@telora/daemon 0.23.17 → 0.23.21

package/dist/verify/effect-reconciliation/injection-stamp.js

@@ -1,42 +1,54 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: packages/daemon/src/verify/effect-reconciliation/stamp-withholds-recorded-targets.test.ts,
-//   packages/daemon/src/verify/engine/verification-commit-sharing.test.ts,
+// Pinned by: packages/daemon/src/integration/review-verdict-ruling-release.test.ts,
+//   packages/daemon/src/integration/shortfall-ruling-release.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/pending-injection-stamp.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/stamp-withholds-recorded-targets.test.ts,
 //   packages/daemon/src/verify/engine/verification-engine.test.ts
 // PINNED-BY-END
 /**
- * The injection stamp is a POST-VERDICT side effect, never part of the verdict.
+ * The injection stamp is a POST-VERDICT side effect, never part of the verdict,
+ * and it is applied when the delivery is DONE.
  *
- * When a verify run passes a delivery anchored to an injection, the daemon
- * stamps that injection verified (the reality_tree_verify_injection compound op)
- * and surfaces any inward drift the reconciliation found. A stamp failure never
- * demotes the PASS: demoting it would discard a rendered deterministic verdict
- * and re-queue the whole suite on the same HEAD.
- *
- * The verdict is recorded as rendered, whatever happens here:
- *   - the stamp is attempted once, in the run;
- *   - on failure it is logged, surfaced ONCE as a machine-lane observation (not
- *     as "no verdict"), and kept in a retry ledger;
- *   - each verification tick re-attempts ONLY the ledgered stamps -- never the
- *     suite -- with the same restatements and evidence the run authored, and
- *     emits the drift once a stamp lands;
- *   - a later verdict for the delivery supersedes its ledgered stamp: a newer
- *     pass stamps afresh, and a non-pass means the stamp no longer describes the
- *     delivery's work.
- * The ledger is in-process. After a restart (or once its attempts run out) the
- * stamp is still re-attempted by the durable safety nets, without the run's
- * restatements: the verify_linked_injection trigger on verify -> done
- * (guard/trigger-executor.ts) and the settle injection sweep
- * (completion/state-cascade/settle-injection-sweep.ts). So the tree does not stay unverified.
+ * A passing verify run authors the stamp of the injection its delivery is
+ * anchored to -- its restatements, the targets it withholds, its evidence -- but
+ * does not attempt it. The promotion gate verifies an injection only once every
+ * live delivery anchored to it is done (supabase/functions/_shared/injection-promotion-earned.ts),
+ * and verify judges a delivery while it is still in verify, ahead of its focus
+ * review. So:
+ *   - a pass RECORDS its stamp as pending, durably (pending-injection-stamp.ts):
+ *     nothing is attempted and nothing is filed;
+ *   - each verification tick reads every pending stamp's delivery. In verify (or
+ *     paused) the stamp waits, with no tick limit. Done: the stamp is applied with
+ *     the run's restatements, and inward drift is emitted for what it flipped. Any
+ *     other status (verify_failed, re-coding, cancelled, gone) means the verdict no
+ *     longer describes the delivery's work: the stamp is dropped;
+ *   - a later verdict for the delivery supersedes it: a newer pass records afresh,
+ *     a non-pass drops it;
+ *   - once done, a refusal because ANOTHER anchored delivery is not done keeps it
+ *     pending, unreported. Any other failure is surfaced once as a machine-lane
+ *     observation and retried, up to MAX_DONE_STAMP_FAILURES; after that the settle
+ *     injection sweep stamps the injection from its declared futures;
+ *   - the settle injection sweep (completion/state-cascade/settle-injection-sweep.ts)
+ *     applies a pending stamp in place of its declared-future writeback
+ *     (preferPendingStamp), so whichever reaches the injection first, it is judged
+ *     once, with the run's restatements.
+ * A stamp never demotes the PASS: demoting it would discard a rendered verdict and
+ * re-queue the suite on the same HEAD.
  *
  * History: docs/daemon/history-verify.md (verify/effect-reconciliation/injection-stamp.ts).
  *
  * @module verify/effect-reconciliation/injection-stamp
  */
-import { ESCALATION_DISPOSITIONS, ESCALATION_REASONS } from '@telora/daemon-core';
+import { DELIVERY_STATUS, ESCALATION_DISPOSITIONS, ESCALATION_REASONS } from '@telora/daemon-core';
+import { isUnearnedPromotionRefusal } from '../../queries/verification/verification.js';
 import { createLogger } from '../../log/daemon-log.js';
 const log = createLogger({ module: 'verification' });
-/** Ticks a ledgered stamp is re-attempted before only the durable safety nets remain. */
-export const MAX_STAMP_RETRIES = 10;
+/**
+ * Failed attempts on a DONE delivery's stamp before it is left to the settle
+ * sweep. Only a real failure counts: a refusal because another anchored
+ * delivery is not done is a wait, not a failure, and has no limit.
+ */
+export const MAX_DONE_STAMP_FAILURES = 10;
 /**
  * Everything this stamp must NOT promote: the operator-EXCUSED shortfall nodes
  * PLUS the targets the focus's arm did not cover.
@@ -55,8 +67,8 @@ export const MAX_STAMP_RETRIES = 10;
  * explicitly costs one array and is the only signal that survives a read the
  * edge could not make.
  *
- * Carried on the ledgered stamp like every other field, so the retries re-send
- * exactly what the run authored rather than a set recomputed later.
+ * Carried on the pending stamp like every other field, so the stamp applied at
+ * done sends exactly what the run authored rather than a set recomputed later.
  *
  * `recordedTargetNodeIds` is null when NO reconciliation ran -- the run learned
  * nothing about coverage, so it withholds nothing on that account. Pure.
@@ -72,11 +84,9 @@ export function stampWithheldNodeIds(excusedNodeIds, recordedTargetNodeIds) {
     }
     return out;
 }
-/** Failed stamps awaiting a stamp-only retry, by delivery id. */
-const ledger = new Map();
 /** Attempt the stamp, then surface inward drift for what it flipped. Throws when the stamp does. */
-async function applyStamp(deps, v, stamp) {
-    await deps.verifyInjection(v.injectionNodeId, stamp.restatements, stamp.evidence, stamp.withheldNodeIds);
+async function applyStamp(deps, injectionNodeId, stamp) {
+    await deps.verifyInjection(injectionNodeId, stamp.restatements, stamp.evidence, stamp.withheldNodeIds);
     // INWARD drift (TEL-3/TEL-4): a target stamped legitimate_divergence is a tree
     // CLAIM reality contradicted -- surfaced only after the flip landed, carrying the
     // tree's ORIGINAL claim. Best-effort: a failure here must not undo the flip.
@@ -92,84 +102,146 @@ async function applyStamp(deps, v, stamp) {
     if (diverged.length === 0)
         return;
     try {
-        await deps.emitInwardDrift(v.injectionNodeId, diverged, stamp.realityTreeId);
+        await deps.emitInwardDrift(injectionNodeId, diverged, stamp.realityTreeId);
     }
     catch (err) {
-        log.warn(`[verification] inward drift emit failed for ${v.injectionNodeId}:`, err.message);
+        log.warn(`[verification] inward drift emit failed for ${injectionNodeId}:`, err.message);
     }
 }
-/** Surface a stamp failure once, in the machine lane: the verdict stands, only the stamp is owed. */
-async function surfaceStampFailure(deps, v, message) {
+/** Surface a DONE delivery's stamp failure once, in the machine lane: the verdict stands, only the stamp is owed. */
+async function surfaceStampFailure(deps, p, message) {
     try {
         await deps.fileEscalation({
             organizationId: deps.organizationId,
-            ...(v.focusId ? { focusId: v.focusId } : {}),
-            ...(v.productId ? { productId: v.productId } : {}),
-            reason: `Verify passed delivery "${v.deliveryName}" but stamping its injection ${v.injectionNodeId} failed: ${message}. ` +
-                'The passed verdict is recorded; the daemon retries only the stamp on later verification ticks, and the ' +
-                'verify -> done trigger and settle injection sweep re-attempt it after that.',
+            ...(p.focusId ? { focusId: p.focusId } : {}),
+            ...(p.productId ? { productId: p.productId } : {}),
+            reason: `Delivery "${p.deliveryName}" passed verify and is done, but stamping its injection ${p.injectionNodeId} ` +
+                `failed: ${message}. The daemon retries only the stamp on later verification ticks, and the settle ` +
+                'injection sweep stamps the injection after that.',
             reasonType: ESCALATION_REASONS.ERROR_ENCOUNTERED,
             disposition: ESCALATION_DISPOSITIONS.AGENT_RESOLVABLE,
             kind: 'verify_injection_stamp_failed',
-            details: { delivery_id: v.deliveryId, injection_node_id: v.injectionNodeId, error: message },
+            details: { delivery_id: p.deliveryId, injection_node_id: p.injectionNodeId, error: message },
         });
     }
     catch (err) {
-        log.warn(`[verification] could not surface the injection stamp failure for delivery ${v.deliveryId}:`, err.message);
+        log.warn(`[verification] could not surface the injection stamp failure for delivery ${p.deliveryId}:`, err.message);
     }
 }
 /**
- * Stamp the injection of a delivery whose verify PASSED. Never throws and never
- * touches the verdict: a failure is logged, surfaced once, and ledgered for a
- * stamp-only retry. Returns whether the stamp landed.
+ * Record the stamp of a delivery whose verify PASSED as pending until the
+ * delivery is done (module doc). Attempts nothing and files nothing; never
+ * throws and never touches the verdict. Returns whether the stamp was kept.
  */
-export async function stampPassedInjection(deps, v, stamp) {
+export function recordPassedInjectionStamp(deps, v, stamp) {
+    const kept = deps.pendingStamps.write({
+        deliveryId: v.deliveryId,
+        deliveryName: v.deliveryName,
+        productId: v.productId,
+        focusId: v.focusId,
+        injectionNodeId: v.injectionNodeId,
+        restatements: stamp.restatements,
+        evidence: stamp.evidence,
+        withheldNodeIds: [...stamp.withheldNodeIds],
+        ...(stamp.realityTreeId !== undefined ? { realityTreeId: stamp.realityTreeId } : {}),
+        recordedAt: new Date().toISOString(),
+        failedAttempts: 0,
+        failureSurfaced: false,
+    });
+    if (kept) {
+        log.info(`[verification] delivery "${v.deliveryName}" (${v.deliveryId}) passed verify: its injection stamp ` +
+            `${v.injectionNodeId} is pending until the delivery is done`);
+    }
+    return kept;
+}
+/** A newly rendered verdict supersedes the delivery's pending stamp (module doc). */
+export function supersedePendingStamp(deps, deliveryId, outcome) {
+    if (outcome !== 'pending')
+        deps.pendingStamps.drop(deliveryId);
+}
+/** Apply a DONE delivery's pending stamp: landed -> dropped; a sibling not done -> it waits; failed -> counted. */
+async function applyDoneStamp(deps, p) {
     try {
-        await applyStamp(deps, v, stamp);
-        ledger.delete(v.deliveryId);
-        return true;
+        await applyStamp(deps, p.injectionNodeId, p);
     }
     catch (err) {
+        if (isUnearnedPromotionRefusal(err)) {
+            log.debug(`[verification] injection stamp ${p.injectionNodeId} of done delivery ${p.deliveryId} waits: another delivery anchored to it is not done`);
+            return false;
+        }
         const message = err.message;
-        const alreadyLedgered = ledger.has(v.deliveryId);
-        ledger.set(v.deliveryId, { ...stamp, delivery: v, attempts: 0, lastError: message });
-        log.warn(`[verification] post-verdict side effect failed for delivery "${v.deliveryName}" (${v.deliveryId}): ` +
-            `injection stamp ${v.injectionNodeId}: ${message} -- the passed verdict stands; the stamp alone is retried`);
-        if (!alreadyLedgered)
-            await surfaceStampFailure(deps, v, message);
+        if (!p.failureSurfaced) {
+            log.warn(`[verification] post-verdict side effect failed for delivery "${p.deliveryName}" (${p.deliveryId}): ` +
+                `injection stamp ${p.injectionNodeId}: ${message} -- the passed verdict stands; the stamp alone is retried`);
+            await surfaceStampFailure(deps, p, message);
+        }
+        const failedAttempts = p.failedAttempts + 1;
+        if (failedAttempts >= MAX_DONE_STAMP_FAILURES) {
+            deps.pendingStamps.drop(p.deliveryId);
+            log.warn(`[verification] injection stamp ${p.injectionNodeId} for done delivery ${p.deliveryId} still failing after ` +
+                `${failedAttempts} attempts (${message}); left to the settle injection sweep`);
+            return false;
+        }
+        deps.pendingStamps.write({ ...p, failedAttempts, failureSurfaced: true });
+        log.debug(`[verification] injection stamp ${p.injectionNodeId} for done delivery ${p.deliveryId} failed again (${message}); retried next tick`);
         return false;
     }
+    deps.pendingStamps.drop(p.deliveryId);
+    log.info(`[verification] delivery "${p.deliveryName}" is done: injection ${p.injectionNodeId} stamped with the ` +
+        `${p.restatements.length} restatement(s) its passing verify authored`);
+    return true;
 }
-/** A newly recorded verdict supersedes the delivery's ledgered stamp (module doc). */
-export function supersedeLedgeredStamp(deliveryId, outcome) {
-    if (outcome !== 'pending')
-        ledger.delete(deliveryId);
-}
-/** Re-attempt ONLY the ledgered stamps -- no suite, no verdict. Called once per verification tick. */
-export async function retryLedgeredStamps(deps) {
-    for (const [deliveryId, entry] of [...ledger]) {
+/**
+ * Apply every pending stamp whose delivery is now done; drop the ones whose
+ * delivery left verify any other way. Called once per verification tick. Never
+ * throws: a delivery whose status cannot be read keeps its stamp for the next tick.
+ */
+export async function applyPendingStamps(deps) {
+    const stampedThisTick = new Set();
+    for (const p of deps.pendingStamps.list()) {
+        let status;
         try {
-            await applyStamp(deps, entry.delivery, entry);
-            ledger.delete(deliveryId);
-            log.info(`[verification] injection stamp ${entry.delivery.injectionNodeId} for delivery ${deliveryId} landed on retry`);
+            status = (await deps.readDeliveryGateRecord(p.deliveryId))?.executionStatus ?? null;
         }
         catch (err) {
-            entry.attempts += 1;
-            entry.lastError = err.message;
-            if (entry.attempts < MAX_STAMP_RETRIES)
-                continue;
-            ledger.delete(deliveryId);
-            log.warn(`[verification] injection stamp ${entry.delivery.injectionNodeId} for delivery ${deliveryId} still failing after ` +
-                `${entry.attempts} retries (${entry.lastError}); left to the verify -> done trigger and the settle injection sweep`);
+            log.debug(`[verification] pending injection stamp of ${p.deliveryId} kept: its status could not be read (${err.message})`);
+            continue;
         }
+        if (status === DELIVERY_STATUS.VERIFY || status === DELIVERY_STATUS.PAUSED)
+            continue;
+        if (status !== DELIVERY_STATUS.DONE || stampedThisTick.has(p.injectionNodeId)) {
+            deps.pendingStamps.drop(p.deliveryId);
+            log.info(`[verification] pending injection stamp ${p.injectionNodeId} of delivery ${p.deliveryId} dropped: ` +
+                (status === DELIVERY_STATUS.DONE
+                    ? 'a newer pending stamp for the same injection landed this tick'
+                    : `the delivery is ${status ?? 'gone'}, so the passing verdict no longer describes its work`));
+            continue;
+        }
+        if (await applyDoneStamp(deps, p))
+            stampedThisTick.add(p.injectionNodeId);
     }
 }
-/** Test seam: the ledgered delivery ids. */
-export function __ledgeredStampsForTests() {
-    return [...ledger.keys()];
-}
-/** Test seam: empty the ledger. */
-export function __resetStampLedgerForTests() {
-    ledger.clear();
+/**
+ * The settle sweep's per-injection verify, preferring a pending stamp: an
+ * injection a passing run left a stamp for is stamped with THAT stamp (the
+ * newest, when several anchored deliveries left one) and its pending stamps are
+ * dropped -- never with the sweep's writeback, which lands every target as a
+ * declared-future 'match' over the classifications the run authored. An
+ * injection with no pending stamp takes the writeback. A failed stamp throws,
+ * so the sweep records it and retries on its next settle.
+ */
+export function preferPendingStamp(deps, writebackVerify) {
+    return async (injectionId, evidence) => {
+        const pending = deps.pendingStamps.list().filter((p) => p.injectionNodeId === injectionId);
+        const newest = pending[0];
+        if (!newest) {
+            await writebackVerify(injectionId, evidence);
+            return;
+        }
+        await applyStamp(deps, injectionId, newest);
+        for (const p of pending)
+            deps.pendingStamps.drop(p.deliveryId);
+        log.info(`[verification] settle sweep stamped injection ${injectionId} with the pending stamp of delivery ${newest.deliveryId}`);
+    };
 }
 //# sourceMappingURL=injection-stamp.js.map

package/dist/verify/effect-reconciliation/injection-stamp.js.map

@@ -1 +1 @@
-{"version":3,"file":"injection-stamp.js","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/injection-stamp.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wGAAwG;AACxG,2EAA2E;AAC3E,kEAAkE;AAClE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAKlF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAepC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oBAAoB,CAClC,cAAiC,EACjC,qBAA+C;IAE/C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,iEAAiE;AACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;AAIhD,oGAAoG;AACpG,KAAK,UAAU,UAAU,CAAC,IAAe,EAAE,CAAsB,EAAE,KAAqB;IACtF,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACzG,+EAA+E;IAC/E,kFAAkF;IAClF,6EAA6E;IAC7E,MAAM,QAAQ,GAAoB,KAAK,CAAC,YAAY;SACjD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,uBAAuB,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,cAAc,EAAE,uBAAuB;QACvC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC,CAAC;IACN,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC,eAAe,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACxG,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,mBAAmB,CAAC,IAAe,EAAE,CAAsB,EAAE,OAAe;IACzF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,cAAc,CAAC;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,EACJ,2BAA2B,CAAC,CAAC,YAAY,gCAAgC,CAAC,CAAC,eAAe,YAAY,OAAO,IAAI;gBACjH,yGAAyG;gBACzG,6EAA6E;YAC/E,UAAU,EAAE,kBAAkB,CAAC,iBAAiB;YAChD,WAAW,EAAE,uBAAuB,CAAC,gBAAgB;YACrD,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE;SAC7F,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC,UAAU,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACjI,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAe,EACf,CAAsB,EACtB,KAAqB;IAErB,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;QACvC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,GAAG,CAAC,IAAI,CACN,gEAAgE,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,UAAU,KAAK;YACrG,mBAAmB,CAAC,CAAC,eAAe,KAAK,OAAO,2DAA2D,CAC5G,CAAC;QACF,IAAI,CAAC,eAAe;YAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,OAA4B;IACrF,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAe;IACvD,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,QAAQ,CAAC,eAAe,iBAAiB,UAAU,kBAAkB,CAAC,CAAC;QAC1H,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,KAAK,CAAC,SAAS,GAAI,GAAa,CAAC,OAAO,CAAC;YACzC,IAAI,KAAK,CAAC,QAAQ,GAAG,iBAAiB;gBAAE,SAAS;YACjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,kCAAkC,KAAK,CAAC,QAAQ,CAAC,eAAe,iBAAiB,UAAU,uBAAuB;gBAClH,GAAG,KAAK,CAAC,QAAQ,aAAa,KAAK,CAAC,SAAS,sEAAsE,CACpH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,0BAA0B;IACxC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC"}
+{"version":3,"file":"injection-stamp.js","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/injection-stamp.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,oFAAoF;AACpF,sEAAsE;AACtE,sFAAsF;AACtF,+FAA+F;AAC/F,kEAAkE;AAClE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAsD,MAAM,4CAA4C,CAAC;AAK5I,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAe1C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oBAAoB,CAClC,cAAiC,EACjC,qBAA+C;IAE/C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAKD,oGAAoG;AACpG,KAAK,UAAU,UAAU,CAAC,IAAoB,EAAE,eAAuB,EAAE,KAAqB;IAC5F,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACvG,+EAA+E;IAC/E,kFAAkF;IAClF,6EAA6E;IAC7E,MAAM,QAAQ,GAAoB,KAAK,CAAC,YAAY;SACjD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,uBAAuB,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,cAAc,EAAE,uBAAuB;QACvC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC,CAAC;IACN,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,+CAA+C,eAAe,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,mBAAmB,CAAC,IAAe,EAAE,CAAwB,EAAE,OAAe;IAC3F,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,cAAc,CAAC;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,EACJ,aAAa,CAAC,CAAC,YAAY,2DAA2D,CAAC,CAAC,eAAe,GAAG;gBAC1G,WAAW,OAAO,kFAAkF;gBACpG,kDAAkD;YACpD,UAAU,EAAE,kBAAkB,CAAC,iBAAiB;YAChD,WAAW,EAAE,uBAAuB,CAAC,gBAAgB;YACrD,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE;SAC7F,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC,UAAU,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACjI,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAAsC,EACtC,CAAsB,EACtB,KAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QACpC,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,cAAc,EAAE,CAAC;QACjB,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IACH,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,IAAI,CACN,4BAA4B,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,UAAU,uCAAuC;YACnG,GAAG,CAAC,CAAC,eAAe,wCAAwC,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CACnC,IAAsC,EACtC,UAAkB,EAClB,OAA4B;IAE5B,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,mHAAmH;AACnH,KAAK,UAAU,cAAc,CAAC,IAAe,EAAE,CAAwB;IACrE,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,eAAe,qBAAqB,CAAC,CAAC,UAAU,qDAAqD,CAAC,CAAC;YACrJ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;QACvC,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CACN,gEAAgE,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,UAAU,KAAK;gBACrG,mBAAmB,CAAC,CAAC,eAAe,KAAK,OAAO,2DAA2D,CAC5G,CAAC;YACF,MAAM,mBAAmB,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,cAAc,GAAG,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC;QAC5C,IAAI,cAAc,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACtC,GAAG,CAAC,IAAI,CACN,kCAAkC,CAAC,CAAC,eAAe,sBAAsB,CAAC,CAAC,UAAU,uBAAuB;gBAC5G,GAAG,cAAc,cAAc,OAAO,uCAAuC,CAC9E,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,eAAe,sBAAsB,CAAC,CAAC,UAAU,kBAAkB,OAAO,sBAAsB,CAAC,CAAC;QAChJ,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtC,GAAG,CAAC,IAAI,CACN,4BAA4B,CAAC,CAAC,YAAY,wBAAwB,CAAC,CAAC,eAAe,oBAAoB;QACvG,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,6CAA6C,CACtE,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAe;IACtD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,eAAe,IAAI,IAAI,CAAC;QACtF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC,UAAU,wCAAyC,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;YACtI,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,eAAe,CAAC,MAAM,IAAI,MAAM,KAAK,eAAe,CAAC,MAAM;YAAE,SAAS;QACrF,IAAI,MAAM,KAAK,eAAe,CAAC,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACtC,GAAG,CAAC,IAAI,CACN,0CAA0C,CAAC,CAAC,eAAe,gBAAgB,CAAC,CAAC,UAAU,YAAY;gBACnG,CAAC,MAAM,KAAK,eAAe,CAAC,IAAI;oBAC9B,CAAC,CAAC,+DAA+D;oBACjE,CAAC,CAAC,mBAAmB,MAAM,IAAI,MAAM,uDAAuD,CAAC,CAChG,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAuD,EACvD,eAAyE;IAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,WAAW,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,iDAAiD,WAAW,uCAAuC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACnI,CAAC,CAAC;AACJ,CAAC"}

package/dist/verify/effect-reconciliation/pending-injection-stamp.d.ts

@@ -0,0 +1,36 @@
+import type { TargetRestatement } from './verify-restatement.js';
+/** One passing run's stamp, waiting for its delivery to be done. */
+export interface PendingInjectionStamp {
+    deliveryId: string;
+    deliveryName: string;
+    productId: string | null;
+    focusId: string | null;
+    injectionNodeId: string;
+    restatements: TargetRestatement[];
+    evidence: string;
+    /** Targets that must not flip with the injection (operator-excused, or recorded rather than judged). */
+    withheldNodeIds: string[];
+    realityTreeId?: string;
+    /** When the passing run recorded it. */
+    recordedAt: string;
+    /** Attempts after done that failed for a reason other than an unfinished sibling anchor. */
+    failedAttempts: number;
+    /** A failure after done is surfaced once; true once it was. */
+    failureSurfaced: boolean;
+}
+/** Where pending stamps are kept. Production: files under the state dir; tests: memory. */
+export interface PendingStampStore {
+    /** Record (or replace) the delivery's pending stamp. False when it could not be kept. */
+    write(stamp: PendingInjectionStamp): boolean;
+    /** Every pending stamp, newest first. Empty when none can be read. */
+    list(): PendingInjectionStamp[];
+    /** Forget the delivery's pending stamp (absent is fine). */
+    drop(deliveryId: string): void;
+}
+/** Parse a stored stamp, or null when it is malformed (a malformed record applies nothing). */
+export declare function parsePendingStamp(raw: unknown): PendingInjectionStamp | null;
+/** The production store: one file per delivery under `dir` (default: the global state dir). */
+export declare function filePendingStampStore(dir?: string): PendingStampStore;
+/** An in-memory store (tests, and any caller with no state dir). */
+export declare function memoryPendingStampStore(): PendingStampStore;
+//# sourceMappingURL=pending-injection-stamp.d.ts.map

package/dist/verify/effect-reconciliation/pending-injection-stamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-injection-stamp.d.ts","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/pending-injection-stamp.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAKjE,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,wGAAwG;IACxG,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC7C,sEAAsE;IACtE,IAAI,IAAI,qBAAqB,EAAE,CAAC;IAChC,4DAA4D;IAC5D,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAoBD,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAqB5E;AAcD,+FAA+F;AAC/F,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAA0B,GAAG,iBAAiB,CAyCxF;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,IAAI,iBAAiB,CAc3D"}

package/dist/verify/effect-reconciliation/pending-injection-stamp.js

@@ -0,0 +1,157 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/composition/settle-sweep-pending-stamp-wiring.test.ts,
+//   packages/daemon/src/integration/explicit-verdict-reuse.test.ts,
+//   packages/daemon/src/integration/review-verdict-ruling-release.test.ts,
+//   packages/daemon/src/integration/shortfall-ruling-release.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/pending-injection-stamp.test.ts,
+//   packages/daemon/src/verify/engine/verification-commit-sharing.test.ts
+// PINNED-BY-END
+/**
+ * The injection stamp a passing verify run authored, held durably until its
+ * delivery reaches done.
+ *
+ * The promotion gate verifies an injection only once every live delivery
+ * anchored to it is done (supabase/functions/_shared/injection-promotion-earned.ts),
+ * and verify judges a delivery while it is still in verify, ahead of its focus
+ * review. So the stamp a pass authors -- its restatements, the targets it
+ * withheld, its evidence -- is not attempted then: it is RECORDED here, and
+ * applied when the delivery is done (verify/effect-reconciliation/injection-stamp.ts).
+ *
+ * One file per delivery under the global state dir, written atomically (temp +
+ * rename) and REPLACED by a later pass of the same delivery. Host-local, like
+ * the review census (completion/review-exit/review-census-record.ts): the
+ * daemon that renders the verdict is the one that claims the product, polls its
+ * deliveries and runs its settle sweep, so the record is read where it is
+ * written, survives a daemon restart, and costs no schema change or edge
+ * release. A record that is missing, unreadable or malformed applies nothing:
+ * the settle sweep then stamps the injection from the tree's declared futures,
+ * which is what happened before this record existed.
+ *
+ * @module verify/effect-reconciliation/pending-injection-stamp
+ */
+import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { resolveGlobalStateDir } from '../../daemon-state/daemon-process.js';
+import { createLogger } from '../../log/daemon-log.js';
+const log = createLogger({ module: 'verification' });
+function isString(v) {
+    return typeof v === 'string';
+}
+function stringOrNull(v) {
+    if (v === null)
+        return null;
+    return isString(v) ? v : undefined;
+}
+function isRestatement(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return false;
+    const r = raw;
+    return isString(r.nodeId) && isString(r.statement)
+        && (r.classification === 'match' || r.classification === 'legitimate_divergence')
+        && (r.divergenceReason === undefined || isString(r.divergenceReason))
+        && isString(r.originalClaim);
+}
+/** Parse a stored stamp, or null when it is malformed (a malformed record applies nothing). */
+export function parsePendingStamp(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return null;
+    const r = raw;
+    if (!isString(r.deliveryId) || !isString(r.deliveryName) || !isString(r.injectionNodeId))
+        return null;
+    if (!isString(r.evidence) || !isString(r.recordedAt))
+        return null;
+    const productId = stringOrNull(r.productId);
+    const focusId = stringOrNull(r.focusId);
+    if (productId === undefined || focusId === undefined)
+        return null;
+    const restatements = r.restatements;
+    const withheld = r.withheldNodeIds;
+    if (!Array.isArray(restatements) || !restatements.every(isRestatement))
+        return null;
+    if (!Array.isArray(withheld) || !withheld.every(isString))
+        return null;
+    if (r.realityTreeId !== undefined && !isString(r.realityTreeId))
+        return null;
+    return {
+        deliveryId: r.deliveryId, deliveryName: r.deliveryName, productId, focusId,
+        injectionNodeId: r.injectionNodeId, restatements, evidence: r.evidence,
+        withheldNodeIds: withheld, ...(isString(r.realityTreeId) ? { realityTreeId: r.realityTreeId } : {}),
+        recordedAt: r.recordedAt,
+        failedAttempts: typeof r.failedAttempts === 'number' && Number.isInteger(r.failedAttempts) ? r.failedAttempts : 0,
+        failureSurfaced: r.failureSurfaced === true,
+    };
+}
+function newestFirst(stamps) {
+    return stamps.sort((a, b) => Date.parse(b.recordedAt) - Date.parse(a.recordedAt));
+}
+function pendingStampDir() {
+    return resolve(resolveGlobalStateDir(), 'pending-injection-stamps');
+}
+function fileName(deliveryId) {
+    return `${deliveryId.replace(/[^a-zA-Z0-9._-]/g, '_')}.json`;
+}
+/** The production store: one file per delivery under `dir` (default: the global state dir). */
+export function filePendingStampStore(dir = pendingStampDir()) {
+    return {
+        write(stamp) {
+            const path = resolve(dir, fileName(stamp.deliveryId));
+            const tmp = `${path}.${process.pid}.tmp`;
+            try {
+                mkdirSync(dir, { recursive: true });
+                writeFileSync(tmp, JSON.stringify(stamp, null, 2), { mode: 0o600 });
+                renameSync(tmp, path);
+                return true;
+            }
+            catch (err) {
+                log.warn(`[verification] could not record the pending injection stamp of delivery ${stamp.deliveryId}: ${err.message}`);
+                return false;
+            }
+        },
+        list() {
+            let names;
+            try {
+                names = readdirSync(dir).filter((name) => name.endsWith('.json'));
+            }
+            catch {
+                return [];
+            }
+            const stamps = [];
+            for (const name of names) {
+                try {
+                    const parsed = parsePendingStamp(JSON.parse(readFileSync(resolve(dir, name), 'utf8')));
+                    if (parsed)
+                        stamps.push(parsed);
+                }
+                catch {
+                    // Unreadable or malformed: applies nothing.
+                }
+            }
+            return newestFirst(stamps);
+        },
+        drop(deliveryId) {
+            try {
+                rmSync(resolve(dir, fileName(deliveryId)), { force: true });
+            }
+            catch (err) {
+                log.warn(`[verification] could not drop the pending injection stamp of delivery ${deliveryId}: ${err.message}`);
+            }
+        },
+    };
+}
+/** An in-memory store (tests, and any caller with no state dir). */
+export function memoryPendingStampStore() {
+    const stamps = new Map();
+    return {
+        write(stamp) {
+            stamps.set(stamp.deliveryId, { ...stamp });
+            return true;
+        },
+        list() {
+            return newestFirst([...stamps.values()].map((s) => ({ ...s })));
+        },
+        drop(deliveryId) {
+            stamps.delete(deliveryId);
+        },
+    };
+}
+//# sourceMappingURL=pending-injection-stamp.js.map

package/dist/verify/effect-reconciliation/pending-injection-stamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-injection-stamp.js","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/pending-injection-stamp.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wFAAwF;AACxF,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,sFAAsF;AACtF,0EAA0E;AAC1E,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAgCrD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;WAC7C,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,IAAI,CAAC,CAAC,cAAc,KAAK,uBAAuB,CAAC;WAC9E,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;WAClE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;AACjC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACtG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,YAAY,GAAY,CAAC,CAAC,YAAY,CAAC;IAC7C,MAAM,QAAQ,GAAY,CAAC,CAAC,eAAe,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO;QAC1E,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACtE,eAAe,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,cAAc,EAAE,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACjH,eAAe,EAAE,CAAC,CAAC,eAAe,KAAK,IAAI;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAA+B;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,OAAO,CAAC,qBAAqB,EAAE,EAAE,0BAA0B,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,qBAAqB,CAAC,MAAc,eAAe,EAAE;IACnE,OAAO;QACL,KAAK,CAAC,KAAK;YACT,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACzC,IAAI,CAAC;gBACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,2EAA2E,KAAK,CAAC,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnI,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI;YACF,IAAI,KAAe,CAAC;YACpB,IAAI,CAAC;gBACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;oBACvF,IAAI,MAAM;wBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;YACH,CAAC;YACD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,UAAU;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,yEAAyE,UAAU,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7H,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IACxD,OAAO;QACL,KAAK,CAAC,KAAK;YACT,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI;YACF,OAAO,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,UAAU;YACb,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/verify/effect-reconciliation/verify-restatement.js

@@ -1,5 +1,5 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: 26 tests -- run: npm run gen:pinned-by -- --list packages/daemon/src/verify/effect-reconciliation/verify-restatement.ts
+// Pinned by: 27 tests -- run: npm run gen:pinned-by -- --list packages/daemon/src/verify/effect-reconciliation/verify-restatement.ts
 // PINNED-BY-END
 /**
  * Verify-time desired-effect reconciliation.

package/dist/verify/engine/verification-deps.d.ts

@@ -32,6 +32,7 @@ import type { AncestorLister } from '../gate-verdicts/judged-ancestor.js';
 import type { CommitVerdictPullRegistry } from '../run-selection/commit-verdict-pull.js';
 import type { InstallProbeTickDeps } from '../install-probe/install-probe-tick.js';
 import type { RecordedTargetsPersist } from '../effect-reconciliation/recorded-targets.js';
+import type { PendingStampStore } from '../effect-reconciliation/pending-injection-stamp.js';
 import type { VerifyCheckout } from '../deterministic-gate/verification-checkout.js';
 import type { WorktreeProvisioningStatus } from '../../worktree/worktree-package-provisioning.js';
 import type { getPendingVerifications, PendingVerification, VerificationOutcome } from '../../queries/verification/verification.js';
@@ -91,6 +92,12 @@ export interface VerificationDeps {
      * operator EXCUSED (verify/shortfalls/shortfall-rulings.ts).
      */
     verifyInjection: (injectionNodeId: string, restatements?: TargetRestatement[], evidence?: string, withheldNodeIds?: readonly string[]) => Promise<void>;
+    /**
+     * Where a passing run's injection stamp waits for its delivery to be done
+     * (verify/effect-reconciliation/pending-injection-stamp.ts). Production: files
+     * under the global state dir, so a pending stamp survives a restart.
+     */
+    pendingStamps: PendingStampStore;
     /**
      * Read the operator shortfall rulings recorded on a delivery
      * (queries/verification/shortfall-rulings.ts). Applied to a judgement's shortfalls before
@@ -121,7 +128,9 @@ export interface VerificationDeps {
      * delivery whose commit set and rulings are unchanged is re-held from the
      * record instead of costing another model call
      * (verify/shortfalls/parked-shortfall-reuse.ts). A null record reads no park, and
-     * the dispatch judges. Production reads the delivery row.
+     * the dispatch judges. The pending injection stamps read it each tick to
+     * apply a stamp once its delivery is done (injection-stamp.ts applyPendingStamps):
+     * null there means the delivery is gone. Production reads the delivery row.
      */
     readDeliveryGateRecord: (deliveryId: string) => Promise<DeliveryGateRecord | null>;
     /**