        // it would reuse a judgement that routes STRICTLY LESS than a fresh one would
+        // (park [A] with detail [A,B] routed A alone, where judging routes A and B),
+        // and the signature check below cannot catch it -- the reconstruction would
+        // re-hash to the park's own signature precisely BECAUSE the extra was
+        // dropped. So refuse and let the reconciliation run.
+        if (!parked.has(id))
+            return null;
+        // Deduped on (nodeId, declared) -- the SIGNATURE's own key
+        // (verify/shortfall-repeat.ts canonicalSignature), not nodeId alone -- so an
+        // identical repeat collapses to one gap while two DIFFERING declarations for
+        // one node stay two and are caught by the signature comparison.
+        const identity = JSON.stringify([s.nodeId, s.declared]);
+        if (identities.has(identity))
+            continue;
+        identities.add(identity);
+        nodesSeen.add(id);
+        gaps.push({
+            nodeId: s.nodeId,
+            declaredStatement: s.declared,
+            achievedStatement: typeof s.achieved === 'string' ? s.achieved : '',
+            reason: typeof s.reason === 'string' ? s.reason : '',
+            ...(s.diffCitation ? { diffCitation: s.diffCitation } : {}),
+        });
+    }
+    // A BIJECTION, both directions: the loop above refused every node the park does
+    // not hold, and this refuses a park node the detail does not carry.
+    if (nodesSeen.size !== parked.size)
+        return null;
+    return sameShortfallSignature(shortfallSignature(gaps), park.signature) ? gaps : null;
+}
+/** Whether one rebuilt gap is a signed reconciliation FAILURE rather than a judgement. Pure. */
+function isFailedReconciliation(gap, injectionNodeId) {
+    return lower(gap.nodeId) === lower(injectionNodeId)
+        || gap.declaredStatement === RECONCILIATION_FAILED_DECLARED;
+}
+/**
+ * Decide whether this dispatch may answer from the park instead of calling the
+ * model (see the module header for each refusal). Pure: every fact is supplied,
+ * and every unknown fact refuses.
+ */
+export function decideParkedShortfallReuse(facts) {
+    const { park } = facts;
+    if (park === null)
+        return { reuse: false, refusal: 'no-park' };
+    if (facts.awaitingModel)
+        return { reuse: false, refusal: 'awaiting-model' };
+    if (park.commitSet === null)
+        return { reuse: false, refusal: 'park-commit-set-unknown' };
+    if (facts.commitSet === null)
+        return { reuse: false, refusal: 'commit-set-unknown' };
+    if (facts.commitSet !== park.commitSet)
+        return { reuse: false, refusal: 'commit-set-changed' };
+    // PRESENT on the park means its recorder could READ the rulings ('' = a
+    // succeeded read of an empty set). Absent means unknown, which never matches.
+    if (park.rulingsFingerprint === undefined)
+        return { reuse: false, refusal: 'park-rulings-unknown' };
+    if (facts.rulingsFingerprint === null)
+        return { reuse: false, refusal: 'rulings-unknown' };
+    if (facts.rulingsFingerprint !== park.rulingsFingerprint)
+        return { reuse: false, refusal: 'rulings-changed' };
+    const shortfalls = reconstructParkedShortfalls(park, facts.detail);
+    if (shortfalls === null)
+        return { reuse: false, refusal: 'gaps-not-reconstructable' };
+    if (shortfalls.some((gap) => isFailedReconciliation(gap, facts.injectionNodeId))) {
+        return { reuse: false, refusal: 'not-a-judgement' };
+    }
+    return { reuse: true, park, shortfalls, rulingsFingerprint: facts.rulingsFingerprint };
+}
+/** The current commit-set fingerprint; null (logged) when unreadable -- which refuses reuse. */
+async function readCommitSet(deps, v, judgedSha) {
+    if (!deps.resolveDeliveryCommitSet)
+        return null;
+    try {
+        const ids = await deps.resolveDeliveryCommitSet(v, judgedSha);
+        return ids === null ? null : commitSetFingerprint(ids);
+    }
+    catch (err) {
+        log.warn(`[verification] parked delivery ${v.deliveryId}: commit set unreadable, re-judging:`, err.message);
+        return null;
+    }
+}
+/** The current rulings fingerprint; null (logged) when unreadable -- which refuses reuse. */
+async function readRulingsFingerprint(deps, deliveryId) {
+    if (!deps.readShortfallRulings)
+        return null;
+    try {
+        return (await deps.readShortfallRulings(deliveryId)).fingerprint;
+    }
+    catch (err) {
+        log.warn(`[verification] parked delivery ${deliveryId}: rulings unreadable, re-judging:`, err.message);
+        return null;
+    }
+}
+/** The delivery's gate record; null (logged) when the read failed -- which refuses reuse. */
+async function readGateRecord(deps, deliveryId) {
+    if (!deps.readDeliveryGateRecord)
+        return null;
+    try {
+        return await deps.readDeliveryGateRecord(deliveryId);
+    }
+    catch (err) {
+        log.warn(`[verification] delivery ${deliveryId}: gate_state unreadable, re-judging:`, err.message);
+        return null;
+    }
+}
+/**
+ * Read the delivery's park and decide about it; null when NO park stands, so an
+ * ordinary dispatch pays one gate_state read and nothing else. The single
+ * decision point: both the cost bound (reuse the judgement) and the re-selection
+ * rule (`parkHoldsOnUnchangedFacts`) ask through here, so the two cannot answer
+ * differently about the same park. Never throws: every read failure refuses.
+ */
+async function decideForDelivery(v, judgedSha, deps) {
+    const record = await readGateRecord(deps, v.deliveryId);
+    const park = record === null ? null : shortfallParkRefusingRework(record);
+    if (park === null)
+        return null;
+    const decision = decideParkedShortfallReuse({
+        park,
+        detail: record?.gateState?.shortfallReconciliation ?? null,
+        awaitingModel: hasModelUnavailableHold(record?.gateState),
+        commitSet: await readCommitSet(deps, v, judgedSha),
+        rulingsFingerprint: await readRulingsFingerprint(deps, v.deliveryId),
+        injectionNodeId: v.injectionNodeId,
+    });
+    return { park, decision };
+}
+/**
+ * Whether a park stands on this delivery whose facts are ALL unchanged -- the
+ * question every re-selection path asks before dropping a run mark.
+ *
+ * TRUE means re-selecting it would re-derive exactly what the park already
+ * records, so the path declines. FALSE means the park is absent, its facts moved
+ * (a new commit, a new ruling), or SOMETHING IS UNKNOWN -- and unknown must
+ * re-select, never suppress: this gate may only ever remove a re-selection it can
+ * PROVE is pointless. Never throws.
+ */
+export async function parkHoldsOnUnchangedFacts(v, judgedSha, deps) {
+    const decided = await decideForDelivery(v, judgedSha, deps);
+    return decided !== null && decided.decision.reuse;
+}
+/**
+ * The park this dispatch may answer from instead of calling the model, or null to
+ * judge. Never throws: every read failure refuses.
+ */
+export async function resolveParkedShortfallReuse(v, judgedSha, deps) {
+    const decided = await decideForDelivery(v, judgedSha, deps);
+    if (decided === null)
+        return null;
+    const { park, decision } = decided;
+    if (!decision.reuse) {
+        log.debug(`[verification] delivery "${v.deliveryName}" (${v.deliveryId}) is parked but re-judged this dispatch ` +
+            `(${decision.refusal}); the reconciliation runs`);
+        return null;
+    }
+    log.info(`[verification] delivery "${v.deliveryName}" (${v.deliveryId}): re-holding the shortfall park recorded ` +
+        `${park.parkedAt} on commit set ${park.commitSet} -- unchanged commit set and rulings, so its ` +
+        `${decision.shortfalls.length} shortfall(s) are reused as judged and NO MODEL CALL WAS MADE ` +
+        `(no reconciliation this dispatch)`);
+    return {
+        restatements: [],
+        shortfalls: decision.shortfalls,
+        rulingsFingerprint: decision.rulingsFingerprint,
+        withheldNodeIds: [],
+        honored: [],
+        park,
+    };
+}
+//# sourceMappingURL=parked-shortfall-reuse.js.map

package/dist/verify/parked-shortfall-reuse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parked-shortfall-reuse.js","sourceRoot":"","sources":["../../src/verify/parked-shortfall-reuse.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,qEAAqE;AACrE,+DAA+D;AAC/D,8DAA8D;AAC9D,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAEH,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAsB,MAAM,qBAAqB,CAAC;AAC5G,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAMzE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAAG,oCAAoC,CAAC;AAoC5E,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAmB,EACnB,MAA4C;IAE5C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3B,8EAA8E;QAC9E,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,qDAAqD;QACrD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,2DAA2D;QAC3D,6EAA6E;QAC7E,6EAA6E;QAC7E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACvC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,iBAAiB,EAAE,CAAC,CAAC,QAAQ;YAC7B,iBAAiB,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACnE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACpD,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,gFAAgF;IAChF,oEAAoE;IACpE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,sBAAsB,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,CAAC;AAED,gGAAgG;AAChG,SAAS,sBAAsB,CAAC,GAAoB,EAAE,eAAuB;IAC3E,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,eAAe,CAAC;WAC9C,GAAG,CAAC,iBAAiB,KAAK,8BAA8B,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAA2B;IACpE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC/D,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5E,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACzF,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IACrF,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAC/F,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IACpG,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC3F,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC9G,MAAM,UAAU,GAAG,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACtF,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;AACzF,CAAC;AAkCD,gGAAgG;AAChG,KAAK,UAAU,aAAa,CAC1B,IAA8B,EAC9B,CAAsB,EACtB,SAAwB;IAExB,IAAI,CAAC,IAAI,CAAC,wBAAwB;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC9D,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,UAAU,sCAAsC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,sBAAsB,CAAC,IAA8B,EAAE,UAAkB;IACtF,IAAI,CAAC,IAAI,CAAC,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,kCAAkC,UAAU,mCAAmC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAClH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,cAAc,CAC3B,IAA8B,EAC9B,UAAkB;IAElB,IAAI,CAAC,IAAI,CAAC,sBAAsB;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,2BAA2B,UAAU,sCAAsC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC9G,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,CAAsB,EACtB,SAAwB,EACxB,IAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC1C,IAAI;QACJ,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,IAAI,IAAI;QAC1D,aAAa,EAAE,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC;QACzD,SAAS,EAAE,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC;QAClD,kBAAkB,EAAE,MAAM,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC;QACpE,eAAe,EAAE,CAAC,CAAC,eAAe;KACnC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,CAAsB,EACtB,SAAwB,EACxB,IAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5D,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,CAAsB,EACtB,SAAwB,EACxB,IAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CACP,4BAA4B,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,UAAU,0CAA0C;YACtG,IAAI,QAAQ,CAAC,OAAO,4BAA4B,CACjD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,GAAG,CAAC,IAAI,CACN,4BAA4B,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,UAAU,4CAA4C;QACxG,GAAG,IAAI,CAAC,QAAQ,kBAAkB,IAAI,CAAC,SAAS,+CAA+C;QAC/F,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,gEAAgE;QAC7F,mCAAmC,CACpC,CAAC;IACF,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,eAAe,EAAE,EAAE;QACnB,OAAO,EAAE,EAAE;QACX,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/verify/reselection-log.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Every path that can re-select a delivery already sitting in verify. A new path
+ * belongs here AND at a `logReselection` call site; the enumeration test fails
+ * on a member with no driver.
+ */
+export declare const RESELECTION_PATHS: readonly ["run-mark-prune", "run-mark-release", "commit-verdict-pull", "credit-rearm", "ruling-rearm", "pending-relisting", "model-unavailable-unmark", "checkout-unavailable-unmark"];
+/** One of {@link RESELECTION_PATHS}. */
+export type ReselectionPath = (typeof RESELECTION_PATHS)[number];
+/** Test-only: forget every de-duplicated line written so far. */
+export declare function __resetReselectionLogForTests(): void;
+/**
+ * Write the one line for this re-selection.
+ *
+ * `dedupeKey` is for a line that fires REPEATEDLY for the same (delivery,
+ * reason) WITHOUT re-selecting anything -- a DECLINED re-selection, e.g. a parked
+ * row the edge re-lists every tick. Pass it and the line is written once per
+ * (path, delivery, key). A line for a re-selection that happens -- a dispatch
+ * follows -- is never de-duplicated: the repetition IS the information (the
+ * incident's ~30 re-dispatches should have produced ~30 lines, not one).
+ */
+export declare function logReselection(path: ReselectionPath, deliveryId: string, detail: string, dedupeKey?: string): void;
+//# sourceMappingURL=reselection-log.d.ts.map

package/dist/verify/reselection-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reselection-log.d.ts","sourceRoot":"","sources":["../../src/verify/reselection-log.ts"],"names":[],"mappings":"AA0CA;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,wLAiBpB,CAAC;AAEX,wCAAwC;AACxC,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKjE,iEAAiE;AACjE,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CAON"}

package/dist/verify/reselection-log.js

@@ -0,0 +1,87 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/explicit-row-selection.test.ts,
+//   packages/daemon/src/verify/reselection-log.test.ts,
+//   packages/daemon/src/verify/verification-default-on.test.ts
+// PINNED-BY-END
+/**
+ * ONE line per re-selection of a delivery sitting in verify, naming the PATH
+ * that re-selected it.
+ *
+ * Why this module exists. On 2026-09-24 delivery 8ae80225 sat parked in verify
+ * at an unchanged focus HEAD (88cd9d77) and was re-dispatched every ~60s for
+ * ~30 ticks. Every tick logged the dispatch ("takes the 'passed' verdict
+ * recorded for focus HEAD 88cd9d77") and, ~28s later, its outcome -- and NOTHING
+ * said why the delivery had been selected again. The five paths that re-arm a
+ * delivery either log per FOCUS (credit-rearm), log nothing at all
+ * (pruneGuardsOutsideVerify -- which turned out to be the one at fault), or log
+ * in their own private shape. So the re-dispatch could not be attributed from
+ * ~/.telora/daemon.log: the incident had to be reasoned out of the source.
+ *
+ * The rule: a delivery whose guards are dropped is a delivery that WILL be
+ * selected again, and exactly one line says which path dropped them. The path
+ * names are an exported const union, so the shape cannot drift and a path added
+ * later without a log line is a visible hole (verify/reselection-log.test.ts
+ * enumerates the union).
+ *
+ * WHO LOGS. Each path logs at its OWN call site, because only there is the
+ * reason known. The guard mutators in verify/default-on-guards.ts are the
+ * fallback, not a second voice: `releaseDefaultOnMark(id)` called with no path
+ * logs 'run-mark-release', and called WITH a path stays silent so the caller's
+ * own richer line stands alone.
+ *
+ * A line is only written when something was actually dropped -- a release that
+ * found no mark suppressed nothing and re-selected nothing.
+ *
+ * @module verify/reselection-log
+ */
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'verification' });
+/**
+ * Every path that can re-select a delivery already sitting in verify. A new path
+ * belongs here AND at a `logReselection` call site; the enumeration test fails
+ * on a member with no driver.
+ */
+export const RESELECTION_PATHS = [
+    /** The default-on scan no longer observed the delivery in verify (default-on-guards.ts pruneGuardsOutsideVerify). */
+    'run-mark-prune',
+    /** The run mark was dropped by a caller that named no path of its own (default-on-guards.ts releaseDefaultOnMark). */
+    'run-mark-release',
+    /** A route held for a verdict on the current HEAD pulled the run (commit-verdict-pull.ts). */
+    'commit-verdict-pull',
+    /** The focus's commit-credit set changed, so the same commit is judged again (credit-rearm.ts). */
+    'credit-rearm',
+    /** An operator ruling released a shortfall park (shortfall-rulings.ts rearmRuledShortfallParks). */
+    'ruling-rearm',
+    /** The edge re-listed an explicit-method row in the pending queue (verification-engine.ts). */
+    'pending-relisting',
+    /** The reconciliation's model could not be reached: no verdict to guard (default-on-guards.ts noteDefaultOnResult). */
+    'model-unavailable-unmark',
+    /** No checkout could be made, or the verdict was discarded mid-run (default-on-guards.ts noteDefaultOnResult). */
+    'checkout-unavailable-unmark',
+];
+/** `${path}@${deliveryId}@${dedupeKey}` triples already written. */
+const written = new Set();
+/** Test-only: forget every de-duplicated line written so far. */
+export function __resetReselectionLogForTests() {
+    written.clear();
+}
+/**
+ * Write the one line for this re-selection.
+ *
+ * `dedupeKey` is for a line that fires REPEATEDLY for the same (delivery,
+ * reason) WITHOUT re-selecting anything -- a DECLINED re-selection, e.g. a parked
+ * row the edge re-lists every tick. Pass it and the line is written once per
+ * (path, delivery, key). A line for a re-selection that happens -- a dispatch
+ * follows -- is never de-duplicated: the repetition IS the information (the
+ * incident's ~30 re-dispatches should have produced ~30 lines, not one).
+ */
+export function logReselection(path, deliveryId, detail, dedupeKey) {
+    if (dedupeKey !== undefined) {
+        const key = `${path}@${deliveryId}@${dedupeKey}`;
+        if (written.has(key))
+            return;
+        written.add(key);
+    }
+    log.info(`[verification] re-selection (${path}): delivery ${deliveryId} -- ${detail}`);
+}
+//# sourceMappingURL=reselection-log.js.map

package/dist/verify/reselection-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reselection-log.js","sourceRoot":"","sources":["../../src/verify/reselection-log.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wEAAwE;AACxE,wDAAwD;AACxD,+DAA+D;AAC/D,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qHAAqH;IACrH,gBAAgB;IAChB,sHAAsH;IACtH,kBAAkB;IAClB,8FAA8F;IAC9F,qBAAqB;IACrB,mGAAmG;IACnG,cAAc;IACd,oGAAoG;IACpG,cAAc;IACd,+FAA+F;IAC/F,mBAAmB;IACnB,uHAAuH;IACvH,0BAA0B;IAC1B,kHAAkH;IAClH,6BAA6B;CACrB,CAAC;AAKX,oEAAoE;AACpE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;AAElC,iEAAiE;AACjE,MAAM,UAAU,6BAA6B;IAC3C,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAqB,EACrB,UAAkB,EAClB,MAAc,EACd,SAAkB;IAElB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,gCAAgC,IAAI,eAAe,UAAU,OAAO,MAAM,EAAE,CAAC,CAAC;AACzF,CAAC"}