@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.0

package/apps/storefront/src/lib/apps/v84NonportableCodeCoaching.ts

@@ -0,0 +1,368 @@
+import type { ApprovedMarketingActionName, UnresolvedInventoryItem } from "@tot/public-runtime";
+
+export const V84_NONPORTABLE_REFUSAL_CRITERIA = [
+  "obfuscated-or-dynamic-code",
+  "secret-bearing-payload",
+  "dom-scrape-or-mutation",
+  "protected-surface-replay",
+  "regulated-data-outside-typed-schema",
+  "consent-bypass",
+  "unbounded-storage-or-cross-tenant",
+  "mutable-supply-chain-or-licensing",
+  "checkout-or-compliance-mutation",
+  "not-deterministic-testable-reversible",
+  "not-fail-closed",
+] as const;
+
+export type V84NonportableRefusalCriterion = (typeof V84_NONPORTABLE_REFUSAL_CRITERIA)[number];
+
+export const V84_NATIVE_REPLACEMENT_PRIORITY = [
+  "reviewed-ws1-adapter-and-actions",
+  "reviewed-first-party-storefront-code",
+  "declarative-typed-mapping",
+  "constrained-server-workflow",
+  "pinned-vendor-sdk",
+  "redesign",
+  "retire",
+] as const;
+
+type SourceKind = "tag" | "variable" | "customTemplate";
+type CoachingDecision = "do-not-port";
+type NativeHook = "storefront.action.activated.v1" | "storefront.page.viewed.v2";
+type ActionSelection = "not-applicable" | "fixed" | "owner-selection-required";
+
+export interface V84NonportableCodeIntentDossier {
+  readonly schemaVersion: 1;
+  readonly dossierId: string;
+  readonly sourceObject: {
+    readonly nodeKey: string;
+    readonly kind: SourceKind;
+    readonly id: string;
+    readonly type: string | null;
+    readonly importedArtifact: "redacted-inert-evidence-only";
+  };
+  readonly recoveredBusinessIntent: string;
+  readonly requiredContract: {
+    readonly events: readonly NativeHook[];
+    readonly typedData: readonly string[];
+    readonly destination: string;
+    readonly consent: readonly string[];
+    readonly allowedSurfaces: readonly string[];
+    readonly excludedSurfaces: readonly string[];
+    readonly actionSelection: ActionSelection;
+    readonly approvedActionNames: readonly ApprovedMarketingActionName[];
+  };
+  readonly portabilityReview: {
+    readonly decision: CoachingDecision;
+    readonly whyOriginalSnippetIsNotPortable: string;
+    readonly security: string;
+    readonly privacy: string;
+    readonly compliance: string;
+    readonly refusalCriteria: readonly V84NonportableRefusalCriterion[];
+  };
+  readonly recommendedTotPort: {
+    readonly route: (typeof V84_NATIVE_REPLACEMENT_PRIORITY)[number];
+    readonly nativeHook: NativeHook | null;
+    readonly owningProductGap: string | null;
+    readonly saferAlternative: string;
+    readonly migrationPlan: readonly string[];
+    readonly status: "not-installed";
+  };
+  readonly verification: {
+    readonly syntheticTests: readonly string[];
+    readonly cloneQa: readonly string[];
+    readonly rollback: string;
+    readonly residualRisk: string;
+  };
+}
+
+interface DossierPlan {
+  readonly nodeKey: string;
+  readonly kind: SourceKind;
+  readonly id: string;
+  readonly type: string | null;
+  readonly dossierId: string;
+  readonly intent: string;
+  readonly events: readonly NativeHook[];
+  readonly data: readonly string[];
+  readonly destination: string;
+  readonly consent: readonly string[];
+  readonly allowed: readonly string[];
+  readonly excluded: readonly string[];
+  readonly actionSelection: ActionSelection;
+  readonly actionNames: readonly ApprovedMarketingActionName[];
+  readonly why: string;
+  readonly security: string;
+  readonly privacy: string;
+  readonly compliance: string;
+  readonly criteria: readonly V84NonportableRefusalCriterion[];
+  readonly route: (typeof V84_NATIVE_REPLACEMENT_PRIORITY)[number];
+  readonly hook: NativeHook | null;
+  readonly gap: string | null;
+  readonly alternative: string;
+  readonly plan: readonly string[];
+  readonly tests: readonly string[];
+  readonly qa: readonly string[];
+  readonly rollback: string;
+  readonly risk: string;
+}
+
+const PUBLIC_ONLY = ["public-marketing-pages"] as const;
+const PROTECTED = ["admin", "account", "identity", "age-assurance", "checkout", "payment"] as const;
+const ACTION_HOOK = "storefront.action.activated.v1" as const;
+const PAGE_VIEW_HOOK = "storefront.page.viewed.v2" as const;
+const ALL_APPROVED_ACTION_NAMES = [
+  "user_clicked_contact_sales_mktg",
+  "user_clicked_create_account_mktg",
+  "user_clicked_login_mktg",
+  "user_clicked_contact_support_consumer_mktg",
+  "user_clicked_contact_support_partner_mktg",
+] as const satisfies readonly ApprovedMarketingActionName[];
+
+const PLANS: readonly DossierPlan[] = [
+  {
+    nodeKey: "tag:4", kind: "tag", id: "4", type: "cvt_88888888_3", dossierId: "v84-hubspot-lead-tag",
+    intent: "Send a consented contact-sales or account-creation signal to HubSpot.",
+    events: [ACTION_HOOK], data: ["name"],
+    destination: "future managed HubSpot destination", consent: ["analytics"], allowed: PUBLIC_ONLY, excluded: PROTECTED,
+    actionSelection: "fixed", actionNames: ["user_clicked_contact_sales_mktg", "user_clicked_create_account_mktg"],
+    why: "The custom-template tag delegates behavior to imported template code and carries an unresolved destination reference.",
+    security: "A template runner would create mutable code and destination authority outside the reviewed adapter catalog.",
+    privacy: "Lead identity must not be inferred from page state or forwarded outside a typed, consented server contract.",
+    compliance: "Contact and account actions may be forwarded only after purpose-specific consent and destination review.",
+    criteria: ["secret-bearing-payload", "dom-scrape-or-mutation", "consent-bypass", "mutable-supply-chain-or-licensing", "not-fail-closed"],
+    route: "constrained-server-workflow", hook: ACTION_HOOK, gap: "managed-hubspot-action-destination",
+    alternative: "Hold delivery until an owned HubSpot server destination accepts only approved action names and typed fields.",
+    plan: ["Map only approved contact-sales and create-account actions.", "Resolve the destination from reviewed server configuration.", "Ship the owned destination with consent, dedupe, timeout, and fail-closed tests."],
+    tests: ["Reject non-allowlisted actions and unknown fields.", "Prove missing consent or destination produces zero delivery effects."],
+    qa: ["Use an in-memory destination in the diagnostic clone.", "Verify no request, listener, markup, or storage effect occurs from this dossier."],
+    rollback: "Remove the owned destination revision; the imported template remains inert and cannot resume.",
+    risk: "HubSpot delivery remains intentionally unavailable until the owning product gap is reviewed and shipped.",
+  },
+  {
+    nodeKey: "customTemplate:3", kind: "customTemplate", id: "3", type: null, dossierId: "v84-hubspot-template-definition-primary",
+    intent: "Provide the reusable code definition behind the HubSpot lead tag.",
+    events: [], data: [], destination: "none", consent: [], allowed: [], excluded: PROTECTED,
+    actionSelection: "not-applicable", actionNames: [],
+    why: "A custom-template definition is executable supply-chain material, not a portable business configuration.",
+    security: "The gallery reference is modified and cannot establish immutable, reviewed behavior.",
+    privacy: "The redacted definition cannot prove data minimization or consent enforcement.",
+    compliance: "Unknown code cannot be certified for identity, age, checkout, payment, or account surfaces.",
+    criteria: ["obfuscated-or-dynamic-code", "regulated-data-outside-typed-schema", "mutable-supply-chain-or-licensing", "not-deterministic-testable-reversible"],
+    route: "retire", hook: null, gap: null,
+    alternative: "Retire the definition and use the owned HubSpot action destination described by dossier v84-hubspot-lead-tag.",
+    plan: ["Preserve only this redacted inventory record for audit.", "Do not copy the definition into any runtime or tenant configuration."],
+    tests: ["Assert the definition is represented once and has no payload field."],
+    qa: ["Confirm the clone adds no markup, origin, listener, storage, or runtime asset."],
+    rollback: "No runtime rollback is needed; retiring inert evidence has no delivery effect.",
+    risk: "No vendor behavior is retained from the unverifiable template definition.",
+  },
+  {
+    nodeKey: "customTemplate:8", kind: "customTemplate", id: "8", type: null, dossierId: "v84-hubspot-template-definition-secondary",
+    intent: "Provide a second reusable code definition associated with the HubSpot experiment.",
+    events: [], data: [], destination: "none", consent: [], allowed: [], excluded: PROTECTED,
+    actionSelection: "not-applicable", actionNames: [],
+    why: "The second custom-template definition is executable material with no independently verified native contract.",
+    security: "Its mutable gallery provenance cannot meet pinned supply-chain review requirements.",
+    privacy: "Its redacted implementation cannot demonstrate a closed data schema or bounded retention.",
+    compliance: "Unverifiable template behavior cannot operate on regulated storefront surfaces.",
+    criteria: ["obfuscated-or-dynamic-code", "unbounded-storage-or-cross-tenant", "mutable-supply-chain-or-licensing", "not-fail-closed"],
+    route: "retire", hook: null, gap: null,
+    alternative: "Retire the duplicate definition and consolidate the recovered intent into the owned HubSpot destination gap.",
+    plan: ["Keep the redacted node identity for accounting.", "Do not install, render, sandbox, or translate the definition."],
+    tests: ["Assert this definition has a distinct dossier and no runtime authority."],
+    qa: ["Confirm the diagnostic clone remains unchanged outside inert evidence output."],
+    rollback: "No runtime rollback is needed because nothing is installed.",
+    risk: "Any behavior unique to this definition is deliberately not reproduced.",
+  },
+  {
+    nodeKey: "tag:18", kind: "tag", id: "18", type: "html", dossierId: "v84-capterra-conversion-pixel",
+    intent: "Attribute an approved sign-in marketing action to Capterra.",
+    events: [ACTION_HOOK], data: ["name"],
+    destination: "future managed Capterra destination", consent: ["analytics"], allowed: PUBLIC_ONLY, excluded: PROTECTED,
+    actionSelection: "fixed", actionNames: ["user_clicked_login_mktg"],
+    why: "The HTML pixel hides its transport, destination, and field selection inside redacted markup.",
+    security: "Re-hosting it could load mutable third-party code or bypass exact-origin controls.",
+    privacy: "A sign-in signal must contain no identity, credential, or DOM-derived value.",
+    compliance: "Authentication and age-assurance surfaces are excluded even when a marketing action shares a label.",
+    criteria: ["dom-scrape-or-mutation", "regulated-data-outside-typed-schema", "consent-bypass", "mutable-supply-chain-or-licensing"],
+    route: "constrained-server-workflow", hook: ACTION_HOOK, gap: "managed-capterra-action-destination",
+    alternative: "Hold the pixel until an owned server destination can accept the allowlisted login action without user identity.",
+    plan: ["Bind only the canonical login marketing action.", "Send a deduplicated anonymous event to an exact reviewed destination."],
+    tests: ["Reject identity and credential fields.", "Prove protected surfaces and absent analytics consent produce zero effects."],
+    qa: ["Exercise a fake in-memory Capterra receiver only.", "Assert the imported HTML is never rendered or interpreted."],
+    rollback: "Disable and remove the owned destination revision without restoring the HTML tag.",
+    risk: "Attribution is paused until Capterra support exists in owning product code.",
+  },
+  {
+    nodeKey: "tag:29", kind: "tag", id: "29", type: "html", dossierId: "v84-linkedin-pageview-loader",
+    intent: "Measure consented public marketing page views for LinkedIn attribution.",
+    events: [PAGE_VIEW_HOOK], data: ["path"],
+    destination: "future managed LinkedIn destination", consent: ["analytics"], allowed: PUBLIC_ONLY, excluded: PROTECTED,
+    actionSelection: "not-applicable", actionNames: [],
+    why: "A page-load HTML loader grants opaque third-party runtime authority rather than declaring a bounded event mapping.",
+    security: "A mutable loader cannot satisfy pinned asset, exact-origin, and deterministic failure requirements.",
+    privacy: "Only a canonical public path may be shared; query strings, identity, and page content are excluded.",
+    compliance: "The destination must remain off on protected, checkout, payment, identity, and age-assurance surfaces.",
+    criteria: ["dom-scrape-or-mutation", "protected-surface-replay", "unbounded-storage-or-cross-tenant", "mutable-supply-chain-or-licensing", "not-deterministic-testable-reversible"],
+    route: "reviewed-first-party-storefront-code", hook: PAGE_VIEW_HOOK, gap: "managed-linkedin-pageview-destination",
+    alternative: "Hold collection until a reviewed LinkedIn destination subscribes to minimized public page-view events.",
+    plan: ["Use the canonical page-view event, not a document observer.", "Allow only data.path on public marketing surfaces after consent."],
+    tests: ["Reject queries, fragments, DOM content, and protected routes.", "Prove exact destination origin and dedupe."],
+    qa: ["Use an in-memory receiver with a synthetic public path.", "Assert zero loader, CSP, markup, and listener effects."],
+    rollback: "Remove the reviewed destination revision; do not restore the loader.",
+    risk: "LinkedIn page-view attribution remains unavailable until the owned gap ships.",
+  },
+  {
+    nodeKey: "tag:31", kind: "tag", id: "31", type: "html", dossierId: "v84-g2-action-pixel",
+    intent: "Record a consented account-interest action for G2 attribution.",
+    events: [ACTION_HOOK], data: ["name"],
+    destination: "future managed G2 destination", consent: ["analytics"], allowed: PUBLIC_ONLY, excluded: PROTECTED,
+    actionSelection: "owner-selection-required", actionNames: ALL_APPROVED_ACTION_NAMES,
+    why: "The HTML pixel cannot prove that it sends only a canonical action or that it avoids protected account context.",
+    security: "Opaque markup can mutate the document or initiate unreviewed transport.",
+    privacy: "Account identity, age signals, and authentication state must never be derived for attribution.",
+    compliance: "Only approved action names on public marketing surfaces may cross the destination boundary.",
+    criteria: ["dom-scrape-or-mutation", "regulated-data-outside-typed-schema", "consent-bypass", "checkout-or-compliance-mutation"],
+    route: "constrained-server-workflow", hook: ACTION_HOOK, gap: "managed-g2-action-destination",
+    alternative: "Hold delivery until a reviewed G2 destination accepts a closed, anonymous action payload.",
+    plan: ["Choose one of the five approved marketing action names.", "Deliver only after consent with an opaque event dedupe key."],
+    tests: ["Reject unknown actions and protected-surface context.", "Prove retries are bounded and idempotent."],
+    qa: ["Use an in-memory receiver and synthetic action.", "Assert no imported markup or destination is activated."],
+    rollback: "Disable the owned destination revision and preserve only redacted audit evidence.",
+    risk: "G2 action attribution remains intentionally paused pending managed support.",
+  },
+  {
+    nodeKey: "tag:48", kind: "tag", id: "48", type: "html", dossierId: "v84-g2-sitewide-loader",
+    intent: "Load a sitewide G2 attribution capability outside embedded and non-live hosts.",
+    events: [PAGE_VIEW_HOOK], data: ["path"],
+    destination: "none", consent: ["analytics"], allowed: PUBLIC_ONLY, excluded: PROTECTED,
+    actionSelection: "not-applicable", actionNames: [],
+    why: "A sitewide HTML loader has broad runtime reach and its exclusions cannot substitute for an allowlisted native surface contract.",
+    security: "The loader is mutable supply-chain code with unbounded document and network authority.",
+    privacy: "Sitewide observation risks collecting page content, account state, and cross-surface browsing behavior.",
+    compliance: "Negative host/path rules do not fail closed and cannot prove checkout, payment, identity, or age-surface exclusion.",
+    criteria: ["dom-scrape-or-mutation", "protected-surface-replay", "unbounded-storage-or-cross-tenant", "mutable-supply-chain-or-licensing", "not-fail-closed"],
+    route: "retire", hook: null, gap: null,
+    alternative: "Retire the sitewide loader; evaluate a future event-scoped G2 adapter only if the narrower action dossier has approved demand.",
+    plan: ["Do not recreate negative hostname or path gates.", "Preserve no loader behavior or generic sitewide observer."],
+    tests: ["Assert the dossier recommends no runtime hook.", "Assert all protected surfaces remain excluded."],
+    qa: ["Confirm clone markup, CSP, listeners, storage, and network counters stay zero."],
+    rollback: "No runtime rollback is needed because the loader is never installed.",
+    risk: "Broad sitewide attribution is intentionally discontinued.",
+  },
+  {
+    nodeKey: "variable:38", kind: "variable", id: "38", type: "jsm", dossierId: "v84-page-context-custom-js",
+    intent: "Derive a stable page-load context value for downstream marketing rules.",
+    events: [PAGE_VIEW_HOOK], data: ["path"], destination: "none", consent: ["analytics"],
+    allowed: PUBLIC_ONLY, excluded: PROTECTED,
+    actionSelection: "not-applicable", actionNames: [],
+    why: "A Custom JavaScript variable is an arbitrary computation with no declared inputs, output schema, or failure behavior.",
+    security: "The hidden computation could read globals, storage, DOM state, or secrets.",
+    privacy: "Only the platform-owned canonical path is an acceptable input; page content and identity are excluded.",
+    compliance: "Derived values must use a closed schema and cannot inspect checkout, payment, identity, or age-assurance state.",
+    criteria: ["secret-bearing-payload", "dom-scrape-or-mutation", "regulated-data-outside-typed-schema", "not-deterministic-testable-reversible"],
+    route: "declarative-typed-mapping", hook: PAGE_VIEW_HOOK, gap: null,
+    alternative: "Replace the computation with a reviewed declarative mapping over data.path if a named consumer still needs it.",
+    plan: ["Document the required output enum with the consumer owner.", "Implement a pure total mapping from data.path with an explicit unknown value.", "Delete the mapping if no named consumer remains."],
+    tests: ["Table-test every path class and the unknown fallback.", "Prove no DOM, global, storage, query, fragment, or identity input is available."],
+    qa: ["Run the mapping against synthetic clone paths only.", "Assert no destination or runtime effect is created by the dossier."],
+    rollback: "Remove the declarative mapping and let consumers receive the explicit unknown value.",
+    risk: "The recovered fixture cannot establish the original output semantics; consumer confirmation is required before implementing the mapping.",
+  },
+] as const;
+
+export interface V84NonportableCoachingInput {
+  readonly scope: {
+    readonly sourceTenant: string;
+    readonly sourceMode: string;
+    readonly cloneTenant: string;
+    readonly destinationMode: string;
+  };
+  readonly codeExecutionUnsupported: readonly UnresolvedInventoryItem[];
+}
+
+export interface V84NonportableCodeCoaching {
+  readonly schemaVersion: 1;
+  readonly policy: {
+    readonly sourceReadOnly: true;
+    readonly importedArtifactsInert: true;
+    readonly installsOrPublishes: false;
+    readonly refusalCriteria: typeof V84_NONPORTABLE_REFUSAL_CRITERIA;
+    readonly replacementPriority: typeof V84_NATIVE_REPLACEMENT_PRIORITY;
+  };
+  readonly dossiers: readonly V84NonportableCodeIntentDossier[];
+}
+
+function assertExactScope(input: V84NonportableCoachingInput): void {
+  if (
+    input.scope.sourceTenant !== "tokenoftrust.com" ||
+    input.scope.sourceMode !== "read-only-fixture" ||
+    input.scope.cloneTenant !== "tokenoftrust.com~clone~gtm-migration-v84" ||
+    input.scope.destinationMode !== "offline-in-memory-only"
+  ) throw new Error("Nonportable coaching is restricted to the exact read-only diagnostic clone proof.");
+}
+
+function itemByNodeKey(items: readonly UnresolvedInventoryItem[]): Map<string, UnresolvedInventoryItem> {
+  const result = new Map<string, UnresolvedInventoryItem>();
+  for (const item of items) {
+    if (result.has(item.nodeKey)) throw new Error("The nonportable coaching inventory contains a duplicate object.");
+    result.set(item.nodeKey, item);
+  }
+  return result;
+}
+
+function buildDossier(plan: DossierPlan, item: UnresolvedInventoryItem): V84NonportableCodeIntentDossier {
+  if (
+    item.kind !== plan.kind || item.id !== plan.id || item.type !== plan.type ||
+    item.disposition !== "unsupported-by-design" || item.reasonCode !== "code-execution-unsupported"
+  ) throw new Error("The nonportable coaching inventory no longer matches the reviewed v84 object contract.");
+  return {
+    schemaVersion: 1,
+    dossierId: plan.dossierId,
+    sourceObject: { nodeKey: item.nodeKey, kind: plan.kind, id: plan.id, type: plan.type, importedArtifact: "redacted-inert-evidence-only" },
+    recoveredBusinessIntent: plan.intent,
+    requiredContract: {
+      events: plan.events,
+      typedData: plan.data,
+      destination: plan.destination,
+      consent: plan.consent,
+      allowedSurfaces: plan.allowed,
+      excludedSurfaces: plan.excluded,
+      actionSelection: plan.actionSelection,
+      approvedActionNames: plan.actionNames,
+    },
+    portabilityReview: { decision: "do-not-port", whyOriginalSnippetIsNotPortable: plan.why, security: plan.security, privacy: plan.privacy, compliance: plan.compliance, refusalCriteria: plan.criteria },
+    recommendedTotPort: { route: plan.route, nativeHook: plan.hook, owningProductGap: plan.gap, saferAlternative: plan.alternative, migrationPlan: plan.plan, status: "not-installed" },
+    verification: { syntheticTests: plan.tests, cloneQa: plan.qa, rollback: plan.rollback, residualRisk: plan.risk },
+  };
+}
+
+/**
+ * Convert the exact eight inert unsupported v84 records into reviewed coaching.
+ * Only stable object identity is read from the import; no source name,
+ * explanation, raw field, markup, template body, or script text is propagated.
+ */
+export function buildV84NonportableCodeCoaching(input: V84NonportableCoachingInput): V84NonportableCodeCoaching {
+  assertExactScope(input);
+  if (input.codeExecutionUnsupported.length !== PLANS.length) {
+    throw new Error("The nonportable coaching inventory must contain exactly eight objects.");
+  }
+  const byNodeKey = itemByNodeKey(input.codeExecutionUnsupported);
+  const dossiers = PLANS.map((plan) => {
+    const item = byNodeKey.get(plan.nodeKey);
+    if (!item) throw new Error("The nonportable coaching inventory is missing a reviewed v84 object.");
+    return buildDossier(plan, item);
+  });
+  return {
+    schemaVersion: 1,
+    policy: {
+      sourceReadOnly: true,
+      importedArtifactsInert: true,
+      installsOrPublishes: false,
+      refusalCriteria: V84_NONPORTABLE_REFUSAL_CRITERIA,
+      replacementPriority: V84_NATIVE_REPLACEMENT_PRIORITY,
+    },
+    dossiers,
+  };
+}

package/apps/storefront/src/lib/apps/v84NonportableRouteContract.ts

@@ -0,0 +1,188 @@
+/** Exact reviewed input boundary for the v84 eight-route dogfood gate. */
+import type { V84CloneMigrationEvidence } from "./v84CloneMigrationEvidence.js";
+import type { V84NonportableCodeIntentDossier } from "./v84NonportableCodeCoaching.js";
+
+const SOURCE = "tokenoftrust.com";
+const CLONE = "tokenoftrust.com~clone~gtm-migration-v84";
+const FINGERPRINT_REFUSAL = "The reviewed eight-dossier identity and contract fingerprint changed.";
+
+function snapshotPlainData(value: unknown, ancestors = new Set<object>()): unknown {
+  const invalid = (): never => { throw new Error(FINGERPRINT_REFUSAL); };
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value !== "object") return invalid();
+  if (ancestors.has(value)) return invalid();
+  ancestors.add(value);
+  try {
+    const array = Array.isArray(value);
+    if (Object.getPrototypeOf(value) !== (array ? Array.prototype : Object.prototype)) {
+      return invalid();
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const keys = Reflect.ownKeys(descriptors);
+    if (keys.some((key) => typeof key !== "string" || key === "toJSON")) {
+      return invalid();
+    }
+    if (array) {
+      const length = descriptors.length;
+      if (!length || !("value" in length) || !Number.isSafeInteger(length.value) || length.value < 0) {
+        return invalid();
+      }
+      const expectedKeys = [...Array.from({ length: length.value }, (_, index) => String(index)), "length"];
+      if (JSON.stringify(keys.sort()) !== JSON.stringify(expectedKeys.sort())) return invalid();
+      return Object.freeze(Array.from({ length: length.value }, (_, index) => {
+        const descriptor = descriptors[String(index)];
+        if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) return invalid();
+        return snapshotPlainData(descriptor.value, ancestors);
+      }));
+    }
+    const copy: Record<string, unknown> = {};
+    for (const key of keys) {
+      const descriptor = descriptors[key as string];
+      if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) return invalid();
+      Object.defineProperty(copy, key, {
+        enumerable: true, configurable: false, writable: false,
+        value: snapshotPlainData(descriptor.value, ancestors),
+      });
+    }
+    return Object.freeze(copy);
+  } finally {
+    ancestors.delete(value);
+  }
+}
+
+function ownPlainData(value: unknown, key: string): unknown {
+  if (value === null || typeof value !== "object" || Object.getPrototypeOf(value) !== Object.prototype) {
+    throw new Error(FINGERPRINT_REFUSAL);
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  for (const ownKey of Reflect.ownKeys(descriptors)) {
+    const descriptor = descriptors[ownKey as string];
+    if (typeof ownKey !== "string" || ownKey === "toJSON" ||
+        !descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+      throw new Error(FINGERPRINT_REFUSAL);
+    }
+  }
+  const selected = descriptors[key];
+  if (!selected || !("value" in selected)) throw new Error(FINGERPRINT_REFUSAL);
+  return selected.value;
+}
+
+function safeBoundary(evidence: unknown, catalogAdapterIds: unknown) {
+  try {
+    const scope = snapshotPlainData(ownPlainData(evidence, "scope"));
+    const nonportableCodeCoaching = snapshotPlainData(ownPlainData(evidence, "nonportableCodeCoaching"));
+    const analysis = ownPlainData(evidence, "analysis");
+    const graph = ownPlainData(analysis, "graph");
+    const edges = snapshotPlainData(ownPlainData(graph, "edges"));
+    return {
+      evidence: { scope, nonportableCodeCoaching, analysis: { graph: { edges } } } as V84CloneMigrationEvidence,
+      catalogAdapterIds: snapshotPlainData(catalogAdapterIds) as readonly string[],
+    };
+  } catch {
+    throw new Error(FINGERPRINT_REFUSAL);
+  }
+}
+
+function fingerprint(item: V84NonportableCodeIntentDossier): string {
+  return JSON.stringify([
+    item.schemaVersion, item.sourceObject.nodeKey, item.sourceObject.kind, item.sourceObject.id,
+    item.sourceObject.type, item.sourceObject.importedArtifact, item.dossierId,
+    item.recoveredBusinessIntent, item.requiredContract.events,
+    item.requiredContract.typedData, item.requiredContract.destination,
+    item.requiredContract.consent, item.requiredContract.allowedSurfaces,
+    item.requiredContract.excludedSurfaces, item.requiredContract.actionSelection,
+    item.requiredContract.approvedActionNames, item.recommendedTotPort.route,
+    item.recommendedTotPort.nativeHook, item.recommendedTotPort.owningProductGap,
+    item.recommendedTotPort.saferAlternative, item.recommendedTotPort.status,
+  ]);
+}
+
+const PROTECTED = ["admin", "account", "identity", "age-assurance", "checkout", "payment"];
+const ACTIONS = [
+  "user_clicked_contact_sales_mktg", "user_clicked_create_account_mktg",
+  "user_clicked_login_mktg", "user_clicked_contact_support_consumer_mktg",
+  "user_clicked_contact_support_partner_mktg",
+];
+const row = (...value: unknown[]) => JSON.stringify(value);
+const EXPECTED_FINGERPRINTS = [
+  row(1, "tag:4", "tag", "4", "cvt_88888888_3", "redacted-inert-evidence-only", "v84-hubspot-lead-tag",
+    "Send a consented contact-sales or account-creation signal to HubSpot.", ["storefront.action.activated.v1"], ["name"],
+    "future managed HubSpot destination", ["analytics"], ["public-marketing-pages"], PROTECTED, "fixed", ACTIONS.slice(0, 2),
+    "constrained-server-workflow", "storefront.action.activated.v1", "managed-hubspot-action-destination",
+    "Hold delivery until an owned HubSpot server destination accepts only approved action names and typed fields.", "not-installed"),
+  row(1, "customTemplate:3", "customTemplate", "3", null, "redacted-inert-evidence-only", "v84-hubspot-template-definition-primary",
+    "Provide the reusable code definition behind the HubSpot lead tag.", [], [], "none", [], [], PROTECTED, "not-applicable", [],
+    "retire", null, null,
+    "Retire the definition and use the owned HubSpot action destination described by dossier v84-hubspot-lead-tag.", "not-installed"),
+  row(1, "customTemplate:8", "customTemplate", "8", null, "redacted-inert-evidence-only", "v84-hubspot-template-definition-secondary",
+    "Provide a second reusable code definition associated with the HubSpot experiment.", [], [], "none", [], [], PROTECTED, "not-applicable", [],
+    "retire", null, null,
+    "Retire the duplicate definition and consolidate the recovered intent into the owned HubSpot destination gap.", "not-installed"),
+  row(1, "tag:18", "tag", "18", "html", "redacted-inert-evidence-only", "v84-capterra-conversion-pixel",
+    "Attribute an approved sign-in marketing action to Capterra.", ["storefront.action.activated.v1"], ["name"],
+    "future managed Capterra destination", ["analytics"], ["public-marketing-pages"], PROTECTED, "fixed", [ACTIONS[2]],
+    "constrained-server-workflow", "storefront.action.activated.v1", "managed-capterra-action-destination",
+    "Hold the pixel until an owned server destination can accept the allowlisted login action without user identity.", "not-installed"),
+  row(1, "tag:29", "tag", "29", "html", "redacted-inert-evidence-only", "v84-linkedin-pageview-loader",
+    "Measure consented public marketing page views for LinkedIn attribution.", ["storefront.page.viewed.v2"], ["path"],
+    "future managed LinkedIn destination", ["analytics"], ["public-marketing-pages"], PROTECTED, "not-applicable", [],
+    "reviewed-first-party-storefront-code", "storefront.page.viewed.v2", "managed-linkedin-pageview-destination",
+    "Hold collection until a reviewed LinkedIn destination subscribes to minimized public page-view events.", "not-installed"),
+  row(1, "tag:31", "tag", "31", "html", "redacted-inert-evidence-only", "v84-g2-action-pixel",
+    "Record a consented account-interest action for G2 attribution.", ["storefront.action.activated.v1"], ["name"],
+    "future managed G2 destination", ["analytics"], ["public-marketing-pages"], PROTECTED, "owner-selection-required", ACTIONS,
+    "constrained-server-workflow", "storefront.action.activated.v1", "managed-g2-action-destination",
+    "Hold delivery until a reviewed G2 destination accepts a closed, anonymous action payload.", "not-installed"),
+  row(1, "tag:48", "tag", "48", "html", "redacted-inert-evidence-only", "v84-g2-sitewide-loader",
+    "Load a sitewide G2 attribution capability outside embedded and non-live hosts.", ["storefront.page.viewed.v2"], ["path"],
+    "none", ["analytics"], ["public-marketing-pages"], PROTECTED, "not-applicable", [], "retire", null, null,
+    "Retire the sitewide loader; evaluate a future event-scoped G2 adapter only if the narrower action dossier has approved demand.", "not-installed"),
+  row(1, "variable:38", "variable", "38", "jsm", "redacted-inert-evidence-only", "v84-page-context-custom-js",
+    "Derive a stable page-load context value for downstream marketing rules.", ["storefront.page.viewed.v2"], ["path"],
+    "none", ["analytics"], ["public-marketing-pages"], PROTECTED, "not-applicable", [],
+    "declarative-typed-mapping", "storefront.page.viewed.v2", null,
+    "Replace the computation with a reviewed declarative mapping over data.path if a named consumer still needs it.", "not-installed"),
+];
+
+function assertGraph(evidence: V84CloneMigrationEvidence): void {
+  const edges = evidence.analysis.graph.edges;
+  const has = (from: string, to: string, kind: string) => edges.some((edge) =>
+    edge.from === from && edge.to === to && edge.kind === kind);
+  if (!has("tag:4", "customTemplate:3", "usesTemplate") ||
+      edges.some((edge) => edge.to === "customTemplate:8")) {
+    throw new Error("The reviewed template dependency graph changed.");
+  }
+  if (!has("trigger:39", "variable:38", "references") ||
+      edges.some((edge) => edge.from.startsWith("tag:") && edge.to === "trigger:39")) {
+    throw new Error("The Custom JS consumer graph changed.");
+  }
+  const tag48 = edges.filter((edge) => edge.from === "tag:48")
+    .map((edge) => `${edge.kind}:${edge.to}`).sort();
+  const expected = ["blocks:trigger:10", "blocks:trigger:11", "blocks:trigger:42", "blocks:trigger:9", "fires:builtInTrigger:2147479553"];
+  if (JSON.stringify(tag48) !== JSON.stringify(expected)) throw new Error("The tag:48 retirement graph changed.");
+}
+
+/** Refuse any type-shaped dossier, scope, graph, or catalog substitution. */
+export function assertExactV84DogfoodContract(
+  evidence: V84CloneMigrationEvidence,
+  catalogAdapterIds: readonly string[],
+): { readonly evidence: V84CloneMigrationEvidence; readonly catalogAdapterIds: readonly string[] } {
+  const safe = safeBoundary(evidence, catalogAdapterIds);
+  if (safe.evidence.scope.sourceTenant !== SOURCE || safe.evidence.scope.sourceMode !== "read-only-fixture" ||
+      safe.evidence.scope.cloneTenant !== CLONE || safe.evidence.scope.destinationMode !== "offline-in-memory-only") {
+    throw new Error("The dogfood evidence is outside the exact diagnostic clone.");
+  }
+  const expectedCatalog = ["platform.amplitude", "platform.google-measurement", "platform.meta-pixel"];
+  if (JSON.stringify([...safe.catalogAdapterIds].sort()) !== JSON.stringify(expectedCatalog)) {
+    throw new Error("The reviewed native adapter catalog changed.");
+  }
+  try {
+    const actual = safe.evidence.nonportableCodeCoaching.dossiers.map(fingerprint);
+    if (JSON.stringify(actual) !== JSON.stringify(EXPECTED_FINGERPRINTS)) throw new Error(FINGERPRINT_REFUSAL);
+  } catch {
+    throw new Error(FINGERPRINT_REFUSAL);
+  }
+  assertGraph(safe.evidence);
+  return safe;
+}