@tiangong-lca/cli 0.0.32 → 0.1.0

package/dist/src/lib/dataset-maintenance-apply.js

@@ -1,14 +1,21 @@
-import { existsSync } from 'node:fs';
+import { closeSync, existsSync, fchmodSync, fsyncSync, openSync, readFileSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { writeJsonArtifact } from './artifacts.js';
+import { collectRemoteReferences } from './dataset-remote-verify.js';
 import { CliError } from './errors.js';
 import { withStateFileLock } from './state-lock.js';
 import { buildAliasBatchRequest, buildAliasPlanRequest, loadMaintenanceDesiredPayload, orderedAliasBatches, } from './dataset-maintenance-alias-request.js';
-import { MAINTENANCE_SCAN_TABLES, appendStableJsonLine, isJsonObject, maintenanceRowKey, parseMaintenancePlan, readJsonFile, readJsonLinesIfPresent, sha256Json, snapshotRemoteRow, writeImmutableJson, } from './dataset-maintenance-contract.js';
+import { MAINTENANCE_SCAN_TABLES, appendStableJsonLine, isJsonObject, maintenanceRowKey, parseMaintenancePlan, readJsonFile, readJsonLinesIfPresent, sha256Json, sha256Text, snapshotRemoteRow, stableJsonText, writeImmutableJson, } from './dataset-maintenance-contract.js';
 import { buildDerivativePlanRequest, derivativePlanAction, parseDerivativeSnapshotResponse, parseDerivativeSubmitResponse, } from './dataset-maintenance-derivatives.js';
 import { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';
 import { isSnapshotCompletenessCompatible } from './dataset-maintenance-pagination.js';
-import { applyMaintenanceAliasPlan, applyMaintenanceDerivativeRebuild, deleteMaintenanceRow, fetchMaintenanceAccountRows, fetchMaintenanceDerivativeSnapshot, fetchMaintenanceExactRows, resolveMaintenanceRemoteContext, saveDraftMaintenanceRow, } from './dataset-maintenance-remote.js';
+import { applyMaintenanceDerivativeRebuild, deleteMaintenanceRow, fetchMaintenanceAccountRows, fetchMaintenanceDerivativeSnapshot, fetchMaintenanceExactRows, fetchMaintenanceVisibleTableRows, resolveMaintenanceRemoteContext, saveDraftMaintenanceRow, } from './dataset-maintenance-remote.js';
+// Process payloads can be large enough for the default 1,000-row page to exceed
+// the database statement timeout. Keep the destructive all-visible RLS fence,
+// but bound each SELECT-only page so admission can complete without weakening it.
+const PARALLEL_DELETE_VISIBLE_PROCESS_PAGE_SIZE = 250;
+const GLOBAL_INBOUND_PROOF_MAX_AGE_MS = 30 * 60 * 1_000;
+const SHA256_PATTERN = /^[0-9a-f]{64}$/u;
 const POSITIVE_INTEGER_TEXT = /^[1-9]\d*$/u;
 function clock(options) {
     return (options.now ?? new Date()).toISOString();
@@ -16,6 +23,405 @@ function clock(options) {
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+const ABSENT_READBACK_SHA256 = sha256Json([]);
+function parallelDeleteDesiredSha256(action) {
+    return sha256Json({
+        action: 'delete',
+        table: action.table,
+        id: action.id,
+        version: action.version,
+        desired: 'absent',
+    });
+}
+function normalizeMaintenanceMaxParallel(value) {
+    const normalized = value ?? 1;
+    if (!Number.isInteger(normalized) || normalized < 1 || normalized > 8) {
+        throw new CliError('--max-parallel must be an integer from 1 to 8.', {
+            code: 'DATASET_MAINTENANCE_MAX_PARALLEL_INVALID',
+            exitCode: 2,
+        });
+    }
+    return normalized;
+}
+function assertParallelDeletePlan(plan) {
+    const targets = new Set();
+    if (plan.operation !== 'delete' ||
+        plan.actions.length === 0 ||
+        plan.actions.some((action) => action.action !== 'delete' || action.table !== 'flows') ||
+        plan.summary.delete !== plan.actions.length ||
+        plan.summary.save_draft !== 0 ||
+        (plan.summary.update_json_ordered ?? 0) !== 0 ||
+        (plan.summary.rebuild_derivatives ?? 0) !== 0 ||
+        plan.summary.current_reference_impacts !== 0 ||
+        plan.summary.projected_reference_impacts !== 0) {
+        throw new CliError('--max-parallel maintenance apply requires a non-empty flow delete-only plan with zero current and projected inbound references.', {
+            code: 'DATASET_MAINTENANCE_PARALLEL_DELETE_PLAN_REQUIRED',
+            exitCode: 1,
+        });
+    }
+    for (const action of plan.actions) {
+        const target = `${action.table}\u0000${action.id}\u0000${action.version}`;
+        if (targets.has(target)) {
+            throw new CliError('Parallel delete plan contains a repeated table/id/version target.', {
+                code: 'DATASET_MAINTENANCE_PARALLEL_DELETE_TARGET_DUPLICATE',
+                exitCode: 1,
+                details: { table: action.table, id: action.id, version: action.version },
+            });
+        }
+        targets.add(target);
+    }
+}
+function parallelDeleteTargetBindingSha256(plan) {
+    return sha256Json(plan.actions.map((action, index) => ({
+        index,
+        ordinal: action.ordinal,
+        action_id: action.action_id,
+        table: action.table,
+        id: action.id,
+        version: action.version,
+        expected_user_id: action.expected_user_id,
+        expected_state_code: action.expected_state_code,
+        before_sha256: action.before?.row_sha256 ?? null,
+    })));
+}
+function invalidGlobalInboundProof(message, details) {
+    throw new CliError(message, {
+        code: 'DATASET_MAINTENANCE_GLOBAL_INBOUND_PROOF_INVALID',
+        exitCode: 1,
+        details,
+    });
+}
+function assertGlobalInboundProofOptionShape(options) {
+    const hasPath = typeof options.proofPath === 'string' && options.proofPath.length > 0;
+    const hasApproval = typeof options.approveProof === 'string' && options.approveProof.length > 0;
+    if (hasPath !== hasApproval) {
+        throw new CliError('--global-inbound-proof and --approve-global-inbound-proof must be provided together.', {
+            code: 'DATASET_MAINTENANCE_GLOBAL_INBOUND_PROOF_OPTIONS_INCOMPLETE',
+            exitCode: 2,
+        });
+    }
+    if ((hasPath || hasApproval) && !options.parallelDeleteMode) {
+        throw new CliError('A global inbound proof is allowed only with --max-parallel flow delete-only execution.', {
+            code: 'DATASET_MAINTENANCE_GLOBAL_INBOUND_PROOF_MODE_INVALID',
+            exitCode: 2,
+        });
+    }
+    if (hasApproval && !SHA256_PATTERN.test(options.approveProof)) {
+        throw new CliError('--approve-global-inbound-proof must be a lowercase SHA-256.', {
+            code: 'DATASET_MAINTENANCE_GLOBAL_INBOUND_PROOF_APPROVAL_INVALID',
+            exitCode: 2,
+        });
+    }
+}
+function validateParallelDeleteGlobalInboundProof(options) {
+    if (!options.proofPath || !options.approveProof)
+        return null;
+    if (!path.isAbsolute(options.proofPath)) {
+        invalidGlobalInboundProof('Global inbound proof path must be absolute.');
+    }
+    let proofText;
+    try {
+        proofText = readFileSync(options.proofPath, 'utf8');
+    }
+    catch (error) {
+        invalidGlobalInboundProof('Global inbound proof file could not be read.', errorMessage(error));
+    }
+    const proofSha256 = sha256Text(proofText);
+    if (proofSha256 !== options.approveProof) {
+        invalidGlobalInboundProof('Global inbound proof file SHA-256 does not match approval.', {
+            expected: options.approveProof,
+            actual: proofSha256,
+        });
+    }
+    let value;
+    try {
+        value = JSON.parse(proofText);
+    }
+    catch (error) {
+        invalidGlobalInboundProof('Global inbound proof is not valid JSON.', errorMessage(error));
+    }
+    if (!isJsonObject(value)) {
+        invalidGlobalInboundProof('Global inbound proof must be a JSON object.');
+    }
+    const expectedBinding = parallelDeleteTargetBindingSha256(options.plan);
+    const capturedAt = typeof value.captured_at_utc === 'string' ? Date.parse(value.captured_at_utc) : NaN;
+    const nowMs = options.now.getTime();
+    const capturedAgeMs = nowMs - capturedAt;
+    const safePositiveInteger = (candidate) => Number.isSafeInteger(candidate) && Number(candidate) > 0;
+    if (value.schema_version !== 'dataset-maintenance-global-inbound-proof.v1' ||
+        value.status !== 'PASS_GLOBAL_ALL_PROCESS_INBOUND_ZERO' ||
+        value.statement_kind !== 'SELECT' ||
+        value.source !== 'supabase_select_only_raw_sql' ||
+        value.process_scope !== 'all_process_rows_without_rls_restriction' ||
+        !Number.isFinite(capturedAt) ||
+        capturedAgeMs < -30_000 ||
+        capturedAgeMs > GLOBAL_INBOUND_PROOF_MAX_AGE_MS ||
+        value.project_ref !== options.context.project_ref ||
+        value.actor_user_id !== options.context.account.user_id ||
+        value.plan_sha256 !== options.plan.plan_sha256 ||
+        value.operation !== 'delete' ||
+        value.target_table !== 'flows' ||
+        value.target_count !== options.plan.actions.length ||
+        value.target_binding_sha256 !== expectedBinding ||
+        !safePositiveInteger(value.global_process_rows) ||
+        !safePositiveInteger(value.global_exchange_rows) ||
+        value.inbound_exchanges !== 0 ||
+        value.old_flow_identities_with_inbound !== 0 ||
+        value.process_identities_with_inbound !== 0 ||
+        value.p0 !== 0 ||
+        value.p1 !== 0 ||
+        !Array.isArray(value.chunks) ||
+        value.chunks.length === 0) {
+        invalidGlobalInboundProof('Global inbound proof metadata or zero-inbound result is invalid.', {
+            expected_project_ref: options.context.project_ref,
+            expected_actor_user_id: options.context.account.user_id,
+            expected_plan_sha256: options.plan.plan_sha256,
+            expected_target_count: options.plan.actions.length,
+            expected_target_binding_sha256: expectedBinding,
+        });
+    }
+    let expectedStart = 0;
+    for (const [index, rawChunk] of value.chunks.entries()) {
+        if (!isJsonObject(rawChunk)) {
+            invalidGlobalInboundProof('Global inbound proof contains a non-object chunk.', { index });
+        }
+        const chunkCapturedAt = typeof rawChunk.captured_at_utc === 'string' ? Date.parse(rawChunk.captured_at_utc) : NaN;
+        const chunkAgeMs = nowMs - chunkCapturedAt;
+        if (rawChunk.index !== index ||
+            rawChunk.start !== expectedStart ||
+            !Number.isSafeInteger(rawChunk.end_exclusive) ||
+            Number(rawChunk.end_exclusive) <= expectedStart ||
+            Number(rawChunk.end_exclusive) > options.plan.actions.length ||
+            rawChunk.target_count !== Number(rawChunk.end_exclusive) - expectedStart ||
+            !Number.isFinite(chunkCapturedAt) ||
+            chunkAgeMs < -30_000 ||
+            chunkAgeMs > GLOBAL_INBOUND_PROOF_MAX_AGE_MS ||
+            rawChunk.inbound_exchanges !== 0 ||
+            rawChunk.old_flow_identities_with_inbound !== 0 ||
+            rawChunk.process_identities_with_inbound !== 0 ||
+            rawChunk.owner_draft_inbound !== 0 ||
+            rawChunk.public_inbound !== 0 ||
+            rawChunk.foreign_private_inbound !== 0 ||
+            rawChunk.other_state_inbound !== 0 ||
+            typeof rawChunk.sql_sha256 !== 'string' ||
+            !SHA256_PATTERN.test(rawChunk.sql_sha256)) {
+            invalidGlobalInboundProof('Global inbound proof contains an invalid or incomplete chunk.', {
+                index,
+                expected_start: expectedStart,
+            });
+        }
+        expectedStart = Number(rawChunk.end_exclusive);
+    }
+    if (expectedStart !== options.plan.actions.length) {
+        invalidGlobalInboundProof('Global inbound proof chunks do not cover every delete target.', {
+            expected_end: options.plan.actions.length,
+            actual_end: expectedStart,
+        });
+    }
+    return {
+        ...value,
+        proof_path: options.proofPath,
+        proof_sha256: proofSha256,
+    };
+}
+function parseParallelDeleteExecutionLog(plan, executionLogPath) {
+    const actions = new Map(plan.actions.map((action) => [action.action_id, action]));
+    const entries = [];
+    const byAction = new Map();
+    const dispatched = new Set();
+    const committed = new Set();
+    for (const value of readJsonLinesIfPresent(executionLogPath)) {
+        const action = isJsonObject(value) && typeof value.action_id === 'string'
+            ? actions.get(value.action_id)
+            : null;
+        const expectedDesired = action ? parallelDeleteDesiredSha256(action) : null;
+        const actionEntries = action ? (byAction.get(action.action_id) ?? []) : [];
+        const priorDispatched = actionEntries.some((entry) => entry.status === 'DISPATCHED');
+        const priorCommitted = actionEntries.some((entry) => entry.status === 'COMMITTED');
+        const status = isJsonObject(value) ? value.status : null;
+        const auditIdValid = isJsonObject(value) &&
+            (value.audit_id === null ||
+                (typeof value.audit_id === 'string' && POSITIVE_INTEGER_TEXT.test(value.audit_id)));
+        const remoteHashValid = isJsonObject(value) &&
+            (value.remote_result_sha256 === null ||
+                (typeof value.remote_result_sha256 === 'string' &&
+                    /^[a-f0-9]{64}$/u.test(value.remote_result_sha256)));
+        const commonOutcomeFieldsValid = isJsonObject(value) &&
+            typeof value.attempt_consumed === 'boolean' &&
+            typeof value.recovered === 'boolean' &&
+            (value.readback_sha256 === null ||
+                (typeof value.readback_sha256 === 'string' &&
+                    /^[a-f0-9]{64}$/u.test(value.readback_sha256))) &&
+            (value.error === null || typeof value.error === 'string');
+        const statusFieldsValid = isJsonObject(value) &&
+            ((status === 'PREPARED' &&
+                value.attempt_consumed === false &&
+                value.recovered === false &&
+                value.audit_id === null &&
+                value.readback_sha256 === null &&
+                value.remote_result_sha256 === null &&
+                value.error === null &&
+                !priorDispatched &&
+                !priorCommitted) ||
+                (status === 'DISPATCHED' &&
+                    value.attempt_consumed === true &&
+                    value.recovered === false &&
+                    value.audit_id === null &&
+                    value.readback_sha256 === null &&
+                    value.remote_result_sha256 === null &&
+                    value.error === null &&
+                    actionEntries.some((entry) => entry.status === 'PREPARED') &&
+                    !priorDispatched &&
+                    !priorCommitted) ||
+                (status === 'UNKNOWN' &&
+                    value.attempt_consumed === true &&
+                    typeof value.error === 'string' &&
+                    value.error.length > 0 &&
+                    priorDispatched &&
+                    !priorCommitted) ||
+                (status === 'COMMITTED' &&
+                    value.attempt_consumed === true &&
+                    value.readback_sha256 === ABSENT_READBACK_SHA256 &&
+                    value.error === null &&
+                    priorDispatched &&
+                    !priorCommitted));
+        if (!isJsonObject(value) ||
+            value.schema_version !== 1 ||
+            value.plan_sha256 !== plan.plan_sha256 ||
+            value.operation_id !== plan.operation_id ||
+            !action ||
+            action.action !== 'delete' ||
+            action.table !== 'flows' ||
+            value.attempt_key !== `${action.action_id}@${expectedDesired}` ||
+            value.action !== 'delete' ||
+            value.table !== 'flows' ||
+            value.id !== action.id ||
+            value.version !== action.version ||
+            value.desired_sha256 !== expectedDesired ||
+            value.before_sha256 !== action.before?.row_sha256 ||
+            !isJsonObject(value.actor) ||
+            value.actor.user_id !== plan.account.user_id ||
+            value.actor.email !== plan.account.email ||
+            !isJsonObject(value.audit_context) ||
+            value.audit_context.plan_sha256 !== plan.plan_sha256 ||
+            value.audit_context.operation_id !== plan.operation_id ||
+            value.audit_context.action_id !== action.action_id ||
+            value.audit_context.reason_code !== action.reason_code ||
+            value.audit_context.source !== 'tiangong-lca dataset maintenance apply' ||
+            typeof value.recorded_at_utc !== 'string' ||
+            !Number.isFinite(Date.parse(value.recorded_at_utc)) ||
+            !auditIdValid ||
+            !remoteHashValid ||
+            !commonOutcomeFieldsValid ||
+            !statusFieldsValid) {
+            throw new CliError('Parallel delete execution log contains an invalid or foreign entry.', {
+                code: 'DATASET_MAINTENANCE_PARALLEL_DELETE_LOG_INVALID',
+                exitCode: 1,
+                details: value,
+            });
+        }
+        const entry = value;
+        entries.push(entry);
+        actionEntries.push(entry);
+        byAction.set(action.action_id, actionEntries);
+        if (entry.status === 'DISPATCHED')
+            dispatched.add(action.action_id);
+        if (entry.status === 'COMMITTED')
+            committed.add(action.action_id);
+    }
+    return { entries, byAction, dispatched, committed };
+}
+function appendParallelDeleteExecutionEntry(options) {
+    const desiredSha256 = parallelDeleteDesiredSha256(options.action);
+    const entry = {
+        schema_version: 1,
+        plan_sha256: options.plan.plan_sha256,
+        operation_id: options.plan.operation_id,
+        action_id: options.action.action_id,
+        attempt_key: `${options.action.action_id}@${desiredSha256}`,
+        action: 'delete',
+        table: 'flows',
+        id: options.action.id,
+        version: options.action.version,
+        desired_sha256: desiredSha256,
+        before_sha256: options.action.before.row_sha256,
+        actor: {
+            user_id: options.context.account.user_id,
+            email: options.context.account.email,
+        },
+        status: options.status,
+        recorded_at_utc: options.recordedAtUtc,
+        attempt_consumed: options.status !== 'PREPARED',
+        recovered: options.recovered ?? false,
+        audit_context: {
+            plan_sha256: options.plan.plan_sha256,
+            operation_id: options.plan.operation_id,
+            action_id: options.action.action_id,
+            reason_code: options.action.reason_code,
+            source: 'tiangong-lca dataset maintenance apply',
+        },
+        audit_id: options.auditId ?? null,
+        readback_sha256: options.readbackSha256 ?? null,
+        remote_result_sha256: options.remoteResultSha256 ?? null,
+        error: options.error ?? null,
+    };
+    const descriptor = openSync(options.path, 'a', 0o600);
+    try {
+        fchmodSync(descriptor, 0o600);
+        writeFileSync(descriptor, `${stableJsonText(entry)}\n`, 'utf8');
+        fsyncSync(descriptor);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+    options.state.entries.push(entry);
+    const actionEntries = options.state.byAction.get(options.action.action_id) ?? [];
+    actionEntries.push(entry);
+    options.state.byAction.set(options.action.action_id, actionEntries);
+    if (entry.status === 'DISPATCHED')
+        options.state.dispatched.add(options.action.action_id);
+    if (entry.status === 'COMMITTED')
+        options.state.committed.add(options.action.action_id);
+    return entry;
+}
+function assertNoVisibleProcessInboundReferences(options) {
+    const targets = new Set(options.plan.actions.map((action) => `${action.id}\u0000${action.version}`));
+    const targetIds = new Set(options.plan.actions.map((action) => action.id));
+    const payloadRows = options.rows
+        .filter((row) => row.table === 'processes' && row.json_ordered !== null)
+        .map((row) => ({
+        table: row.table,
+        id: row.id,
+        version: row.version,
+        json_ordered: row.json_ordered,
+    }));
+    const references = collectRemoteReferences(payloadRows).filter((reference) => reference.role === 'reference' &&
+        reference.table === 'flows' &&
+        typeof reference.id === 'string');
+    const inbound = references.filter((reference) => reference.version
+        ? targets.has(`${reference.id}\u0000${reference.version}`)
+        : targetIds.has(reference.id));
+    if (inbound.length > 0) {
+        throw new CliError('Parallel flow delete admission found visible process inbound references.', {
+            code: 'DATASET_MAINTENANCE_PARALLEL_DELETE_INBOUND_REFERENCES',
+            exitCode: 1,
+            details: {
+                inbound_count: inbound.length,
+                first: inbound.slice(0, 20),
+            },
+        });
+    }
+    return {
+        process_rows: payloadRows.length,
+        process_references: references.length,
+        snapshot_sha256: sha256Json(payloadRows.map((row) => ({
+            table: row.table,
+            id: row.id,
+            version: row.version,
+            payload_sha256: sha256Json(row.json_ordered),
+        }))),
+    };
+}
 function loadDesiredPayload(planDir, action) {
     return loadMaintenanceDesiredPayload(planDir, action);
 }
@@ -413,6 +819,13 @@ function assertApplyPreconditions(options) {
             }
             continue;
         }
+        if (action.action === 'delete' && options.attemptedDeleteActionIds?.has(action.action_id)) {
+            // A request may have committed before its response or progress row was
+            // persisted, or the target may have drifted after dispatch. The execution
+            // ledger owns both cases and permits only read-only recovery, never an
+            // automatic replay.
+            continue;
+        }
         if (!currentRow || currentRow.user_id !== action.expected_user_id) {
             throw new CliError(`Action row is missing, non-draft, or not owned: ${action.action_id}`, {
                 code: 'DATASET_MAINTENANCE_ACTION_ROW_DRIFT',
@@ -627,39 +1040,6 @@ function validateAliasPlanRpcResult(value, plan) {
         raw: value,
     };
 }
-async function executeAliasPlan(options) {
-    const request = buildAliasPlanRequest(options);
-    const remoteResult = await applyMaintenanceAliasPlan({
-        context: options.context,
-        plan: request,
-    });
-    const rpc = validateAliasPlanRpcResult(remoteResult, options.plan);
-    const afterByAction = new Map();
-    for (const action of options.plan.actions) {
-        const exact = await fetchMaintenanceExactRows({
-            context: options.context,
-            table: action.table,
-            id: action.id,
-            version: action.version,
-        });
-        const row = exact.rows.length === 1 ? exact.rows[0] : null;
-        const snapshot = row ? snapshotRemoteRow(row) : null;
-        if (!row ||
-            row.user_id !== action.expected_user_id ||
-            row.state_code !== 0 ||
-            snapshot?.payload_sha256 !== action.desired_payload?.sha256 ||
-            row.model_id !== action.before?.model_id ||
-            row.rule_verification !== action.before?.rule_verification) {
-            throw new CliError(`Alias plan readback failed for action ${action.action_id}.`, {
-                code: 'DATASET_MAINTENANCE_ALIAS_READBACK_FAILED',
-                exitCode: 1,
-            });
-        }
-        afterByAction.set(action.action_id, snapshot.row_sha256);
-    }
-    await assertAliasSupportSnapshots({ plan: options.plan, context: options.context });
-    return { rpc, after_by_action: afterByAction };
-}
 function aliasExchangeProgressKey(value) {
     return `${value.batch_id}\u0000${value.action_id}\u0000${value.exchange_index}\u0000${value.data_set_internal_id}`;
 }
@@ -1026,6 +1406,335 @@ async function executeAction(options) {
     }
     return { afterSha256: null, remoteResultSha256: sha256Json(remoteResult) };
 }
+function appendParallelDeleteProgress(options) {
+    const entry = {
+        schema_version: 1,
+        plan_sha256: options.plan.plan_sha256,
+        operation_id: options.plan.operation_id,
+        action_id: options.action.action_id,
+        action: 'delete',
+        table: options.action.table,
+        id: options.action.id,
+        version: options.action.version,
+        reason_code: options.action.reason_code,
+        audit_context: {
+            plan_sha256: options.plan.plan_sha256,
+            operation_id: options.plan.operation_id,
+            action_id: options.action.action_id,
+            reason_code: options.action.reason_code,
+            source: 'tiangong-lca dataset maintenance apply',
+        },
+        actor: {
+            user_id: options.context.account.user_id,
+            email: options.context.account.email,
+        },
+        started_at_utc: options.startedAtUtc,
+        ended_at_utc: options.endedAtUtc,
+        before_sha256: options.action.before.row_sha256,
+        after_sha256: null,
+        remote_result_sha256: options.remoteResultSha256,
+        result: options.result,
+        error: options.error,
+        rollback: options.action.rollback,
+    };
+    appendStableJsonLine(options.progressPath, entry);
+    options.progress.entries.push(entry);
+    if (entry.result === 'success') {
+        options.progress.successes.set(entry.action_id, entry);
+        options.progress.latestFailures.delete(entry.action_id);
+    }
+    else if (!options.progress.successes.has(entry.action_id)) {
+        options.progress.latestFailures.set(entry.action_id, entry);
+    }
+    return entry;
+}
+function remoteAuditId(value) {
+    const candidate = value.audit_id;
+    return typeof candidate === 'string' && POSITIVE_INTEGER_TEXT.test(candidate) ? candidate : null;
+}
+async function exactParallelDeleteRows(options) {
+    return (await fetchMaintenanceExactRows({
+        context: options.context,
+        table: options.action.table,
+        id: options.action.id,
+        version: options.action.version,
+    })).rows;
+}
+function exactParallelDeleteBefore(options) {
+    const row = options.rows[0];
+    return Boolean(options.rows.length === 1 &&
+        row &&
+        row.user_id === options.action.expected_user_id &&
+        row.state_code === 0 &&
+        snapshotRemoteRow(row).row_sha256 === options.action.before?.row_sha256);
+}
+async function executeParallelDeletePlan(options) {
+    const statuses = new Map();
+    const recoverAttempted = async (action) => {
+        const startedAt = options.now();
+        let rows;
+        try {
+            rows = await exactParallelDeleteRows({ context: options.context, action });
+        }
+        catch (error) {
+            statuses.set(action.action_id, 'unknown');
+            if (options.execution.byAction.get(action.action_id)?.at(-1)?.status !== 'UNKNOWN') {
+                appendParallelDeleteExecutionEntry({
+                    path: options.executionLogPath,
+                    state: options.execution,
+                    plan: options.plan,
+                    action,
+                    context: options.context,
+                    status: 'UNKNOWN',
+                    recordedAtUtc: options.now(),
+                    recovered: true,
+                    error: `Read-only recovery failed: ${errorMessage(error)}`,
+                });
+            }
+            return;
+        }
+        if (rows.length === 0) {
+            const priorCommitted = options.execution.committed.has(action.action_id);
+            if (!priorCommitted) {
+                appendParallelDeleteExecutionEntry({
+                    path: options.executionLogPath,
+                    state: options.execution,
+                    plan: options.plan,
+                    action,
+                    context: options.context,
+                    status: 'COMMITTED',
+                    recordedAtUtc: options.now(),
+                    recovered: true,
+                    readbackSha256: ABSENT_READBACK_SHA256,
+                });
+            }
+            if (!options.progress.successes.has(action.action_id)) {
+                appendParallelDeleteProgress({
+                    progressPath: options.progressPath,
+                    progress: options.progress,
+                    plan: options.plan,
+                    action,
+                    context: options.context,
+                    startedAtUtc: startedAt,
+                    endedAtUtc: options.now(),
+                    result: 'success',
+                    remoteResultSha256: sha256Json({
+                        recovery: 'desired_absent',
+                        action_id: action.action_id,
+                        desired_sha256: parallelDeleteDesiredSha256(action),
+                    }),
+                    error: null,
+                });
+            }
+            statuses.set(action.action_id, 'success');
+            return;
+        }
+        const message = exactParallelDeleteBefore({ rows, action })
+            ? 'Prior dispatch has exact-before readback but no zero-dispatch/zero-mutation audit proof; replay is forbidden.'
+            : 'Prior dispatch has ambiguous or drifted readback; replay is forbidden.';
+        if (!options.execution.committed.has(action.action_id) &&
+            options.execution.byAction.get(action.action_id)?.at(-1)?.status !== 'UNKNOWN') {
+            appendParallelDeleteExecutionEntry({
+                path: options.executionLogPath,
+                state: options.execution,
+                plan: options.plan,
+                action,
+                context: options.context,
+                status: 'UNKNOWN',
+                recordedAtUtc: options.now(),
+                recovered: true,
+                readbackSha256: sha256Json(rows.map(snapshotRemoteRow)),
+                error: message,
+            });
+        }
+        if (!options.progress.successes.has(action.action_id)) {
+            appendParallelDeleteProgress({
+                progressPath: options.progressPath,
+                progress: options.progress,
+                plan: options.plan,
+                action,
+                context: options.context,
+                startedAtUtc: startedAt,
+                endedAtUtc: options.now(),
+                result: 'failed',
+                remoteResultSha256: null,
+                error: `UNKNOWN: ${message}`,
+            });
+        }
+        statuses.set(action.action_id, 'unknown');
+    };
+    const executeOne = async (action) => {
+        if (options.progress.successes.has(action.action_id)) {
+            statuses.set(action.action_id, 'success');
+            return;
+        }
+        if (options.execution.dispatched.has(action.action_id)) {
+            await recoverAttempted(action);
+            return;
+        }
+        const startedAt = options.now();
+        let rows;
+        try {
+            rows = await exactParallelDeleteRows({ context: options.context, action });
+            if (!exactParallelDeleteBefore({ rows, action })) {
+                throw new CliError(`Action row drifted immediately before write: ${action.action_id}`, {
+                    code: 'DATASET_MAINTENANCE_ACTION_JUST_IN_TIME_DRIFT',
+                    exitCode: 1,
+                });
+            }
+        }
+        catch (error) {
+            appendParallelDeleteProgress({
+                progressPath: options.progressPath,
+                progress: options.progress,
+                plan: options.plan,
+                action,
+                context: options.context,
+                startedAtUtc: startedAt,
+                endedAtUtc: options.now(),
+                result: 'failed',
+                remoteResultSha256: null,
+                error: errorMessage(error),
+            });
+            statuses.set(action.action_id, 'failed');
+            return;
+        }
+        appendParallelDeleteExecutionEntry({
+            path: options.executionLogPath,
+            state: options.execution,
+            plan: options.plan,
+            action,
+            context: options.context,
+            status: 'PREPARED',
+            recordedAtUtc: options.now(),
+        });
+        appendParallelDeleteExecutionEntry({
+            path: options.executionLogPath,
+            state: options.execution,
+            plan: options.plan,
+            action,
+            context: options.context,
+            status: 'DISPATCHED',
+            recordedAtUtc: options.now(),
+        });
+        let remoteResult = null;
+        let dispatchError = null;
+        try {
+            remoteResult = await deleteMaintenanceRow({
+                context: options.context,
+                table: action.table,
+                id: action.id,
+                version: action.version,
+                audit: {
+                    plan_sha256: options.plan.plan_sha256,
+                    operation_id: options.plan.operation_id,
+                    action_id: action.action_id,
+                    reason_code: action.reason_code,
+                    desired_sha256: parallelDeleteDesiredSha256(action),
+                    source: 'tiangong-lca dataset maintenance apply',
+                },
+            });
+        }
+        catch (error) {
+            dispatchError = error;
+        }
+        let readbackRows = null;
+        let readbackError = null;
+        try {
+            readbackRows = await exactParallelDeleteRows({ context: options.context, action });
+        }
+        catch (error) {
+            readbackError = error;
+        }
+        if (readbackRows?.length === 0) {
+            const remoteResultSha256 = remoteResult ? sha256Json(remoteResult) : null;
+            appendParallelDeleteExecutionEntry({
+                path: options.executionLogPath,
+                state: options.execution,
+                plan: options.plan,
+                action,
+                context: options.context,
+                status: 'COMMITTED',
+                recordedAtUtc: options.now(),
+                recovered: dispatchError !== null,
+                auditId: remoteResult ? remoteAuditId(remoteResult) : null,
+                readbackSha256: ABSENT_READBACK_SHA256,
+                remoteResultSha256,
+            });
+            appendParallelDeleteProgress({
+                progressPath: options.progressPath,
+                progress: options.progress,
+                plan: options.plan,
+                action,
+                context: options.context,
+                startedAtUtc: startedAt,
+                endedAtUtc: options.now(),
+                result: 'success',
+                remoteResultSha256: remoteResultSha256 ??
+                    sha256Json({
+                        recovery: 'desired_absent',
+                        action_id: action.action_id,
+                        desired_sha256: parallelDeleteDesiredSha256(action),
+                    }),
+                error: null,
+            });
+            statuses.set(action.action_id, 'success');
+            return;
+        }
+        const error = readbackError
+            ? `Readback failed after dispatch: ${errorMessage(readbackError)}`
+            : dispatchError
+                ? `Dispatch outcome ambiguous and desired absence was not observed: ${errorMessage(dispatchError)}`
+                : 'Delete RPC returned but exact absent readback was not observed.';
+        appendParallelDeleteExecutionEntry({
+            path: options.executionLogPath,
+            state: options.execution,
+            plan: options.plan,
+            action,
+            context: options.context,
+            status: 'UNKNOWN',
+            recordedAtUtc: options.now(),
+            recovered: dispatchError !== null,
+            auditId: remoteResult ? remoteAuditId(remoteResult) : null,
+            readbackSha256: readbackRows ? sha256Json(readbackRows.map(snapshotRemoteRow)) : null,
+            remoteResultSha256: remoteResult ? sha256Json(remoteResult) : null,
+            error,
+        });
+        appendParallelDeleteProgress({
+            progressPath: options.progressPath,
+            progress: options.progress,
+            plan: options.plan,
+            action,
+            context: options.context,
+            startedAtUtc: startedAt,
+            endedAtUtc: options.now(),
+            result: 'failed',
+            remoteResultSha256: null,
+            error: `UNKNOWN: ${error}`,
+        });
+        statuses.set(action.action_id, 'unknown');
+    };
+    let nextIndex = 0;
+    let fatalError = null;
+    const worker = async () => {
+        while (fatalError === null) {
+            const index = nextIndex;
+            nextIndex += 1;
+            if (index >= options.plan.actions.length)
+                return;
+            try {
+                await executeOne(options.plan.actions[index]);
+            }
+            catch (error) {
+                fatalError ??= error;
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(options.maxParallel, options.plan.actions.length) }, () => worker()));
+    if (fatalError !== null)
+        throw fatalError;
+    return statuses;
+}
 async function executeDerivativeAdmission(options) {
     const action = derivativePlanAction(options.plan);
     const plannedSnapshot = action.derivative_before;
@@ -1036,8 +1745,7 @@ async function executeDerivativeAdmission(options) {
     }), { id: action.id, version: action.version, userId: action.expected_user_id });
     if (preflight.modified_at !== plannedSnapshot.modified_at ||
         preflight.json_sha256 !== plannedSnapshot.json_sha256 ||
-        preflight.json_ordered_sha256 !== plannedSnapshot.json_ordered_sha256 ||
-        preflight.extracted_text_sha256 !== plannedSnapshot.extracted_text_sha256) {
+        preflight.json_ordered_sha256 !== plannedSnapshot.json_ordered_sha256) {
         throw new CliError('Derivative action primary preconditions drifted after planning.', {
             code: 'DATASET_MAINTENANCE_DERIVATIVE_PRIMARY_DRIFT',
             exitCode: 1,
@@ -1087,6 +1795,13 @@ function nextAttemptPath(planDir) {
     }
     return path.join(planDir, `commit-report.attempt-${String(attempt).padStart(4, '0')}.json`);
 }
+function nextParallelDeleteInboundBarrierPath(planDir) {
+    let attempt = 1;
+    while (existsSync(path.join(planDir, `parallel-delete-inbound-barrier.attempt-${String(attempt).padStart(4, '0')}.json`))) {
+        attempt += 1;
+    }
+    return path.join(planDir, `parallel-delete-inbound-barrier.attempt-${String(attempt).padStart(4, '0')}.json`);
+}
 export async function runDatasetMaintenanceApply(options) {
     if (!options.commit) {
         throw new CliError('Dataset maintenance apply requires commit=true.', {
@@ -1097,6 +1812,16 @@ export async function runDatasetMaintenanceApply(options) {
     const planPath = path.resolve(options.planPath);
     const planDir = path.dirname(planPath);
     const plan = parseMaintenancePlan(readJsonFile(planPath, 'Maintenance plan'));
+    const parallelDeleteMode = options.maxParallel !== undefined;
+    const maxParallel = normalizeMaintenanceMaxParallel(options.maxParallel);
+    assertGlobalInboundProofOptionShape({
+        parallelDeleteMode,
+        proofPath: options.globalInboundProofPath,
+        approveProof: options.approveGlobalInboundProof,
+    });
+    if (parallelDeleteMode) {
+        assertParallelDeletePlan(plan);
+    }
     if (options.approvePlan !== plan.plan_sha256) {
         throw new CliError('approvePlan must exactly match the canonical maintenance plan hash.', {
             code: 'DATASET_MAINTENANCE_PLAN_APPROVAL_REQUIRED',
@@ -1147,24 +1872,87 @@ export async function runDatasetMaintenanceApply(options) {
                 exitCode: 2,
             });
         }
+        const globalInboundProof = parallelDeleteMode
+            ? validateParallelDeleteGlobalInboundProof({
+                proofPath: options.globalInboundProofPath,
+                approveProof: options.approveGlobalInboundProof,
+                plan,
+                context,
+                now: options.now ?? new Date(),
+            })
+            : null;
         const derivativeProgress = plan.operation === 'rebuild-derivatives'
             ? parseDerivativeSubmitProgress(plan, progressPath)
             : { entries: [], latest: null };
         const progress = plan.operation === 'rebuild-derivatives'
             ? { entries: [], successes: new Map(), latestFailures: new Map() }
             : parseProgress(plan, progressPath);
+        const executionLogPath = path.join(planDir, 'apply-execution-log.jsonl');
+        const parallelDeleteExecution = parallelDeleteMode
+            ? parseParallelDeleteExecutionLog(plan, executionLogPath)
+            : { entries: [], byAction: new Map(), dispatched: new Set(), committed: new Set() };
         const resumedSuccesses = progress.successes.size;
-        const current = await fetchMaintenanceAccountRows({
-            context,
-            userId: plan.account.user_id,
-        });
+        const [current, visibleProcesses] = await Promise.all([
+            fetchMaintenanceAccountRows({
+                context,
+                userId: plan.account.user_id,
+            }),
+            parallelDeleteMode && !globalInboundProof
+                ? fetchMaintenanceVisibleTableRows({
+                    context,
+                    table: 'processes',
+                    pageSize: PARALLEL_DELETE_VISIBLE_PROCESS_PAGE_SIZE,
+                })
+                : Promise.resolve(null),
+        ]);
         assertApplyPreconditions({
             plan,
             planDir,
             currentRows: current.rows,
             progress,
             aliasPlanProgress: { entries: [], success: null, latestFailure: null },
+            attemptedDeleteActionIds: parallelDeleteExecution.dispatched,
         });
+        const inboundBarrierPath = nextParallelDeleteInboundBarrierPath(planDir);
+        const inboundBarrier = globalInboundProof
+            ? {
+                process_rows: globalInboundProof.global_process_rows,
+                process_references: globalInboundProof.global_exchange_rows,
+                snapshot_sha256: globalInboundProof.proof_sha256,
+            }
+            : parallelDeleteMode && visibleProcesses
+                ? assertNoVisibleProcessInboundReferences({ plan, rows: visibleProcesses.rows })
+                : null;
+        if (inboundBarrier && (visibleProcesses || globalInboundProof)) {
+            writeImmutableJson(inboundBarrierPath, {
+                schema_version: 1,
+                generated_at_utc: clock(options),
+                plan_sha256: plan.plan_sha256,
+                operation_id: plan.operation_id,
+                actor: { user_id: context.account.user_id, email: context.account.email },
+                target_table: 'flows',
+                target_count: plan.actions.length,
+                inbound_reference_count: 0,
+                ...inboundBarrier,
+                completeness: globalInboundProof
+                    ? {
+                        status: 'complete',
+                        complete: true,
+                        strategy: 'sha256_approved_global_select_only_all_processes',
+                        statement_kind: globalInboundProof.statement_kind,
+                        process_scope: globalInboundProof.process_scope,
+                        proof_path: globalInboundProof.proof_path,
+                        proof_sha256: globalInboundProof.proof_sha256,
+                        captured_at_utc: globalInboundProof.captured_at_utc,
+                        target_binding_sha256: globalInboundProof.target_binding_sha256,
+                        chunk_count: globalInboundProof.chunks.length,
+                        global_process_rows: globalInboundProof.global_process_rows,
+                        global_exchange_rows: globalInboundProof.global_exchange_rows,
+                        inbound_exchanges: globalInboundProof.inbound_exchanges,
+                    }
+                    : visibleProcesses.completeness,
+            });
+        }
         const approvalPath = path.join(planDir, 'approval-record.json');
         const approvalAlreadyExisted = existsSync(approvalPath);
         validateApprovalRecord({ path: approvalPath, plan, context });
@@ -1284,6 +2072,80 @@ export async function runDatasetMaintenanceApply(options) {
             writeJsonArtifact(report.artifacts.commit_report, report);
             return report;
         }
+        if (parallelDeleteMode) {
+            const executionStatuses = await executeParallelDeletePlan({
+                plan,
+                context,
+                progress,
+                progressPath,
+                executionLogPath,
+                execution: parallelDeleteExecution,
+                maxParallel,
+                now: () => clock(options),
+            });
+            const actions = plan.actions.map((action) => {
+                const status = executionStatuses.get(action.action_id);
+                return {
+                    action_id: action.action_id,
+                    action: action.action,
+                    table: action.table,
+                    id: action.id,
+                    version: action.version,
+                    status,
+                    error: progress.latestFailures.get(action.action_id)?.error ?? null,
+                };
+            });
+            const successCount = actions.filter((action) => action.status === 'success').length;
+            const failureCount = actions.filter((action) => action.status === 'failed').length;
+            const unknownCount = actions.filter((action) => action.status === 'unknown').length;
+            const attemptPath = nextAttemptPath(planDir);
+            const report = {
+                schema_version: 1,
+                generated_at_utc: clock(options),
+                status: unknownCount > 0
+                    ? 'completed_with_unknowns'
+                    : successCount === actions.length
+                        ? 'completed'
+                        : 'completed_with_failures',
+                task_id: plan.task_id,
+                operation: plan.operation,
+                operation_id: plan.operation_id,
+                target_mode: plan.target_mode,
+                plan_sha256: plan.plan_sha256,
+                actor: { user_id: context.account.user_id, email: context.account.email },
+                summary: {
+                    actions: actions.length,
+                    success: successCount,
+                    failed: failureCount,
+                    unknown: unknownCount,
+                    pending: actions.length - successCount - failureCount - unknownCount,
+                    resumed_successes: resumedSuccesses,
+                },
+                actions,
+                artifacts: {
+                    approval_record: approvalPath,
+                    apply_progress: progressPath,
+                    execution_log: executionLogPath,
+                    inbound_reference_barrier: inboundBarrierPath,
+                    commit_report: path.join(planDir, 'commit-report.json'),
+                    attempt_report: attemptPath,
+                },
+                database_audit: {
+                    rpc_transaction_log: 'public.command_audit_log',
+                    source: 'tiangong-lca dataset maintenance apply',
+                    correlation_fields: [
+                        'plan_sha256',
+                        'operation_id',
+                        'action_id',
+                        'reason_code',
+                        'desired_sha256',
+                    ],
+                },
+            };
+            writeImmutableJson(attemptPath, report);
+            writeJsonArtifact(report.artifacts.commit_report, report);
+            return report;
+        }
         const ordered = [...plan.actions].sort((left, right) => {
             const rank = {
                 save_draft: 0,
@@ -1426,25 +2288,36 @@ export const __testInternals = {
     aliasExchangeProgressKey,
     appendAliasSuccessLogs,
     appendAliasProofProgress,
+    appendParallelDeleteExecutionEntry,
+    assertNoVisibleProcessInboundReferences,
     assertApplyPreconditions,
     assertAliasSupportSnapshots,
+    assertGlobalInboundProofOptionShape,
+    assertParallelDeletePlan,
     buildAliasBatchRequest,
     buildAliasPlanRequest,
     clock,
     errorMessage,
     executeDerivativeAdmission,
-    executeAliasPlan,
     executeAction,
+    executeParallelDeletePlan,
     finalProjectedRows,
     loadDesiredPayload,
     nextAttemptPath,
+    nextParallelDeleteInboundBarrierPath,
+    normalizeMaintenanceMaxParallel,
+    parallelDeleteDesiredSha256,
+    parallelDeleteTargetBindingSha256,
     parseDerivativeSubmitProgress,
     validateDerivativeAdmissionAttempt,
     parseAliasBatchProgress,
     parseAliasPlanProgress,
     parseProgress,
+    parseParallelDeleteExecutionLog,
+    remoteAuditId,
     validateAliasRpcResult,
     validateAliasPlanRpcResult,
     validateApprovalRecord,
+    validateParallelDeleteGlobalInboundProof,
 };
 //# sourceMappingURL=dataset-maintenance-apply.js.map