@telora/daemon 0.22.245 → 0.22.290

package/dist/verify/effect-reconciliation/judge-workspace.js

@@ -0,0 +1,239 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/effect-reconciliation/judge-checkout.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/judge-invoker.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/judge-isolation.live.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/judge-tool-guard.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/judge-workspace.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/verify-reconciliation.test.ts,
+//   packages/daemon/src/verify/inspection-strategies/ai-inspection-pinned-change.test.ts,
+//   packages/daemon/src/verify/inspection-strategies/verification-strategies.test.ts
+// PINNED-BY-END
+/**
+ * The judge's workspace: an EXPORT of the judged commit's tree, and the rule
+ * that resolves what a verdict cites.
+ *
+ * Verify's model judges are not handed the delivery's diff. They are handed the
+ * question (the declared future), the commit range, the changed-file list and
+ * the diff stat, and read what they need with Read, Grep and Glob from an export
+ * of the judged commit's tree -- never the live focus worktree, which a team may
+ * be writing -- and, beside it, an export of the BASE tree (the state before the
+ * delivery's change) to compare against. Each export is files only: no `.git`,
+ * no object database (verify/effect-reconciliation/judge-checkout.ts
+ * exportCommitTree), so no commit but the one exported is reachable from it,
+ * by construction rather than by parsing what the judge asks for. Both are
+ * READ-ONLY on disk for the judgement and removed after it. So what a
+ * judgement costs is bounded by what it is asked, not by how much code changed.
+ * The range still covers the delivery's recorded commits (the completeness
+ * rule, verify/effect-reconciliation/verification-evidence.ts
+ * assessRecordedCoverage); what completeness means is "the judge can reach all
+ * of it", not "every byte was in the prompt".
+ *
+ * Every verdict CITES what it rests on, and a citation counts only when it
+ * RESOLVES at the judged commit. The daemon resolves it in the SOURCE
+ * repository's objects, through the one hermetic reader a review met's
+ * evidence resolves through too (verify/shortfalls/ruling-evidence-resolution.ts:
+ * no inherited GIT_DIR, config or replacement redirects it). The grammar:
+ *   - `path`, `path:LINE`, `path::test name` -- the one evidence grammar
+ *     (drift/artifact-ref-shape.ts parseEvidenceRef), resolved by existence;
+ *   - `grep:<count>:<regex>` -- the TREE CHECK: the daemon RUNS `git grep -E`
+ *     over the whole judged tree and the citation holds only when exactly
+ *     <count> lines match (what it found is named in the reason when it does
+ *     not hold).
+ * A declared future that is a claim about the whole tree is judged from a
+ * tree check the judge cites, never from a slice of the diff. Whether a
+ * declaration IS such a claim cannot be read reliably, so EVERY verdict of
+ * either judge must rest on at least one grep: check AND at least one concrete
+ * file, line or test citation (`citationShapeGaps`). The daemon confirms each
+ * cited check resolves; whether it ESTABLISHES the claim is the judge's
+ * judgement, as it is for every other target: the judge is a model the daemon
+ * runs, not an adversary (docs/daemon/history-verify.md). A check the daemon does
+ * not itself evaluate is no tree check: an npm script's NAME existing says
+ * nothing about whether it passes, so `script:` citations are refused by name.
+ *
+ * @module verify/effect-reconciliation/judge-workspace
+ */
+import { existsSync, mkdirSync, rmSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parseEvidenceRef } from '../../drift/artifact-ref-shape.js';
+import { countMatchingLinesAtCommit, resolveEvidenceRefsAtCommit, } from '../shortfalls/ruling-evidence-resolution.js';
+import { createLogger } from '../../log/daemon-log.js';
+import { commitOf, exportCommitTree, hermeticGit, judgeBaseDir, setCheckoutWritable } from './judge-checkout.js';
+const log = createLogger({ module: 'verification' });
+/** A tree-wide grep check: `grep:<count>:<regex>`. */
+const GREP_CHECK = /^grep:(\d{1,7}):(.+)$/s;
+/** A named check nothing evaluates (an npm script by name): refused, with the reason. */
+const UNEVALUATED_CHECK = /^script:/;
+/** Whether a citation is a TREE CHECK (grep:), the only kind a whole-tree claim may rest on. Pure. */
+export function isTreeCheckCitation(ref) {
+    return GREP_CHECK.test(ref.trim());
+}
+/** Whether a citation names a concrete file, line or test (the one evidence grammar, not a check). Pure. */
+function isConcreteCitation(ref) {
+    const r = ref.trim();
+    return !GREP_CHECK.test(r) && !UNEVALUATED_CHECK.test(r) && parseEvidenceRef(r) !== null;
+}
+/**
+ * What keeps a verdict's citations from vouching for it whatever they resolve to
+ * (module header): no concrete file / line / test citation, or no grep: check.
+ * Empty when both are present. Pure.
+ */
+export function citationShapeGaps(citations) {
+    const gaps = [];
+    if (!citations.some(isConcreteCitation)) {
+        gaps.push({ ref: '(no concrete citation)', reason: 'every verdict must name the file, line or test it rests on' });
+    }
+    if (!citations.some(isTreeCheckCitation)) {
+        gaps.push({
+            ref: '(no tree check)',
+            reason: 'every verdict must rest on at least one grep: check the daemon runs -- a whole-tree claim on the check that establishes it',
+        });
+    }
+    return gaps;
+}
+/** Resolve a grep check: null when the tree at `sha` has exactly the cited count of matching lines. */
+async function resolveGrepCheck(repoPath, sha, count, regex) {
+    const found = await countMatchingLinesAtCommit(repoPath, sha, regex);
+    if (typeof found === 'string')
+        return `git grep for /${regex}/ failed at ${sha.slice(0, 12)} (${found})`;
+    return found === count ? null : `/${regex}/ matches ${found} line(s) at ${sha.slice(0, 12)}, not the cited ${count}`;
+}
+/**
+ * Resolve a verdict's citations at `sha` in the repository at `repoPath`
+ * (module header grammar): the ones that did NOT resolve, each with its reason.
+ * An empty citation list resolves nothing and is reported as such. Never throws.
+ */
+export async function resolveJudgeCitations(repoPath, sha, refs) {
+    if (refs.length === 0)
+        return [{ ref: '(no citation)', reason: 'the verdict cites nothing it rests on' }];
+    const out = [];
+    const paths = [];
+    for (const raw of refs) {
+        const ref = raw.trim();
+        const grep = GREP_CHECK.exec(ref);
+        let reason = null;
+        if (grep)
+            reason = await resolveGrepCheck(repoPath, sha, Number(grep[1]), grep[2] ?? '');
+        else if (UNEVALUATED_CHECK.test(ref))
+            reason = 'a named script is not evaluated by the daemon: cite a grep: check it can run';
+        else {
+            const parsed = parseEvidenceRef(ref);
+            if (parsed)
+                paths.push(parsed);
+            else
+                reason = "not a citation ('path', 'path:LINE', 'path::test name' or 'grep:<count>:<regex>')";
+        }
+        if (reason !== null)
+            out.push({ ref, reason });
+    }
+    return [...out, ...(paths.length > 0 ? await resolveEvidenceRefsAtCommit(repoPath, paths, sha) : [])];
+}
+/** Remove an export (writable again first), and what an older daemon left at the same key: its git directory beside it. */
+function removeExport(dir) {
+    for (const d of [dir, `${dir}.git`]) {
+        setCheckoutWritable(d, true);
+        if (existsSync(d))
+            rmSync(d, { recursive: true, force: true });
+    }
+}
+/**
+ * The delivery's range as the judge is given it: CONCRETE, in commits, ending at
+ * the judged commit -- never a branch name or a symbolic HEAD, which would name
+ * state other than the commit being judged. Each `A...B` / `A..B` part becomes
+ * `<merge-base>..<B>` (B = the judged sha when it is HEAD or empty); each bare
+ * commit is resolved. A part that cannot be resolved leaves just the judged
+ * commit, and says so. Read with hermetic git (judge-checkout.ts).
+ */
+export function concreteJudgeRange(repoPath, range, sha) {
+    const parts = range.split(/\s+/).filter((p) => p !== '');
+    const out = [];
+    for (const part of parts) {
+        const m = /^(.*?)(\.\.\.?)(.*)$/.exec(part);
+        const to = !m ? commitOf(repoPath, part) : (m[3] === '' || m[3] === 'HEAD' ? sha : commitOf(repoPath, m[3]));
+        const from = m ? (m[1] === '' || m[1] === 'HEAD' ? sha : commitOf(repoPath, m[1])) : null;
+        const base = from && to ? hermeticGit(['merge-base', from, to], repoPath) : null;
+        if (!to || (m && !base?.success)) {
+            log.warn(`judge checkout: range part "${part}" could not be resolved at ${sha.slice(0, 12)}; the judge is given the judged commit only`);
+            return sha;
+        }
+        out.push(m && base ? `${base.output.trim()}..${to}` : to);
+    }
+    return out.length > 0 ? out.join(' ') : sha;
+}
+/**
+ * The commit the delivery's change starts from: the start of the range's first
+ * part (`X..Y` -> X, already concrete), or the first listed commit's parent.
+ * Null when there is none (a root commit). Pure over git reads.
+ */
+function rangeBase(repoPath, range, sha) {
+    const first = range.split(/\s+/).find((p) => p !== '') ?? sha;
+    const m = /^(.*?)\.\.\.?/.exec(first);
+    return m ? commitOf(repoPath, m[1] || sha) : commitOf(repoPath, `${first}^`);
+}
+/**
+ * The exports of `sha` -- or, when null, of `repoPath`'s HEAD read now -- and of
+ * the delivery's base, for one judgement (module header), keyed by `key` (a
+ * delivery judges once at a time). A leftover from a crashed run at the same
+ * path is removed first. Its range is the concrete one (concreteJudgeRange).
+ * Returns null when the judged tree cannot be exported -- the caller holds
+ * rather than judging the live worktree. A base that cannot be exported leaves
+ * the judge the judged tree alone, and says so.
+ */
+export function createJudgeWorkspace(repoPath, key, judgedSha, range, deps) {
+    const sha = commitOf(repoPath, judgedSha ?? 'HEAD');
+    if (!sha) {
+        log.warn(`judge checkout: cannot read ${judgedSha ?? 'HEAD'} in ${repoPath}`);
+        return null;
+    }
+    const checkoutPath = resolve(deps.checkoutRoot, `judge-${key.replace(/[^a-zA-Z0-9._-]/g, '_')}`);
+    const baseDir = judgeBaseDir(checkoutPath);
+    const workspaceRange = concreteJudgeRange(repoPath, range, sha);
+    let basePath = null;
+    try {
+        mkdirSync(deps.checkoutRoot, { recursive: true });
+        removeExport(checkoutPath);
+        removeExport(baseDir);
+        const failed = exportCommitTree(repoPath, sha, checkoutPath);
+        if (failed) {
+            log.warn(`judge checkout: ${failed}`);
+            removeExport(checkoutPath);
+            return null;
+        }
+        const base = rangeBase(repoPath, workspaceRange, sha);
+        const baseFailed = base ? exportCommitTree(repoPath, base, baseDir) : 'no base commit';
+        if (baseFailed)
+            log.warn(`judge checkout: no base tree beside ${sha.slice(0, 12)} (${baseFailed}); the judge reads the judged tree alone`);
+        else
+            basePath = baseDir;
+    }
+    catch (err) {
+        log.warn(`judge checkout: setup failed at ${checkoutPath}: ${err.message}`);
+        try {
+            removeExport(checkoutPath);
+            removeExport(baseDir);
+        }
+        catch { /* the next judgement at this key removes it first */ }
+        return null;
+    }
+    let disposed = false;
+    return {
+        checkoutPath,
+        basePath,
+        sourceRepo: repoPath,
+        sha,
+        range: workspaceRange,
+        resolveCitations: (refs) => resolveJudgeCitations(repoPath, sha, refs),
+        dispose: () => {
+            if (disposed)
+                return;
+            disposed = true;
+            try {
+                removeExport(checkoutPath);
+                removeExport(baseDir);
+            }
+            catch (err) {
+                log.warn(`judge checkout: removal failed at ${checkoutPath}: ${err.message}`);
+            }
+        },
+    };
+}
+//# sourceMappingURL=judge-workspace.js.map

package/dist/verify/effect-reconciliation/judge-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge-workspace.js","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/judge-workspace.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,sFAAsF;AACtF,4EAA4E;AAC5E,mFAAmF;AACnF,+EAA+E;AAC/E,8EAA8E;AAC9E,oFAAoF;AACpF,0FAA0F;AAC1F,qFAAqF;AACrF,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,mCAAmC,CAAC;AACvF,OAAO,EACL,0BAA0B,EAAE,2BAA2B,GACxD,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEjH,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD,sDAAsD;AACtD,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,yFAAyF;AACzF,MAAM,iBAAiB,GAAG,UAAU,CAAC;AA0BrC,sGAAsG;AACtG,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACrC,CAAC;AAKD,4GAA4G;AAC5G,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAA4B;IAC5D,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC;YACR,GAAG,EAAE,iBAAiB;YACtB,MAAM,EAAE,4HAA4H;SACrI,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa,EAAE,KAAa;IACzF,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,iBAAiB,KAAK,eAAe,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC;IACzG,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,KAAK,eAAe,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,KAAK,EAAE,CAAC;AACvH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB,EAAE,GAAW,EAAE,IAAuB;IAChG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAC1G,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,IAAI;YAAE,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aACpF,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,8EAA8E,CAAC;aACzH,CAAC;YACJ,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;gBAC1B,MAAM,GAAG,mFAAmF,CAAC;QACpG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,2BAA2B,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,2HAA2H;AAC3H,SAAS,YAAY,CAAC,GAAW;IAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC;QACpC,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,KAAa,EAAE,GAAW;IAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,+BAA+B,IAAI,8BAA8B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6CAA6C,CAAC,CAAC;YACzI,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,QAAgB,EAAE,KAAa,EAAE,GAAW;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,GAAG,CAAC;IAC9D,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,GAAW,EACX,SAAwB,EACxB,KAAa,EACb,IAAwB;IAExB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,IAAI,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,+BAA+B,SAAS,IAAI,MAAM,OAAO,QAAQ,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3B,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;YACtC,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACvF,IAAI,UAAU;YAAE,GAAG,CAAC,IAAI,CAAC,uCAAuC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,UAAU,0CAA0C,CAAC,CAAC;;YACtI,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,mCAAmC,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC;YAAC,YAAY,CAAC,YAAY,CAAC,CAAC;YAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;QAC1H,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,UAAU,EAAE,QAAQ;QACpB,GAAG;QACH,KAAK,EAAE,cAAc;QACrB,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;QACtE,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBACH,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,YAAY,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,qCAAqC,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/verify/effect-reconciliation/recorded-targets.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Report the targets a verify run did NOT hold its delivery to: named in the
+ * daemon log, and RECORDED on the delivery's gate_state, where an operator and a
+ * later pass can read them.
+ *
+ * An arm covers the effects the focus held when the human said go, and the verify
+ * reconciliation narrows what it judges to those (verify/effect-reconciliation/verify-restatement.ts
+ * narrowToArmCoverage, over queries/focuses/arm-covered-targets.ts). A target added after
+ * the arm produces no shortfall, no hold and no re-work issue -- it waits for the
+ * next arm. That is the intended behaviour, but an intended silence and an
+ * accidental one read identically: a gate that sets work aside without recording
+ * it is indistinguishable from a gate that never saw the work. So the set is
+ * stated at the same altitude as the verdict (the log) AND kept where the verdict
+ * is kept (the delivery row), because a log line does not survive the run and
+ * cannot be read by the next pass.
+ *
+ * WHEN THE WRITE HAPPENS. Last, after the run's own gate_state writers have
+ * settled (the shortfall hold, the evidence-unavailable re-work, the
+ * deterministic failure feedback, and the pass's history reset all rewrite the
+ * gate). Writing earlier would hand those writers a gate_state they did not read
+ * this record from, and the record would be dropped by the very run that made it.
+ * Written last, it stamps ONLY its own key over the FRESH row in the delivery's
+ * serialized write turn (queries/deliveries/deliveries.ts
+ * rewriteDeliveryGateStateAtOwnStatus), at the row's own status, so it never
+ * moves a delivery and never erases what those writers left.
+ *
+ * WHAT CHANGES IT. Only a reconciliation's own result: a run that reconciled
+ * records what it set aside, or removes a record it no longer sets aside (the
+ * next arm covered those targets, so a standing record would lie). A run that
+ * never reconciled -- a deterministic failure, a security-gate demotion, a
+ * delivery that left verify -- leaves the record exactly as it stands: it learned
+ * nothing about coverage, and silence is not an answer.
+ *
+ * Its lifetime is the gate's. It is a record of THIS gate, so it clears with the
+ * rest of gate_state when the delivery finally routes -- the same lifetime as the
+ * verdict it qualifies.
+ *
+ * @module verify/effect-reconciliation/recorded-targets
+ */
+import { type DeliveryGateRowIo } from '../../queries/deliveries/deliveries.js';
+import { type DeliveryGateState } from '../../queries/delivery-gate-state/delivery-gate-state.js';
+import { type RecordedTargetsRecord } from '../../queries/delivery-gate-state/recorded-targets-record.js';
+/** The delivery a verify run is reporting about, and the injection it verified. */
+export interface RecordedTargetsSubject {
+    deliveryId: string;
+    injectionNodeId: string | null;
+}
+/** The durable write's row IO and clock, bound at the composition root (composition/verification-context.ts). */
+export interface RecordedTargetsWriteDeps extends DeliveryGateRowIo {
+    now: () => string;
+}
+/**
+ * Persist a verify run's set-aside targets on its delivery's gate_state
+ * (verify/effect-reconciliation/recorded-targets.ts). Bound in composition/verification-context.ts; a test binds its own.
+ */
+export type RecordedTargetsPersist = (deliveryId: string, injectionNodeId: string | null, nodeIds: string[]) => Promise<unknown>;
+/** The recorded-targets record `gateState` carries; null when absent or malformed. Pure. */
+export declare function readRecordedTargets(gateState: unknown): RecordedTargetsRecord | null;
+/**
+ * `gateState` with its recorded targets REPLACED: set to `recorded` when the run
+ * set targets aside, removed when it set none aside, so a stale set never stands
+ * for a newer run. Every other key is untouched, and a gate left holding nothing
+ * is null. A record stamped on a null gate_state rides beside an EMPTY `blocking`
+ * array, like carried history, so it is never read as a live block. Pure.
+ */
+export declare function stampRecordedTargets(gateState: unknown, recorded: RecordedTargetsRecord | null): DeliveryGateState | null;
+/**
+ * Record on the delivery's gate_state the targets its verify run set aside --
+ * `nodeIds`, of the injection `injectionNodeId` -- or REMOVE the standing record
+ * when the run set none aside.
+ *
+ * Reads the row FRESH and writes it at the row's OWN status inside one serialized
+ * write turn (see the module header), so the gate-only write never moves the
+ * delivery and never carries a stale copy of what another writer left. Nothing is
+ * written when the record would not change, when there is no record to remove, or
+ * for a delivery that is not found, done or cancelled. Best-effort: never throws
+ * -- a record that failed to land holds nothing and is written by the next run.
+ * Returns whether a write landed.
+ */
+export declare function persistRecordedTargets(deliveryId: string, injectionNodeId: string | null, nodeIds: readonly string[], deps: RecordedTargetsWriteDeps): Promise<boolean>;
+/**
+ * Name the targets the arm did NOT cover, so narrowing what verify judges never
+ * looks like losing track of it.
+ *
+ * Targets recorded after the arm produce no shortfall, no hold and no re-work
+ * issue -- they wait for the next arm. That is the intended behaviour, but an
+ * intended silence and an accidental one read identically in a log, so the
+ * reconciliation reports the set and this states it at the same altitude as the
+ * verdict.
+ */
+export declare function logRecordedTargets(v: RecordedTargetsSubject, recordedTargetNodeIds: readonly string[]): void;
+/**
+ * Report a verify run's set-aside targets: state them in the log, then record
+ * them on the delivery (see the module header).
+ *
+ * `recordedTargetNodeIds` is null when NO reconciliation ran, and the record is
+ * then left exactly as it stands -- this run learned nothing about coverage. An
+ * empty array is an answer: the run reconciled and set nothing aside, so a
+ * standing record is removed. `persist` is the durable writer (the composition
+ * root binds persistRecordedTargets). Best-effort: never
+ * throws, so reporting never demotes a rendered verdict.
+ */
+export declare function reportRecordedTargets(v: RecordedTargetsSubject, recordedTargetNodeIds: string[] | null, persist: RecordedTargetsPersist): Promise<void>;
+//# sourceMappingURL=recorded-targets.d.ts.map

package/dist/verify/effect-reconciliation/recorded-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorded-targets.d.ts","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/recorded-targets.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAuC,KAAK,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AACrH,OAAO,EAAE,KAAK,iBAAiB,EAAgB,MAAM,0DAA0D,CAAC;AAChH,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,8DAA8D,CAAC;AAKhI,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,iHAAiH;AACjH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,OAAO,EAAE,MAAM,EAAE,KACd,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,4FAA4F;AAC5F,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAKpF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,qBAAqB,GAAG,IAAI,GACrC,iBAAiB,GAAG,IAAI,CAW1B;AAcD;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,EAAE,sBAAsB,EACzB,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,IAAI,CAON;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,CAAC,EAAE,sBAAsB,EACzB,qBAAqB,EAAE,MAAM,EAAE,GAAG,IAAI,EACtC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/verify/effect-reconciliation/recorded-targets.js

@@ -0,0 +1,158 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/composition/subsystem-contexts.test.ts,
+//   packages/daemon/src/composition/verification-context.test.ts,
+//   packages/daemon/src/queries/deliveries/delivery-gate-record-wire-parity.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/recorded-targets.test.ts
+// PINNED-BY-END
+/**
+ * Report the targets a verify run did NOT hold its delivery to: named in the
+ * daemon log, and RECORDED on the delivery's gate_state, where an operator and a
+ * later pass can read them.
+ *
+ * An arm covers the effects the focus held when the human said go, and the verify
+ * reconciliation narrows what it judges to those (verify/effect-reconciliation/verify-restatement.ts
+ * narrowToArmCoverage, over queries/focuses/arm-covered-targets.ts). A target added after
+ * the arm produces no shortfall, no hold and no re-work issue -- it waits for the
+ * next arm. That is the intended behaviour, but an intended silence and an
+ * accidental one read identically: a gate that sets work aside without recording
+ * it is indistinguishable from a gate that never saw the work. So the set is
+ * stated at the same altitude as the verdict (the log) AND kept where the verdict
+ * is kept (the delivery row), because a log line does not survive the run and
+ * cannot be read by the next pass.
+ *
+ * WHEN THE WRITE HAPPENS. Last, after the run's own gate_state writers have
+ * settled (the shortfall hold, the evidence-unavailable re-work, the
+ * deterministic failure feedback, and the pass's history reset all rewrite the
+ * gate). Writing earlier would hand those writers a gate_state they did not read
+ * this record from, and the record would be dropped by the very run that made it.
+ * Written last, it stamps ONLY its own key over the FRESH row in the delivery's
+ * serialized write turn (queries/deliveries/deliveries.ts
+ * rewriteDeliveryGateStateAtOwnStatus), at the row's own status, so it never
+ * moves a delivery and never erases what those writers left.
+ *
+ * WHAT CHANGES IT. Only a reconciliation's own result: a run that reconciled
+ * records what it set aside, or removes a record it no longer sets aside (the
+ * next arm covered those targets, so a standing record would lie). A run that
+ * never reconciled -- a deterministic failure, a security-gate demotion, a
+ * delivery that left verify -- leaves the record exactly as it stands: it learned
+ * nothing about coverage, and silence is not an answer.
+ *
+ * Its lifetime is the gate's. It is a record of THIS gate, so it clears with the
+ * rest of gate_state when the delivery finally routes -- the same lifetime as the
+ * verdict it qualifies.
+ *
+ * @module verify/effect-reconciliation/recorded-targets
+ */
+import { rewriteDeliveryGateStateAtOwnStatus } from '../../queries/deliveries/deliveries.js';
+import { isEmptyClear } from '../../queries/delivery-gate-state/delivery-gate-state.js';
+import { parseRecordedTargets } from '../../queries/delivery-gate-state/recorded-targets-record.js';
+import { createLogger } from '../../log/daemon-log.js';
+const log = createLogger({ module: 'verification' });
+/** The recorded-targets record `gateState` carries; null when absent or malformed. Pure. */
+export function readRecordedTargets(gateState) {
+    const gate = gateState != null && typeof gateState === 'object' && !Array.isArray(gateState)
+        ? gateState
+        : null;
+    return parseRecordedTargets(gate?.recordedTargets);
+}
+/**
+ * `gateState` with its recorded targets REPLACED: set to `recorded` when the run
+ * set targets aside, removed when it set none aside, so a stale set never stands
+ * for a newer run. Every other key is untouched, and a gate left holding nothing
+ * is null. A record stamped on a null gate_state rides beside an EMPTY `blocking`
+ * array, like carried history, so it is never read as a live block. Pure.
+ */
+export function stampRecordedTargets(gateState, recorded) {
+    const gate = gateState != null && typeof gateState === 'object' && !Array.isArray(gateState)
+        ? gateState
+        : null;
+    let next;
+    if (gate)
+        next = { ...gate };
+    else if (recorded)
+        next = { blocking: [], warnings: [], evaluatedAt: recorded.recordedAt };
+    else
+        return null;
+    delete next.recordedTargets;
+    if (recorded)
+        next.recordedTargets = recorded;
+    return isEmptyClear(next) ? null : next;
+}
+/** Whether a standing record already states exactly this run's set-aside targets. Pure. */
+function alreadyRecorded(standing, injectionNodeId, nodeIds) {
+    return standing !== null
+        && standing.injectionNodeId === injectionNodeId
+        && standing.nodeIds.length === nodeIds.length
+        && standing.nodeIds.every((id, i) => id === nodeIds[i]);
+}
+/**
+ * Record on the delivery's gate_state the targets its verify run set aside --
+ * `nodeIds`, of the injection `injectionNodeId` -- or REMOVE the standing record
+ * when the run set none aside.
+ *
+ * Reads the row FRESH and writes it at the row's OWN status inside one serialized
+ * write turn (see the module header), so the gate-only write never moves the
+ * delivery and never carries a stale copy of what another writer left. Nothing is
+ * written when the record would not change, when there is no record to remove, or
+ * for a delivery that is not found, done or cancelled. Best-effort: never throws
+ * -- a record that failed to land holds nothing and is written by the next run.
+ * Returns whether a write landed.
+ */
+export async function persistRecordedTargets(deliveryId, injectionNodeId, nodeIds, deps) {
+    const { now } = deps;
+    try {
+        const written = await rewriteDeliveryGateStateAtOwnStatus(deliveryId, (row) => {
+            const standing = readRecordedTargets(row.gateState);
+            if (nodeIds.length === 0)
+                return standing ? stampRecordedTargets(row.gateState, null) : undefined;
+            if (alreadyRecorded(standing, injectionNodeId, nodeIds))
+                return undefined;
+            return stampRecordedTargets(row.gateState, { injectionNodeId, nodeIds: [...nodeIds], recordedAt: now() });
+        }, { io: deps });
+        return written === 'written';
+    }
+    catch (err) {
+        log.warn(`[verification] failed to record the targets the arm did not cover for delivery ${deliveryId}:`, err.message);
+        return false;
+    }
+}
+/**
+ * Name the targets the arm did NOT cover, so narrowing what verify judges never
+ * looks like losing track of it.
+ *
+ * Targets recorded after the arm produce no shortfall, no hold and no re-work
+ * issue -- they wait for the next arm. That is the intended behaviour, but an
+ * intended silence and an accidental one read identically in a log, so the
+ * reconciliation reports the set and this states it at the same altitude as the
+ * verdict.
+ */
+export function logRecordedTargets(v, recordedTargetNodeIds) {
+    if (recordedTargetNodeIds.length === 0)
+        return;
+    log.info(`[verification] injection ${v.injectionNodeId} carries ${recordedTargetNodeIds.length} ` +
+        `target(s) the focus's arm did not cover -- recorded, not judged, and not held against ` +
+        `delivery ${v.deliveryId}; they run on the next arm: ${recordedTargetNodeIds.join(', ')}`);
+}
+/**
+ * Report a verify run's set-aside targets: state them in the log, then record
+ * them on the delivery (see the module header).
+ *
+ * `recordedTargetNodeIds` is null when NO reconciliation ran, and the record is
+ * then left exactly as it stands -- this run learned nothing about coverage. An
+ * empty array is an answer: the run reconciled and set nothing aside, so a
+ * standing record is removed. `persist` is the durable writer (the composition
+ * root binds persistRecordedTargets). Best-effort: never
+ * throws, so reporting never demotes a rendered verdict.
+ */
+export async function reportRecordedTargets(v, recordedTargetNodeIds, persist) {
+    if (recordedTargetNodeIds === null)
+        return;
+    logRecordedTargets(v, recordedTargetNodeIds);
+    try {
+        await persist(v.deliveryId, v.injectionNodeId, recordedTargetNodeIds);
+    }
+    catch (err) {
+        log.warn(`[verification] failed to report the targets the arm did not cover for delivery ${v.deliveryId}:`, err.message);
+    }
+}
+//# sourceMappingURL=recorded-targets.js.map

package/dist/verify/effect-reconciliation/recorded-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recorded-targets.js","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/recorded-targets.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,yEAAyE;AACzE,kEAAkE;AAClE,qFAAqF;AACrF,8EAA8E;AAC9E,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,mCAAmC,EAA0B,MAAM,wCAAwC,CAAC;AACrH,OAAO,EAA0B,YAAY,EAAE,MAAM,0DAA0D,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAA8B,MAAM,8DAA8D,CAAC;AAChI,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAuBrD,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB,CAAC,SAAkB;IACpD,MAAM,IAAI,GAAG,SAAS,IAAI,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1F,CAAC,CAAE,SAA2C;QAC9C,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAkB,EAClB,QAAsC;IAEtC,MAAM,IAAI,GAAG,SAAS,IAAI,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1F,CAAC,CAAE,SAA+B;QAClC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,IAAuB,CAAC;IAC5B,IAAI,IAAI;QAAE,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;SACxB,IAAI,QAAQ;QAAE,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;;QACtF,OAAO,IAAI,CAAC;IACjB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC5B,IAAI,QAAQ;QAAE,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;IAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,2FAA2F;AAC3F,SAAS,eAAe,CACtB,QAAsC,EACtC,eAA8B,EAC9B,OAA0B;IAE1B,OAAO,QAAQ,KAAK,IAAI;WACnB,QAAQ,CAAC,eAAe,KAAK,eAAe;WAC5C,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;WAC1C,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,eAA8B,EAC9B,OAA0B,EAC1B,IAA8B;IAE9B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC1E,OAAO,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjB,OAAO,OAAO,KAAK,SAAS,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,kFAAkF,UAAU,GAAG,EAC9F,GAAa,CAAC,OAAO,CACvB,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,CAAyB,EACzB,qBAAwC;IAExC,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/C,GAAG,CAAC,IAAI,CACN,4BAA4B,CAAC,CAAC,eAAe,YAAY,qBAAqB,CAAC,MAAM,GAAG;QACxF,wFAAwF;QACxF,YAAY,CAAC,CAAC,UAAU,+BAA+B,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,CAAyB,EACzB,qBAAsC,EACtC,OAA+B;IAE/B,IAAI,qBAAqB,KAAK,IAAI;QAAE,OAAO;IAC3C,kBAAkB,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,kFAAkF,CAAC,CAAC,UAAU,GAAG,EAChG,GAAa,CAAC,OAAO,CACvB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/verify/effect-reconciliation/retire-aware-restatement.d.ts

@@ -0,0 +1,73 @@
+import type { CallApiFn, AuthorRestatementFn } from './cascade-restatement.js';
+/**
+ * A node whose `frt_statement` should be authored from a verified/retired
+ * injection. `statement` is the original UDE text to restate; `injectionStatements`
+ * condition the prose.
+ */
+export interface RetiredInjectionCandidate {
+    nodeId: string;
+    /** The original (pre-flip) UDE text -- the thing to restate positively. */
+    statement: string;
+    /** Verified injection statement(s) that flipped this node, for conditioning. */
+    injectionStatements: string[];
+}
+export interface RetireAwareDeps {
+    callApi: CallApiFn;
+    /** Authors one positive future-state sentence; production binds de-restatement.ts authorRestatement. */
+    authorRestatement: AuthorRestatementFn;
+    /**
+     * Opt-in PROVENANCE-FREE FALLBACK (DEFAULTS OFF). When true, a blank
+     * `frt_statement` ACTIVE `desired_effect` node whose base `statement` is still
+     * problem-shaped but which has NO qualifying verified-injection history row is
+     * ALSO authored, conditioned on the TREE's verified/retired injection
+     * statements (tree-level conditioning, the same list for every fallback node).
+     *
+     * This is the historical-tail path: pre-instrumentation flips have neither a
+     * `reality_tree_node_history` row nor surviving `targets` edges, so the precise
+     * per-node history path drops them. Gated to the completed-focus BACKFILL scan
+     * (the CLI) only -- the active eager loop and the departed-focus catch-up call
+     * these helpers WITHOUT this flag, so going-forward per-injection authoring is
+     * never affected.
+     *
+     * Precedence: the precise per-node history path ALWAYS wins when a verified
+     * injection history row exists for the node; the fallback fires ONLY in its
+     * absence.
+     */
+    includeProvenanceFreeFallback?: boolean;
+}
+/**
+ * Find the retire-aware authoring candidates for one tree: `desired_effect`
+ * nodes with a blank `frt_statement` that a VERIFIED/RETIRED injection flipped
+ * (per node history) and whose base `statement` is still the raw pre-flip UDE
+ * text. Read-only -- no model calls, no writes. The dry-run preview and the
+ * write path share this selection so they never diverge.
+ *
+ * When `includeProvenanceFreeFallback` is set, a blank `desired_effect` node
+ * that is still problem-shaped but lacks any verified-injection history row is
+ * ALSO returned, conditioned on the tree's verified/retired injection
+ * statements (gathered once). The precise per-node history path still wins
+ * whenever provenance exists; the fallback fires only in its absence.
+ */
+export declare function findRetiredInjectionRestatementCandidates(treeId: string, deps: {
+    callApi: CallApiFn;
+    includeProvenanceFreeFallback?: boolean;
+}): Promise<RetiredInjectionCandidate[]>;
+/** authorRetiredInjectionRestatements with its author bound (index.ts binds de-restatement.ts authorRestatement). */
+export type RetiredInjectionAuthor = (treeId: string, deps: Omit<RetireAwareDeps, 'authorRestatement'>) => Promise<{
+    authored: string[];
+    skipped: string[];
+}>;
+/**
+ * Author missing `frt_statement` prose for the UDEs that verified/retired
+ * injections flipped on one tree. Delegates candidate selection to
+ * `findRetiredInjectionRestatementCandidates`, then authors one positive
+ * future-state sentence per candidate (injection-conditioned) and writes it via
+ * `reality_tree_node_update`.
+ *
+ * Best-effort per node; idempotent (already-authored nodes are not candidates).
+ */
+export declare function authorRetiredInjectionRestatements(treeId: string, deps: RetireAwareDeps): Promise<{
+    authored: string[];
+    skipped: string[];
+}>;
+//# sourceMappingURL=retire-aware-restatement.d.ts.map

package/dist/verify/effect-reconciliation/retire-aware-restatement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retire-aware-restatement.d.ts","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/retire-aware-restatement.ts"],"names":[],"mappings":"AAyDA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AA0B/E;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,SAAS,CAAC;IACnB,wGAAwG;IACxG,iBAAiB,EAAE,mBAAmB,CAAC;IACvC;;;;;;;;;;;;;;;;;OAiBG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;CACzC;AAyCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,yCAAyC,CAC7D,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,6BAA6B,CAAC,EAAE,OAAO,CAAA;CAAE,GACpE,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAiGtC;AAED,qHAAqH;AACrH,MAAM,MAAM,sBAAsB,GAAG,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,KAC7C,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAsCpD"}