@unrulysystems/native-motion 0.1.0-alpha.0

package/src/native/motion/driverValueChannel.ts

@@ -0,0 +1,3288 @@
+// Private JS-side value-channel handoff (REQ-VALUE-014/015, REQ-DRIVER-034): the exact-object
+// identity registry and its retention reconciliation, the serializable handoff protocol machine
+// (freeze → prepare → source-confirmed release/abort → immutable COMMIT → destination
+// acknowledgement), tuple validation at every producer/consumer boundary, the JS destination
+// COMMIT consumer with its preallocated acknowledgement slot, and the bounded post-RELEASE
+// refusal drain. Every transition replaces state immutably; malformed, conflicting, or
+// out-of-sequence input is refused with the file's typed vocabulary and never mutates retained
+// protocol state.
+
+import type { MotionValue } from '@unrulysystems/native-motion-core'
+import type {
+  MotionValueDriverBindingEligibility,
+  MotionValueDriverPort,
+  MotionValueDriverPortObservation,
+} from '@unrulysystems/native-motion-core/internal-driver'
+
+export type ValueChannelSide = 'UI' | 'JS'
+export type ValueHandoffDirection = 'UI_TO_JS' | 'JS_TO_UI'
+
+export type ValueHandoffOwnership =
+  | 'IDLE'
+  | 'UI_RUNNING'
+  | 'UI_FROZEN_TO_JS'
+  | 'JS_PREPARED'
+  | 'UI_RELEASE_PENDING_TO_JS'
+  | 'UI_RELEASED_TO_JS'
+  | 'JS_RUNNING'
+  | 'JS_FROZEN_TO_UI'
+  | 'UI_PREPARED'
+  | 'JS_RELEASE_PENDING_TO_UI'
+  | 'JS_RELEASED_TO_UI'
+  | 'UI_DRAINING'
+  | 'JS_DRAINING'
+  | 'BOUNDED_REFUSAL_DRAINING'
+  | 'TERMINAL_REFUSED'
+
+export interface ValueChannelHistoryState {
+  readonly currentValue: number
+  readonly previousValue: number
+  readonly currentTimestampMs: number
+  readonly previousTimestampMs: number
+}
+
+export interface ValueChannelSequenceState {
+  readonly authoritativeSequence: number
+  readonly commandSequence: number
+  readonly writeSequence: number
+  readonly eventSequence: number
+  readonly frameSequence: number
+  readonly dueWorkSequence: number
+  readonly valueCompletionSequence: number
+  readonly batchDependencyEventSequence: number
+  readonly dependencyOutboxAckSequence: number
+}
+
+export type NormalizedValueChannelEasingPlan =
+  | { readonly kind: 'LINEAR' }
+  | {
+      readonly kind: 'CUBIC_BEZIER'
+      readonly x1: number
+      readonly y1: number
+      readonly x2: number
+      readonly y2: number
+    }
+
+export type NormalizedValueChannelGeneratorPlan =
+  | {
+      readonly kind: 'SPRING'
+      readonly from: number
+      readonly target: number
+      readonly initialVelocity: number
+      readonly stiffness: number
+      readonly damping: number
+      readonly mass: number
+      readonly restSpeed: number
+      readonly restDelta: number
+      readonly delayMs: number
+    }
+  | {
+      readonly kind: 'TIMING'
+      readonly keyframes: readonly number[]
+      readonly times: readonly number[]
+      readonly easing: readonly NormalizedValueChannelEasingPlan[]
+      readonly durationMs: number
+      readonly delayMs: number
+      readonly repeatCount: number
+      readonly repeatType: 'loop' | 'reverse' | 'mirror'
+      readonly repeatDelayMs: number
+    }
+  | {
+      readonly kind: 'INSTANT'
+      readonly target: number
+      readonly delayMs: number
+    }
+  | {
+      readonly kind: 'INERTIA'
+      readonly from: number
+      readonly initialVelocity: number
+      readonly power: number
+      readonly timeConstant: number
+      readonly bounceStiffness: number
+      readonly bounceDamping: number
+      readonly restDelta: number
+      readonly restSpeed: number
+      readonly min: number | null
+      readonly max: number | null
+    }
+
+export interface NormalizedValueChannelWritePayload {
+  readonly writeSequence: number
+  readonly frameSequence: number
+  readonly value: number
+  readonly velocity: number
+  readonly previousValue: number
+  readonly previousTimestampMs: number
+  readonly currentTimestampMs: number
+}
+
+export type NormalizedValueChannelTaskCallbackPayload =
+  | {
+      readonly callbackKind: 'transition-on-update' | 'transition-on-complete'
+      readonly callbackId: number
+      readonly eventSequence: number
+      readonly callbackDeliverySequence: number
+    }
+  | {
+      readonly callbackKind: 'animation-complete'
+      readonly callbackId: number
+      readonly eventSequence: number
+      readonly callbackDeliverySequence: number
+      readonly completionSequence: number
+    }
+
+export type NormalizedValueChannelCarrierValue =
+  | { readonly kind: 'number'; readonly value: number }
+  | { readonly kind: 'keyword'; readonly value: string }
+
+export type ValueHandoffDestinationLedgerKind =
+  | 'PUBLIC_CONTROL'
+  | 'RETENTION'
+  | 'EXECUTION'
+  | 'DUE_WORK'
+  | 'COMPLETION'
+  | 'DEPENDENCY_EVENT'
+  | 'GENERATION'
+  | 'SEQUENCE'
+
+interface ValueHandoffDestinationLedgerSlot<Ledger extends ValueHandoffDestinationLedgerKind> {
+  readonly ledger: Ledger
+  readonly slotId: number
+}
+
+export interface ValueChannelHandoffResourceState {
+  readonly preparedStateRetained: boolean
+  readonly preparedCloneRetained: boolean
+  readonly transferActivityRetained: boolean
+  readonly transferTimerArmed: boolean
+}
+
+export interface DriverValueChannelIdentityRecordState {
+  readonly channelId: number
+  readonly jsRecordId: number
+  readonly uiRecordId: number
+  readonly creationKind: 'direct-public-finite-number'
+  readonly publicReferenceRetained: boolean
+  readonly sinkCount: number
+  readonly changeObserverCount: number
+  readonly publicControlSlotId: number | null
+  readonly physicalExecutionIds: readonly number[]
+  readonly dueWorkSequences: readonly number[]
+  readonly valueCompletionSequences: readonly number[]
+  readonly targetBatchDependencyIds: readonly number[]
+  readonly dependencyEventOutboxSequences: readonly number[]
+  readonly dependencyEventAckWatermark: number
+  readonly sharedBatchReferenceCount: number
+  readonly pendingFrameActivity: boolean
+  readonly currentBindingGeneration: number
+  readonly retiredBindingGeneration: number
+  readonly directOperationEpoch: number
+  readonly executionLeaseEpoch: number
+  readonly history: ValueChannelHistoryState
+  readonly sequences: ValueChannelSequenceState
+}
+
+export interface ValueHandoffPreparedMutableTuple {
+  readonly publicControlSlot:
+    | { readonly kind: 'empty' }
+    | {
+        readonly kind: 'installed'
+        readonly controlId: number
+        readonly executionId: number
+        readonly directOperationEpoch: number
+      }
+  readonly physicalExecutionIds: readonly number[]
+  readonly dueWorkSequences: readonly number[]
+  readonly valueCompletionSequences: readonly number[]
+  readonly targetBatchDependencyIds: readonly number[]
+  readonly dependencyEventOutboxSequences: readonly number[]
+  readonly currentBindingGeneration: number
+  readonly retiredBindingGeneration: number
+  readonly directOperationEpoch: number
+  readonly dueWorkSequence: number
+  readonly valueCompletionSequence: number
+  readonly batchDependencyEventSequence: number
+  readonly dependencyOutboxAckSequence: number
+  readonly authoritativeSequence: number
+}
+
+export type NormalizedRetainedWorkEntry =
+  | {
+      readonly kind: 'public-control-slot'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'PUBLIC_CONTROL'>
+      readonly authoritativeSequence: number
+      readonly state:
+        | { readonly kind: 'EMPTY' }
+        | {
+            readonly kind: 'INSTALLED'
+            readonly controlId: number
+            readonly executionId: number
+            readonly directOperationEpoch: number
+          }
+    }
+  | {
+      readonly kind: 'retention-edge'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'RETENTION'>
+      readonly authoritativeSequence: number
+      readonly registrationKind: 'SINK' | 'CHANGE_OBSERVER' | 'PUBLIC_REFERENCE'
+      readonly registrationId: number
+      readonly bindingGeneration: number
+      readonly edge: 'ATTACH' | 'DETACH'
+    }
+  | {
+      readonly kind: 'generator-execution'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'EXECUTION'>
+      readonly authoritativeSequence: number
+      readonly executionId: number
+      readonly controlId: number
+      readonly directOperationEpoch: number
+      readonly executionLease: number
+      readonly plan: NormalizedValueChannelGeneratorPlan
+      readonly elapsedMs: number
+      readonly sample: NormalizedValueChannelWritePayload & { readonly done: boolean }
+      readonly phase: 'RUNNING' | 'DONE_DECIDED' | 'STOPPED'
+      readonly orphaned: boolean
+    }
+  | {
+      readonly kind: 'update-task'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'DUE_WORK'>
+      readonly authoritativeSequence: number
+      readonly taskId: number
+      readonly taskSequence: number
+      readonly taskClass: 'instant' | 'equal' | 'idle-direct-write'
+      readonly state: 'QUEUED' | 'WRITE_RESOLVED' | 'CALLBACKS_PENDING'
+      readonly write: NormalizedValueChannelWritePayload
+      readonly callbacks: readonly NormalizedValueChannelTaskCallbackPayload[]
+    }
+  | {
+      readonly kind: 'carrier-task'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'DUE_WORK'>
+      readonly authoritativeSequence: number
+      readonly taskId: number
+      readonly taskSequence: number
+      readonly taskClass: 'transition-end-carrier' | 'exit-carrier' | 'packet-b-carrier'
+      readonly carrier: {
+        readonly carrierId: number
+        readonly identityId: number
+        readonly authoredIndex: number
+        readonly key: string
+        readonly value: NormalizedValueChannelCarrierValue
+      }
+    }
+  | {
+      readonly kind: 'direct-write'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'DUE_WORK'>
+      readonly authoritativeSequence: number
+      readonly operation: 'SET' | 'JUMP'
+      readonly commandSequence: number
+      readonly directOperationEpoch: number
+      readonly write: NormalizedValueChannelWritePayload
+    }
+  | {
+      readonly kind: 'value-completion'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'COMPLETION'>
+      readonly authoritativeSequence: number
+      readonly executionId: number
+      readonly completionSequence: number
+      readonly eventSequence: number
+      readonly bindingGeneration: number
+      readonly state: 'ARMED' | 'RESOLVED' | 'DELIVERED'
+      readonly transitionOnCompleteCallbackId: number | null
+      readonly lifecycleCallbackIds: readonly number[]
+      readonly publicStartPromiseId: number | null
+      readonly clearControlIdAtArm: number | null
+    }
+  | {
+      readonly kind: 'target-batch-dependency-event'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'DEPENDENCY_EVENT'>
+      readonly authoritativeSequence: number
+      readonly batchId: number
+      readonly dependencyId: number
+      readonly identityId: number
+      readonly dependencyEventKind: 'RAW_RESOLVED' | 'VALUE_ACKNOWLEDGED' | 'PERMANENTLY_UNRESOLVED'
+      readonly eventSequence: number
+      readonly outboxSequence: number
+      readonly outboxAcknowledgementWatermark: number
+      readonly state: 'UNACKNOWLEDGED' | 'ACKNOWLEDGED'
+    }
+  | {
+      readonly kind: 'binding-generation'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'GENERATION'>
+      readonly authoritativeSequence: number
+      readonly currentBindingGeneration: number
+      readonly retiredBindingGeneration: number
+    }
+  | {
+      readonly kind: 'sequence-state'
+      readonly destinationSlot: ValueHandoffDestinationLedgerSlot<'SEQUENCE'>
+      readonly authoritativeSequence: number
+      readonly sequences: ValueChannelSequenceState
+    }
+
+export type ValueHandoffDestinationLedgerSlotState =
+  | {
+      readonly ledger: 'PUBLIC_CONTROL'
+      readonly slotId: number
+      readonly entries: readonly Extract<
+        NormalizedRetainedWorkEntry,
+        { readonly kind: 'public-control-slot' }
+      >[]
+    }
+  | {
+      readonly ledger: 'RETENTION'
+      readonly slotId: number
+      readonly entries: readonly Extract<
+        NormalizedRetainedWorkEntry,
+        { readonly kind: 'retention-edge' }
+      >[]
+    }
+  | {
+      readonly ledger: 'EXECUTION'
+      readonly slotId: number
+      readonly entries: readonly Extract<
+        NormalizedRetainedWorkEntry,
+        { readonly kind: 'generator-execution' }
+      >[]
+    }
+  | {
+      readonly ledger: 'DUE_WORK'
+      readonly slotId: number
+      readonly entries: readonly Extract<
+        NormalizedRetainedWorkEntry,
+        { readonly kind: 'update-task' | 'carrier-task' | 'direct-write' }
+      >[]
+    }
+  | {
+      readonly ledger: 'COMPLETION'
+      readonly slotId: number
+      readonly entries: readonly Extract<
+        NormalizedRetainedWorkEntry,
+        { readonly kind: 'value-completion' }
+      >[]
+    }
+  | {
+      readonly ledger: 'DEPENDENCY_EVENT'
+      readonly slotId: number
+      readonly entries: readonly Extract<
+        NormalizedRetainedWorkEntry,
+        { readonly kind: 'target-batch-dependency-event' }
+      >[]
+    }
+  | {
+      readonly ledger: 'GENERATION'
+      readonly slotId: number
+      readonly entries: readonly Extract<
+        NormalizedRetainedWorkEntry,
+        { readonly kind: 'binding-generation' }
+      >[]
+    }
+  | {
+      readonly ledger: 'SEQUENCE'
+      readonly slotId: number
+      readonly entries: readonly Extract<
+        NormalizedRetainedWorkEntry,
+        { readonly kind: 'sequence-state' }
+      >[]
+    }
+
+export interface ValueHandoffDestinationLedgerState {
+  readonly slots: readonly ValueHandoffDestinationLedgerSlotState[]
+}
+
+export type ValueHandoffPhase = 'PREPARED' | 'RELEASE_PENDING_PRE_FENCE' | 'RELEASED_POST_FENCE'
+
+interface ValueHandoffSequencedPhaseEvent {
+  readonly authoritativeSequence: number
+}
+
+export type ValueHandoffPhaseMutationEvent =
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'sink-attach'
+      readonly sink: DriverValueChannelSinkRegistration
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'sink-detach'
+      readonly sink: DriverValueChannelSinkRegistration
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'observer-arm'
+      readonly observerId: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'observer-disarm'
+      readonly observerId: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'start'
+      readonly executionId: number
+      readonly controlId: number
+      readonly directOperationEpoch: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'retarget'
+      readonly previousControlId: number
+      readonly executionId: number
+      readonly controlId: number
+      readonly directOperationEpoch: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'set'
+      readonly value: number
+      readonly commandSequence: number
+      readonly directOperationEpoch: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'jump'
+      readonly value: number
+      readonly commandSequence: number
+      readonly directOperationEpoch: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'stop'
+      readonly controlId: number | null
+      readonly commandSequence: number
+      readonly directOperationEpoch: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'destroy'
+      readonly retiredBindingGeneration: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'public-slot'
+      readonly controlId: number | null
+      readonly executionId: number | null
+      readonly directOperationEpoch: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'physical-sample'
+      readonly executionId: number
+      readonly writeSequence: number
+      readonly value: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'physical-done'
+      readonly executionId: number
+      readonly writeSequence: number
+      readonly completionSequence: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'completion-arm'
+      readonly executionId: number
+      readonly completionSequence: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'completion-resolved'
+      readonly executionId: number
+      readonly completionSequence: number
+      readonly eventSequence: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'batch-dependency'
+      readonly batchId: number
+      readonly dependencyId: number
+      readonly referenceDelta: -1 | 1
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'batch-outbox'
+      readonly batchId: number
+      readonly dependencyId: number
+      readonly status: 'RAW_RESOLVED' | 'VALUE_ACKNOWLEDGED' | 'PERMANENTLY_UNRESOLVED'
+      readonly eventSequence: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'batch-outbox-ack'
+      readonly acknowledgedThroughSequence: number
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'fifo-task'
+      readonly taskSequence: number
+      readonly taskClass: 'instant' | 'equal' | 'carrier' | 'idle'
+    })
+  | (ValueHandoffSequencedPhaseEvent & {
+      readonly kind: 'binding-generation'
+      readonly currentBindingGeneration: number
+      readonly retiredBindingGeneration: number
+    })
+
+export type ValueHandoffPhaseReadEvent =
+  | { readonly kind: 'synchronous-snapshot' }
+  | { readonly kind: 'synchronous-get' }
+  | { readonly kind: 'synchronous-get-velocity' }
+
+export type ValueHandoffPhaseEvent = ValueHandoffPhaseMutationEvent | ValueHandoffPhaseReadEvent
+
+export type ValueHandoffPhaseEventKind = ValueHandoffPhaseEvent['kind']
+export type ValueHandoffPhaseEventOperation = `phase-event-${ValueHandoffPhaseEventKind}`
+
+export interface ValueHandoffPhaseEventEnvelope {
+  readonly direction: ValueHandoffDirection
+  readonly transferLease: number
+  readonly phaseToken: number
+  readonly phase: ValueHandoffPhase
+  readonly event: ValueHandoffPhaseEvent
+}
+
+export type ValueHandoffPhaseReadView =
+  | 'AUTHORITATIVE_SOURCE'
+  | 'SOURCE_WITH_DIRECT_OPERATION_OVERLAY'
+  | 'PREPARED_DESTINATION_WITH_DIRECT_OPERATION_OVERLAY'
+
+export type ValueHandoffPhaseEventDisposition =
+  | {
+      readonly kind: 'ABORT_AND_REPREPARE'
+      readonly phase: 'PREPARED' | 'RELEASE_PENDING_PRE_FENCE'
+      readonly eventKind: ValueHandoffPhaseMutationEvent['kind']
+      readonly status: Extract<ValueHandoffSourceStatus, { readonly kind: 'ABORTED' }>
+    }
+  | {
+      readonly kind: 'APPEND_IMMUTABLE_COMMIT_SUFFIX'
+      readonly phase: 'RELEASED_POST_FENCE'
+      readonly eventKind: ValueHandoffPhaseMutationEvent['kind']
+      readonly commit: ImmutableDestinationCommit
+      readonly authoredSuffix: readonly ValueHandoffPhaseMutationEvent[]
+    }
+  | {
+      readonly kind: 'SYNCHRONOUS_READ_WITHOUT_PROTOCOL_MUTATION'
+      readonly phase: ValueHandoffPhase
+      readonly eventKind: ValueHandoffPhaseReadEvent['kind']
+      readonly view: ValueHandoffPhaseReadView
+      readonly history: ValueChannelHistoryState
+    }
+
+export type ValueHandoffProtocolCheckpoint =
+  | 'FREEZE'
+  | 'PREPARE_READY'
+  | 'RELEASE_PENDING_SOURCE_UNKNOWN'
+  | 'SOURCE_CONFIRMED_ABORTED'
+  | 'SOURCE_CONFIRMED_RELEASED'
+  | 'DESTINATION_COMMIT_CONSUMPTION'
+  | 'DESTINATION_ACKNOWLEDGED'
+
+interface ValueHandoffProtocolRetainedWorkPayload {
+  readonly retainedWorkEntry: NormalizedRetainedWorkEntry
+}
+
+export type ValueHandoffProtocolMutationEvent =
+  | (ValueHandoffPhaseMutationEvent & ValueHandoffProtocolRetainedWorkPayload)
+  | (ValueHandoffSequencedPhaseEvent &
+      ValueHandoffProtocolRetainedWorkPayload & {
+        readonly kind: 'tokenless-task-enqueue'
+        readonly taskSequence: number
+        readonly taskClass: 'instant' | 'equal' | 'carrier' | 'idle'
+      })
+  | (ValueHandoffSequencedPhaseEvent &
+      ValueHandoffProtocolRetainedWorkPayload & {
+        readonly kind: 'lifecycle-enqueue'
+        readonly lifecycleSequence: number
+        readonly lifecycleKind: 'animationStart' | 'animationCancel' | 'animationComplete'
+        readonly bindingGeneration: number
+      })
+
+export type ValueHandoffProtocolEvent =
+  | ValueHandoffProtocolMutationEvent
+  | ValueHandoffPhaseReadEvent
+
+export type ValueHandoffProtocolEventKind = ValueHandoffProtocolEvent['kind']
+export type ValueHandoffProtocolMutationEventKind = ValueHandoffProtocolMutationEvent['kind']
+export type ValueHandoffProtocolCheckpointOperation =
+  `protocol-checkpoint-${ValueHandoffProtocolCheckpoint}-${ValueHandoffProtocolEventKind}`
+
+export interface ValueHandoffProtocolCheckpointEnvelope {
+  readonly direction: ValueHandoffDirection
+  readonly transferLease: number
+  readonly phaseToken: number
+  readonly checkpoint: ValueHandoffProtocolCheckpoint
+  readonly event: ValueHandoffProtocolEvent
+}
+
+export type ValueHandoffProtocolMutationHandling =
+  | 'INVALIDATE_FREEZE_AND_REPREPARE_SOURCE'
+  | 'ABORT_PREPARE_AND_REPREPARE_SOURCE'
+  | 'SEQUENCE_WITHOUT_INFERRING_SOURCE_STATUS'
+  | 'APPLY_CONFIRMED_ABORT_AND_REPREPARE_SOURCE'
+  | 'APPEND_TO_IMMUTABLE_RELEASED_COMMIT'
+  | 'APPLY_IN_DESTINATION_COMMIT_PREFIX'
+  | 'APPLY_TO_ACKNOWLEDGED_DESTINATION_OR_REVERSE'
+
+export type ValueHandoffProtocolReadAuthority =
+  | 'AUTHORITATIVE_SOURCE'
+  | 'SOURCE_WITH_DIRECT_OPERATION_OVERLAY'
+  | 'PREPARED_DESTINATION_WITH_DIRECT_OPERATION_OVERLAY'
+  | 'ACKNOWLEDGED_DESTINATION'
+
+export type ValueHandoffProtocolRetainedWorkDisposition =
+  | {
+      readonly kind: 'CARRIED_IN_INVALIDATED_FREEZE_REPREPARE'
+      readonly carriedEntry: NormalizedRetainedWorkEntry
+    }
+  | {
+      readonly kind: 'CARRIED_IN_ABORTED_PREPARE_REPREPARE'
+      readonly carriedEntry: NormalizedRetainedWorkEntry
+    }
+  | {
+      readonly kind: 'QUEUED_BEHIND_SOURCE_DECISION'
+      readonly queuedEntry: NormalizedRetainedWorkEntry
+    }
+  | {
+      readonly kind: 'APPLIED_TO_CONFIRMED_SOURCE_BEFORE_REPREPARE'
+      readonly appliedEntry: NormalizedRetainedWorkEntry
+    }
+  | {
+      readonly kind: 'APPENDED_TO_IMMUTABLE_RELEASED_COMMIT'
+      readonly appendedEntry: NormalizedRetainedWorkEntry
+    }
+  | {
+      readonly kind: 'APPLIED_TO_PREFILLED_DESTINATION_SLOT'
+      readonly destinationSlot: NormalizedRetainedWorkEntry['destinationSlot']
+      readonly appliedEntry: NormalizedRetainedWorkEntry
+    }
+  | {
+      readonly kind: 'APPLIED_TO_ACKNOWLEDGED_DESTINATION_OR_REVERSE'
+      readonly destinationSlot: NormalizedRetainedWorkEntry['destinationSlot']
+      readonly appliedEntry: NormalizedRetainedWorkEntry
+    }
+
+export type ValueHandoffProtocolCheckpointDisposition =
+  | {
+      readonly kind: 'MUTATION'
+      readonly checkpoint: ValueHandoffProtocolCheckpoint
+      readonly eventKind: ValueHandoffProtocolMutationEvent['kind']
+      readonly operation: ValueHandoffProtocolMutationEvent
+      readonly handling: ValueHandoffProtocolMutationHandling
+      readonly retainedWorkDisposition: ValueHandoffProtocolRetainedWorkDisposition
+      readonly absoluteTransferDeadlineMs: number
+      readonly absoluteNoConsumerDeadlineMs: number
+      readonly resources: ValueChannelHandoffResourceState
+    }
+  | {
+      readonly kind: 'SYNCHRONOUS_READ_WITHOUT_PROTOCOL_MUTATION'
+      readonly checkpoint: ValueHandoffProtocolCheckpoint
+      readonly eventKind: ValueHandoffPhaseReadEvent['kind']
+      readonly authority: ValueHandoffProtocolReadAuthority
+      readonly history: ValueChannelHistoryState
+    }
+
+export interface ValueHandoffProtocolCheckpointTransition {
+  readonly state: DriverValueChannelState
+  readonly observation: DriverValueChannelObservation
+  readonly disposition: ValueHandoffProtocolCheckpointDisposition
+  readonly orderedEffects: readonly ValueHandoffEffect[]
+}
+
+export interface ImmutableDestinationCommit {
+  readonly kind: 'DESTINATION_COMMIT'
+  readonly channelId: number
+  readonly sourceRecordId: number
+  readonly destinationRecordId: number
+  readonly direction: ValueHandoffDirection
+  readonly transferLease: number
+  readonly releaseFenceSequence: number
+  readonly sentThroughAuthoritativeSequence: number
+  readonly includedPostFencePrefix: readonly NormalizedRetainedWorkEntry[]
+}
+
+export interface DestinationCommitAcknowledgement {
+  readonly kind: 'DESTINATION_COMMIT_ACKNOWLEDGEMENT'
+  readonly channelId: number
+  readonly sourceRecordId: number
+  readonly destinationRecordId: number
+  readonly direction: ValueHandoffDirection
+  readonly transferLease: number
+  readonly releaseFenceSequence: number
+  readonly drainedThroughAuthoritativeSequence: number
+}
+
+export type JsDestinationRoot =
+  | 'js-local-graph-frame'
+  | 'js-fallback-frame'
+  | 'js-pending-update'
+  | 'js-orphan-drain-frame'
+
+export type DestinationRuntime =
+  | { readonly kind: 'live-ui'; readonly driverId: number }
+  | { readonly kind: 'manual-ui'; readonly manualFrameGroupId: number }
+  | { readonly kind: 'js'; readonly root: JsDestinationRoot }
+
+export interface JsPreparedDestinationRecordState {
+  readonly destinationRecordId: number
+  readonly channelId: number
+  readonly sourceRecordId: number
+  readonly direction: ValueHandoffDirection
+  readonly transferLease: number
+  readonly releaseFenceSequence: number
+  readonly adoptedCommitSlotId: number | null
+  readonly adoptedSentThroughAuthoritativeSequence: number
+  readonly appliedThroughAuthoritativeSequence: number
+  readonly ledgers: ValueHandoffDestinationLedgerState
+}
+
+export interface JsDestinationCommitAcknowledgementSlotState {
+  readonly acknowledgementSlotId: number
+  readonly commitSlotId: number
+  readonly state: 'EMPTY' | 'FILLED' | 'STAGED_IN_CURRENT_ENVELOPE'
+  readonly acknowledgement: DestinationCommitAcknowledgement | null
+}
+
+export type JsDestinationCommitEnvelopeEntry =
+  | {
+      readonly kind: 'DESTINATION_COMMIT_ACKNOWLEDGEMENT'
+      readonly acknowledgementSlotId: number
+      readonly acknowledgement: DestinationCommitAcknowledgement
+    }
+  | {
+      readonly kind: 'ROOT_SIBLING_DUE_WORK'
+      readonly dueWorkSequence: number
+    }
+
+export interface JsDestinationCommitEnvelopeState {
+  readonly root: JsDestinationRoot
+  readonly mailboxDrainId: number
+  readonly state: 'NOT_BEGUN' | 'OPEN' | 'SEALED'
+  readonly beginCount: number
+  readonly entries: readonly JsDestinationCommitEnvelopeEntry[]
+  readonly sealCount: number
+}
+
+export interface JsDestinationCommitConsumeState {
+  readonly preparedDestinationRecords: readonly JsPreparedDestinationRecordState[]
+  readonly acknowledgementSlots: readonly JsDestinationCommitAcknowledgementSlotState[]
+  readonly envelope: JsDestinationCommitEnvelopeState
+}
+
+export interface JsDestinationCommitConsumeRequest {
+  readonly root: JsDestinationRoot
+  readonly commitSlotId: number
+  readonly acknowledgementSlotId: number
+  readonly commit: ImmutableDestinationCommit
+  readonly siblingDueWorkSequences: readonly number[]
+}
+
+export type JsDestinationCommitRefusalReason =
+  | 'root-mismatch'
+  | 'envelope-already-begun'
+  | 'missing-prepared-destination-record'
+  | 'missing-acknowledgement-slot'
+  | 'wrong-channel'
+  | 'wrong-source-record'
+  | 'wrong-destination-record'
+  | 'wrong-direction'
+  | 'wrong-transfer-lease'
+  | 'wrong-release-fence'
+  | 'ahead-of-sent-watermark'
+  | 'sent-watermark-regressed'
+  | 'prefix-not-contiguous'
+
+export type JsDestinationCommitConsumeOutcome =
+  | {
+      readonly kind: 'APPLIED'
+      readonly commitSlotId: number
+      readonly acknowledgement: DestinationCommitAcknowledgement
+    }
+  | {
+      readonly kind: 'DUPLICATE_REACKNOWLEDGED'
+      readonly commitSlotId: number
+      readonly acknowledgement: DestinationCommitAcknowledgement
+    }
+  | {
+      readonly kind: 'REFUSED'
+      readonly commitSlotId: number
+      readonly reason: JsDestinationCommitRefusalReason
+    }
+
+export type JsDestinationCommitEffect =
+  | { readonly kind: 'begin-js-destination-envelope'; readonly root: JsDestinationRoot }
+  | {
+      readonly kind: 'lookup-js-prepared-destination-record'
+      readonly destinationRecordId: number
+    }
+  | {
+      readonly kind: 'validate-js-immutable-destination-commit'
+      readonly commitSlotId: number
+    }
+  | {
+      readonly kind: 'adopt-js-immutable-destination-commit'
+      readonly commitSlotId: number
+    }
+  | {
+      readonly kind: 'apply-js-destination-ledger-entry-in-place'
+      readonly commitSlotId: number
+      readonly prefixIndex: number
+      readonly destinationSlot: NormalizedRetainedWorkEntry['destinationSlot']
+      readonly entry: NormalizedRetainedWorkEntry
+    }
+  | {
+      readonly kind: 'dedupe-js-destination-commit-application'
+      readonly commitSlotId: number
+      readonly drainedThroughAuthoritativeSequence: number
+    }
+  | {
+      readonly kind: 'fill-js-destination-acknowledgement-slot'
+      readonly commitSlotId: number
+      readonly acknowledgementSlotId: number
+    }
+  | {
+      readonly kind: 'stage-js-destination-acknowledgement-in-current-envelope'
+      readonly acknowledgementSlotId: number
+      readonly mailboxDrainId: number
+    }
+  | { readonly kind: 'run-js-root-sibling-due-work'; readonly dueWorkSequence: number }
+  | {
+      readonly kind: 'refuse-malformed-js-destination-commit'
+      readonly commitSlotId: number
+      readonly reason: JsDestinationCommitRefusalReason
+    }
+  | {
+      readonly kind: 'seal-js-destination-envelope-once'
+      readonly mailboxDrainId: number
+      readonly entryCount: number
+    }
+
+export interface JsDestinationCommitTransition {
+  readonly state: JsDestinationCommitConsumeState
+  readonly outcome: JsDestinationCommitConsumeOutcome
+  readonly orderedEffects: readonly JsDestinationCommitEffect[]
+}
+
+export interface ValueHandoffProtocolState {
+  readonly ownership: ValueHandoffOwnership
+  readonly desiredSide: ValueChannelSide | null
+  readonly direction: ValueHandoffDirection | null
+  readonly transferLease: number
+  readonly phaseToken: number
+  readonly sourceRecordId: number | null
+  readonly destinationRecordId: number | null
+  readonly absoluteTransferDeadlineMs: number | null
+  readonly absoluteNoConsumerDeadlineMs: number | null
+  readonly releaseFenceSequence: number | null
+  readonly sentThroughAuthoritativeSequence: number
+  readonly drainedThroughAuthoritativeSequence: number
+  readonly preparedMutableTuple: ValueHandoffPreparedMutableTuple | null
+  readonly destinationRuntime: DestinationRuntime | null
+  readonly sourceMutationQueue: readonly NormalizedRetainedWorkEntry[]
+  readonly commitQueue: readonly ImmutableDestinationCommit[]
+  readonly resources: ValueChannelHandoffResourceState
+}
+
+export interface DriverValueChannelState {
+  readonly identity: DriverValueChannelIdentityRecordState
+  readonly handoff: ValueHandoffProtocolState
+}
+
+interface ValueHandoffCommitLossRetainedWorkCommon {
+  readonly workSequence: number
+}
+
+export type ValueHandoffCommitLossRetainedWork =
+  | (ValueHandoffCommitLossRetainedWorkCommon & {
+      readonly kind: 'cache-adoption'
+      readonly authoritativeSequence: number
+      readonly value: number
+    })
+  | (ValueHandoffCommitLossRetainedWorkCommon & {
+      readonly kind: 'transition-on-update'
+      readonly callbackId: number
+      readonly value: number
+    })
+  | (ValueHandoffCommitLossRetainedWorkCommon & {
+      readonly kind: 'transition-on-complete'
+      readonly callbackId: number
+    })
+  | (ValueHandoffCommitLossRetainedWorkCommon & {
+      readonly kind: 'current-animation-complete'
+      readonly listenerId: number
+      readonly bindingGeneration: number
+    })
+  | (ValueHandoffCommitLossRetainedWorkCommon & {
+      readonly kind: 'token-blind-public-slot-clear'
+      readonly initiallyInstalledControlId: number
+      readonly installedControlIdAtClear: number | null
+    })
+  | (ValueHandoffCommitLossRetainedWorkCommon & {
+      readonly kind: 'public-start-promise-resolution'
+      readonly promiseId: number
+    })
+  | (ValueHandoffCommitLossRetainedWorkCommon & {
+      readonly kind: 'target-batch-dependency-delivery'
+      readonly batchId: number
+      readonly dependencyId: number
+      readonly eventSequence: number
+    })
+  | (ValueHandoffCommitLossRetainedWorkCommon & {
+      readonly kind: 'target-batch-dependency-acknowledgement'
+      readonly batchId: number
+      readonly dependencyId: number
+      readonly acknowledgedEventSequence: number
+    })
+  | (ValueHandoffCommitLossRetainedWorkCommon & {
+      readonly kind: 'settle-release'
+      readonly settleEntryId: number
+    })
+
+export interface ValueHandoffCommitLossCleanupCounts {
+  readonly transferTimerCancellationCount: number
+  readonly preparedStateReleaseCount: number
+  readonly preparedCloneReleaseCount: number
+  readonly transferActivityReleaseCount: number
+  readonly terminalFinalizationCount: number
+}
+
+export interface ValueHandoffCommitLossDrainState {
+  readonly channel: DriverValueChannelState
+  readonly retainedWork: readonly ValueHandoffCommitLossRetainedWork[]
+  readonly drainedWorkSequences: readonly number[]
+  readonly retiredListenerIds: readonly number[]
+  readonly retiredSinkRegistrationIds: readonly number[]
+  readonly cleanupCounts: ValueHandoffCommitLossCleanupCounts
+}
+
+export interface ValueHandoffCommitLossDrainObservation {
+  readonly remainingRetainedWorkCount: number
+  readonly drainedWorkCount: number
+  readonly retiredListenerDeliveryCount: number
+  readonly retiredSinkPublicationCount: number
+  readonly hostOnUpdatePublicationCount: number
+  readonly dependencyAcknowledgementCount: number
+  readonly settleReleaseCount: number
+  readonly destinationRunPermitCount: number
+  readonly sourceRevivalCount: number
+  readonly reverseTransferCount: number
+  readonly cleanupCounts: ValueHandoffCommitLossCleanupCounts
+}
+
+export type ValueHandoffCommitLossDrainEffect =
+  | {
+      readonly kind: 'adopt-bounded-destination-cache'
+      readonly workSequence: number
+      readonly authoritativeSequence: number
+      readonly value: number
+    }
+  | {
+      readonly kind: 'deliver-bounded-transition-on-update'
+      readonly workSequence: number
+      readonly callbackId: number
+      readonly value: number
+    }
+  | {
+      readonly kind: 'deliver-bounded-transition-on-complete'
+      readonly workSequence: number
+      readonly callbackId: number
+    }
+  | {
+      readonly kind: 'deliver-current-animation-complete'
+      readonly workSequence: number
+      readonly listenerId: number
+      readonly bindingGeneration: number
+    }
+  | {
+      readonly kind: 'clear-public-control-slot-token-blind'
+      readonly workSequence: number
+      readonly initiallyInstalledControlId: number
+      readonly installedControlIdAtClear: number | null
+    }
+  | {
+      readonly kind: 'resolve-public-start-promise'
+      readonly workSequence: number
+      readonly promiseId: number
+    }
+  | {
+      readonly kind: 'deliver-target-batch-dependency-event'
+      readonly workSequence: number
+      readonly batchId: number
+      readonly dependencyId: number
+      readonly eventSequence: number
+    }
+  | {
+      readonly kind: 'acknowledge-target-batch-dependency-event'
+      readonly workSequence: number
+      readonly batchId: number
+      readonly dependencyId: number
+      readonly acknowledgedEventSequence: number
+    }
+  | {
+      readonly kind: 'release-settle-entry'
+      readonly workSequence: number
+      readonly settleEntryId: number
+    }
+  | { readonly kind: 'cancel-transfer-timer-once' }
+  | { readonly kind: 'release-prepared-state-once' }
+  | { readonly kind: 'release-prepared-clone-once' }
+  | { readonly kind: 'release-transfer-activity-once' }
+  | { readonly kind: 'finalize-bounded-refusal-without-run-or-reverse-once' }
+
+export interface ValueHandoffCommitLossDrainTransition {
+  readonly state: ValueHandoffCommitLossDrainState
+  readonly observation: ValueHandoffCommitLossDrainObservation
+  readonly orderedEffects: readonly ValueHandoffCommitLossDrainEffect[]
+}
+
+export interface DriverValueChannelSinkRegistration {
+  readonly driverId: number
+  readonly handle: number
+  readonly key: string
+  readonly bindingGeneration: number
+}
+
+/**
+ * Exact-object registry record. The public reference and private CORE port are intentionally
+ * available only on this private seam; primitive observation below never exposes either object.
+ * Cross-identity target-batch authority is deliberately absent from this shape.
+ */
+export interface DriverValueChannelIdentityRegistryRecord<T> {
+  readonly value: MotionValue<T>
+  readonly port: MotionValueDriverPort<T>
+  readonly state: DriverValueChannelState
+  readonly sinks: readonly DriverValueChannelSinkRegistration[]
+}
+
+export interface DriverValueChannelResolveBindingRequest<T> {
+  readonly value: MotionValue<T>
+  readonly port: MotionValueDriverPort<T>
+  readonly currentValue: unknown
+  readonly requestedState: DriverValueChannelState
+  readonly sink: DriverValueChannelSinkRegistration
+}
+
+export type DriverValueChannelBindingResolution<T> =
+  | {
+      readonly kind: 'eligible'
+      readonly record: DriverValueChannelIdentityRegistryRecord<T>
+      readonly created: boolean
+      readonly attachedSink: DriverValueChannelSinkRegistration
+    }
+  | {
+      readonly kind: 'ineligible'
+      readonly eligibility: Extract<
+        MotionValueDriverBindingEligibility,
+        { readonly kind: 'ineligible' }
+      >
+    }
+
+export interface DriverValueChannelDetachBindingRequest<T> {
+  readonly value: MotionValue<T>
+  readonly sink: DriverValueChannelSinkRegistration
+}
+
+export interface DriverValueChannelRebindRequest<T> {
+  readonly previousValue: MotionValue<T>
+  readonly previousSink: DriverValueChannelSinkRegistration
+  readonly replacement: DriverValueChannelResolveBindingRequest<T>
+}
+
+export interface DriverValueChannelRebindResult<T> {
+  readonly previousRecord: DriverValueChannelIdentityRegistryRecord<T>
+  readonly replacement: DriverValueChannelBindingResolution<T>
+}
+
+export interface DriverValueChannelRetentionReconciliation<T> {
+  readonly value: MotionValue<T>
+  readonly nextState: DriverValueChannelState
+}
+
+export interface DriverValueChannelIdentityRegistryRecordObservation {
+  readonly channelId: number
+  readonly jsRecordId: number
+  readonly uiRecordId: number
+  readonly portChannelId: number
+  readonly creationKind: MotionValueDriverPortObservation['creationKind']
+  readonly initializerProvenance: MotionValueDriverPortObservation['initializerProvenance']
+  readonly sinkCount: number
+  readonly sinks: readonly DriverValueChannelSinkRegistration[]
+  readonly currentBindingGeneration: number
+  readonly retiredBindingGeneration: number
+  readonly retentionReasons: readonly DriverValueChannelRetentionReason[]
+  readonly retained: boolean
+  readonly stronglyRegistered: boolean
+}
+
+export interface DriverValueChannelIdentityRegistryObservation {
+  readonly retainedRecordCount: number
+  readonly retainedChannelIds: readonly number[]
+}
+
+export interface CreateDriverValueChannelIdentityRegistryOptions<T> {
+  readonly initialRecords?: readonly DriverValueChannelIdentityRegistryRecord<T>[]
+}
+
+export interface DriverValueChannelCanonicalOperationObservation<T> {
+  readonly record: DriverValueChannelIdentityRegistryRecord<T>
+  readonly port: MotionValueDriverPortObservation
+}
+
+export interface DriverValueChannelIdentityRegistry<T> {
+  observe(): DriverValueChannelIdentityRegistryObservation
+  peekExact(value: MotionValue<T>): DriverValueChannelIdentityRegistryRecordObservation | null
+  peekById(channelId: number): DriverValueChannelIdentityRegistryRecordObservation | null
+  resolveBinding(
+    request: DriverValueChannelResolveBindingRequest<T>,
+  ): DriverValueChannelBindingResolution<T>
+  detachBinding(
+    request: DriverValueChannelDetachBindingRequest<T>,
+  ): DriverValueChannelIdentityRegistryRecord<T> | null
+  rebind(request: DriverValueChannelRebindRequest<T>): DriverValueChannelRebindResult<T>
+  reconcileRetention(
+    reconciliation: DriverValueChannelRetentionReconciliation<T>,
+  ): DriverValueChannelIdentityRegistryObservation
+  snapshotForHandoff(value: MotionValue<T>): DriverValueChannelState
+  observeCanonicalOperation(
+    value: MotionValue<T>,
+  ): DriverValueChannelCanonicalOperationObservation<T>
+}
+
+export type DriverValueChannelRetentionReason =
+  | 'public-reference'
+  | 'sink'
+  | 'change-observer'
+  | 'public-control-slot'
+  | 'physical-execution'
+  | 'due-work'
+  | 'value-completion'
+  | 'target-batch-dependency'
+  | 'dependency-event-outbox'
+  | 'shared-batch-reference'
+  | 'pending-frame-activity'
+  | 'prepared-state'
+  | 'prepared-clone'
+  | 'transfer-activity'
+  | 'transfer-timer'
+
+export interface DriverValueChannelObservation {
+  readonly channelId: number
+  readonly jsRecordId: number
+  readonly uiRecordId: number
+  readonly ownership: ValueHandoffOwnership
+  readonly ownerSide: ValueChannelSide | null
+  readonly desiredSide: ValueChannelSide | null
+  readonly transferLease: number
+  readonly currentBindingGeneration: number
+  readonly retiredBindingGeneration: number
+  readonly publicControlSlotId: number | null
+  readonly physicalExecutionCount: number
+  readonly dueWorkCount: number
+  readonly valueCompletionCount: number
+  readonly targetBatchDependencyCount: number
+  readonly dependencyEventOutboxCount: number
+  readonly dependencyEventAckWatermark: number
+  readonly commitQueueLength: number
+  readonly sourceMutationQueueLength: number
+  readonly sentThroughAuthoritativeSequence: number
+  readonly drainedThroughAuthoritativeSequence: number
+  readonly retentionReasons: readonly DriverValueChannelRetentionReason[]
+  readonly retained: boolean
+}
+
+export type DestinationCommitValidation =
+  | { readonly kind: 'accepted'; readonly duplicate: boolean }
+  | {
+      readonly kind: 'rejected'
+      readonly reason:
+        | 'wrong-channel'
+        | 'wrong-source-record'
+        | 'wrong-destination-record'
+        | 'wrong-direction'
+        | 'wrong-transfer-lease'
+        | 'wrong-release-fence'
+        | 'ahead-of-sent-watermark'
+        | 'sent-watermark-regressed'
+        | 'prefix-not-contiguous'
+    }
+
+export type DestinationCommitAcknowledgementValidation =
+  | {
+      readonly kind: 'accepted'
+      readonly extent: 'duplicate' | 'partial' | 'through-current-tail'
+    }
+  | {
+      readonly kind: 'rejected'
+      readonly reason:
+        | 'wrong-channel'
+        | 'wrong-source-record'
+        | 'wrong-destination-record'
+        | 'wrong-direction'
+        | 'wrong-transfer-lease'
+        | 'wrong-release-fence'
+        | 'before-release-fence-watermark'
+        | 'ahead-of-sent-watermark'
+    }
+
+export interface ValueHandoffSourceStatusIdentity {
+  readonly channelId: number
+  readonly sourceRecordId: number
+  readonly destinationRecordId: number
+  readonly direction: ValueHandoffDirection
+  readonly transferLease: number
+}
+
+export type ValueHandoffSourceStatus = ValueHandoffSourceStatusIdentity &
+  (
+    | {
+        readonly kind: 'ABORTED'
+        readonly authoritativeSequence: number
+      }
+    | {
+        readonly kind: 'RELEASED'
+        readonly releaseFenceSequence: number
+      }
+  )
+
+export type ValueHandoffSourceStatusRefusalReason =
+  | 'wrong-channel'
+  | 'wrong-source-record'
+  | 'wrong-destination-record'
+  | 'wrong-direction'
+  | 'wrong-transfer-lease'
+
+export type ValueHandoffSourceStatusValidation =
+  | { readonly kind: 'accepted' }
+  | { readonly kind: 'rejected'; readonly reason: ValueHandoffSourceStatusRefusalReason }
+
+export type ValueHandoffSourceStatusProductionRequest = ValueHandoffSourceStatusIdentity &
+  (
+    | { readonly outcome: 'ABORTED'; readonly authoritativeSequence: number }
+    | { readonly outcome: 'RELEASED'; readonly releaseFenceSequence: number }
+  )
+
+export interface ValueHandoffSourceStatusProductionTransition {
+  readonly state: DriverValueChannelState
+  readonly validation: ValueHandoffSourceStatusValidation
+  readonly producedStatus: ValueHandoffSourceStatus | null
+}
+
+export type ValueHandoffEvent =
+  | {
+      readonly kind: 'begin-handoff'
+      readonly direction: ValueHandoffDirection
+      readonly destinationRecordId: number
+      readonly destinationRuntime: DestinationRuntime
+      readonly transferLease: number
+      readonly phaseToken: number
+      readonly absoluteTransferDeadlineMs: number
+      readonly absoluteNoConsumerDeadlineMs: number
+    }
+  | {
+      readonly kind: 'destination-ready'
+      readonly direction: ValueHandoffDirection
+      readonly transferLease: number
+      readonly preparedMutableTuple: ValueHandoffPreparedMutableTuple
+    }
+  | {
+      readonly kind: 'source-mutation'
+      readonly entry: NormalizedRetainedWorkEntry
+    }
+  | { readonly kind: 'source-status'; readonly status: ValueHandoffSourceStatus }
+  | {
+      readonly kind: 'enqueue-destination-commit'
+      readonly commit: ImmutableDestinationCommit
+    }
+  | {
+      readonly kind: 'destination-commit-acknowledgement'
+      readonly acknowledgement: DestinationCommitAcknowledgement
+    }
+  | {
+      readonly kind: 'phase-timeout'
+      readonly direction: ValueHandoffDirection
+      readonly transferLease: number
+      readonly phaseToken: number
+    }
+  | {
+      readonly kind: 'bounded-terminal'
+      readonly direction: ValueHandoffDirection
+      readonly transferLease: number
+      readonly phaseToken: number
+    }
+  | {
+      readonly kind: 'finish-bounded-refusal-drain'
+      readonly direction: ValueHandoffDirection
+      readonly transferLease: number
+    }
+
+export type ValueHandoffEffect =
+  | { readonly kind: 'send-prepare'; readonly direction: ValueHandoffDirection }
+  | { readonly kind: 'invalidate-prepared-clone' }
+  | { readonly kind: 'resume-authoritative-source'; readonly side: ValueChannelSide }
+  | { readonly kind: 'request-source-release-status' }
+  | { readonly kind: 'enqueue-immutable-destination-commit' }
+  | {
+      readonly kind: 'request-autonomous-destination-root'
+      readonly root: 'live-ui-frame' | JsDestinationRoot
+    }
+  | { readonly kind: 'arm-manual-frame-group'; readonly manualFrameGroupId: number }
+  | { readonly kind: 'rebuild-same-commit-with-suffix'; readonly suffixStartSequence: number }
+  | { readonly kind: 'cancel-transfer-timer' }
+  | { readonly kind: 'release-prepared-state' }
+  | { readonly kind: 'release-prepared-clone' }
+  | { readonly kind: 'release-transfer-activity' }
+  | { readonly kind: 'permit-destination-run-or-reverse' }
+  | { readonly kind: 'enter-change-host-silent-drain' }
+  | { readonly kind: 'refuse-live-channel-property' }
+  | { readonly kind: 'finalize-bounded-refusal-without-run-or-reverse' }
+
+export interface ValueHandoffTransition {
+  readonly state: DriverValueChannelState
+  readonly observation: DriverValueChannelObservation
+  readonly orderedEffects: readonly ValueHandoffEffect[]
+  readonly outcome:
+    | { readonly kind: 'APPLIED' }
+    | { readonly kind: 'IGNORED_STALE_EVENT' }
+    | {
+        readonly kind: 'SOURCE_STATUS_REFUSED'
+        readonly reason: ValueHandoffSourceStatusRefusalReason
+      }
+}
+
+export interface ValueHandoffPhaseEventTransition {
+  readonly state: DriverValueChannelState
+  readonly observation: DriverValueChannelObservation
+  readonly disposition: ValueHandoffPhaseEventDisposition
+  readonly orderedEffects: readonly ValueHandoffEffect[]
+}
+
+export type DriverValueChannelOperation =
+  | ValueHandoffEvent['kind']
+  | ValueHandoffPhaseEventOperation
+  | ValueHandoffProtocolCheckpointOperation
+  | `consume-js-destination-commit-${JsDestinationRoot}`
+  | 'validate-destination-commit'
+  | 'validate-destination-commit-acknowledgement'
+  | 'produce-source-status'
+  | 'registry-resolve-binding'
+  | 'registry-detach-binding'
+  | 'registry-rebind'
+  | 'registry-reconcile-retention'
+  | 'registry-snapshot-for-handoff'
+  | 'registry-observe-canonical-operation'
+  | 'drain-post-release-commit-loss'
+
+export const DRIVER_VALUE_CHANNEL_UNIMPLEMENTED =
+  'NATIVE_MOTION_DRIVER_VALUE_CHANNEL_UNIMPLEMENTED' as const
+
+export class DriverValueChannelUnimplementedError extends Error {
+  readonly code = DRIVER_VALUE_CHANNEL_UNIMPLEMENTED
+  readonly operation: DriverValueChannelOperation
+
+  constructor(operation: DriverValueChannelOperation) {
+    super(
+      `native-motion: driver value-channel operation '${operation}' is unimplemented ` +
+        '(REQ-VALUE-014/015, REQ-DRIVER-034)',
+    )
+    this.name = 'DriverValueChannelUnimplementedError'
+    this.operation = operation
+  }
+}
+
+export const DRIVER_VALUE_CHANNEL_INVARIANT =
+  'NATIVE_MOTION_DRIVER_VALUE_CHANNEL_INVARIANT' as const
+
+export type DriverValueChannelInvariant =
+  | 'registry-record-missing'
+  | 'registry-rebind-previous-record-missing'
+  | 'handoff-event-kind-unrecognized'
+  | 'phase-event-kind-unrecognized'
+  | 'phase-event-phase-unrecognized'
+  | 'protocol-checkpoint-unrecognized'
+  | 'protocol-event-kind-unrecognized'
+  | 'commit-loss-work-kind-unrecognized'
+
+/** Typed fail-closed refusal for malformed, conflicting, or out-of-sequence channel input. */
+export class DriverValueChannelInvariantError extends Error {
+  readonly code = DRIVER_VALUE_CHANNEL_INVARIANT
+  readonly invariant: DriverValueChannelInvariant
+  readonly operation: DriverValueChannelOperation | null
+
+  constructor(invariant: DriverValueChannelInvariant, operation?: DriverValueChannelOperation) {
+    super(
+      `native-motion: driver value-channel invariant '${invariant}' was violated` +
+        (operation === undefined ? '' : ` by operation '${operation}'`) +
+        ' (REQ-VALUE-014/015, REQ-DRIVER-034)',
+    )
+    this.name = 'DriverValueChannelInvariantError'
+    this.invariant = invariant
+    this.operation = operation ?? null
+  }
+}
+
+function ownerSide(
+  ownership: ValueHandoffOwnership,
+  direction: ValueHandoffDirection | null,
+): ValueChannelSide | null {
+  switch (ownership) {
+    case 'UI_RUNNING':
+    case 'UI_FROZEN_TO_JS':
+    case 'JS_PREPARED':
+    case 'UI_RELEASE_PENDING_TO_JS':
+    case 'UI_DRAINING':
+      return 'UI'
+    case 'JS_RUNNING':
+    case 'JS_FROZEN_TO_UI':
+    case 'UI_PREPARED':
+    case 'JS_RELEASE_PENDING_TO_UI':
+    case 'JS_DRAINING':
+      return 'JS'
+    case 'BOUNDED_REFUSAL_DRAINING':
+      return direction === 'UI_TO_JS' ? 'JS' : direction === 'JS_TO_UI' ? 'UI' : null
+    case 'UI_RELEASED_TO_JS':
+    case 'JS_RELEASED_TO_UI':
+    case 'IDLE':
+    case 'TERMINAL_REFUSED':
+      return null
+    default: {
+      const exhaustive: never = ownership
+      return exhaustive
+    }
+  }
+}
+
+export function observeDriverValueChannel(
+  state: DriverValueChannelState,
+): DriverValueChannelObservation {
+  const { handoff, identity } = state
+  const reasons: DriverValueChannelRetentionReason[] = []
+  if (identity.publicReferenceRetained) reasons.push('public-reference')
+  if (identity.sinkCount > 0) reasons.push('sink')
+  if (identity.changeObserverCount > 0) reasons.push('change-observer')
+  if (identity.publicControlSlotId !== null) reasons.push('public-control-slot')
+  if (identity.physicalExecutionIds.length > 0) reasons.push('physical-execution')
+  if (identity.dueWorkSequences.length > 0) reasons.push('due-work')
+  if (identity.valueCompletionSequences.length > 0) reasons.push('value-completion')
+  if (identity.targetBatchDependencyIds.length > 0) reasons.push('target-batch-dependency')
+  if (identity.dependencyEventOutboxSequences.length > 0) {
+    reasons.push('dependency-event-outbox')
+  }
+  if (identity.sharedBatchReferenceCount > 0) reasons.push('shared-batch-reference')
+  if (identity.pendingFrameActivity) reasons.push('pending-frame-activity')
+  if (handoff.resources.preparedStateRetained) reasons.push('prepared-state')
+  if (handoff.resources.preparedCloneRetained) reasons.push('prepared-clone')
+  if (handoff.resources.transferActivityRetained) reasons.push('transfer-activity')
+  if (handoff.resources.transferTimerArmed) reasons.push('transfer-timer')
+
+  return {
+    channelId: identity.channelId,
+    jsRecordId: identity.jsRecordId,
+    uiRecordId: identity.uiRecordId,
+    ownership: handoff.ownership,
+    ownerSide: ownerSide(handoff.ownership, handoff.direction),
+    desiredSide: handoff.desiredSide,
+    transferLease: handoff.transferLease,
+    currentBindingGeneration: identity.currentBindingGeneration,
+    retiredBindingGeneration: identity.retiredBindingGeneration,
+    publicControlSlotId: identity.publicControlSlotId,
+    physicalExecutionCount: identity.physicalExecutionIds.length,
+    dueWorkCount: identity.dueWorkSequences.length,
+    valueCompletionCount: identity.valueCompletionSequences.length,
+    targetBatchDependencyCount: identity.targetBatchDependencyIds.length,
+    dependencyEventOutboxCount: identity.dependencyEventOutboxSequences.length,
+    dependencyEventAckWatermark: identity.dependencyEventAckWatermark,
+    commitQueueLength: handoff.commitQueue.length,
+    sourceMutationQueueLength: handoff.sourceMutationQueue.length,
+    sentThroughAuthoritativeSequence: handoff.sentThroughAuthoritativeSequence,
+    drainedThroughAuthoritativeSequence: handoff.drainedThroughAuthoritativeSequence,
+    retentionReasons: reasons,
+    retained: reasons.length > 0,
+  }
+}
+
+function frozenOwnershipFor(direction: ValueHandoffDirection): ValueHandoffOwnership {
+  return direction === 'UI_TO_JS' ? 'UI_FROZEN_TO_JS' : 'JS_FROZEN_TO_UI'
+}
+
+function preparedOwnershipFor(direction: ValueHandoffDirection): ValueHandoffOwnership {
+  return direction === 'UI_TO_JS' ? 'JS_PREPARED' : 'UI_PREPARED'
+}
+
+function releasePendingOwnershipFor(direction: ValueHandoffDirection): ValueHandoffOwnership {
+  return direction === 'UI_TO_JS' ? 'UI_RELEASE_PENDING_TO_JS' : 'JS_RELEASE_PENDING_TO_UI'
+}
+
+function releasedOwnershipFor(direction: ValueHandoffDirection): ValueHandoffOwnership {
+  return direction === 'UI_TO_JS' ? 'UI_RELEASED_TO_JS' : 'JS_RELEASED_TO_UI'
+}
+
+function sourceRunningOwnershipFor(direction: ValueHandoffDirection): ValueHandoffOwnership {
+  return direction === 'UI_TO_JS' ? 'UI_RUNNING' : 'JS_RUNNING'
+}
+
+function destinationRunningOwnershipFor(direction: ValueHandoffDirection): ValueHandoffOwnership {
+  return direction === 'UI_TO_JS' ? 'JS_RUNNING' : 'UI_RUNNING'
+}
+
+function sourceSideFor(direction: ValueHandoffDirection): ValueChannelSide {
+  return direction === 'UI_TO_JS' ? 'UI' : 'JS'
+}
+
+/** The one already-declared autonomous destination turn a successful COMMIT enqueue activates. */
+function destinationActivationEffect(
+  runtime: DestinationRuntime | null,
+): ValueHandoffEffect | null {
+  if (runtime === null) return null
+  switch (runtime.kind) {
+    case 'live-ui':
+      return { kind: 'request-autonomous-destination-root', root: 'live-ui-frame' }
+    case 'manual-ui':
+      return { kind: 'arm-manual-frame-group', manualFrameGroupId: runtime.manualFrameGroupId }
+    case 'js':
+      return { kind: 'request-autonomous-destination-root', root: runtime.root }
+    default: {
+      const exhaustive: never = runtime
+      return exhaustive
+    }
+  }
+}
+
+function withHandoff(
+  state: DriverValueChannelState,
+  handoff: ValueHandoffProtocolState,
+): DriverValueChannelState {
+  return { identity: state.identity, handoff }
+}
+
+function appliedTransition(
+  state: DriverValueChannelState,
+  orderedEffects: readonly ValueHandoffEffect[],
+): ValueHandoffTransition {
+  return {
+    state,
+    observation: observeDriverValueChannel(state),
+    orderedEffects,
+    outcome: { kind: 'APPLIED' },
+  }
+}
+
+function ignoredTransition(state: DriverValueChannelState): ValueHandoffTransition {
+  return {
+    state,
+    observation: observeDriverValueChannel(state),
+    orderedEffects: [],
+    outcome: { kind: 'IGNORED_STALE_EVENT' },
+  }
+}
+
+/**
+ * The immutable five-field transfer identity every producer/consumer boundary revalidates; a
+ * mismatch is refused by name and never mutates retained protocol state.
+ */
+function validateTransferIdentityTuple(
+  state: DriverValueChannelState,
+  candidate: ValueHandoffSourceStatusIdentity,
+): ValueHandoffSourceStatusRefusalReason | null {
+  if (candidate.channelId !== state.identity.channelId) return 'wrong-channel'
+  if (candidate.sourceRecordId !== state.handoff.sourceRecordId) return 'wrong-source-record'
+  if (candidate.destinationRecordId !== state.handoff.destinationRecordId) {
+    return 'wrong-destination-record'
+  }
+  if (candidate.direction !== state.handoff.direction) return 'wrong-direction'
+  if (candidate.transferLease !== state.handoff.transferLease) return 'wrong-transfer-lease'
+  return null
+}
+
+function releasedResourceState(): ValueChannelHandoffResourceState {
+  return {
+    preparedStateRetained: false,
+    preparedCloneRetained: false,
+    transferActivityRetained: false,
+    transferTimerArmed: false,
+  }
+}
+
+function baseDestinationCommit(
+  state: DriverValueChannelState,
+  direction: ValueHandoffDirection,
+): ImmutableDestinationCommit {
+  return {
+    kind: 'DESTINATION_COMMIT',
+    channelId: state.identity.channelId,
+    sourceRecordId: state.handoff.sourceRecordId ?? -1,
+    destinationRecordId: state.handoff.destinationRecordId ?? -1,
+    direction,
+    transferLease: state.handoff.transferLease,
+    releaseFenceSequence: state.handoff.releaseFenceSequence ?? -1,
+    sentThroughAuthoritativeSequence: state.handoff.sentThroughAuthoritativeSequence,
+    includedPostFencePrefix: [],
+  }
+}
+
+/** Append one retained-work entry to the current immutable COMMIT, creating it when absent. */
+function appendEntryToCommitQueue(
+  state: DriverValueChannelState,
+  entry: NormalizedRetainedWorkEntry,
+): readonly ImmutableDestinationCommit[] {
+  const queue = state.handoff.commitQueue
+  const current = queue.at(-1)
+  if (current === undefined) {
+    const direction = state.handoff.direction
+    if (direction === null) return queue
+    return [
+      {
+        ...baseDestinationCommit(state, direction),
+        sentThroughAuthoritativeSequence: entry.authoritativeSequence,
+        includedPostFencePrefix: [entry],
+      },
+    ]
+  }
+  return [
+    ...queue.slice(0, -1),
+    {
+      ...current,
+      sentThroughAuthoritativeSequence: entry.authoritativeSequence,
+      includedPostFencePrefix: [...current.includedPostFencePrefix, entry],
+    },
+  ]
+}
+
+function isProtocolReadEvent(
+  event: ValueHandoffPhaseEvent | ValueHandoffProtocolEvent,
+): event is ValueHandoffPhaseReadEvent {
+  return (
+    event.kind === 'synchronous-snapshot' ||
+    event.kind === 'synchronous-get' ||
+    event.kind === 'synchronous-get-velocity'
+  )
+}
+
+/**
+ * Fail closed on any phase outside the closed union BEFORE a phase-keyed transition runs; an
+ * untyped caller must never fall into the pre-fence branch by default.
+ */
+function requireValueHandoffPhase(phase: ValueHandoffPhase): void {
+  switch (phase) {
+    case 'PREPARED':
+    case 'RELEASE_PENDING_PRE_FENCE':
+    case 'RELEASED_POST_FENCE':
+      return
+    default: {
+      const exhaustive: never = phase
+      void exhaustive
+      throw new DriverValueChannelInvariantError('phase-event-phase-unrecognized')
+    }
+  }
+}
+
+/** Fail closed on any phase event kind outside the closed union before mutation dispatch. */
+function requirePhaseEventKind(kind: ValueHandoffPhaseEventKind): void {
+  switch (kind) {
+    case 'sink-attach':
+    case 'sink-detach':
+    case 'observer-arm':
+    case 'observer-disarm':
+    case 'start':
+    case 'retarget':
+    case 'set':
+    case 'jump':
+    case 'stop':
+    case 'destroy':
+    case 'public-slot':
+    case 'physical-sample':
+    case 'physical-done':
+    case 'completion-arm':
+    case 'completion-resolved':
+    case 'batch-dependency':
+    case 'batch-outbox':
+    case 'batch-outbox-ack':
+    case 'fifo-task':
+    case 'binding-generation':
+    case 'synchronous-snapshot':
+    case 'synchronous-get':
+    case 'synchronous-get-velocity':
+      return
+    default: {
+      const exhaustive: never = kind
+      void exhaustive
+      throw new DriverValueChannelInvariantError('phase-event-kind-unrecognized')
+    }
+  }
+}
+
+/** Fail closed on any checkpoint outside the closed union before a keyed transition runs. */
+function requireProtocolCheckpoint(checkpoint: ValueHandoffProtocolCheckpoint): void {
+  switch (checkpoint) {
+    case 'FREEZE':
+    case 'PREPARE_READY':
+    case 'RELEASE_PENDING_SOURCE_UNKNOWN':
+    case 'SOURCE_CONFIRMED_ABORTED':
+    case 'SOURCE_CONFIRMED_RELEASED':
+    case 'DESTINATION_COMMIT_CONSUMPTION':
+    case 'DESTINATION_ACKNOWLEDGED':
+      return
+    default: {
+      const exhaustive: never = checkpoint
+      void exhaustive
+      throw new DriverValueChannelInvariantError('protocol-checkpoint-unrecognized')
+    }
+  }
+}
+
+/** Fail closed on any protocol event kind outside the closed union before mutation dispatch. */
+function requireProtocolEventKind(kind: ValueHandoffProtocolEventKind): void {
+  switch (kind) {
+    case 'sink-attach':
+    case 'sink-detach':
+    case 'observer-arm':
+    case 'observer-disarm':
+    case 'start':
+    case 'retarget':
+    case 'set':
+    case 'jump':
+    case 'stop':
+    case 'destroy':
+    case 'public-slot':
+    case 'physical-sample':
+    case 'physical-done':
+    case 'completion-arm':
+    case 'completion-resolved':
+    case 'batch-dependency':
+    case 'batch-outbox':
+    case 'batch-outbox-ack':
+    case 'fifo-task':
+    case 'binding-generation':
+    case 'tokenless-task-enqueue':
+    case 'lifecycle-enqueue':
+    case 'synchronous-snapshot':
+    case 'synchronous-get':
+    case 'synchronous-get-velocity':
+      return
+    default: {
+      const exhaustive: never = kind
+      void exhaustive
+      throw new DriverValueChannelInvariantError('protocol-event-kind-unrecognized')
+    }
+  }
+}
+
+function readViewForPhase(phase: ValueHandoffPhase): ValueHandoffPhaseReadView {
+  switch (phase) {
+    case 'PREPARED':
+      return 'AUTHORITATIVE_SOURCE'
+    case 'RELEASE_PENDING_PRE_FENCE':
+      return 'SOURCE_WITH_DIRECT_OPERATION_OVERLAY'
+    case 'RELEASED_POST_FENCE':
+      return 'PREPARED_DESTINATION_WITH_DIRECT_OPERATION_OVERLAY'
+    default: {
+      const exhaustive: never = phase
+      return exhaustive
+    }
+  }
+}
+
+function readAuthorityForCheckpoint(
+  checkpoint: ValueHandoffProtocolCheckpoint,
+): ValueHandoffProtocolReadAuthority {
+  switch (checkpoint) {
+    case 'FREEZE':
+    case 'PREPARE_READY':
+    case 'SOURCE_CONFIRMED_ABORTED':
+      return 'AUTHORITATIVE_SOURCE'
+    case 'RELEASE_PENDING_SOURCE_UNKNOWN':
+      return 'SOURCE_WITH_DIRECT_OPERATION_OVERLAY'
+    case 'SOURCE_CONFIRMED_RELEASED':
+    case 'DESTINATION_COMMIT_CONSUMPTION':
+      return 'PREPARED_DESTINATION_WITH_DIRECT_OPERATION_OVERLAY'
+    case 'DESTINATION_ACKNOWLEDGED':
+      return 'ACKNOWLEDGED_DESTINATION'
+    default: {
+      const exhaustive: never = checkpoint
+      return exhaustive
+    }
+  }
+}
+
+function mutationHandlingForCheckpoint(
+  checkpoint: ValueHandoffProtocolCheckpoint,
+): ValueHandoffProtocolMutationHandling {
+  switch (checkpoint) {
+    case 'FREEZE':
+      return 'INVALIDATE_FREEZE_AND_REPREPARE_SOURCE'
+    case 'PREPARE_READY':
+      return 'ABORT_PREPARE_AND_REPREPARE_SOURCE'
+    case 'RELEASE_PENDING_SOURCE_UNKNOWN':
+      return 'SEQUENCE_WITHOUT_INFERRING_SOURCE_STATUS'
+    case 'SOURCE_CONFIRMED_ABORTED':
+      return 'APPLY_CONFIRMED_ABORT_AND_REPREPARE_SOURCE'
+    case 'SOURCE_CONFIRMED_RELEASED':
+      return 'APPEND_TO_IMMUTABLE_RELEASED_COMMIT'
+    case 'DESTINATION_COMMIT_CONSUMPTION':
+      return 'APPLY_IN_DESTINATION_COMMIT_PREFIX'
+    case 'DESTINATION_ACKNOWLEDGED':
+      return 'APPLY_TO_ACKNOWLEDGED_DESTINATION_OR_REVERSE'
+    default: {
+      const exhaustive: never = checkpoint
+      return exhaustive
+    }
+  }
+}
+
+function retainedWorkDispositionFor(
+  checkpoint: ValueHandoffProtocolCheckpoint,
+  event: ValueHandoffProtocolMutationEvent,
+): ValueHandoffProtocolRetainedWorkDisposition {
+  switch (checkpoint) {
+    case 'FREEZE':
+      return {
+        kind: 'CARRIED_IN_INVALIDATED_FREEZE_REPREPARE',
+        carriedEntry: event.retainedWorkEntry,
+      }
+    case 'PREPARE_READY':
+      return {
+        kind: 'CARRIED_IN_ABORTED_PREPARE_REPREPARE',
+        carriedEntry: event.retainedWorkEntry,
+      }
+    case 'RELEASE_PENDING_SOURCE_UNKNOWN':
+      return {
+        kind: 'QUEUED_BEHIND_SOURCE_DECISION',
+        queuedEntry: event.retainedWorkEntry,
+      }
+    case 'SOURCE_CONFIRMED_ABORTED':
+      return {
+        kind: 'APPLIED_TO_CONFIRMED_SOURCE_BEFORE_REPREPARE',
+        appliedEntry: event.retainedWorkEntry,
+      }
+    case 'SOURCE_CONFIRMED_RELEASED':
+      return {
+        kind: 'APPENDED_TO_IMMUTABLE_RELEASED_COMMIT',
+        appendedEntry: event.retainedWorkEntry,
+      }
+    case 'DESTINATION_COMMIT_CONSUMPTION':
+      return {
+        kind: 'APPLIED_TO_PREFILLED_DESTINATION_SLOT',
+        destinationSlot: event.retainedWorkEntry.destinationSlot,
+        appliedEntry: event.retainedWorkEntry,
+      }
+    case 'DESTINATION_ACKNOWLEDGED':
+      return {
+        kind: 'APPLIED_TO_ACKNOWLEDGED_DESTINATION_OR_REVERSE',
+        destinationSlot: event.retainedWorkEntry.destinationSlot,
+        appliedEntry: event.retainedWorkEntry,
+      }
+    default: {
+      const exhaustive: never = checkpoint
+      return exhaustive
+    }
+  }
+}
+
+/**
+ * Apply one confirmed retained-work entry to the identity record. Sequence-state entries adopt
+ * their exact sequences and advance the dependency-outbox acknowledgement watermark; outbox
+ * dependency events append their event sequence; destroy retires the current binding generation
+ * and clears the current public reference, sinks, and observers (channel-generation retirement,
+ * never public-object death).
+ */
+function applyProtocolMutationToIdentity(
+  identity: DriverValueChannelIdentityRecordState,
+  event: ValueHandoffProtocolMutationEvent,
+): DriverValueChannelIdentityRecordState {
+  const entry = event.retainedWorkEntry
+  switch (entry.kind) {
+    case 'sequence-state':
+      return {
+        ...identity,
+        dependencyEventAckWatermark: entry.sequences.dependencyOutboxAckSequence,
+        sequences: entry.sequences,
+      }
+    case 'binding-generation':
+      if (event.kind === 'destroy') {
+        return {
+          ...identity,
+          publicReferenceRetained: false,
+          sinkCount: 0,
+          changeObserverCount: 0,
+          currentBindingGeneration: entry.currentBindingGeneration,
+          retiredBindingGeneration: entry.retiredBindingGeneration,
+        }
+      }
+      return {
+        ...identity,
+        currentBindingGeneration: entry.currentBindingGeneration,
+        retiredBindingGeneration: entry.retiredBindingGeneration,
+      }
+    case 'target-batch-dependency-event':
+      return {
+        ...identity,
+        dependencyEventOutboxSequences: identity.dependencyEventOutboxSequences.includes(
+          entry.eventSequence,
+        )
+          ? identity.dependencyEventOutboxSequences
+          : [...identity.dependencyEventOutboxSequences, entry.eventSequence],
+        sequences: {
+          ...identity.sequences,
+          batchDependencyEventSequence: entry.eventSequence,
+        },
+      }
+    default:
+      return identity
+  }
+}
+
+/** Append one COMMIT entry to its prefilled destination ledger slot, in place by slot identity. */
+function appendLedgerEntry(
+  slot: ValueHandoffDestinationLedgerSlotState,
+  entry: NormalizedRetainedWorkEntry,
+): ValueHandoffDestinationLedgerSlotState {
+  switch (slot.ledger) {
+    case 'PUBLIC_CONTROL':
+      return entry.kind === 'public-control-slot'
+        ? { ...slot, entries: [...slot.entries, entry] }
+        : slot
+    case 'RETENTION':
+      return entry.kind === 'retention-edge' ? { ...slot, entries: [...slot.entries, entry] } : slot
+    case 'EXECUTION':
+      return entry.kind === 'generator-execution'
+        ? { ...slot, entries: [...slot.entries, entry] }
+        : slot
+    case 'DUE_WORK':
+      return entry.kind === 'update-task' ||
+        entry.kind === 'carrier-task' ||
+        entry.kind === 'direct-write'
+        ? { ...slot, entries: [...slot.entries, entry] }
+        : slot
+    case 'COMPLETION':
+      return entry.kind === 'value-completion'
+        ? { ...slot, entries: [...slot.entries, entry] }
+        : slot
+    case 'DEPENDENCY_EVENT':
+      return entry.kind === 'target-batch-dependency-event'
+        ? { ...slot, entries: [...slot.entries, entry] }
+        : slot
+    case 'GENERATION':
+      return entry.kind === 'binding-generation'
+        ? { ...slot, entries: [...slot.entries, entry] }
+        : slot
+    case 'SEQUENCE':
+      return entry.kind === 'sequence-state' ? { ...slot, entries: [...slot.entries, entry] } : slot
+    default: {
+      const exhaustive: never = slot
+      return exhaustive
+    }
+  }
+}
+
+/** Grow one destination ledger slot at the consumption edge when the prefix declares a new slot. */
+function createLedgerSlot(
+  entry: NormalizedRetainedWorkEntry,
+): ValueHandoffDestinationLedgerSlotState {
+  switch (entry.kind) {
+    case 'public-control-slot':
+      return { ledger: 'PUBLIC_CONTROL', slotId: entry.destinationSlot.slotId, entries: [entry] }
+    case 'retention-edge':
+      return { ledger: 'RETENTION', slotId: entry.destinationSlot.slotId, entries: [entry] }
+    case 'generator-execution':
+      return { ledger: 'EXECUTION', slotId: entry.destinationSlot.slotId, entries: [entry] }
+    case 'update-task':
+    case 'carrier-task':
+    case 'direct-write':
+      return { ledger: 'DUE_WORK', slotId: entry.destinationSlot.slotId, entries: [entry] }
+    case 'value-completion':
+      return { ledger: 'COMPLETION', slotId: entry.destinationSlot.slotId, entries: [entry] }
+    case 'target-batch-dependency-event':
+      return {
+        ledger: 'DEPENDENCY_EVENT',
+        slotId: entry.destinationSlot.slotId,
+        entries: [entry],
+      }
+    case 'binding-generation':
+      return { ledger: 'GENERATION', slotId: entry.destinationSlot.slotId, entries: [entry] }
+    case 'sequence-state':
+      return { ledger: 'SEQUENCE', slotId: entry.destinationSlot.slotId, entries: [entry] }
+    default: {
+      const exhaustive: never = entry
+      return exhaustive
+    }
+  }
+}
+
+function applyEntriesToLedgers(
+  ledgers: ValueHandoffDestinationLedgerState,
+  entries: readonly NormalizedRetainedWorkEntry[],
+): ValueHandoffDestinationLedgerState {
+  let slots = ledgers.slots
+  for (const entry of entries) {
+    const index = slots.findIndex(
+      (slot) =>
+        slot.ledger === entry.destinationSlot.ledger &&
+        slot.slotId === entry.destinationSlot.slotId,
+    )
+    if (index < 0) {
+      slots = [...slots, createLedgerSlot(entry)]
+      continue
+    }
+    const slot = slots[index]
+    if (slot === undefined) continue
+    slots = [...slots.slice(0, index), appendLedgerEntry(slot, entry), ...slots.slice(index + 1)]
+  }
+  return { slots }
+}
+
+class DriverValueChannelIdentityRegistryImpl<T> implements DriverValueChannelIdentityRegistry<T> {
+  readonly #recordsByExactValue = new WeakMap<
+    MotionValue<T>,
+    DriverValueChannelIdentityRegistryRecord<T>
+  >()
+  readonly #retainedRecordsByChannelId = new Map<
+    number,
+    DriverValueChannelIdentityRegistryRecord<T>
+  >()
+
+  constructor(options: CreateDriverValueChannelIdentityRegistryOptions<T>) {
+    for (const record of options.initialRecords ?? []) {
+      this.#recordsByExactValue.set(record.value, record)
+      if (observeDriverValueChannel(record.state).retained) {
+        this.#retainedRecordsByChannelId.set(record.state.identity.channelId, record)
+      }
+    }
+  }
+
+  observe(): DriverValueChannelIdentityRegistryObservation {
+    const retainedChannelIds = [...this.#retainedRecordsByChannelId.keys()].reduce<number[]>(
+      (ordered, channelId) => {
+        const insertionIndex = ordered.findIndex((existing) => existing > channelId)
+        if (insertionIndex < 0) return [...ordered, channelId]
+        return [...ordered.slice(0, insertionIndex), channelId, ...ordered.slice(insertionIndex)]
+      },
+      [],
+    )
+    return {
+      retainedRecordCount: this.#retainedRecordsByChannelId.size,
+      retainedChannelIds,
+    }
+  }
+
+  peekExact(value: MotionValue<T>): DriverValueChannelIdentityRegistryRecordObservation | null {
+    const record = this.#recordsByExactValue.get(value)
+    return record === undefined ? null : this.#observeRecord(record)
+  }
+
+  peekById(channelId: number): DriverValueChannelIdentityRegistryRecordObservation | null {
+    const record = this.#retainedRecordsByChannelId.get(channelId)
+    return record === undefined ? null : this.#observeRecord(record)
+  }
+
+  resolveBinding(
+    request: DriverValueChannelResolveBindingRequest<T>,
+  ): DriverValueChannelBindingResolution<T> {
+    const existing = this.#recordsByExactValue.get(request.value)
+    if (existing !== undefined) {
+      // Exact-object identity is the law: conflicting caller ports, snapshots, or ids never fork
+      // the canonical record; the binding only appends its sink registration.
+      ;(existing.sinks as DriverValueChannelSinkRegistration[]).push(request.sink)
+      return { kind: 'eligible', record: existing, created: false, attachedSink: request.sink }
+    }
+    const eligibility = request.port.evaluateBindingEligibility(request.currentValue)
+    if (eligibility.kind === 'ineligible') {
+      return { kind: 'ineligible', eligibility }
+    }
+    const record: DriverValueChannelIdentityRegistryRecord<T> = {
+      value: request.value,
+      port: request.port,
+      state: request.requestedState,
+      sinks: [request.sink],
+    }
+    this.#recordsByExactValue.set(request.value, record)
+    if (observeDriverValueChannel(record.state).retained) {
+      this.#retainedRecordsByChannelId.set(record.state.identity.channelId, record)
+    }
+    return { kind: 'eligible', record, created: true, attachedSink: request.sink }
+  }
+
+  detachBinding(
+    request: DriverValueChannelDetachBindingRequest<T>,
+  ): DriverValueChannelIdentityRegistryRecord<T> | null {
+    const record = this.#recordsByExactValue.get(request.value)
+    if (record === undefined) return null
+    const sinks = record.sinks as DriverValueChannelSinkRegistration[]
+    let index = sinks.indexOf(request.sink)
+    if (index < 0) {
+      index = sinks.findIndex(
+        (candidate) =>
+          candidate.driverId === request.sink.driverId &&
+          candidate.handle === request.sink.handle &&
+          candidate.key === request.sink.key &&
+          candidate.bindingGeneration === request.sink.bindingGeneration,
+      )
+    }
+    if (index >= 0) sinks.splice(index, 1)
+    return record
+  }
+
+  rebind(request: DriverValueChannelRebindRequest<T>): DriverValueChannelRebindResult<T> {
+    const previousRecord = this.detachBinding({
+      value: request.previousValue,
+      sink: request.previousSink,
+    })
+    if (previousRecord === null) {
+      throw new DriverValueChannelInvariantError(
+        'registry-rebind-previous-record-missing',
+        'registry-rebind',
+      )
+    }
+    return { previousRecord, replacement: this.resolveBinding(request.replacement) }
+  }
+
+  reconcileRetention(
+    reconciliation: DriverValueChannelRetentionReconciliation<T>,
+  ): DriverValueChannelIdentityRegistryObservation {
+    const record = this.#recordsByExactValue.get(reconciliation.value)
+    if (record === undefined) {
+      throw new DriverValueChannelInvariantError(
+        'registry-record-missing',
+        'registry-reconcile-retention',
+      )
+    }
+    const nextRecord: DriverValueChannelIdentityRegistryRecord<T> = {
+      value: record.value,
+      port: record.port,
+      state: reconciliation.nextState,
+      sinks: record.sinks,
+    }
+    this.#recordsByExactValue.set(record.value, nextRecord)
+    for (const [channelId, retained] of this.#retainedRecordsByChannelId) {
+      if (retained === record) this.#retainedRecordsByChannelId.delete(channelId)
+    }
+    if (observeDriverValueChannel(nextRecord.state).retained) {
+      this.#retainedRecordsByChannelId.set(nextRecord.state.identity.channelId, nextRecord)
+    }
+    return this.observe()
+  }
+
+  snapshotForHandoff(value: MotionValue<T>): DriverValueChannelState {
+    const record = this.#recordsByExactValue.get(value)
+    if (record === undefined) {
+      throw new DriverValueChannelInvariantError(
+        'registry-record-missing',
+        'registry-snapshot-for-handoff',
+      )
+    }
+    // Identity-local state only: the JS-global batch controller is never stored or cloned here.
+    return record.state
+  }
+
+  observeCanonicalOperation(
+    value: MotionValue<T>,
+  ): DriverValueChannelCanonicalOperationObservation<T> {
+    const record = this.#recordsByExactValue.get(value)
+    if (record === undefined) {
+      throw new DriverValueChannelInvariantError(
+        'registry-record-missing',
+        'registry-observe-canonical-operation',
+      )
+    }
+    const port = record.port.observe()
+    if (port.currentExecutionId !== null || !record.value.isAnimating()) {
+      return { record, port }
+    }
+    // A public start that bypassed the port is still observable through the canonical record:
+    // report the record's latest retained physical execution identity.
+    const currentExecutionId = record.state.identity.physicalExecutionIds.at(-1) ?? null
+    if (currentExecutionId === null) {
+      return { record, port }
+    }
+    return { record, port: { ...port, currentExecutionId } }
+  }
+
+  #observeRecord(
+    record: DriverValueChannelIdentityRegistryRecord<T>,
+  ): DriverValueChannelIdentityRegistryRecordObservation {
+    const state = observeDriverValueChannel(record.state)
+    const port = record.port.observe()
+    return {
+      channelId: state.channelId,
+      jsRecordId: state.jsRecordId,
+      uiRecordId: state.uiRecordId,
+      portChannelId: port.channelId,
+      creationKind: port.creationKind,
+      initializerProvenance: port.initializerProvenance,
+      sinkCount: record.sinks.length,
+      sinks: record.sinks,
+      currentBindingGeneration: state.currentBindingGeneration,
+      retiredBindingGeneration: state.retiredBindingGeneration,
+      retentionReasons: state.retentionReasons,
+      retained: state.retained,
+      stronglyRegistered: this.#retainedRecordsByChannelId.get(state.channelId) === record,
+    }
+  }
+}
+
+export function createDriverValueChannelIdentityRegistry<T>(
+  options: CreateDriverValueChannelIdentityRegistryOptions<T> = {},
+): DriverValueChannelIdentityRegistry<T> {
+  return new DriverValueChannelIdentityRegistryImpl(options)
+}
+
+export function validateDestinationCommit(
+  state: DriverValueChannelState,
+  commit: ImmutableDestinationCommit,
+): DestinationCommitValidation {
+  const refusal = validateTransferIdentityTuple(state, commit)
+  if (refusal !== null) return { kind: 'rejected', reason: refusal }
+  const fence = state.handoff.releaseFenceSequence
+  if (fence === null || commit.releaseFenceSequence !== fence) {
+    return { kind: 'rejected', reason: 'wrong-release-fence' }
+  }
+  if (commit.sentThroughAuthoritativeSequence > state.handoff.sentThroughAuthoritativeSequence) {
+    return { kind: 'rejected', reason: 'ahead-of-sent-watermark' }
+  }
+  if (commit.sentThroughAuthoritativeSequence < state.handoff.sentThroughAuthoritativeSequence) {
+    return { kind: 'rejected', reason: 'sent-watermark-regressed' }
+  }
+  const prefix = commit.includedPostFencePrefix
+  for (let index = 1; index < prefix.length; index += 1) {
+    const previous = prefix[index - 1]
+    const current = prefix[index]
+    if (previous === undefined || current === undefined) break
+    if (current.authoritativeSequence <= previous.authoritativeSequence) {
+      return { kind: 'rejected', reason: 'prefix-not-contiguous' }
+    }
+  }
+  const last = prefix.at(-1)
+  if (last !== undefined && last.authoritativeSequence > commit.sentThroughAuthoritativeSequence) {
+    return { kind: 'rejected', reason: 'prefix-not-contiguous' }
+  }
+  return {
+    kind: 'accepted',
+    duplicate:
+      commit.sentThroughAuthoritativeSequence <= state.handoff.drainedThroughAuthoritativeSequence,
+  }
+}
+
+export function validateDestinationCommitAcknowledgement(
+  state: DriverValueChannelState,
+  acknowledgement: DestinationCommitAcknowledgement,
+): DestinationCommitAcknowledgementValidation {
+  const refusal = validateTransferIdentityTuple(state, acknowledgement)
+  if (refusal !== null) return { kind: 'rejected', reason: refusal }
+  const fence = state.handoff.releaseFenceSequence
+  if (fence === null || acknowledgement.releaseFenceSequence !== fence) {
+    return { kind: 'rejected', reason: 'wrong-release-fence' }
+  }
+  if (acknowledgement.drainedThroughAuthoritativeSequence < fence) {
+    return { kind: 'rejected', reason: 'before-release-fence-watermark' }
+  }
+  if (
+    acknowledgement.drainedThroughAuthoritativeSequence >
+    state.handoff.sentThroughAuthoritativeSequence
+  ) {
+    return { kind: 'rejected', reason: 'ahead-of-sent-watermark' }
+  }
+  if (
+    acknowledgement.drainedThroughAuthoritativeSequence <=
+    state.handoff.drainedThroughAuthoritativeSequence
+  ) {
+    return { kind: 'accepted', extent: 'duplicate' }
+  }
+  if (
+    acknowledgement.drainedThroughAuthoritativeSequence <
+    state.handoff.sentThroughAuthoritativeSequence
+  ) {
+    return { kind: 'accepted', extent: 'partial' }
+  }
+  return { kind: 'accepted', extent: 'through-current-tail' }
+}
+
+export function produceValueHandoffSourceStatus(
+  state: DriverValueChannelState,
+  request: ValueHandoffSourceStatusProductionRequest,
+): ValueHandoffSourceStatusProductionTransition {
+  const refusal = validateTransferIdentityTuple(state, request)
+  if (refusal !== null) {
+    return { state, validation: { kind: 'rejected', reason: refusal }, producedStatus: null }
+  }
+  const identity: ValueHandoffSourceStatusIdentity = {
+    channelId: request.channelId,
+    sourceRecordId: request.sourceRecordId,
+    destinationRecordId: request.destinationRecordId,
+    direction: request.direction,
+    transferLease: request.transferLease,
+  }
+  const producedStatus: ValueHandoffSourceStatus =
+    request.outcome === 'ABORTED'
+      ? { ...identity, kind: 'ABORTED', authoritativeSequence: request.authoritativeSequence }
+      : { ...identity, kind: 'RELEASED', releaseFenceSequence: request.releaseFenceSequence }
+  return { state, validation: { kind: 'accepted' }, producedStatus }
+}
+
+function beginHandoff(
+  state: DriverValueChannelState,
+  event: Extract<ValueHandoffEvent, { readonly kind: 'begin-handoff' }>,
+): ValueHandoffTransition {
+  const direction = event.direction
+  const next = withHandoff(state, {
+    ...state.handoff,
+    ownership: frozenOwnershipFor(direction),
+    direction,
+    transferLease: event.transferLease,
+    phaseToken: event.phaseToken,
+    destinationRecordId: event.destinationRecordId,
+    destinationRuntime: event.destinationRuntime,
+    absoluteTransferDeadlineMs: event.absoluteTransferDeadlineMs,
+    absoluteNoConsumerDeadlineMs: event.absoluteNoConsumerDeadlineMs,
+    releaseFenceSequence: null,
+    preparedMutableTuple: null,
+    sourceMutationQueue: [],
+    commitQueue: [],
+  })
+  return appliedTransition(next, [{ kind: 'send-prepare', direction }])
+}
+
+function destinationReady(
+  state: DriverValueChannelState,
+  event: Extract<ValueHandoffEvent, { readonly kind: 'destination-ready' }>,
+): ValueHandoffTransition {
+  const handoff = state.handoff
+  if (
+    handoff.direction !== event.direction ||
+    handoff.transferLease !== event.transferLease ||
+    handoff.ownership !== frozenOwnershipFor(event.direction)
+  ) {
+    return ignoredTransition(state)
+  }
+  const next = withHandoff(state, {
+    ...handoff,
+    ownership: preparedOwnershipFor(event.direction),
+    preparedMutableTuple: event.preparedMutableTuple,
+    releaseFenceSequence: null,
+  })
+  return appliedTransition(next, [{ kind: 'request-source-release-status' }])
+}
+
+function sourceMutation(
+  state: DriverValueChannelState,
+  event: Extract<ValueHandoffEvent, { readonly kind: 'source-mutation' }>,
+): ValueHandoffTransition {
+  const handoff = state.handoff
+  const entry = event.entry
+  switch (handoff.ownership) {
+    case 'UI_FROZEN_TO_JS':
+    case 'JS_FROZEN_TO_UI':
+    case 'JS_PREPARED':
+    case 'UI_PREPARED': {
+      const direction = handoff.direction
+      if (direction === null) return ignoredTransition(state)
+      // Pre-fence: the prepared clone is invalidated and the authoritative source resumes.
+      const next = withHandoff(state, {
+        ...handoff,
+        ownership: sourceRunningOwnershipFor(direction),
+        releaseFenceSequence: null,
+        preparedMutableTuple: null,
+        commitQueue: [],
+      })
+      return appliedTransition(next, [
+        { kind: 'invalidate-prepared-clone' },
+        { kind: 'resume-authoritative-source', side: sourceSideFor(direction) },
+      ])
+    }
+    case 'UI_RELEASE_PENDING_TO_JS':
+    case 'JS_RELEASE_PENDING_TO_UI': {
+      // The source RELEASE/ABORT status is still unknown: sequence, never infer.
+      const next = withHandoff(state, {
+        ...handoff,
+        sourceMutationQueue: [...handoff.sourceMutationQueue, entry],
+      })
+      return appliedTransition(next, [])
+    }
+    case 'UI_RELEASED_TO_JS':
+    case 'JS_RELEASED_TO_UI': {
+      // Post-fence: the fence and lease are immutable; the mutation joins the COMMIT prefix.
+      const next = withHandoff(state, {
+        ...handoff,
+        sentThroughAuthoritativeSequence: entry.authoritativeSequence,
+        commitQueue: appendEntryToCommitQueue(state, entry),
+      })
+      return appliedTransition(next, [])
+    }
+    default:
+      return ignoredTransition(state)
+  }
+}
+
+function sourceStatus(
+  state: DriverValueChannelState,
+  event: Extract<ValueHandoffEvent, { readonly kind: 'source-status' }>,
+): ValueHandoffTransition {
+  const refusal = validateTransferIdentityTuple(state, event.status)
+  if (refusal !== null) {
+    return {
+      state,
+      observation: observeDriverValueChannel(state),
+      orderedEffects: [],
+      outcome: { kind: 'SOURCE_STATUS_REFUSED', reason: refusal },
+    }
+  }
+  const handoff = state.handoff
+  const status = event.status
+  const direction = status.direction
+  if (handoff.ownership !== releasePendingOwnershipFor(direction)) {
+    return ignoredTransition(state)
+  }
+  if (status.kind === 'ABORTED') {
+    const next = withHandoff(state, {
+      ...handoff,
+      ownership: sourceRunningOwnershipFor(direction),
+      releaseFenceSequence: null,
+      preparedMutableTuple: null,
+      commitQueue: [],
+    })
+    return appliedTransition(next, [
+      { kind: 'invalidate-prepared-clone' },
+      { kind: 'resume-authoritative-source', side: sourceSideFor(direction) },
+    ])
+  }
+  // Source-confirmed RELEASE is the handoff linearization point: mutations queued behind the
+  // source decision drain into the one immutable COMMIT, which is enqueued and activates the
+  // declared destination turn without permitting the destination to run on its own yet.
+  const drainedPrefix = handoff.sourceMutationQueue
+  const sentThrough =
+    drainedPrefix.at(-1)?.authoritativeSequence ?? handoff.sentThroughAuthoritativeSequence
+  const commit: ImmutableDestinationCommit = {
+    kind: 'DESTINATION_COMMIT',
+    channelId: status.channelId,
+    sourceRecordId: status.sourceRecordId,
+    destinationRecordId: status.destinationRecordId,
+    direction,
+    transferLease: status.transferLease,
+    releaseFenceSequence: status.releaseFenceSequence,
+    sentThroughAuthoritativeSequence: sentThrough,
+    includedPostFencePrefix: drainedPrefix,
+  }
+  const activation = destinationActivationEffect(handoff.destinationRuntime)
+  const next = withHandoff(state, {
+    ...handoff,
+    ownership: releasedOwnershipFor(direction),
+    releaseFenceSequence: status.releaseFenceSequence,
+    sentThroughAuthoritativeSequence: sentThrough,
+    sourceMutationQueue: [],
+    commitQueue: [commit],
+  })
+  return appliedTransition(
+    next,
+    activation === null
+      ? [{ kind: 'enqueue-immutable-destination-commit' }]
+      : [{ kind: 'enqueue-immutable-destination-commit' }, activation],
+  )
+}
+
+function enqueueDestinationCommit(
+  state: DriverValueChannelState,
+  event: Extract<ValueHandoffEvent, { readonly kind: 'enqueue-destination-commit' }>,
+): ValueHandoffTransition {
+  const handoff = state.handoff
+  const activation = destinationActivationEffect(handoff.destinationRuntime)
+  const next = withHandoff(state, {
+    ...handoff,
+    commitQueue: [...handoff.commitQueue, event.commit],
+  })
+  return appliedTransition(
+    next,
+    activation === null
+      ? [{ kind: 'enqueue-immutable-destination-commit' }]
+      : [{ kind: 'enqueue-immutable-destination-commit' }, activation],
+  )
+}
+
+function destinationCommitAcknowledgement(
+  state: DriverValueChannelState,
+  event: Extract<ValueHandoffEvent, { readonly kind: 'destination-commit-acknowledgement' }>,
+): ValueHandoffTransition {
+  const validation = validateDestinationCommitAcknowledgement(state, event.acknowledgement)
+  if (validation.kind === 'rejected' || validation.extent === 'duplicate') {
+    // Malformed candidates and completed-prefix duplicates are inert: cleanup never repeats.
+    return ignoredTransition(state)
+  }
+  const handoff = state.handoff
+  const acknowledgement = event.acknowledgement
+  if (validation.extent === 'partial') {
+    const current = handoff.commitQueue.at(-1)
+    if (current === undefined) return ignoredTransition(state)
+    // A partial acknowledgement rebuilds and re-enqueues the same immutable COMMIT shape with
+    // only the remaining ordered suffix under the same lease, fence, and activation rule.
+    const suffix = current.includedPostFencePrefix.filter(
+      (entry) => entry.authoritativeSequence > acknowledgement.drainedThroughAuthoritativeSequence,
+    )
+    const firstSuffix = suffix[0]
+    const effects: ValueHandoffEffect[] = [
+      {
+        kind: 'rebuild-same-commit-with-suffix',
+        suffixStartSequence:
+          firstSuffix?.authoritativeSequence ?? acknowledgement.drainedThroughAuthoritativeSequence,
+      },
+    ]
+    const activation = destinationActivationEffect(handoff.destinationRuntime)
+    if (activation !== null) effects.push(activation)
+    const next = withHandoff(state, {
+      ...handoff,
+      drainedThroughAuthoritativeSequence: acknowledgement.drainedThroughAuthoritativeSequence,
+      commitQueue: [
+        ...handoff.commitQueue.slice(0, -1),
+        { ...current, includedPostFencePrefix: suffix },
+      ],
+    })
+    return appliedTransition(next, effects)
+  }
+  // Acknowledged through the current tail: cancel the timer, release every retained protocol
+  // resource exactly once, then permit the destination to run or reverse.
+  const next = withHandoff(state, {
+    ...handoff,
+    ownership: destinationRunningOwnershipFor(acknowledgement.direction),
+    drainedThroughAuthoritativeSequence: acknowledgement.drainedThroughAuthoritativeSequence,
+    commitQueue: [],
+    resources: releasedResourceState(),
+  })
+  return appliedTransition(next, [
+    { kind: 'cancel-transfer-timer' },
+    { kind: 'release-prepared-state' },
+    { kind: 'release-prepared-clone' },
+    { kind: 'release-transfer-activity' },
+    { kind: 'permit-destination-run-or-reverse' },
+  ])
+}
+
+function phaseTimeout(
+  state: DriverValueChannelState,
+  event: Extract<ValueHandoffEvent, { readonly kind: 'phase-timeout' }>,
+): ValueHandoffTransition {
+  const handoff = state.handoff
+  if (
+    handoff.direction !== event.direction ||
+    handoff.transferLease !== event.transferLease ||
+    handoff.phaseToken !== event.phaseToken
+  ) {
+    // A timeout from a retired lease is stale; the successor lease is never touched.
+    return ignoredTransition(state)
+  }
+  const direction = event.direction
+  switch (handoff.ownership) {
+    case 'UI_FROZEN_TO_JS':
+    case 'JS_FROZEN_TO_UI':
+    case 'JS_PREPARED':
+    case 'UI_PREPARED': {
+      const next = withHandoff(state, {
+        ...handoff,
+        ownership: sourceRunningOwnershipFor(direction),
+        releaseFenceSequence: null,
+        preparedMutableTuple: null,
+        commitQueue: [],
+      })
+      return appliedTransition(next, [
+        { kind: 'invalidate-prepared-clone' },
+        { kind: 'resume-authoritative-source', side: sourceSideFor(direction) },
+      ])
+    }
+    case 'UI_RELEASE_PENDING_TO_JS':
+    case 'JS_RELEASE_PENDING_TO_UI':
+      // The source status is still unknown: retransmit only the query, never guess ownership.
+      return appliedTransition(state, [{ kind: 'request-source-release-status' }])
+    case 'UI_RELEASED_TO_JS':
+    case 'JS_RELEASED_TO_UI': {
+      const activation = destinationActivationEffect(handoff.destinationRuntime)
+      return appliedTransition(
+        state,
+        activation === null
+          ? [{ kind: 'enqueue-immutable-destination-commit' }]
+          : [{ kind: 'enqueue-immutable-destination-commit' }, activation],
+      )
+    }
+    default:
+      return ignoredTransition(state)
+  }
+}
+
+function boundedTerminal(
+  state: DriverValueChannelState,
+  event: Extract<ValueHandoffEvent, { readonly kind: 'bounded-terminal' }>,
+): ValueHandoffTransition {
+  const handoff = state.handoff
+  if (
+    handoff.direction !== event.direction ||
+    handoff.transferLease !== event.transferLease ||
+    handoff.phaseToken !== event.phaseToken ||
+    handoff.ownership !== releasedOwnershipFor(event.direction)
+  ) {
+    return ignoredTransition(state)
+  }
+  // Expiry after confirmed release enters the bounded-refusal drain with every protocol resource
+  // still retained; cleanup waits for the retained pin-visible work to finish.
+  const next = withHandoff(state, { ...handoff, ownership: 'BOUNDED_REFUSAL_DRAINING' })
+  return appliedTransition(next, [
+    { kind: 'enter-change-host-silent-drain' },
+    { kind: 'refuse-live-channel-property' },
+  ])
+}
+
+function finishBoundedRefusalDrain(
+  state: DriverValueChannelState,
+  event: Extract<ValueHandoffEvent, { readonly kind: 'finish-bounded-refusal-drain' }>,
+): ValueHandoffTransition {
+  const handoff = state.handoff
+  if (
+    handoff.direction !== event.direction ||
+    handoff.transferLease !== event.transferLease ||
+    handoff.ownership !== 'BOUNDED_REFUSAL_DRAINING'
+  ) {
+    return ignoredTransition(state)
+  }
+  const next = withHandoff(state, {
+    ...handoff,
+    ownership: 'TERMINAL_REFUSED',
+    resources: releasedResourceState(),
+  })
+  return appliedTransition(next, [
+    { kind: 'cancel-transfer-timer' },
+    { kind: 'release-prepared-state' },
+    { kind: 'release-prepared-clone' },
+    { kind: 'release-transfer-activity' },
+    { kind: 'finalize-bounded-refusal-without-run-or-reverse' },
+  ])
+}
+
+export function advanceValueHandoff(
+  state: DriverValueChannelState,
+  event: ValueHandoffEvent,
+  now: number,
+): ValueHandoffTransition {
+  void now
+  switch (event.kind) {
+    case 'begin-handoff':
+      return beginHandoff(state, event)
+    case 'destination-ready':
+      return destinationReady(state, event)
+    case 'source-mutation':
+      return sourceMutation(state, event)
+    case 'source-status':
+      return sourceStatus(state, event)
+    case 'enqueue-destination-commit':
+      return enqueueDestinationCommit(state, event)
+    case 'destination-commit-acknowledgement':
+      return destinationCommitAcknowledgement(state, event)
+    case 'phase-timeout':
+      return phaseTimeout(state, event)
+    case 'bounded-terminal':
+      return boundedTerminal(state, event)
+    case 'finish-bounded-refusal-drain':
+      return finishBoundedRefusalDrain(state, event)
+    default: {
+      // An untyped/JS caller can reach this with a kind outside the union: fail closed with the
+      // typed invariant (never return the event as a transition — that would corrupt state).
+      const exhaustive: never = event
+      void exhaustive
+      throw new DriverValueChannelInvariantError('handoff-event-kind-unrecognized')
+    }
+  }
+}
+
+export function advanceValueHandoffPhaseEvent(
+  state: DriverValueChannelState,
+  envelope: ValueHandoffPhaseEventEnvelope,
+  now: number,
+): ValueHandoffPhaseEventTransition {
+  void now
+  const { phase, event } = envelope
+  requireValueHandoffPhase(phase)
+  requirePhaseEventKind(event.kind)
+  if (isProtocolReadEvent(event)) {
+    return {
+      state,
+      observation: observeDriverValueChannel(state),
+      disposition: {
+        kind: 'SYNCHRONOUS_READ_WITHOUT_PROTOCOL_MUTATION',
+        phase,
+        eventKind: event.kind,
+        view: readViewForPhase(phase),
+        history: state.identity.history,
+      },
+      orderedEffects: [],
+    }
+  }
+  if (phase === 'RELEASED_POST_FENCE') {
+    // Post-fence: the fence is immutable; the authored suffix rides the same COMMIT shape.
+    const current = state.handoff.commitQueue.at(-1)
+    const commit: ImmutableDestinationCommit = {
+      kind: 'DESTINATION_COMMIT',
+      channelId: state.identity.channelId,
+      sourceRecordId: state.handoff.sourceRecordId ?? -1,
+      destinationRecordId: state.handoff.destinationRecordId ?? -1,
+      direction: envelope.direction,
+      transferLease: envelope.transferLease,
+      releaseFenceSequence:
+        state.handoff.releaseFenceSequence ?? current?.releaseFenceSequence ?? -1,
+      sentThroughAuthoritativeSequence: event.authoritativeSequence,
+      includedPostFencePrefix: current?.includedPostFencePrefix ?? [],
+    }
+    const next = withHandoff(state, {
+      ...state.handoff,
+      sentThroughAuthoritativeSequence: event.authoritativeSequence,
+    })
+    return {
+      state: next,
+      observation: observeDriverValueChannel(next),
+      disposition: {
+        kind: 'APPEND_IMMUTABLE_COMMIT_SUFFIX',
+        phase,
+        eventKind: event.kind,
+        commit,
+        authoredSuffix: [event],
+      },
+      orderedEffects: [],
+    }
+  }
+  const direction = envelope.direction
+  const status: ValueHandoffSourceStatus = {
+    kind: 'ABORTED',
+    channelId: state.identity.channelId,
+    sourceRecordId: state.handoff.sourceRecordId ?? -1,
+    destinationRecordId: state.handoff.destinationRecordId ?? -1,
+    direction,
+    transferLease: envelope.transferLease,
+    authoritativeSequence: event.authoritativeSequence,
+  }
+  const next = withHandoff(state, {
+    ...state.handoff,
+    ownership: frozenOwnershipFor(direction),
+    releaseFenceSequence: null,
+    preparedMutableTuple: null,
+    commitQueue: [],
+  })
+  return {
+    state: next,
+    observation: observeDriverValueChannel(next),
+    disposition: { kind: 'ABORT_AND_REPREPARE', phase, eventKind: event.kind, status },
+    orderedEffects: [
+      { kind: 'invalidate-prepared-clone' },
+      { kind: 'resume-authoritative-source', side: sourceSideFor(direction) },
+      { kind: 'send-prepare', direction },
+    ],
+  }
+}
+
+function applyProtocolCheckpointMutation(
+  state: DriverValueChannelState,
+  envelope: ValueHandoffProtocolCheckpointEnvelope,
+  event: ValueHandoffProtocolMutationEvent,
+): {
+  readonly state: DriverValueChannelState
+  readonly orderedEffects: readonly ValueHandoffEffect[]
+} {
+  const handoff = state.handoff
+  const direction = envelope.direction
+  switch (envelope.checkpoint) {
+    case 'FREEZE':
+      return { state, orderedEffects: [{ kind: 'send-prepare', direction }] }
+    case 'PREPARE_READY': {
+      const next = withHandoff(state, {
+        ...handoff,
+        ownership: frozenOwnershipFor(direction),
+        releaseFenceSequence: null,
+        preparedMutableTuple: null,
+        commitQueue: [],
+      })
+      return {
+        state: next,
+        orderedEffects: [
+          { kind: 'invalidate-prepared-clone' },
+          { kind: 'send-prepare', direction },
+        ],
+      }
+    }
+    case 'RELEASE_PENDING_SOURCE_UNKNOWN': {
+      const next = withHandoff(state, {
+        ...handoff,
+        sourceMutationQueue: [...handoff.sourceMutationQueue, event.retainedWorkEntry],
+      })
+      return { state: next, orderedEffects: [] }
+    }
+    case 'SOURCE_CONFIRMED_ABORTED':
+      return {
+        state: {
+          identity: applyProtocolMutationToIdentity(state.identity, event),
+          handoff,
+        },
+        orderedEffects: [{ kind: 'send-prepare', direction }],
+      }
+    case 'SOURCE_CONFIRMED_RELEASED':
+    case 'DESTINATION_COMMIT_CONSUMPTION': {
+      const next = {
+        identity: applyProtocolMutationToIdentity(state.identity, event),
+        handoff: {
+          ...handoff,
+          sentThroughAuthoritativeSequence: event.retainedWorkEntry.authoritativeSequence,
+          commitQueue: appendEntryToCommitQueue(state, event.retainedWorkEntry),
+        },
+      }
+      return { state: next, orderedEffects: [] }
+    }
+    case 'DESTINATION_ACKNOWLEDGED':
+      return {
+        state: {
+          identity: applyProtocolMutationToIdentity(state.identity, event),
+          handoff,
+        },
+        orderedEffects: [],
+      }
+    default: {
+      const exhaustive: never = envelope.checkpoint
+      return exhaustive
+    }
+  }
+}
+
+export function advanceValueHandoffProtocolCheckpoint(
+  state: DriverValueChannelState,
+  envelope: ValueHandoffProtocolCheckpointEnvelope,
+  now: number,
+): ValueHandoffProtocolCheckpointTransition {
+  void now
+  const { checkpoint, event } = envelope
+  requireProtocolCheckpoint(checkpoint)
+  requireProtocolEventKind(event.kind)
+  if (isProtocolReadEvent(event)) {
+    return {
+      state,
+      observation: observeDriverValueChannel(state),
+      disposition: {
+        kind: 'SYNCHRONOUS_READ_WITHOUT_PROTOCOL_MUTATION',
+        checkpoint,
+        eventKind: event.kind,
+        authority: readAuthorityForCheckpoint(checkpoint),
+        history: state.identity.history,
+      },
+      orderedEffects: [],
+    }
+  }
+  const mutation = applyProtocolCheckpointMutation(state, envelope, event)
+  return {
+    state: mutation.state,
+    observation: observeDriverValueChannel(mutation.state),
+    disposition: {
+      kind: 'MUTATION',
+      checkpoint,
+      eventKind: event.kind,
+      operation: event,
+      handling: mutationHandlingForCheckpoint(checkpoint),
+      retainedWorkDisposition: retainedWorkDispositionFor(checkpoint, event),
+      absoluteTransferDeadlineMs: state.handoff.absoluteTransferDeadlineMs ?? -1,
+      absoluteNoConsumerDeadlineMs: state.handoff.absoluteNoConsumerDeadlineMs ?? -1,
+      resources: state.handoff.resources,
+    },
+    orderedEffects: mutation.orderedEffects,
+  }
+}
+
+function refuseJsDestinationCommit(
+  state: JsDestinationCommitConsumeState,
+  request: JsDestinationCommitConsumeRequest,
+  reason: JsDestinationCommitRefusalReason,
+  priorEffects: readonly JsDestinationCommitEffect[],
+  envelope: JsDestinationCommitEnvelopeState | null,
+): JsDestinationCommitTransition {
+  if (envelope === null) {
+    // The envelope never began: refuse without begin/seal or any destination mutation.
+    return {
+      state,
+      outcome: { kind: 'REFUSED', commitSlotId: request.commitSlotId, reason },
+      orderedEffects: [
+        {
+          kind: 'refuse-malformed-js-destination-commit',
+          commitSlotId: request.commitSlotId,
+          reason,
+        },
+      ],
+    }
+  }
+  const sealedEnvelope: JsDestinationCommitEnvelopeState = {
+    ...envelope,
+    state: 'SEALED',
+    sealCount: envelope.sealCount + 1,
+  }
+  return {
+    state: {
+      preparedDestinationRecords: state.preparedDestinationRecords,
+      acknowledgementSlots: state.acknowledgementSlots,
+      envelope: sealedEnvelope,
+    },
+    outcome: { kind: 'REFUSED', commitSlotId: request.commitSlotId, reason },
+    orderedEffects: [
+      ...priorEffects,
+      {
+        kind: 'refuse-malformed-js-destination-commit',
+        commitSlotId: request.commitSlotId,
+        reason,
+      },
+      {
+        kind: 'seal-js-destination-envelope-once',
+        mailboxDrainId: sealedEnvelope.mailboxDrainId,
+        entryCount: 0,
+      },
+    ],
+  }
+}
+
+function validateJsCommitAgainstRecord(
+  record: JsPreparedDestinationRecordState,
+  commit: ImmutableDestinationCommit,
+): JsDestinationCommitRefusalReason | null {
+  if (commit.channelId !== record.channelId) return 'wrong-channel'
+  if (commit.sourceRecordId !== record.sourceRecordId) return 'wrong-source-record'
+  if (commit.destinationRecordId !== record.destinationRecordId) return 'wrong-destination-record'
+  if (commit.direction !== record.direction) return 'wrong-direction'
+  if (commit.transferLease !== record.transferLease) return 'wrong-transfer-lease'
+  if (commit.releaseFenceSequence !== record.releaseFenceSequence) return 'wrong-release-fence'
+  if (
+    commit.includedPostFencePrefix.some(
+      (entry) => entry.authoritativeSequence > commit.sentThroughAuthoritativeSequence,
+    )
+  ) {
+    return 'ahead-of-sent-watermark'
+  }
+  if (commit.sentThroughAuthoritativeSequence < record.adoptedSentThroughAuthoritativeSequence) {
+    return 'sent-watermark-regressed'
+  }
+  const newEntries = commit.includedPostFencePrefix.filter(
+    (entry) => entry.authoritativeSequence > record.appliedThroughAuthoritativeSequence,
+  )
+  for (let index = 0; index < newEntries.length; index += 1) {
+    const entry = newEntries[index]
+    if (entry === undefined) break
+    if (entry.authoritativeSequence !== record.appliedThroughAuthoritativeSequence + index + 1) {
+      return 'prefix-not-contiguous'
+    }
+  }
+  return null
+}
+
+export function consumeJsDestinationCommit(
+  state: JsDestinationCommitConsumeState,
+  request: JsDestinationCommitConsumeRequest,
+): JsDestinationCommitTransition {
+  const envelope = state.envelope
+  if (envelope.root !== request.root) {
+    return refuseJsDestinationCommit(state, request, 'root-mismatch', [], null)
+  }
+  if (envelope.state !== 'NOT_BEGUN') {
+    return refuseJsDestinationCommit(state, request, 'envelope-already-begun', [], null)
+  }
+  const commit = request.commit
+  const openEnvelope: JsDestinationCommitEnvelopeState = {
+    ...envelope,
+    state: 'OPEN',
+    beginCount: envelope.beginCount + 1,
+  }
+  const effects: JsDestinationCommitEffect[] = [
+    { kind: 'begin-js-destination-envelope', root: request.root },
+    {
+      kind: 'lookup-js-prepared-destination-record',
+      destinationRecordId: commit.destinationRecordId,
+    },
+  ]
+  // The runtime keys its prepared records by its own destination record id; a commit naming an
+  // unknown destination id for a known channel still resolves the channel's authority so the
+  // validator can diagnose the exact tuple field rather than report a missing record.
+  const record =
+    state.preparedDestinationRecords.find(
+      (candidate) => candidate.destinationRecordId === commit.destinationRecordId,
+    ) ??
+    state.preparedDestinationRecords.find((candidate) => candidate.channelId === commit.channelId)
+  if (record === undefined) {
+    return refuseJsDestinationCommit(
+      state,
+      request,
+      'missing-prepared-destination-record',
+      effects,
+      openEnvelope,
+    )
+  }
+  effects.push({
+    kind: 'validate-js-immutable-destination-commit',
+    commitSlotId: request.commitSlotId,
+  })
+  const refusal = validateJsCommitAgainstRecord(record, commit)
+  if (refusal !== null) {
+    return refuseJsDestinationCommit(state, request, refusal, effects, openEnvelope)
+  }
+  const acknowledgementSlot = state.acknowledgementSlots.find(
+    (candidate) => candidate.acknowledgementSlotId === request.acknowledgementSlotId,
+  )
+  if (acknowledgementSlot === undefined) {
+    return refuseJsDestinationCommit(
+      state,
+      request,
+      'missing-acknowledgement-slot',
+      effects,
+      openEnvelope,
+    )
+  }
+
+  // Validation is complete before any entry applies: only the entries beyond the applied
+  // watermark are new; a fully-applied candidate dedupes without a second application.
+  const newEntries = commit.includedPostFencePrefix.filter(
+    (entry) => entry.authoritativeSequence > record.appliedThroughAuthoritativeSequence,
+  )
+  const appliedThrough =
+    newEntries.at(-1)?.authoritativeSequence ?? record.appliedThroughAuthoritativeSequence
+  const acknowledgement: DestinationCommitAcknowledgement = {
+    kind: 'DESTINATION_COMMIT_ACKNOWLEDGEMENT',
+    channelId: commit.channelId,
+    sourceRecordId: commit.sourceRecordId,
+    destinationRecordId: commit.destinationRecordId,
+    direction: commit.direction,
+    transferLease: commit.transferLease,
+    releaseFenceSequence: commit.releaseFenceSequence,
+    drainedThroughAuthoritativeSequence: appliedThrough,
+  }
+  const duplicate = newEntries.length === 0
+  let nextRecord = record
+  if (duplicate) {
+    effects.push({
+      kind: 'dedupe-js-destination-commit-application',
+      commitSlotId: request.commitSlotId,
+      drainedThroughAuthoritativeSequence: record.appliedThroughAuthoritativeSequence,
+    })
+  } else {
+    effects.push({
+      kind: 'adopt-js-immutable-destination-commit',
+      commitSlotId: request.commitSlotId,
+    })
+    for (const entry of newEntries) {
+      effects.push({
+        kind: 'apply-js-destination-ledger-entry-in-place',
+        commitSlotId: request.commitSlotId,
+        prefixIndex: entry.authoritativeSequence - commit.releaseFenceSequence - 1,
+        destinationSlot: entry.destinationSlot,
+        entry,
+      })
+    }
+    nextRecord = {
+      ...record,
+      adoptedCommitSlotId: request.commitSlotId,
+      adoptedSentThroughAuthoritativeSequence: commit.sentThroughAuthoritativeSequence,
+      appliedThroughAuthoritativeSequence: appliedThrough,
+      ledgers: applyEntriesToLedgers(record.ledgers, newEntries),
+    }
+  }
+  effects.push({
+    kind: 'fill-js-destination-acknowledgement-slot',
+    commitSlotId: request.commitSlotId,
+    acknowledgementSlotId: request.acknowledgementSlotId,
+  })
+  effects.push({
+    kind: 'stage-js-destination-acknowledgement-in-current-envelope',
+    acknowledgementSlotId: request.acknowledgementSlotId,
+    mailboxDrainId: openEnvelope.mailboxDrainId,
+  })
+  const entries: JsDestinationCommitEnvelopeEntry[] = [
+    {
+      kind: 'DESTINATION_COMMIT_ACKNOWLEDGEMENT',
+      acknowledgementSlotId: request.acknowledgementSlotId,
+      acknowledgement,
+    },
+  ]
+  for (const dueWorkSequence of request.siblingDueWorkSequences) {
+    effects.push({ kind: 'run-js-root-sibling-due-work', dueWorkSequence })
+    entries.push({ kind: 'ROOT_SIBLING_DUE_WORK', dueWorkSequence })
+  }
+  const sealedEnvelope: JsDestinationCommitEnvelopeState = {
+    ...openEnvelope,
+    state: 'SEALED',
+    entries,
+    sealCount: openEnvelope.sealCount + 1,
+  }
+  effects.push({
+    kind: 'seal-js-destination-envelope-once',
+    mailboxDrainId: sealedEnvelope.mailboxDrainId,
+    entryCount: entries.length,
+  })
+  const filledSlot: JsDestinationCommitAcknowledgementSlotState = {
+    ...acknowledgementSlot,
+    state: 'STAGED_IN_CURRENT_ENVELOPE',
+    acknowledgement,
+  }
+  return {
+    state: {
+      preparedDestinationRecords: duplicate
+        ? state.preparedDestinationRecords
+        : state.preparedDestinationRecords.map((candidate) =>
+            candidate === record ? nextRecord : candidate,
+          ),
+      acknowledgementSlots: state.acknowledgementSlots.map((candidate) =>
+        candidate === acknowledgementSlot ? filledSlot : candidate,
+      ),
+      envelope: sealedEnvelope,
+    },
+    outcome: duplicate
+      ? { kind: 'DUPLICATE_REACKNOWLEDGED', commitSlotId: request.commitSlotId, acknowledgement }
+      : { kind: 'APPLIED', commitSlotId: request.commitSlotId, acknowledgement },
+    orderedEffects: effects,
+  }
+}
+
+export function drainPostReleaseCommitLoss(
+  state: ValueHandoffCommitLossDrainState,
+  now: number,
+): ValueHandoffCommitLossDrainTransition {
+  void now
+  // The bounded drain is change/host-silent: every retained public obligation still runs in
+  // packet order; retired listeners, retired sinks, and host publication stay silent.
+  const orderedEffects: ValueHandoffCommitLossDrainEffect[] = []
+  const drainedWorkSequences: number[] = []
+  let dependencyAcknowledgementCount = 0
+  let settleReleaseCount = 0
+  for (const work of state.retainedWork) {
+    drainedWorkSequences.push(work.workSequence)
+    switch (work.kind) {
+      case 'cache-adoption':
+        orderedEffects.push({
+          kind: 'adopt-bounded-destination-cache',
+          workSequence: work.workSequence,
+          authoritativeSequence: work.authoritativeSequence,
+          value: work.value,
+        })
+        break
+      case 'transition-on-update':
+        orderedEffects.push({
+          kind: 'deliver-bounded-transition-on-update',
+          workSequence: work.workSequence,
+          callbackId: work.callbackId,
+          value: work.value,
+        })
+        break
+      case 'transition-on-complete':
+        orderedEffects.push({
+          kind: 'deliver-bounded-transition-on-complete',
+          workSequence: work.workSequence,
+          callbackId: work.callbackId,
+        })
+        break
+      case 'current-animation-complete':
+        orderedEffects.push({
+          kind: 'deliver-current-animation-complete',
+          workSequence: work.workSequence,
+          listenerId: work.listenerId,
+          bindingGeneration: work.bindingGeneration,
+        })
+        break
+      case 'token-blind-public-slot-clear':
+        orderedEffects.push({
+          kind: 'clear-public-control-slot-token-blind',
+          workSequence: work.workSequence,
+          initiallyInstalledControlId: work.initiallyInstalledControlId,
+          installedControlIdAtClear: work.installedControlIdAtClear,
+        })
+        break
+      case 'public-start-promise-resolution':
+        orderedEffects.push({
+          kind: 'resolve-public-start-promise',
+          workSequence: work.workSequence,
+          promiseId: work.promiseId,
+        })
+        break
+      case 'target-batch-dependency-delivery':
+        orderedEffects.push({
+          kind: 'deliver-target-batch-dependency-event',
+          workSequence: work.workSequence,
+          batchId: work.batchId,
+          dependencyId: work.dependencyId,
+          eventSequence: work.eventSequence,
+        })
+        break
+      case 'target-batch-dependency-acknowledgement':
+        dependencyAcknowledgementCount += 1
+        orderedEffects.push({
+          kind: 'acknowledge-target-batch-dependency-event',
+          workSequence: work.workSequence,
+          batchId: work.batchId,
+          dependencyId: work.dependencyId,
+          acknowledgedEventSequence: work.acknowledgedEventSequence,
+        })
+        break
+      case 'settle-release':
+        settleReleaseCount += 1
+        orderedEffects.push({
+          kind: 'release-settle-entry',
+          workSequence: work.workSequence,
+          settleEntryId: work.settleEntryId,
+        })
+        break
+      default: {
+        // An untyped caller can reach this with a work kind outside the union: fail closed with
+        // the typed invariant (never return the work entry as a drain transition).
+        const exhaustive: never = work
+        void exhaustive
+        throw new DriverValueChannelInvariantError('commit-loss-work-kind-unrecognized')
+      }
+    }
+  }
+
+  // Only when the due-work set ends does the refusal release its protocol resources, each
+  // exactly once, finalizing without permitting either side to run or reverse.
+  let transferTimerCancellationCount = state.cleanupCounts.transferTimerCancellationCount
+  let preparedStateReleaseCount = state.cleanupCounts.preparedStateReleaseCount
+  let preparedCloneReleaseCount = state.cleanupCounts.preparedCloneReleaseCount
+  let transferActivityReleaseCount = state.cleanupCounts.transferActivityReleaseCount
+  let terminalFinalizationCount = state.cleanupCounts.terminalFinalizationCount
+  let preparedStateRetained = state.channel.handoff.resources.preparedStateRetained
+  let preparedCloneRetained = state.channel.handoff.resources.preparedCloneRetained
+  let transferActivityRetained = state.channel.handoff.resources.transferActivityRetained
+  let transferTimerArmed = state.channel.handoff.resources.transferTimerArmed
+  let ownership = state.channel.handoff.ownership
+  if (transferTimerCancellationCount === 0 && transferTimerArmed) {
+    orderedEffects.push({ kind: 'cancel-transfer-timer-once' })
+    transferTimerCancellationCount = 1
+    transferTimerArmed = false
+  }
+  if (preparedStateReleaseCount === 0 && preparedStateRetained) {
+    orderedEffects.push({ kind: 'release-prepared-state-once' })
+    preparedStateReleaseCount = 1
+    preparedStateRetained = false
+  }
+  if (preparedCloneReleaseCount === 0 && preparedCloneRetained) {
+    orderedEffects.push({ kind: 'release-prepared-clone-once' })
+    preparedCloneReleaseCount = 1
+    preparedCloneRetained = false
+  }
+  if (transferActivityReleaseCount === 0 && transferActivityRetained) {
+    orderedEffects.push({ kind: 'release-transfer-activity-once' })
+    transferActivityReleaseCount = 1
+    transferActivityRetained = false
+  }
+  if (terminalFinalizationCount === 0) {
+    orderedEffects.push({ kind: 'finalize-bounded-refusal-without-run-or-reverse-once' })
+    terminalFinalizationCount = 1
+    ownership = 'TERMINAL_REFUSED'
+  }
+
+  const cleanupCounts: ValueHandoffCommitLossCleanupCounts = {
+    transferTimerCancellationCount,
+    preparedStateReleaseCount,
+    preparedCloneReleaseCount,
+    transferActivityReleaseCount,
+    terminalFinalizationCount,
+  }
+  const resources: ValueChannelHandoffResourceState = {
+    preparedStateRetained,
+    preparedCloneRetained,
+    transferActivityRetained,
+    transferTimerArmed,
+  }
+
+  const nextState: ValueHandoffCommitLossDrainState = {
+    channel: {
+      identity: state.channel.identity,
+      handoff: { ...state.channel.handoff, ownership, resources },
+    },
+    retainedWork: [],
+    drainedWorkSequences: [...state.drainedWorkSequences, ...drainedWorkSequences],
+    retiredListenerIds: state.retiredListenerIds,
+    retiredSinkRegistrationIds: state.retiredSinkRegistrationIds,
+    cleanupCounts,
+  }
+  return {
+    state: nextState,
+    observation: {
+      remainingRetainedWorkCount: nextState.retainedWork.length,
+      drainedWorkCount: drainedWorkSequences.length,
+      retiredListenerDeliveryCount: 0,
+      retiredSinkPublicationCount: 0,
+      hostOnUpdatePublicationCount: 0,
+      dependencyAcknowledgementCount,
+      settleReleaseCount,
+      destinationRunPermitCount: 0,
+      sourceRevivalCount: 0,
+      reverseTransferCount: 0,
+      cleanupCounts,
+    },
+    orderedEffects,
+  }
+}