@tiinex/app 0.1.1

package/src/workspaces/workspace.persistenceRecovery.js

@@ -0,0 +1,147 @@
+(function attachWorkspacePersistenceRecovery(global) {
+  'use strict';
+  const LOCAL_RECOVERY_INDEX_KEY = 'tiinex.site.localRecoveryIndex.v1';
+  const LOCAL_RECOVERY_INDEX_SCHEMA_ID = 'tiinex.workspace.localRecoveryIndex.v1';
+
+  function createLocalRecoveryIndex(state = {}, localDeltaState = null) {
+    const localState = localDeltaState || { activeWorkspaceId: state.activeWorkspaceId || '', workspaces: [] };
+    const fullById = new Map((Array.isArray(state.workspaces) ? state.workspaces : []).map((workspace) => [workspace.id, workspace]));
+    const workspaces = (Array.isArray(localState.workspaces) ? localState.workspaces : []).map((delta) => {
+      const full = fullById.get(delta.id) || {};
+      const hasConfiguredSource = (Array.isArray(full.sources) ? full.sources : []).some((source) => source && source.id !== 'local' && source.adapterId !== 'local' && source.kind !== 'local-session');
+      return { id: delta.id || '', title: delta.title || delta.name || full.title || full.name || 'Local workspace', name: delta.name || delta.title || full.name || full.title || 'Local workspace', localOnly: !hasConfiguredSource, hadConfiguredSource: hasConfiguredSource, recordCount: Array.isArray(delta.records) ? delta.records.length : 0, assetCount: Array.isArray(delta.assets) ? delta.assets.length : 0, updatedAt: new Date().toISOString() };
+    }).filter((workspace) => workspace.id);
+    return { schema: LOCAL_RECOVERY_INDEX_SCHEMA_ID, currentWorkspaceId: localState.activeWorkspaceId || state.activeWorkspaceId || workspaces[0]?.id || '', writtenAt: new Date().toISOString(), workspaces };
+  }
+
+  function readLocalRecoveryIndex(storage) {
+    try {
+      const value = storage?.getItem?.(LOCAL_RECOVERY_INDEX_KEY);
+      const parsed = value ? JSON.parse(value) : null;
+      return parsed && parsed.schema === LOCAL_RECOVERY_INDEX_SCHEMA_ID ? parsed : null;
+    } catch (_) { return null; }
+  }
+
+  function recoverableStateFromLocalDeltas(localState = {}, index = null) {
+    const metaById = new Map((Array.isArray(index?.workspaces) ? index.workspaces : []).map((workspace) => [workspace.id, workspace]));
+    const workspaces = (Array.isArray(localState.workspaces) ? localState.workspaces : []).map((delta) => {
+      const meta = metaById.get(delta.id) || {};
+      const localSource = { id: 'local', kind: 'local', adapterId: 'local', sourceKind: 'local.session', label: 'Local', boundary: 'recovered browser-local material; no source provenance inferred' };
+      return Object.assign({}, delta, {
+        id: delta.id,
+        name: delta.name || delta.title || meta.name || meta.title || 'Recovered local workspace',
+        title: delta.title || delta.name || meta.title || meta.name || 'Recovered local workspace',
+        kind: 'workspace',
+        source: { id: 'local-session', kind: 'local-session', adapterId: 'local', sourceKind: 'local.session', label: 'Local session' },
+        sources: [localSource], sourceOrder: ['local'], discoveryProgress: null,
+        workspaceRecovery: { schema: LOCAL_RECOVERY_INDEX_SCHEMA_ID, recoveredFromCleanStart: true, hadConfiguredSource: Boolean(meta.hadConfiguredSource), boundary: 'durable local deltas recovered without route/hash; source material must be reloaded explicitly' }
+      });
+    });
+    if (!workspaces.length) return null;
+    const current = index?.currentWorkspaceId || localState.activeWorkspaceId || '';
+    const activeWorkspaceId = workspaces.some((workspace) => workspace.id === current) ? current : workspaces[0].id;
+    return normalizeLegacyWorkspaceCandidateState({ version: localState.version || 1, activeWorkspaceId, view: defaultRecoveredView(), audit: null, workspaces });
+  }
+
+
+  function augmentStartupStateWithLocalRecovery(state = {}, localState = null, index = null, options = {}) {
+    const canonical = normalizeLegacyWorkspaceCandidateState(state);
+    if (!localState?.workspaces?.length) return canonical;
+    const canonicalLocalState = normalizeLegacyWorkspaceCandidateState(localState);
+    const localById = new Map((canonicalLocalState.workspaces || []).map((workspace) => [workspace.id, workspace]));
+    const workspaces = (canonical.workspaces || []).map((workspace) => mergeWorkspaceLocalDeltaForStartup(workspace, localById.get(workspace.id)));
+    const known = new Set(workspaces.map((workspace) => workspace.id));
+    const recovered = recoverableStateFromLocalDeltas(localState, index);
+    const unmatched = (recovered?.workspaces || []).filter((workspace) => !known.has(workspace.id));
+    const combined = [...workspaces, ...unmatched];
+    const savedFocusId = String(index?.currentWorkspaceId || localState?.activeWorkspaceId || '').trim();
+    const restoreFocus = options.restoreFocus !== false && savedFocusId && combined.some((workspace) => workspace.id === savedFocusId);
+    return Object.assign({}, canonical, { workspaces: combined, activeWorkspaceId: restoreFocus ? savedFocusId : (canonical.activeWorkspaceId || combined[0]?.id || '') });
+  }
+
+  function mergeWorkspaceLocalDeltaForStartup(workspace = {}, local = null) {
+    if (!local) return workspace;
+    const isLocal = (item = {}) => item?.source?.adapterId === 'local' || item?.source?.kind === 'local-session' || String(item?.sourceMode || '').startsWith('local-');
+    const merge = (primary = [], secondary = []) => {
+      const out = primary.slice(); const keys = new Set(out.map((item) => `${item?.id || ''}::${item?.path || ''}`));
+      for (const item of secondary) { const key = `${item?.id || ''}::${item?.path || ''}`; if (!keys.has(key)) { out.push(item); keys.add(key); } }
+      return out;
+    };
+    return Object.assign({}, workspace, {
+      records: merge((workspace.records || []).filter((record) => !isLocal(record)), local.records || []),
+      assets: merge((workspace.assets || []).filter((asset) => !isLocal(asset)), local.assets || []),
+      workspaceMarkdown: local.workspaceMarkdown || workspace.workspaceMarkdown || '',
+      workspaceImport: Object.assign({}, workspace.workspaceImport || {}, local.workspaceImport || {}),
+      importLog: Array.isArray(local.importLog) ? local.importLog : (workspace.importLog || []),
+      publicationReceipts: Array.isArray(local.publicationReceipts) ? local.publicationReceipts : (workspace.publicationReceipts || [])
+    });
+  }
+
+  function surfaceLocalPersistenceFailure(receipt = {}, target = global) {
+    target.TiinexLocalStatePersistenceFailure = receipt;
+    if (typeof target.dispatchEvent !== 'function' || typeof target.CustomEvent !== 'function') return receipt;
+    try { target.dispatchEvent(new target.CustomEvent('tiinex:local-persistence-failure', { detail: receipt })); } catch (_) {}
+    return receipt;
+  }
+
+  function normalizeLegacyWorkspaceCandidateState(state = {}) {
+    if (!state || typeof state !== 'object' || !Array.isArray(state.workspaces)) return state;
+    const next = JSON.parse(JSON.stringify(state));
+    next.workspaces = next.workspaces.map(normalizeLegacyWorkspaceCandidatesInWorkspace);
+    next.view = normalizeLegacyWorkspaceView(next.view || {});
+    if (next.workspaceViews && typeof next.workspaceViews === 'object') {
+      next.workspaceViews = Object.fromEntries(Object.entries(next.workspaceViews).map(([id, view]) => [id, normalizeLegacyWorkspaceView(view || {})]));
+    }
+    return next;
+  }
+
+  function normalizeLegacyWorkspaceView(view = {}) {
+    const next = Object.assign({}, view || {});
+    const displayOptions = Object.assign({}, next.displayOptions || {});
+    if (displayOptions.showWorkspaceArtifacts == null && displayOptions.showWorkspaceCandidates != null) displayOptions.showWorkspaceArtifacts = displayOptions.showWorkspaceCandidates !== false;
+    delete displayOptions.showWorkspaceCandidates;
+    if (displayOptions.artifactFilter === 'workspace-candidate') displayOptions.artifactFilter = 'workspace-artifact';
+    next.displayOptions = displayOptions;
+    return next;
+  }
+
+  function normalizeLegacyWorkspaceCandidatesInWorkspace(workspace = {}) {
+    const candidates = Array.isArray(workspace.workspaceMergeCandidates) ? workspace.workspaceMergeCandidates : [];
+    if (!candidates.length) { const clean = Object.assign({}, workspace); delete clean.workspaceMergeCandidates; return clean; }
+    const records = Array.isArray(workspace.records) ? workspace.records.slice() : [];
+    for (const candidate of candidates) {
+      const path = canonicalCandidatePath(candidate.path || candidate.sourcePath || '');
+      const recordIndex = records.findIndex((record) => (candidate.sourceRecordId && record.id === candidate.sourceRecordId) || (path && canonicalCandidatePath(record.path || record.sourceTarget?.sourceArtifactPath || '') === path));
+      const role = { schema: 'tiinex.workspace.artifact.role.v1', openEligible: true, mergeEligible: true, migratedFromLegacyCandidate: true, legacyCandidateId: candidate.id || '' };
+      if (recordIndex >= 0) records[recordIndex] = Object.assign({}, records[recordIndex], { workspaceArtifactRole: Object.assign({}, records[recordIndex].workspaceArtifactRole || {}, role) });
+      else records.push(candidateAsCanonicalRecord(candidate, role));
+      migrateDivergentLegacySnapshot(records, candidate, role);
+    }
+    const canonical = Object.assign({}, workspace, { records, workspaceCandidateMigration: { schema: 'tiinex.workspace.candidate-migration.v1', migrated: candidates.length, runtimeModel: 'canonical-artifact-records' } });
+    delete canonical.workspaceMergeCandidates;
+    return canonical;
+  }
+
+  function migrateDivergentLegacySnapshot(records, candidate, role) {
+    const snapshot = candidate?.materialReconciliation?.localCandidateSnapshot;
+    if (!snapshot || typeof snapshot !== 'object' || sameCandidatePayload(snapshot, candidate)) return;
+    const localRecord = candidateAsCanonicalRecord(snapshot, Object.assign({}, role, { migratedLegacyLocalSnapshot: true }));
+    localRecord.source = Object.assign({ id: 'local', kind: 'local-session', adapterId: 'local', sourceKind: 'local.session', label: 'Local' }, snapshot.source?.adapterId === 'local' ? snapshot.source : {});
+    localRecord.sourceMode = snapshot.sourceMode || 'local-workspace-file';
+    localRecord.materialReconciliation = { schema: 'tiinex.workspace.material.reconciliation.v1', status: 'legacy-candidate-local-snapshot-migrated-explicit', message: 'Legacy hidden candidate snapshot was migrated into explicit local workspace material.' };
+    if (!records.some((record) => record.id === localRecord.id && String(record.markdown || '') === String(localRecord.markdown || ''))) records.push(localRecord);
+  }
+
+  function candidateAsCanonicalRecord(candidate = {}, role = {}) {
+    const path = canonicalCandidatePath(candidate.path || candidate.sourcePath || 'workspace.workspace.md') || 'workspace.workspace.md';
+    return Object.assign({}, candidate, { id: candidate.sourceRecordId || candidate.id || `workspace:${path}`, path, title: candidate.title || candidate.name || path.split('/').pop() || 'Workspace', kind: candidate.kind && candidate.kind !== 'workspace-candidate' ? candidate.kind : 'tiinex.workspace.v1', schemaId: candidate.schemaId || candidate.rootFallback?.currentSchemaId || 'tiinex.workspace.v1', sourceMode: candidate.sourceMode || (candidate.source?.adapterId === 'local' ? 'local-workspace-file' : 'source-backed'), workspaceArtifactRole: Object.assign({}, candidate.workspaceArtifactRole || {}, role) });
+  }
+
+  function defaultRecoveredView() {
+    return { universe: 'column', workspaceVerse: 'feed', reader: 'scan', query: '', displayOptions: { leavesFirst: false, leavesOnly: true, mismatchesOnly: false, showSupportingMarkdown: false, showWorkspaceArtifacts: true, showAssets: false, schemaFilter: 'all', artifactFilter: 'all', sourceFilter: 'all' }, expandedTreeFolders: [] };
+  }
+  function sameCandidatePayload(a = {}, b = {}) { return canonicalCandidatePath(a.path || '') === canonicalCandidatePath(b.path || '') && String(a.markdown || '') === String(b.markdown || ''); }
+  function canonicalCandidatePath(value = '') { const out = []; for (const part of String(value || '').replace(/\\/g, '/').split('/')) { if (!part || part === '.') continue; if (part === '..') out.pop(); else out.push(part); } return out.join('/'); }
+
+  global.TiinexWorkspacePersistenceRecovery = { LOCAL_RECOVERY_INDEX_KEY, LOCAL_RECOVERY_INDEX_SCHEMA_ID, createLocalRecoveryIndex, readLocalRecoveryIndex, recoverableStateFromLocalDeltas, augmentStartupStateWithLocalRecovery, surfaceLocalPersistenceFailure, normalizeLegacyWorkspaceCandidateState };
+})(typeof window !== 'undefined' ? window : globalThis);

package/src/workspaces/workspace.persistenceRouteCache.js

@@ -0,0 +1,82 @@
+(function attachWorkspacePersistenceRouteCache(global) {
+  'use strict';
+
+  function mergeWorkspaceRouteShell(routeWorkspace = {}, cachedWorkspace = {}) {
+    const routeSources = asArray(routeWorkspace.sources);
+    const routeSourceIds = new Set(routeSources.map(sourceIdentity).filter(Boolean));
+    return Object.assign({}, cachedWorkspace, routeWorkspace, {
+      source: Object.assign({}, cachedWorkspace.source || {}, routeWorkspace.source || {}),
+      sources: hydrateRouteMembers(routeSources, cachedWorkspace.sources, sourceIdentity, hydrateSource),
+      sourceOrder: routeSourceOrder(routeWorkspace.sourceOrder, routeSources, routeSourceIds),
+      records: hydrateRouteMembers(routeWorkspace.records, cachedWorkspace.records, recordIdentity, hydrateRecord),
+      assets: hydrateRouteMembers(routeWorkspace.assets, cachedWorkspace.assets, assetIdentity, hydrateAsset),
+      ...((Array.isArray(routeWorkspace.workspaceMergeCandidates) && routeWorkspace.workspaceMergeCandidates.length) || (Array.isArray(cachedWorkspace.workspaceMergeCandidates) && cachedWorkspace.workspaceMergeCandidates.length)
+        ? { workspaceMergeCandidates: hydrateRouteMembers(routeWorkspace.workspaceMergeCandidates, cachedWorkspace.workspaceMergeCandidates, recordIdentity, hydrateRecord) }
+        : {}),
+      importLog: asArray(routeWorkspace.importLog),
+      workspaceMarkdown: routeWorkspace.workspaceMarkdown || cachedWorkspace.workspaceMarkdown || '',
+      workspaceImport: Object.assign({}, cachedWorkspace.workspaceImport || {}, routeWorkspace.workspaceImport || {})
+    });
+  }
+
+  function hydrateRouteMembers(routeItems = [], cachedItems = [], identity = recordIdentity, hydrate = hydrateRecord) {
+    const cachedByIdentity = new Map();
+    for (const item of asArray(cachedItems)) {
+      const key = identity(item);
+      if (key) cachedByIdentity.set(key, item);
+    }
+    return asArray(routeItems).map((routeItem) => {
+      const cachedItem = cachedByIdentity.get(identity(routeItem));
+      return cachedItem ? hydrate(routeItem, cachedItem) : routeItem;
+    });
+  }
+
+  function hydrateRecord(routeItem = {}, cachedItem = {}) {
+    const next = Object.assign({}, cachedItem, routeItem, {
+      source: Object.assign({}, cachedItem.source || {}, routeItem.source || {})
+    });
+    if (!recordHasRouteOwnedMaterial(routeItem)) {
+      if (cachedItem.cacheState) next.cacheState = cachedItem.cacheState;
+      if (cachedItem.materialAvailability) next.materialAvailability = cachedItem.materialAvailability;
+    }
+    return next;
+  }
+
+  function hydrateAsset(routeItem = {}, cachedItem = {}) {
+    const next = Object.assign({}, cachedItem, routeItem, {
+      source: Object.assign({}, cachedItem.source || {}, routeItem.source || {})
+    });
+    if (!assetHasRouteOwnedMaterial(routeItem)) {
+      if (cachedItem.cacheState) next.cacheState = cachedItem.cacheState;
+      if (cachedItem.previewState) next.previewState = cachedItem.previewState;
+    }
+    return next;
+  }
+
+  function recordHasRouteOwnedMaterial(item = {}) {
+    return Boolean(String(item.markdown || '')) || item.materialAvailability === 'available';
+  }
+
+  function assetHasRouteOwnedMaterial(item = {}) {
+    return Boolean(item.content || item.bytes || item.blob || item.objectUrl) || item.previewState === 'available' || item.materialAvailability === 'available';
+  }
+
+  function hydrateSource(routeItem = {}, cachedItem = {}) {
+    return Object.assign({}, cachedItem, routeItem, {
+      surfaces: Object.assign({}, cachedItem.surfaces || {}, routeItem.surfaces || {})
+    });
+  }
+
+  function routeSourceOrder(routeOrder = [], routeSources = [], routeSourceIds = new Set()) {
+    const ordered = asArray(routeOrder).filter((id) => routeSourceIds.has(id));
+    for (const source of routeSources) if (source?.id && !ordered.includes(source.id)) ordered.push(source.id);
+    return ordered;
+  }
+
+  function sourceIdentity(source = {}) { return String(source.id || '').trim(); }
+  function recordIdentity(record = {}) { return String(record.id || record.path || record.sourcePath || '').trim(); }
+  function assetIdentity(asset = {}) { return String(asset.id || asset.path || asset.sourcePath || '').trim(); }
+  function asArray(value) { return Array.isArray(value) ? value : []; }
+
+  global.TiinexWorkspacePersistenceRouteCache = { mergeWorkspaceRouteShell };
+})(typeof window !== 'undefined' ? window : globalThis);

package/src/workspaces/workspace.publicationReceipts.case.mjs

@@ -0,0 +1,36 @@
+import assert from 'node:assert/strict';
+import { buildPublicationPlan, buildPublicationResult } from '@tiinex/core/publication/publication.contract.js';
+import { stateWithWorkspacePublicationReceipt } from './workspace.publicationReceipts.js';
+import './workspace.persistence.js';
+
+const markdown = '# Continuity Context\n\n- Envelope Schema: [tiinex.root.v1](tiinex.root.v1.schema.md)\n- Current\n  - Current Schema: [tiinex.topic.v1](tiinex.topic.v1.schema.md)\n  - Created At: 2026-08-19T00:00:00.000Z\n  - Summary: Guided publication fixture\n  - Status: draft/local\n\n---\n\n# Guided publication fixture\n\nReadable exact local payload.\n\n# Continuity Integrity\n\n- Draft Local Integrity\n  - Method: browser-local-draft\n  - Value: pending-publication-or-export\n';
+const local = { id: 'local-1', title: 'Local', path: 'local.trace.md', markdown, schemaId: 'tiinex.topic.v1', sourceMode: 'local-transition', source: { adapterId: 'local' } };
+const source = { id: 'source-1', title: 'Source', path: 'source.trace.md', markdown: '# source', sourceMode: 'source-backed', source: { adapterId: 'github', repo: 'Tiinex/docs', ref: 'main' } };
+const state = { version: 1, activeWorkspaceId: 'w', view: {}, workspaces: [{ id: 'w', title: 'W', name: 'W', records: [local, source], assets: [], sources: [], importLog: [] }] };
+const plan = buildPublicationPlan(state.workspaces[0], { recordId: local.id, mutationPolicy: 'create-new', destination: { provider: 'github', repository: 'Tiinex/docs', targetKind: 'github.issue.body' } });
+const targetA = 'https://github.com/Tiinex/docs/issues/12';
+const targetB = 'https://github.com/Tiinex/docs/issues/13';
+const result = buildPublicationResult(plan, { state: 'success', verificationStatus: 'verified', verifiedPayloadSha256: plan.outboundPayload.sha256, sourceTarget: { adapterId: 'github', targetKind: 'github.issue.body', inputTarget: targetA } });
+assert.equal(result.status, 'success');
+const attestation = { schema: 'tiinex.site.githubPublicationHumanMutationAttestation.v2', type: 'human-github-web-mutation-confirmation', planSha256: plan.planSha256, mutationTarget: { provider: 'github', targetKind: 'github.issue.body', inputTarget: targetA, repository: 'Tiinex/docs', issueNumberLexeme: '12', commentId: '', issueTarget: targetA }, confirmedAt: '2026-08-19T11:59:59.000Z', boundary: 'Human confirmed exact plan + exact target; Tiinex did not perform a hidden/API write.' };
+const beforeLocal = JSON.stringify(local); const beforeSource = JSON.stringify(source);
+assert.equal(stateWithWorkspacePublicationReceipt(state, 'w', result).ok, false, 'receipt needs target-bound execution evidence');
+assert.equal(stateWithWorkspacePublicationReceipt(state, 'w', result, { executionAttestation: { ...attestation, planSha256: 'stale' } }).ok, false, 'stale plan evidence rejected');
+assert.equal(stateWithWorkspacePublicationReceipt(state, 'w', result, { executionAttestation: { ...attestation, mutationTarget: { ...attestation.mutationTarget, inputTarget: targetB, issueNumberLexeme: '13', issueTarget: targetB } } }).ok, false, 'result target A cannot pair with attestation target B');
+const applied = stateWithWorkspacePublicationReceipt(state, 'w', result, { executionAttestation: attestation, clock: () => Date.parse('2026-08-19T12:00:00Z') });
+assert.equal(applied.ok, true);
+assert.equal(applied.workspace.publicationReceipts.length, 1);
+assert.equal(applied.workspace.publicationReceipts[0].executionAttestation.planSha256, plan.planSha256);
+assert.equal(applied.workspace.publicationReceipts[0].executionAttestation.mutationTarget.inputTarget, targetA);
+assert.equal(applied.workspace.publicationReceipts[0].executionAttestation.mutationTarget.issueNumberLexeme, '12');
+assert.match(applied.workspace.publicationReceipts[0].executionAttestation.boundary, /Tiinex did not perform/i);
+assert.equal(JSON.stringify(applied.workspace.records.find((r) => r.id === local.id)), beforeLocal);
+assert.equal(JSON.stringify(applied.workspace.records.find((r) => r.id === source.id)), beforeSource);
+const delta = globalThis.TiinexWorkspacePersistence.createLocalDeltaState(applied.state);
+assert.equal(delta.workspaces[0].publicationReceipts.length, 1, 'publication receipt survives durable local-delta projection');
+const roundTrip = JSON.parse(JSON.stringify(delta));
+assert.equal(roundTrip.workspaces[0].publicationReceipts[0].sourceBinding.remoteTarget.inputTarget, targetA);
+assert.equal(roundTrip.workspaces[0].publicationReceipts[0].executionAttestation.mutationTarget.inputTarget, targetA, 'exact target-bound execution evidence survives reopen');
+assert.equal(roundTrip.workspaces[0].records.find((r) => r.id === local.id).source.adapterId, 'local');
+assert.equal(state.workspaces[0].publicationReceipts, undefined, 'input state stays unchanged');
+console.log('workspace.publicationReceipts: PASS');

package/src/workspaces/workspace.publicationReceipts.js

@@ -0,0 +1,56 @@
+import { parseExactGithubIssueTarget } from '@tiinex/core/sources/github/github.issueTarget.js';
+
+export const WORKSPACE_PUBLICATION_RECEIPTS_LIMIT = 64;
+
+export function stateWithWorkspacePublicationReceipt(state = {}, workspaceId = '', result = {}, options = {}) {
+  if (result?.status !== 'success' || !result?.sourceBinding || !result?.receipt) return { ok: false, error: 'publication.receipt.unqualified', state };
+  const executionAttestation = qualifiedGithubHumanMutationAttestation(result, options.executionAttestation);
+  if (!executionAttestation) return { ok: false, error: 'publication.receipt.human-mutation-attestation-missing', state };
+  const next = JSON.parse(JSON.stringify(state || {}));
+  const id = String(workspaceId || next.activeWorkspaceId || '').trim();
+  const workspace = (next.workspaces || []).find((item) => String(item?.id || '') === id);
+  if (!workspace) return { ok: false, error: 'workspace.not.found', state };
+  const recordId = String(result.receipt?.localInputId || result.sourceBinding?.localInputId || '').trim();
+  const record = (workspace.records || []).find((item) => String(item?.id || '') === recordId);
+  if (!record) return { ok: false, error: 'publication.receipt.local-input-missing', state };
+  const before = JSON.stringify(record);
+  const entry = {
+    schema: 'tiinex.site.workspace.publicationReceipt.v1',
+    resultId: String(result.resultId || ''),
+    recordedAt: nowIso(options.clock),
+    receipt: result.receipt,
+    sourceBinding: result.sourceBinding,
+    executionAttestation,
+    boundary: 'Browser-local durable publication fact with exact-plan + exact-target human GitHub web mutation confirmation. Tiinex did not perform a hidden/API write, and this state does not re-identify, remove, or mutate the local input artifact.'
+  };
+  const existing = Array.isArray(workspace.publicationReceipts) ? workspace.publicationReceipts.filter((item) => item?.receipt?.receiptId !== result.receipt.receiptId) : [];
+  workspace.publicationReceipts = [entry, ...existing].slice(0, WORKSPACE_PUBLICATION_RECEIPTS_LIMIT);
+  const after = JSON.stringify((workspace.records || []).find((item) => String(item?.id || '') === recordId));
+  if (after !== before) return { ok: false, error: 'publication.receipt.local-input-mutated', state };
+  return { ok: true, state: next, workspace, entry };
+}
+
+function qualifiedGithubHumanMutationAttestation(result = {}, value = null) {
+  if (!value || typeof value !== 'object') return null;
+  if (String(value.type || '') !== 'human-github-web-mutation-confirmation') return null;
+  const planSha256 = String(result?.receipt?.planSha256 || '').trim();
+  if (!planSha256 || String(value.planSha256 || '') !== planSha256) return null;
+  const resultTarget = result?.sourceBinding?.remoteTarget || result?.receipt?.remoteTarget || result?.remoteTarget || null;
+  const attestedTarget = value.mutationTarget || null;
+  const parsedResult = parseExactGithubIssueTarget(resultTarget?.inputTarget || '');
+  const parsedAttested = parseExactGithubIssueTarget(attestedTarget?.inputTarget || '');
+  if (!parsedResult.ok || !parsedAttested.ok) return null;
+  if (String(resultTarget?.targetKind || '') !== parsedResult.targetKind || String(attestedTarget?.targetKind || '') !== parsedAttested.targetKind) return null;
+  if (parsedResult.targetKind !== parsedAttested.targetKind || parsedResult.inputTarget !== parsedAttested.inputTarget) return null;
+  const confirmedAt = String(value.confirmedAt || '').trim();
+  if (!confirmedAt) return null;
+  return Object.freeze({
+    schema: 'tiinex.site.workspace.publicationExecutionAttestation.v2',
+    type: 'human-github-web-mutation-confirmation',
+    planSha256,
+    mutationTarget: Object.freeze({ provider: 'github', targetKind: parsedAttested.targetKind, inputTarget: parsedAttested.inputTarget, repository: parsedAttested.repository, issueNumberLexeme: parsedAttested.issueNumber, commentId: String(parsedAttested.commentId || ''), issueTarget: parsedAttested.issueTarget }),
+    confirmedAt,
+    boundary: String(value.boundary || 'Human confirmed the GitHub web mutation for the exact publication plan at the exact qualified target; Tiinex did not perform a hidden/API write.')
+  });
+}
+function nowIso(clock) { return typeof clock === 'function' ? new Date(clock()).toISOString() : new Date().toISOString(); }

package/src/workspaces/workspace.recoverabilityView.js

@@ -0,0 +1,264 @@
+import { isWorkspaceRecord } from '@tiinex/core/actions/record.actions.js';
+import { buildPublicationPreflight } from '@tiinex/core/publication/publication.preflight.js';
+import { buildSourceBoundaryReport } from '@tiinex/core/diagnostics/sourceBoundary.report.js';
+import { buildReingestPlan } from '@tiinex/core/reingest/reingest.plan.js';
+import { buildExportPackagePreflight } from '@tiinex/core/export/package.preflight.js';
+import { buildExportPackageContract, buildExportPackageManifest, buildExportPackageReceipt } from '@tiinex/core/export/package.manifest.js';
+import { buildExportPackageBundle, inspectExportPackageBundle } from '@tiinex/core/export/package.builder.js';
+import { buildExportPackageApplyResult, buildExportPackageImportPlan } from '@tiinex/core/export/package.apply.js';
+import { buildSourceTransportReport } from '../diagnostics/sourceTransport.report.js';
+
+export const WORKSPACE_RECOVERABILITY_VIEW_SCHEMA_ID = 'tiinex.workspace.recoverabilityView.v1';
+
+export function buildWorkspaceRecoverabilityView(workspace = {}, input = {}) {
+  const records = Array.isArray(input.records) ? input.records : (Array.isArray(workspace.records) ? workspace.records : []);
+  const assets = Array.isArray(input.assets) ? input.assets : (Array.isArray(workspace.assets) ? workspace.assets : []);
+  // Compatibility-only descriptor input. Canonical product runtime must already normalize legacy candidates into records.
+  const legacyWorkspaceCandidates = Array.isArray(input.workspaceCandidates) ? input.workspaceCandidates : [];
+  const workspaceArtifacts = records.filter(isWorkspaceRecord);
+  const importResults = Array.isArray(workspace.importResults) ? workspace.importResults : [];
+  const importLog = Array.isArray(workspace.importLog) ? workspace.importLog : [];
+  const sourceBackedRecords = records.filter((record) => isSourceBacked(record.source));
+  const localRecords = records.filter((record) => !isSourceBacked(record.source));
+  const localAssets = assets.filter((asset) => !isSourceBacked(asset.source));
+  const previewOmittedAssets = assets.filter((asset) => asset.previewState === 'omitted-large' || asset.cacheState === 'preview-truncated-for-session-cache');
+  const latestImport = importResults[0] || null;
+  const warnings = importResults.flatMap((result) => Array.isArray(result.warnings) ? result.warnings : []);
+  const errors = importResults.flatMap((result) => Array.isArray(result.errors) ? result.errors : []);
+  const sourceBoundary = buildSourceBoundaryReport(workspace, { records, assets });
+  const sourceTransport = buildSourceTransportReport(workspace);
+  const publicationPreflight = buildPublicationPreflight(workspace, { records, assets, workspaceCandidates: legacyWorkspaceCandidates });
+  const reingestPlan = buildReingestPlan(workspace, { records, assets, workspaceCandidates: legacyWorkspaceCandidates, sourceBoundary, publicationPreflight });
+  const exportPackagePreflight = buildExportPackagePreflight(workspace, { records, assets, workspaceCandidates: legacyWorkspaceCandidates, sourceBoundary, publicationPreflight, reingestPlan });
+  const exportPackageManifest = buildExportPackageManifest(workspace, { records, assets, workspaceCandidates: legacyWorkspaceCandidates, sourceBoundary, publicationPreflight, reingestPlan, preflight: exportPackagePreflight });
+  const exportPackageReceipt = buildExportPackageReceipt(exportPackageManifest);
+  const exportPackageContract = buildExportPackageContract(workspace, { records, assets, workspaceCandidates: legacyWorkspaceCandidates, sourceBoundary, publicationPreflight, reingestPlan, preflight: exportPackagePreflight, manifest: exportPackageManifest, receipt: exportPackageReceipt });
+  const exportPackageBundle = buildExportPackageBundle(workspace, { records, assets, workspaceCandidates: legacyWorkspaceCandidates, contract: exportPackageContract });
+  const exportPackageBundleInspection = inspectExportPackageBundle(exportPackageBundle);
+  const exportPackageImportPlan = buildExportPackageImportPlan(exportPackageBundle, { inspection: exportPackageBundleInspection });
+  const exportPackageApplyResult = buildExportPackageApplyResult(exportPackageBundle, { importPlan: exportPackageImportPlan });
+  const degraded = Boolean(errors.length || warnings.length || previewOmittedAssets.length || sourceBoundary.status !== 'clean' || sourceTransport.status !== 'clean' || publicationPreflight.status !== 'ready' || reingestPlan.status !== 'ready' || exportPackagePreflight.status !== 'ready');
+
+  return {
+    schema: WORKSPACE_RECOVERABILITY_VIEW_SCHEMA_ID,
+    workspaceId: workspace.id || '',
+    title: `Recoverability · ${workspace.title || workspace.name || 'workspace'}`,
+    status: errors.length ? 'needs-attention' : degraded ? 'degraded' : 'recoverable',
+    boundary: 'Loaded/session recovery summary. Local material remains local; source-backed material keeps explicit source boundaries.',
+    counts: {
+      records: records.length,
+      localRecords: localRecords.length,
+      sourceBackedRecords: sourceBackedRecords.length,
+      assets: assets.length,
+      localAssets: localAssets.length,
+      workspaceArtifacts: workspaceArtifacts.length,
+      importResults: importResults.length,
+      warnings: warnings.length,
+      errors: errors.length,
+      previewOmitted: previewOmittedAssets.length,
+      importLogEntries: importLog.length,
+      sourceBoundaryErrors: sourceBoundary.counts.errors || 0,
+      sourceBoundaryWarnings: sourceBoundary.counts.warnings || 0,
+      sourceTransportEvents: sourceTransport.counts.events || 0,
+      sourceTransportRateLimited: sourceTransport.counts.rateLimited || 0,
+      sourceTransportRetryable: sourceTransport.counts.retryable || 0,
+      sourceTransportErrors: sourceTransport.counts.errors || 0,
+      sourceTransportWarnings: sourceTransport.counts.warnings || 0,
+      publishableLocalDrafts: publicationPreflight.counts.publishableLocalDrafts || 0,
+      publicationPreflightErrors: publicationPreflight.counts.errors || 0,
+      publicationPreflightWarnings: publicationPreflight.counts.warnings || 0,
+      reingestSourceTargets: reingestPlan.counts.sourceTargets || 0,
+      reingestPinnedSourceTargets: reingestPlan.counts.pinnedSourceTargets || 0,
+      reingestLocalDraftTargets: reingestPlan.counts.localDraftTargets || 0,
+      reingestErrors: reingestPlan.counts.errors || 0,
+      reingestWarnings: reingestPlan.counts.warnings || 0,
+      exportPackageEntries: exportPackagePreflight.counts.packageEntries || 0,
+      exportPackageLocalDraftEntries: exportPackagePreflight.counts.localDraftEntries || 0,
+      exportPackageSourceReferences: exportPackagePreflight.counts.sourceReferenceEntries || 0,
+      exportPackageErrors: exportPackagePreflight.counts.errors || 0,
+      exportPackageWarnings: exportPackagePreflight.counts.warnings || 0,
+      exportPackageManifestEntries: exportPackageManifest.counts.entries || 0,
+      exportPackageManifestBlocked: exportPackageManifest.counts.blocked || 0,
+      exportPackageBundleFiles: exportPackageBundle.counts.files || 0,
+      exportPackageBundleMaterialFiles: exportPackageBundle.counts.materialFiles || 0,
+      exportPackageBundleErrors: exportPackageBundle.counts.errors || 0,
+      exportPackageBundleWarnings: exportPackageBundle.counts.warnings || 0,
+      exportPackageImportRecords: exportPackageImportPlan.counts.importedRecords || 0,
+      exportPackageImportSourceReferences: exportPackageImportPlan.counts.sourceReferences || 0,
+      exportPackageImportAssets: exportPackageImportPlan.counts.assets || 0,
+      exportPackageImportWorkspaceCandidates: exportPackageImportPlan.counts.workspaceCandidates || 0,
+      exportPackageApplyRecords: exportPackageApplyResult.counts.records || 0,
+      exportPackageApplyAssets: exportPackageApplyResult.counts.assets || 0
+    },
+    latestImport: latestImport ? summarizeImportResult(latestImport) : null,
+    sourceBoundary,
+    sourceTransport: summarizeSourceTransport(sourceTransport),
+    publicationPreflight: summarizePublicationPreflight(publicationPreflight),
+    reingestPlan: summarizeReingestPlan(reingestPlan),
+    exportPackagePreflight: summarizeExportPackagePreflight(exportPackagePreflight),
+    exportPackageManifest: summarizeExportPackageManifest(exportPackageManifest),
+    exportPackageReceipt: summarizeExportPackageReceipt(exportPackageReceipt),
+    exportPackageContract: summarizeExportPackageContract(exportPackageContract),
+    exportPackageBundle: summarizeExportPackageBundle(exportPackageBundle, exportPackageBundleInspection),
+    exportPackageImportPlan: summarizeExportPackageImportPlan(exportPackageImportPlan),
+    exportPackageApplyResult: summarizeExportPackageApplyResult(exportPackageApplyResult),
+    guarantees: [
+      `${localRecords.length} local/session artifact${localRecords.length === 1 ? '' : 's'} retained without GitHub provenance.`,
+      `${localAssets.length} local asset${localAssets.length === 1 ? '' : 's'} retained as assets, not fake leaves.`,
+      `${workspaceArtifacts.length} workspace artifact${workspaceArtifacts.length === 1 ? '' : 's'} available with ordinary artifact inspection plus Open/Merge capabilities.`,
+      `${sourceBackedRecords.length} source-backed artifact${sourceBackedRecords.length === 1 ? '' : 's'} retain explicit source boundary.`
+    ],
+    warnings: warnings.slice(0, 10).map(normalizeIssue),
+    errors: errors.slice(0, 10).map(normalizeIssue),
+    assets: assets.slice(0, 12).map((asset) => ({
+      id: asset.id || asset.path || '',
+      path: asset.path || '',
+      name: asset.name || asset.path || 'asset',
+      previewState: asset.previewState || (asset.content || asset.dataUrl ? 'preview-available' : 'metadata-only'),
+      cacheState: asset.cacheState || '',
+      boundary: asset.source?.boundary || 'Local/session asset boundary.'
+    }))
+  };
+}
+
+
+
+
+
+function summarizeSourceTransport(report = {}) {
+  return {
+    schema: report.schema || 'tiinex.sourceTransport.report.v1',
+    status: report.status || 'unknown',
+    boundary: report.boundary || '',
+    counts: Object.assign({ sources: 0, importResults: 0, adapterResults: 0, events: 0, requests: 0, cacheHits: 0, cacheMisses: 0, rateLimited: 0, unavailable: 0, notFound: 0, retryable: 0, errors: 0, warnings: 0 }, report.counts || {}),
+    events: (report.events || []).slice(0, 8).map(normalizeIssue),
+    nextActions: (report.nextActions || []).slice(0, 5)
+  };
+}
+
+function summarizeExportPackageImportPlan(plan = {}) {
+  return {
+    schema: plan.schema || 'tiinex.export.package.import.plan.v1',
+    status: plan.status || 'unknown',
+    packageId: plan.packageId || '',
+    boundary: plan.boundary || '',
+    counts: Object.assign({ files: 0, importedRecords: 0, sourceReferences: 0, assets: 0, metadataOnlyAssets: 0, workspaceCandidates: 0, errors: 0, warnings: 0 }, plan.counts || {}),
+    findings: (plan.findings || []).slice(0, 8).map(normalizeIssue)
+  };
+}
+
+function summarizeExportPackageApplyResult(result = {}) {
+  return {
+    schema: result.schema || 'tiinex.export.package.apply.result.v1',
+    status: result.status || 'unknown',
+    packageId: result.packageId || '',
+    boundary: result.boundary || '',
+    counts: Object.assign({ records: 0, assets: 0, sourceReferences: 0, workspaceCandidates: 0, errors: 0, warnings: 0 }, result.counts || {}),
+    diagnostics: Object.assign({ noRemoteFetch: false, noSourceMutation: false }, result.adapterResult?.diagnostics || {})
+  };
+}
+
+function summarizeExportPackageBundle(bundle = {}, inspection = {}) {
+  return {
+    schema: bundle.schema || 'tiinex.export.package.bundle.v1',
+    status: bundle.status || 'unknown',
+    packageId: bundle.packageId || '',
+    boundary: bundle.boundary || '',
+    packageFingerprint: bundle.packageFingerprint || '',
+    counts: Object.assign({ files: 0, controlFiles: 0, materialFiles: 0, localDraftFiles: 0, sourceReferenceFiles: 0, assetContentFiles: 0, assetMetadataFiles: 0, workspaceCandidateFiles: 0, errors: 0, warnings: 0 }, bundle.counts || {}),
+    inspection: {
+      schema: inspection.schema || 'tiinex.export.package.bundle.inspection.v1',
+      status: inspection.status || 'unknown',
+      counts: Object.assign({ files: 0, findings: 0, errors: 0 }, inspection.counts || {})
+    },
+    findings: (bundle.findings || []).slice(0, 8).map(normalizeIssue)
+  };
+}
+
+function summarizeExportPackageManifest(manifest = {}) {
+  return {
+    schema: manifest.schema || 'tiinex.export.package.manifest.v1',
+    status: manifest.status || 'unknown',
+    packageId: manifest.packageId || '',
+    boundary: manifest.boundary || '',
+    counts: Object.assign({ entries: 0, localDrafts: 0, sourceReferences: 0, assets: 0, workspaceContextCandidates: 0, blocked: 0, errors: 0, warnings: 0 }, manifest.counts || {}),
+    integrity: Object.assign({ algorithm: '', fingerprint: '' }, manifest.integrity || {}),
+    findings: (manifest.findings || []).slice(0, 8).map(normalizeIssue)
+  };
+}
+
+function summarizeExportPackageReceipt(receipt = {}) {
+  return {
+    schema: receipt.schema || 'tiinex.export.package.receipt.v1',
+    state: receipt.state || 'unknown',
+    status: receipt.status || 'unknown',
+    receiptId: receipt.receiptId || '',
+    manifestFingerprint: receipt.manifestFingerprint || '',
+    boundary: receipt.boundary || '',
+    counts: Object.assign({ entries: 0, blocked: 0, errors: 0, warnings: 0 }, receipt.counts || {}),
+    nextActions: (receipt.nextActions || []).slice(0, 5),
+    findings: (receipt.findings || []).slice(0, 8).map(normalizeIssue)
+  };
+}
+
+function summarizeExportPackageContract(contract = {}) {
+  return {
+    schema: contract.schema || 'tiinex.export.package.contract.v1',
+    status: contract.status || 'unknown',
+    boundary: contract.boundary || ''
+  };
+}
+
+function summarizeExportPackagePreflight(preflight = {}) {
+  return {
+    schema: preflight.schema || 'tiinex.export.package.preflight.v1',
+    status: preflight.status || 'unknown',
+    boundary: preflight.boundary || '',
+    entryPolicy: preflight.entryPolicy || '',
+    counts: Object.assign({ packageEntries: 0, localDraftEntries: 0, blockedLocalEntries: 0, sourceReferenceEntries: 0, pinnedSourceReferences: 0, degradedSourceReferences: 0, assetEntries: 0, metadataOnlyAssets: 0, workspaceCandidateEntries: 0, errors: 0, warnings: 0 }, preflight.counts || {}),
+    findings: (preflight.findings || []).slice(0, 8).map(normalizeIssue)
+  };
+}
+
+function summarizeReingestPlan(plan = {}) {
+  return {
+    schema: plan.schema || 'tiinex.reingest.plan.v1',
+    status: plan.status || 'unknown',
+    boundary: plan.boundary || '',
+    counts: Object.assign({ sourceTargets: 0, pinnedSourceTargets: 0, degradedSourceTargets: 0, localDraftTargets: 0, blockedLocalTargets: 0, assets: 0, metadataOnlyAssets: 0, workspaceCandidates: 0, errors: 0, warnings: 0 }, plan.counts || {}),
+    findings: (plan.findings || []).slice(0, 8).map(normalizeIssue)
+  };
+}
+
+function summarizePublicationPreflight(preflight = {}) {
+  return {
+    schema: preflight.schema || 'tiinex.publication.preflight.v1',
+    status: preflight.status || 'unknown',
+    boundary: preflight.boundary || '',
+    counts: Object.assign({ publishableLocalDrafts: 0, blockedLocalDrafts: 0, sourceReferences: 0, errors: 0, warnings: 0 }, preflight.counts || {}),
+    findings: (preflight.findings || []).slice(0, 8).map(normalizeIssue)
+  };
+}
+
+function summarizeImportResult(result = {}) {
+  return {
+    ok: result.ok !== false,
+    message: result.message || 'Import result available.',
+    at: result.at || '',
+    counts: Object.assign({ records: 0, assets: 0, workspaceEntries: 0, warnings: 0, errors: 0, previewOmitted: 0 }, result.counts || {}),
+    diagnostics: Object.assign({}, result.diagnostics || {})
+  };
+}
+
+function normalizeIssue(issue = {}) {
+  if (typeof issue === 'string') return { code: 'message', message: issue };
+  return {
+    code: issue.code || issue.error || issue.type || 'message',
+    message: issue.message || issue.error || String(issue.code || issue.type || 'Issue'),
+    path: issue.path || issue.ref || ''
+  };
+}
+
+function isSourceBacked(source = {}) {
+  return Boolean(source?.adapterId && source.adapterId !== 'local');
+}