@tiangong-lca/cli 0.0.23 → 0.0.25

package/dist/src/lib/dataset-maintenance-apply.js

@@ -3,10 +3,12 @@ import path from 'node:path';
 import { writeJsonArtifact } from './artifacts.js';
 import { CliError } from './errors.js';
 import { withStateFileLock } from './state-lock.js';
-import { MAINTENANCE_SCAN_TABLES, appendStableJsonLine, isJsonObject, maintenanceRowKey, parseMaintenancePlan, readJsonFile, readJsonLinesIfPresent, resolveMaintenancePlanArtifactPath, sha256Json, snapshotRemoteRow, writeImmutableJson, } from './dataset-maintenance-contract.js';
+import { buildAliasBatchRequest, buildAliasPlanRequest, loadMaintenanceDesiredPayload, orderedAliasBatches, } from './dataset-maintenance-alias-request.js';
+import { MAINTENANCE_SCAN_TABLES, appendStableJsonLine, isJsonObject, maintenanceRowKey, parseMaintenancePlan, readJsonFile, readJsonLinesIfPresent, sha256Json, snapshotRemoteRow, writeImmutableJson, } from './dataset-maintenance-contract.js';
+import { buildDerivativePlanRequest, derivativePlanAction, parseDerivativeSnapshotResponse, parseDerivativeSubmitResponse, } from './dataset-maintenance-derivatives.js';
 import { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';
 import { isSnapshotCompletenessCompatible } from './dataset-maintenance-pagination.js';
-import { applyMaintenanceAliasPlan, deleteMaintenanceRow, fetchMaintenanceAccountRows, fetchMaintenanceExactRows, resolveMaintenanceRemoteContext, saveDraftMaintenanceRow, } from './dataset-maintenance-remote.js';
+import { applyMaintenanceAliasPlan, applyMaintenanceDerivativeRebuild, deleteMaintenanceRow, fetchMaintenanceAccountRows, fetchMaintenanceDerivativeSnapshot, fetchMaintenanceExactRows, resolveMaintenanceRemoteContext, saveDraftMaintenanceRow, } from './dataset-maintenance-remote.js';
 const POSITIVE_INTEGER_TEXT = /^[1-9]\d*$/u;
 function clock(options) {
     return (options.now ?? new Date()).toISOString();
@@ -15,21 +17,7 @@ function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
 function loadDesiredPayload(planDir, action) {
-    if (!action.desired_payload) {
-        throw new CliError(`save_draft action lacks desired payload: ${action.action_id}`, {
-            code: 'DATASET_MAINTENANCE_PLAN_INVALID',
-            exitCode: 2,
-        });
-    }
-    const payloadPath = resolveMaintenancePlanArtifactPath(planDir, action.desired_payload.path, 'Maintenance desired payload path');
-    const payload = readJsonFile(payloadPath, 'Maintenance desired payload');
-    if (!isJsonObject(payload) || sha256Json(payload) !== action.desired_payload.sha256) {
-        throw new CliError(`Desired payload hash mismatch for action ${action.action_id}.`, {
-            code: 'DATASET_MAINTENANCE_DESIRED_PAYLOAD_HASH_MISMATCH',
-            exitCode: 1,
-        });
-    }
-    return payload;
+    return loadMaintenanceDesiredPayload(planDir, action);
 }
 function parseProgress(plan, progressPath) {
     const rawEntries = readJsonLinesIfPresent(progressPath);
@@ -101,6 +89,98 @@ function parseProgress(plan, progressPath) {
     }
     return { entries, successes, latestFailures };
 }
+function derivativeProofIdentity(proof) {
+    return sha256Json({
+        schema_version: proof.schema_version,
+        plan_sha256: proof.plan_sha256,
+        operation_id: proof.operation_id,
+        target_visibility: proof.target_visibility,
+        plan_request_sha256: proof.plan_request_sha256,
+        action_count: proof.action_count,
+        accepted_count: proof.accepted_count,
+        summary_audit_id: proof.summary_audit_id,
+        request_id: proof.request_id,
+        action_request_sha256: proof.action_request_sha256,
+        database_audit_id: proof.database_audit_id,
+    });
+}
+function parseDerivativeSubmitProgress(plan, progressPath) {
+    const action = derivativePlanAction(plan);
+    const entries = readJsonLinesIfPresent(progressPath).map((value) => {
+        const rawProof = isJsonObject(value) && isJsonObject(value.proof) ? value.proof : null;
+        let proof;
+        try {
+            proof = parseDerivativeSubmitResponse(rawProof
+                ? {
+                    ok: true,
+                    command: 'cmd_dataset_derivative_rebuild_plan_guarded',
+                    ...rawProof,
+                }
+                : null, plan);
+        }
+        catch (error) {
+            throw new CliError('Derivative submit progress contains an invalid RPC proof.', {
+                code: 'DATASET_MAINTENANCE_DERIVATIVE_PROGRESS_INVALID',
+                exitCode: 1,
+                details: errorMessage(error),
+            });
+        }
+        if (!isJsonObject(value) ||
+            value.schema_version !== 1 ||
+            value.plan_sha256 !== plan.plan_sha256 ||
+            value.operation_id !== plan.operation_id ||
+            value.action_id !== action.action_id ||
+            value.target_mode !== 'owner_draft' ||
+            !isJsonObject(value.actor) ||
+            value.actor.user_id !== plan.account.user_id ||
+            value.actor.email !== plan.account.email ||
+            typeof value.started_at_utc !== 'string' ||
+            typeof value.ended_at_utc !== 'string' ||
+            value.result !== 'accepted') {
+            throw new CliError('Derivative submit progress contains an invalid or foreign entry.', {
+                code: 'DATASET_MAINTENANCE_DERIVATIVE_PROGRESS_INVALID',
+                exitCode: 1,
+                details: value,
+            });
+        }
+        return { ...value, proof };
+    });
+    const identities = new Set(entries.map((entry) => derivativeProofIdentity(entry.proof)));
+    if (identities.size > 1) {
+        throw new CliError('Derivative submit replays do not identify one durable request.', {
+            code: 'DATASET_MAINTENANCE_DERIVATIVE_PROGRESS_INVALID',
+            exitCode: 1,
+        });
+    }
+    return { entries, latest: entries.at(-1) ?? null };
+}
+function validateDerivativeAdmissionAttempt(options) {
+    if (!existsSync(options.path))
+        return null;
+    const value = readJsonFile(options.path, 'Derivative admission attempt');
+    const action = derivativePlanAction(options.plan);
+    if (!isJsonObject(value) ||
+        value.schema_version !== 1 ||
+        value.plan_sha256 !== options.plan.plan_sha256 ||
+        value.operation_id !== options.plan.operation_id ||
+        value.action_id !== action.action_id ||
+        value.table !== 'processes' ||
+        value.id !== action.id ||
+        value.version !== action.version ||
+        value.expected_snapshot_sha256 !== action.derivative_before?.snapshot_sha256 ||
+        !isJsonObject(value.actor) ||
+        value.actor.user_id !== options.context.account.user_id ||
+        value.actor.email !== options.context.account.email ||
+        typeof value.prepared_at_utc !== 'string' ||
+        !Number.isFinite(Date.parse(value.prepared_at_utc))) {
+        throw new CliError('Derivative admission attempt is invalid or belongs to another plan.', {
+            code: 'DATASET_MAINTENANCE_DERIVATIVE_ATTEMPT_INVALID',
+            exitCode: 1,
+            details: value,
+        });
+    }
+    return value;
+}
 function parseAliasBatchProgress(plan, progressPath) {
     const batches = new Map(plan.alias_batches.map((batch) => [batch.batch_id, batch]));
     const entries = readJsonLinesIfPresent(progressPath).map((value) => {
@@ -433,81 +513,6 @@ async function assertAliasSupportSnapshots(options) {
         }
     }
 }
-function buildAliasBatchRequest(options) {
-    if (options.plan.target_mode !== 'owner_draft') {
-        throw new CliError('Alias batch request requires target_mode=owner_draft.', {
-            code: 'DATASET_MAINTENANCE_TARGET_MODE_INVALID',
-            exitCode: 2,
-        });
-    }
-    const targetSnapshot = (snapshot) => {
-        return {
-            id: snapshot.id,
-            version: snapshot.version,
-            expected_modified_at: snapshot.modified_at,
-            expected_json_ordered: snapshot.json_ordered,
-        };
-    };
-    const actions = options.batch.action_ids.map((actionId) => {
-        const action = options.plan.actions.find((entry) => entry.action_id === actionId);
-        return {
-            action_id: action.action_id,
-            action: 'update_json_ordered',
-            table: action.table,
-            id: action.id,
-            version: action.version,
-            expected_state_code: 0,
-            expected_modified_at: action.before.modified_at,
-            expected_json_ordered: action.before.json_ordered,
-            desired_json_ordered: loadDesiredPayload(options.planDir, action),
-            mutation: action.alias_mutation,
-        };
-    });
-    return {
-        schema_version: 'dataset-alias-batch.v1',
-        target_visibility: 'owner_draft',
-        plan_sha256: options.plan.plan_sha256,
-        operation_id: options.plan.operation_id,
-        batch_id: options.batch.batch_id,
-        dimension: options.batch.dimension,
-        factor: options.batch.factor,
-        target: {
-            flowproperty: targetSnapshot(options.batch.target_snapshots.flowproperty),
-            unitgroup: targetSnapshot(options.batch.target_snapshots.unitgroup),
-            source_unitgroup: targetSnapshot(options.batch.target_snapshots.source_unitgroup),
-        },
-        actions,
-    };
-}
-function orderedAliasBatches(plan) {
-    const time = plan.alias_batches.find((batch) => batch.dimension === 'time');
-    const lengthTime = plan.alias_batches.find((batch) => batch.dimension === 'length_time');
-    return [time, lengthTime].filter((batch) => batch !== undefined);
-}
-function buildAliasPlanRequest(options) {
-    if (options.plan.target_mode !== 'owner_draft') {
-        throw new CliError('Alias plan request requires target_mode=owner_draft.', {
-            code: 'DATASET_MAINTENANCE_TARGET_MODE_INVALID',
-            exitCode: 2,
-        });
-    }
-    const batches = orderedAliasBatches(options.plan);
-    if (batches.length !== 2 ||
-        batches[0]?.dimension !== 'time' ||
-        batches[1]?.dimension !== 'length_time') {
-        throw new CliError('Alias plan request requires time followed by length_time exactly once.', {
-            code: 'DATASET_MAINTENANCE_ALIAS_PLAN_INVALID',
-            exitCode: 2,
-        });
-    }
-    return {
-        schema_version: 'dataset-alias-plan.v1',
-        plan_sha256: options.plan.plan_sha256,
-        operation_id: options.plan.operation_id,
-        target_visibility: 'owner_draft',
-        batches: batches.map((batch) => buildAliasBatchRequest({ plan: options.plan, batch, planDir: options.planDir })),
-    };
-}
 function validateAliasRpcResult(value, batch, plan) {
     const audit = Array.isArray(value.audit) ? value.audit : [];
     const proofs = audit.filter(isJsonObject).map((entry) => ({
@@ -658,106 +663,6 @@ async function executeAliasPlan(options) {
 function aliasExchangeProgressKey(value) {
     return `${value.batch_id}\u0000${value.action_id}\u0000${value.exchange_index}\u0000${value.data_set_internal_id}`;
 }
-function aliasBatchDerivedLogsComplete(options) {
-    const planBatchProof = options.planSuccess.batches.find((proof) => proof.batch_id === options.batch.batch_id);
-    if (!planBatchProof ||
-        planBatchProof.dimension !== options.batch.dimension ||
-        planBatchProof.batch_request_sha256 !== options.batchSuccess.batch_request_sha256 ||
-        planBatchProof.summary_audit_id !== options.batchSuccess.summary_audit_id ||
-        options.batchSuccess.plan_request_sha256 !== options.planSuccess.plan_request_sha256 ||
-        options.batchSuccess.plan_summary_audit_id !== options.planSuccess.summary_audit_id ||
-        !options.batch.action_ids.every((actionId) => options.progress.successes.get(actionId)?.batch_request_sha256 ===
-            options.batchSuccess.batch_request_sha256 &&
-            options.progress.successes.get(actionId)?.summary_audit_id ===
-                options.batchSuccess.summary_audit_id &&
-            options.progress.successes.get(actionId)?.plan_request_sha256 ===
-                options.planSuccess.plan_request_sha256 &&
-            options.progress.successes.get(actionId)?.plan_summary_audit_id ===
-                options.planSuccess.summary_audit_id)) {
-        return false;
-    }
-    const expected = new Map(options.batch.exchange_rewrites.map((rewrite) => [
-        aliasExchangeProgressKey({ batch_id: options.batch.batch_id, ...rewrite }),
-        rewrite,
-    ]));
-    const exchangeKeys = new Set();
-    for (const value of readJsonLinesIfPresent(options.exchangeProgressPath)) {
-        if (!isJsonObject(value) || value.batch_id !== options.batch.batch_id)
-            continue;
-        const key = typeof value.action_id === 'string' &&
-            typeof value.exchange_index === 'number' &&
-            typeof value.data_set_internal_id === 'string'
-            ? aliasExchangeProgressKey({
-                batch_id: options.batch.batch_id,
-                action_id: value.action_id,
-                exchange_index: value.exchange_index,
-                data_set_internal_id: value.data_set_internal_id,
-            })
-            : '';
-        const rewrite = expected.get(key);
-        const rowProof = rewrite ? options.progress.successes.get(rewrite.action_id) : null;
-        if (!rewrite ||
-            !rowProof ||
-            value.schema_version !== 1 ||
-            value.plan_sha256 !== options.plan.plan_sha256 ||
-            value.operation_id !== options.plan.operation_id ||
-            value.target_mode !== 'owner_draft' ||
-            value.batch_request_sha256 !== options.batchSuccess.batch_request_sha256 ||
-            value.batch_request_sha256 !== rowProof.batch_request_sha256 ||
-            value.summary_audit_id !== options.batchSuccess.summary_audit_id ||
-            value.summary_audit_id !== rowProof.summary_audit_id ||
-            value.plan_request_sha256 !== options.planSuccess.plan_request_sha256 ||
-            value.plan_request_sha256 !== rowProof.plan_request_sha256 ||
-            value.plan_summary_audit_id !== options.planSuccess.summary_audit_id ||
-            value.plan_summary_audit_id !== rowProof.plan_summary_audit_id ||
-            value.factor !== options.batch.factor ||
-            value.result !== 'success' ||
-            !isJsonObject(value.actor) ||
-            value.actor.user_id !== options.plan.account.user_id ||
-            value.actor.email !== options.plan.account.email ||
-            typeof value.logged_at_utc !== 'string' ||
-            typeof value.database_audit_id !== 'string' ||
-            !POSITIVE_INTEGER_TEXT.test(value.database_audit_id) ||
-            value.database_audit_id !== rowProof.database_audit_id ||
-            typeof value.summary_audit_id !== 'string' ||
-            !POSITIVE_INTEGER_TEXT.test(value.summary_audit_id) ||
-            sha256Json({
-                action_id: value.action_id,
-                process_id: value.process_id,
-                process_version: value.process_version,
-                exchange_index: value.exchange_index,
-                data_set_internal_id: value.data_set_internal_id,
-                flow_id: value.flow_id,
-                flow_version: value.flow_version,
-                direction: value.direction,
-                before_exchange_sha256: value.before_exchange_sha256,
-                before_mean_amount: value.before_mean_amount,
-                before_resulting_amount: value.before_resulting_amount,
-                after_mean_amount: value.after_mean_amount,
-                after_resulting_amount: value.after_resulting_amount,
-                after_exchange_sha256: value.after_exchange_sha256,
-            }) !== sha256Json(rewrite) ||
-            exchangeKeys.has(key)) {
-            return false;
-        }
-        exchangeKeys.add(key);
-    }
-    return options.batch.exchange_rewrites.every((rewrite) => exchangeKeys.has(aliasExchangeProgressKey({ batch_id: options.batch.batch_id, ...rewrite })));
-}
-function aliasPlanDerivedLogsComplete(options) {
-    return orderedAliasBatches(options.plan).every((batch) => {
-        const batchSuccess = options.batchProgress.successes.get(batch.batch_id);
-        return Boolean(batchSuccess &&
-            aliasBatchDerivedLogsComplete({
-                plan: options.plan,
-                batch,
-                planSuccess: options.planSuccess,
-                batchSuccess,
-                progress: options.progress,
-                exchangeProgressPath: options.exchangeProgressPath,
-            }));
-    });
-}
 function appendAliasSuccessLogs(options) {
     const batchRpc = options.execution.rpc.batches.get(options.batch.dimension);
     for (const actionId of options.batch.action_ids) {
@@ -1012,33 +917,13 @@ function appendAliasProofProgress(options) {
     options.planProgress.latestFailure = null;
     return entry;
 }
-function appendAliasPlanFailure(options) {
-    const entry = {
-        schema_version: 1,
-        plan_sha256: options.plan.plan_sha256,
-        operation_id: options.plan.operation_id,
-        target_mode: 'owner_draft',
-        actor: { user_id: options.context.account.user_id, email: options.context.account.email },
-        started_at_utc: options.startedAt,
-        ended_at_utc: options.endedAt,
-        plan_request_sha256: null,
-        idempotent_replay: null,
-        batch_count: 2,
-        row_count: 52,
-        exchange_count: 59,
-        summary_audit_id: null,
-        batches: [],
-        result: 'failed',
-        error: errorMessage(options.error),
-    };
-    appendStableJsonLine(options.progressPath, entry);
-    options.planProgress.entries.push(entry);
-    if (!options.planProgress.success) {
-        options.planProgress.latestFailure = entry;
-    }
-    return entry;
-}
 async function executeAction(options) {
+    if (options.action.action === 'rebuild_derivatives') {
+        throw new CliError('Derivative rebuild actions may only execute through the guarded whole-plan RPC.', {
+            code: 'DATASET_MAINTENANCE_DERIVATIVE_SEQUENTIAL_WRITE_FORBIDDEN',
+            exitCode: 1,
+        });
+    }
     if (!options.action.before) {
         throw new CliError(`Action lacks a before snapshot: ${options.action.action_id}`, {
             code: 'DATASET_MAINTENANCE_PLAN_INVALID',
@@ -1114,6 +999,12 @@ async function executeAction(options) {
             exitCode: 1,
         });
     }
+    if (options.action.action !== 'delete') {
+        throw new CliError(`Unsupported maintenance action: ${options.action.action}`, {
+            code: 'DATASET_MAINTENANCE_ACTION_UNSUPPORTED',
+            exitCode: 2,
+        });
+    }
     const remoteResult = await deleteMaintenanceRow({
         context: options.context,
         table: options.action.table,
@@ -1135,6 +1026,60 @@ async function executeAction(options) {
     }
     return { afterSha256: null, remoteResultSha256: sha256Json(remoteResult) };
 }
+async function executeDerivativeAdmission(options) {
+    const action = derivativePlanAction(options.plan);
+    const plannedSnapshot = action.derivative_before;
+    const preflight = parseDerivativeSnapshotResponse(await fetchMaintenanceDerivativeSnapshot({
+        context: options.context,
+        id: action.id,
+        version: action.version,
+    }), { id: action.id, version: action.version, userId: action.expected_user_id });
+    if (preflight.modified_at !== plannedSnapshot.modified_at ||
+        preflight.json_sha256 !== plannedSnapshot.json_sha256 ||
+        preflight.json_ordered_sha256 !== plannedSnapshot.json_ordered_sha256 ||
+        preflight.extracted_text_sha256 !== plannedSnapshot.extracted_text_sha256) {
+        throw new CliError('Derivative action primary preconditions drifted after planning.', {
+            code: 'DATASET_MAINTENANCE_DERIVATIVE_PRIMARY_DRIFT',
+            exitCode: 1,
+            details: {
+                expected_snapshot_sha256: plannedSnapshot.snapshot_sha256,
+                actual_snapshot_sha256: preflight.snapshot_sha256,
+            },
+        });
+    }
+    if (!options.replayPossible && preflight.snapshot_sha256 !== plannedSnapshot.snapshot_sha256) {
+        throw new CliError('Derivative action-scoped snapshot drifted before first admission.', {
+            code: 'DATASET_MAINTENANCE_DERIVATIVE_SNAPSHOT_DRIFT',
+            exitCode: 1,
+            details: {
+                expected: plannedSnapshot.snapshot_sha256,
+                actual: preflight.snapshot_sha256,
+            },
+        });
+    }
+    if (!options.replayPossible) {
+        writeImmutableJson(options.attemptPath, {
+            schema_version: 1,
+            plan_sha256: options.plan.plan_sha256,
+            operation_id: options.plan.operation_id,
+            action_id: action.action_id,
+            table: 'processes',
+            id: action.id,
+            version: action.version,
+            expected_snapshot_sha256: plannedSnapshot.snapshot_sha256,
+            actor: {
+                user_id: options.context.account.user_id,
+                email: options.context.account.email,
+            },
+            prepared_at_utc: options.preparedAtUtc,
+        });
+    }
+    const result = await applyMaintenanceDerivativeRebuild({
+        context: options.context,
+        plan: buildDerivativePlanRequest(options.plan),
+    });
+    return parseDerivativeSubmitResponse(result, options.plan);
+}
 function nextAttemptPath(planDir) {
     let attempt = 1;
     while (existsSync(path.join(planDir, `commit-report.attempt-${String(attempt).padStart(4, '0')}.json`))) {
@@ -1165,6 +1110,12 @@ export async function runDatasetMaintenanceApply(options) {
             details: plan.blockers,
         });
     }
+    if (plan.operation === 'merge-support-aliases') {
+        throw new CliError('merge-support-aliases is sealed for dataset maintenance run-protected and cannot use ordinary apply.', {
+            code: 'DATASET_MAINTENANCE_PROTECTED_RUN_REQUIRED',
+            exitCode: 1,
+        });
+    }
     if (plan.operation === 'redo-import' &&
         !plan.source_import_run_id &&
         plan.source_lineage === null) {
@@ -1173,10 +1124,9 @@ export async function runDatasetMaintenanceApply(options) {
             exitCode: 1,
         });
     }
-    const progressPath = path.join(planDir, 'apply-progress.jsonl');
-    const aliasPlanProgressPath = path.join(planDir, 'alias-plan-progress.jsonl');
-    const aliasBatchProgressPath = path.join(planDir, 'alias-batch-progress.jsonl');
-    const aliasExchangeProgressPath = path.join(planDir, 'alias-exchange-progress.jsonl');
+    const progressPath = path.join(planDir, plan.operation === 'rebuild-derivatives'
+        ? 'derivative-submit-progress.jsonl'
+        : 'apply-progress.jsonl');
     return withStateFileLock(progressPath, { reason: `dataset_maintenance_apply_${plan.operation_id}` }, async () => {
         const context = await resolveMaintenanceRemoteContext({
             env: options.env,
@@ -1197,14 +1147,13 @@ export async function runDatasetMaintenanceApply(options) {
                 exitCode: 2,
             });
         }
-        const progress = parseProgress(plan, progressPath);
-        let resumedSuccesses = progress.successes.size;
-        const aliasPlanProgress = plan.operation === 'merge-support-aliases'
-            ? parseAliasPlanProgress(plan, aliasPlanProgressPath)
-            : { entries: [], success: null, latestFailure: null };
-        const aliasBatchProgress = plan.operation === 'merge-support-aliases'
-            ? parseAliasBatchProgress(plan, aliasBatchProgressPath)
-            : { entries: [], successes: new Map() };
+        const derivativeProgress = plan.operation === 'rebuild-derivatives'
+            ? parseDerivativeSubmitProgress(plan, progressPath)
+            : { entries: [], latest: null };
+        const progress = plan.operation === 'rebuild-derivatives'
+            ? { entries: [], successes: new Map(), latestFailures: new Map() }
+            : parseProgress(plan, progressPath);
+        const resumedSuccesses = progress.successes.size;
         const current = await fetchMaintenanceAccountRows({
             context,
             userId: plan.account.user_id,
@@ -1214,14 +1163,12 @@ export async function runDatasetMaintenanceApply(options) {
             planDir,
             currentRows: current.rows,
             progress,
-            aliasPlanProgress,
+            aliasPlanProgress: { entries: [], success: null, latestFailure: null },
         });
-        if (plan.operation === 'merge-support-aliases') {
-            await assertAliasSupportSnapshots({ plan, context });
-        }
         const approvalPath = path.join(planDir, 'approval-record.json');
+        const approvalAlreadyExisted = existsSync(approvalPath);
         validateApprovalRecord({ path: approvalPath, plan, context });
-        if (!existsSync(approvalPath)) {
+        if (!approvalAlreadyExisted) {
             writeImmutableJson(approvalPath, {
                 schema_version: 1,
                 approved_at_utc: clock(options),
@@ -1243,87 +1190,48 @@ export async function runDatasetMaintenanceApply(options) {
                     : null,
             });
         }
-        if (plan.operation === 'merge-support-aliases') {
-            const alreadyComplete = Boolean(aliasPlanProgress.success &&
-                aliasPlanDerivedLogsComplete({
-                    plan,
-                    planSuccess: aliasPlanProgress.success,
-                    batchProgress: aliasBatchProgress,
-                    progress,
-                    exchangeProgressPath: aliasExchangeProgressPath,
-                }));
-            resumedSuccesses = alreadyComplete ? plan.actions.length : 0;
-            let planSuccess = alreadyComplete ? aliasPlanProgress.success : null;
-            let planFailure = null;
-            if (!alreadyComplete) {
-                const startedAt = clock(options);
-                try {
-                    const execution = await executeAliasPlan({ plan, planDir, context });
-                    const endedAt = clock(options);
-                    for (const batch of orderedAliasBatches(plan)) {
-                        appendAliasSuccessLogs({
-                            plan,
-                            batch,
-                            execution,
-                            progress,
-                            progressPath,
-                            exchangeProgressPath: aliasExchangeProgressPath,
-                            context,
-                            startedAt,
-                            endedAt,
-                        });
-                    }
-                    planSuccess = appendAliasProofProgress({
-                        plan,
-                        execution,
-                        planProgress: aliasPlanProgress,
-                        batchProgress: aliasBatchProgress,
-                        planProgressPath: aliasPlanProgressPath,
-                        batchProgressPath: aliasBatchProgressPath,
-                        context,
-                        startedAt,
-                        endedAt,
-                    });
-                }
-                catch (error) {
-                    planFailure = appendAliasPlanFailure({
-                        plan,
-                        planProgress: aliasPlanProgress,
-                        progressPath: aliasPlanProgressPath,
-                        context,
-                        startedAt,
-                        endedAt: clock(options),
-                        error,
-                    });
-                }
-            }
-            const fullyProven = Boolean(planSuccess &&
-                aliasPlanDerivedLogsComplete({
-                    plan,
-                    planSuccess,
-                    batchProgress: aliasBatchProgress,
-                    progress,
-                    exchangeProgressPath: aliasExchangeProgressPath,
-                }));
-            const failureError = planFailure?.error ?? 'Whole-plan proof is incomplete.';
-            const actions = plan.actions.map((action) => {
-                return {
-                    action_id: action.action_id,
-                    action: action.action,
-                    table: action.table,
-                    id: action.id,
-                    version: action.version,
-                    status: fullyProven ? 'success' : 'failed',
-                    error: fullyProven ? null : failureError,
-                };
+        if (plan.operation === 'rebuild-derivatives') {
+            const startedAt = clock(options);
+            const derivativeAttemptPath = path.join(planDir, 'derivative-admission-attempt.json');
+            const derivativeAttempt = validateDerivativeAdmissionAttempt({
+                path: derivativeAttemptPath,
+                plan,
+                context,
+            });
+            const proof = await executeDerivativeAdmission({
+                plan,
+                context,
+                replayPossible: derivativeAttempt !== null,
+                attemptPath: derivativeAttemptPath,
+                preparedAtUtc: startedAt,
             });
-            const successCount = fullyProven ? actions.length : 0;
-            const failureCount = fullyProven ? 0 : actions.length;
+            if (derivativeProgress.latest &&
+                derivativeProofIdentity(derivativeProgress.latest.proof) !==
+                    derivativeProofIdentity(proof)) {
+                throw new CliError('Derivative guarded-RPC replay returned a different request proof.', {
+                    code: 'DATASET_MAINTENANCE_DERIVATIVE_REPLAY_MISMATCH',
+                    exitCode: 1,
+                });
+            }
+            const action = derivativePlanAction(plan);
+            const entry = {
+                schema_version: 1,
+                plan_sha256: plan.plan_sha256,
+                operation_id: plan.operation_id,
+                action_id: action.action_id,
+                target_mode: 'owner_draft',
+                actor: { user_id: context.account.user_id, email: context.account.email },
+                started_at_utc: startedAt,
+                ended_at_utc: clock(options),
+                result: 'accepted',
+                proof,
+            };
+            appendStableJsonLine(progressPath, entry);
             const attemptPath = nextAttemptPath(planDir);
             const report = {
                 schema_version: 1,
                 generated_at_utc: clock(options),
-                status: successCount === actions.length ? 'completed' : 'completed_with_failures',
+                status: 'accepted',
                 task_id: plan.task_id,
                 operation: plan.operation,
                 operation_id: plan.operation_id,
@@ -1331,21 +1239,31 @@ export async function runDatasetMaintenanceApply(options) {
                 plan_sha256: plan.plan_sha256,
                 actor: { user_id: context.account.user_id, email: context.account.email },
                 summary: {
-                    actions: actions.length,
-                    success: successCount,
-                    failed: failureCount,
-                    pending: actions.length - successCount - failureCount,
-                    resumed_successes: resumedSuccesses,
+                    actions: 1,
+                    success: 0,
+                    failed: 0,
+                    pending: 1,
+                    resumed_successes: 0,
+                    accepted: 1,
                 },
-                actions,
+                actions: [
+                    {
+                        action_id: action.action_id,
+                        action: action.action,
+                        table: action.table,
+                        id: action.id,
+                        version: action.version,
+                        status: 'accepted',
+                        error: null,
+                    },
+                ],
                 artifacts: {
                     approval_record: approvalPath,
                     apply_progress: progressPath,
+                    derivative_submit_progress: progressPath,
+                    derivative_admission_attempt: derivativeAttemptPath,
                     commit_report: path.join(planDir, 'commit-report.json'),
                     attempt_report: attemptPath,
-                    alias_plan_progress: aliasPlanProgressPath,
-                    alias_batch_progress: aliasBatchProgressPath,
-                    alias_exchange_progress: aliasExchangeProgressPath,
                 },
                 database_audit: {
                     rpc_transaction_log: 'public.command_audit_log',
@@ -1353,25 +1271,14 @@ export async function runDatasetMaintenanceApply(options) {
                     correlation_fields: [
                         'plan_sha256',
                         'operation_id',
+                        'action_id',
                         'target_visibility',
                         'plan_request_sha256',
-                        'batch_id',
-                        'action_id',
-                        'batch_request_sha256',
+                        'action_request_sha256',
+                        'request_id',
                     ],
                 },
-                ...(fullyProven && planSuccess
-                    ? {
-                        alias_plan_proof: {
-                            plan_request_sha256: planSuccess.plan_request_sha256,
-                            summary_audit_id: planSuccess.summary_audit_id,
-                            batch_count: 2,
-                            row_count: 52,
-                            exchange_count: 59,
-                            idempotent_replay: planSuccess.idempotent_replay,
-                        },
-                    }
-                    : {}),
+                derivative_admission: { ...proof, admission: 'accepted' },
             };
             writeImmutableJson(attemptPath, report);
             writeJsonArtifact(report.artifacts.commit_report, report);
@@ -1381,6 +1288,7 @@ export async function runDatasetMaintenanceApply(options) {
             const rank = {
                 save_draft: 0,
                 update_json_ordered: 0,
+                rebuild_derivatives: 0,
                 delete: 1,
             };
             const actionOrder = rank[left.action] - rank[right.action];
@@ -1515,21 +1423,23 @@ export async function runDatasetMaintenanceApply(options) {
     });
 }
 export const __testInternals = {
-    aliasBatchDerivedLogsComplete,
-    aliasPlanDerivedLogsComplete,
     aliasExchangeProgressKey,
     appendAliasSuccessLogs,
+    appendAliasProofProgress,
     assertApplyPreconditions,
     assertAliasSupportSnapshots,
     buildAliasBatchRequest,
     buildAliasPlanRequest,
     clock,
     errorMessage,
+    executeDerivativeAdmission,
     executeAliasPlan,
     executeAction,
     finalProjectedRows,
     loadDesiredPayload,
     nextAttemptPath,
+    parseDerivativeSubmitProgress,
+    validateDerivativeAdmissionAttempt,
     parseAliasBatchProgress,
     parseAliasPlanProgress,
     parseProgress,