@xema/omni-protocol 0.1.82 → 0.1.84

package/dist/testing.js

@@ -1,5 +1,5 @@
 import { browserSessionKey, effectiveLevels, sameCapabilities, } from "./index.js";
-import { assertNoViolations, validateAuthenticationState, validateEventEnvelope, validateHostGuarantees, validateHostReport, validateDescribedUsers, observeRules, ruleEvaluated, validateHostMute, validateHostRecording, validateLoginStore, validateHandlingReport, validateManifest, validateResult, validateSnapshot, validateTask, validateTimeZone, validatePhone, validateTaskCommand, isTimeZone, sameTimeZone, } from "./validation.js";
+import { assertNoViolations, validateAuthenticationState, validateBreakTransition, validateEventEnvelope, validateHostGuarantees, validateHostReport, validateDescribedUsers, observeRules, ruleEvaluated, validateHostMute, validateHostRecording, validateLoginStore, validateInteractionReport, validateManifest, validateResult, validateSnapshot, validateTask, validateTimeZone, validatePhone, validateTaskCommand, isTimeZone, sameTimeZone, } from "./validation.js";
 export { ProtocolConformanceError, assertNoViolations } from "./validation.js";
 /**
  * A part of the contract a run may never reach: state nothing obliges an adapter to publish, so
@@ -11,7 +11,7 @@ const STATE_SUBJECTS = [
     "tasks",
     "task.browsers",
     "task.attributes",
-    "task.handlingHistory",
+    "task.interactionHistory",
     "task.onCall",
     "task.leadAssist",
     "task.assisting",
@@ -53,8 +53,8 @@ function observeTask(value, seen) {
         seen.add("task.browsers");
     if (some(value.attributes))
         seen.add("task.attributes");
-    if (isRecord(value.handlingHistory) && some(value.handlingHistory.steps))
-        seen.add("task.handlingHistory");
+    if (isRecord(value.interactionHistory) && some(value.interactionHistory.steps))
+        seen.add("task.interactionHistory");
     if (some(value.onCall))
         seen.add("task.onCall");
     if (value.leadAssist !== undefined)
@@ -305,6 +305,8 @@ export async function exerciseAdapter(adapter, context, options = {}) {
         // What every connection owes on connect, the first and a reloaded second alike.
         const connectObligations = (on) => {
             // A refusal is visible on both sides: what the host would not take, the adapter is told, with the rules.
+            if (adapter.manifest.timeCheck === true)
+                requireMethod(on, "checkTime", "the manifest declares timeCheck");
             requireMethod(on, "refused", "every connection is told what the host refused");
             // Dial is declared by presence: the capability object carries a destination policy rather
             // than an `enabled` flag, so its presence is the declaration.
@@ -479,7 +481,7 @@ export async function exerciseAdapter(adapter, context, options = {}) {
         const snapshot = await connection.snapshot();
         await snapshotRead(live, snapshot, "snapshot");
         stream.seed(snapshot);
-        breaks.seed(snapshot);
+        violations.push(...breaks.seed(snapshot));
         seeded = true;
         // A snapshot supersedes what it restates and nothing else. Of the events held during the read,
         // a state-replacing kind is dropped, since the snapshot carries that state and must account for
@@ -659,8 +661,8 @@ function userIdsIn(snapshot) {
     }
     for (const task of Array.isArray(snapshot?.tasks) ? snapshot.tasks : []) {
         const t = task;
-        if (isRecord(t.handlingHistory) && Array.isArray(t.handlingHistory.steps))
-            for (const step of t.handlingHistory.steps)
+        if (isRecord(t.interactionHistory) && Array.isArray(t.interactionHistory.steps))
+            for (const step of t.interactionHistory.steps)
                 if (isRecord(step))
                     add(step.by);
         if (Array.isArray(t.onCall))
@@ -679,7 +681,7 @@ function userIdsIn(snapshot) {
     return [...ids];
 }
 const teamNamesUsers = (team) => isRecord(team) && (some(team.members) || some(team.requests));
-const taskNamesUsers = (task) => isRecord(task) && ((isRecord(task.handlingHistory) && Array.isArray(task.handlingHistory.steps) && task.handlingHistory.steps.some(step => isRecord(step) && step.by !== undefined)) ||
+const taskNamesUsers = (task) => isRecord(task) && ((isRecord(task.interactionHistory) && Array.isArray(task.interactionHistory.steps) && task.interactionHistory.steps.some(step => isRecord(step) && step.by !== undefined)) ||
     (isRecord(task.leadAssist) && task.leadAssist.leadId !== undefined) ||
     isRecord(task.assisting) ||
     isRecord(task.monitoring));
@@ -1005,7 +1007,7 @@ export class TaskStream {
             return;
         const entries = [
             ...(Array.isArray(task.onCall) ? task.onCall : []),
-            ...(isRecord(task.handlingHistory) && Array.isArray(task.handlingHistory.steps) ? task.handlingHistory.steps : []),
+            ...(isRecord(task.interactionHistory) && Array.isArray(task.interactionHistory.steps) ? task.interactionHistory.steps : []),
         ];
         for (const entry of entries) {
             if (isRecord(entry) && typeof entry.dialId === "string")
@@ -1050,9 +1052,9 @@ export class TaskStream {
     }
     /** The entries of a task's record, each by step and instant, or undefined where the task carries no record. */
     static record(task) {
-        if (!isRecord(task) || !isRecord(task.handlingHistory) || !Array.isArray(task.handlingHistory.steps))
+        if (!isRecord(task) || !isRecord(task.interactionHistory) || !Array.isArray(task.interactionHistory.steps))
             return undefined;
-        return new Set(task.handlingHistory.steps.filter(isRecord).map(entry => `${String(entry.step)}@${String(entry.at)}`));
+        return new Set(task.interactionHistory.steps.filter(isRecord).map(entry => `${String(entry.step)}@${String(entry.at)}`));
     }
     /** What a restated record lost of the one read before it: nothing, or the entries by step and instant. */
     static lost(was, now) {
@@ -1073,9 +1075,9 @@ export class TaskStream {
                     stages.set(entry.dialId, entry.stage);
             }
         }
-        const partyRingingByHost = isRecord(task) && Array.isArray(task.onCall)
-            && task.onCall.some(entry => isRecord(entry) && entry.role === "party" && entry.stage === "ringing" && typeof entry.dialId === "string");
-        return { partyRingingByHost, channel: String(isRecord(task) ? task.channel : undefined), completionMode: String(isRecord(task) ? task.completionMode : undefined),
+        const partyRingingBeforeWork = isRecord(task) && Array.isArray(task.onCall)
+            && task.onCall.some(entry => isRecord(entry) && entry.role === "party" && entry.stage === "ringing" && (typeof entry.dialId === "string" || (task.phase === "preview" && task.atDeadline === "calls" && entry.dialId === undefined)));
+        return { partyRingingBeforeWork, channel: String(isRecord(task) ? task.channel : undefined), completionMode: String(isRecord(task) ? task.completionMode : undefined),
             wrapAllowance: isRecord(task) && typeof task.wrapAllowance === "number" ? task.wrapAllowance : undefined,
             phase: String(isRecord(task) ? task.phase : undefined), media, source: String(isRecord(task) ? task.capabilitySource : undefined), stages, record: TaskStream.record(task), allocation: String(isRecord(task) ? task.allocationId : undefined) };
     }
@@ -1090,7 +1092,7 @@ export class TaskStream {
     resync(snapshot, at) {
         const found = [];
         const refuse = (rule, where, message) => found.push({ rule, path: where, message });
-        ruleEvaluated("stream.snapshot.capabilitySource", "stream.snapshot.handlingHistory", "stream.snapshot.phase", "stream.snapshot.media");
+        ruleEvaluated("stream.snapshot.capabilitySource", "stream.snapshot.interactionHistory", "stream.snapshot.phase", "stream.snapshot.media");
         if (isRecord(snapshot) && Array.isArray(snapshot.tasks)) {
             snapshot.tasks.forEach((task, index) => {
                 if (!isRecord(task) || typeof task.id !== "string")
@@ -1104,7 +1106,7 @@ export class TaskStream {
                 // A record once read is not unread: a resync restates it whole, or with more, never with less.
                 const lost = TaskStream.lost(was.record, TaskStream.record(task));
                 if (lost.length > 0) {
-                    refuse("stream.snapshot.handlingHistory", `${at}.tasks[${index}].handlingHistory`, `${task.id}'s record lost ${lost.join(", ")} on the snapshot: an entry read by the host stays in the record until the task ends`);
+                    refuse("stream.snapshot.interactionHistory", `${at}.tasks[${index}].interactionHistory`, `${task.id}'s record lost ${lost.join(", ")} on the snapshot: an entry read by the host stays in the record until the task ends`);
                 }
                 const to = String(task.phase);
                 const reachable = REACHABLE_PHASES[was.phase];
@@ -1176,7 +1178,7 @@ export class TaskStream {
                     break;
                 }
                 // The rules about a known task are evaluated only once there is one.
-                ruleEvaluated("stream.taskUpdated.capabilitySource", "stream.taskUpdated.phase", "stream.taskUpdated.allocation", "stream.taskUpdated.mediaOpen", "stream.taskUpdated.handlingHistory", "stream.taskMediaEnded.follow", "stream.taskUpdated.media", "stream.taskUpdated.stage", "stream.taskUpdated.stage.lingering");
+                ruleEvaluated("stream.taskUpdated.capabilitySource", "stream.taskUpdated.phase", "stream.taskUpdated.allocation", "stream.taskUpdated.mediaOpen", "stream.taskUpdated.interactionHistory", "stream.taskMediaEnded.follow", "stream.taskUpdated.media", "stream.taskUpdated.stage", "stream.taskUpdated.stage.lingering");
                 // Terms once read stay read. A re-read that fails is not a new fact about the task, so the
                 // last statement stands and the failure is a diagnostic; undetermined is a place a task
                 // starts from, never one it returns to.
@@ -1208,7 +1210,7 @@ export class TaskStream {
                 {
                     const lost = TaskStream.lost(known.record, TaskStream.record(event.task));
                     if (lost.length > 0) {
-                        refuse("stream.taskUpdated.handlingHistory", `${at}.task.handlingHistory`, `${id}'s record lost ${lost.join(", ")} on the update: an entry read by the host stays in the record until the task ends`);
+                        refuse("stream.taskUpdated.interactionHistory", `${at}.task.interactionHistory`, `${id}'s record lost ${lost.join(", ")} on the update: an entry read by the host stays in the record until the task ends`);
                     }
                 }
                 // A task completes after its media ends, never around it: an update that moves a task to
@@ -1268,7 +1270,7 @@ export class TaskStream {
                     refuse("stream.taskMedia.channel", `${at}.type`, "only a voice task has media transitions");
                     break;
                 }
-                if (!AT_WORK.has(known.phase) && !known.partyRingingByHost) {
+                if (!AT_WORK.has(known.phase) && !known.partyRingingBeforeWork) {
                     refuse("stream.taskMediaStarted.beforeWork", `${at}.taskId`, `media cannot arrive on ${id} while it is ${known.phase}: a task is never its audio, and its work has not begun`);
                 }
                 if (known.media === "started") {
@@ -1290,7 +1292,7 @@ export class TaskStream {
                     refuse("stream.taskMedia.channel", `${at}.type`, "only a voice task has media transitions");
                     break;
                 }
-                if (!WORK_BEGUN.has(known.phase)) {
+                if (!WORK_BEGUN.has(known.phase) && !known.partyRingingBeforeWork) {
                     refuse("stream.taskMediaEnded.beforeWork", `${at}.taskId`, `media cannot end on ${id} while it is ${known.phase}: a task is never its audio, and its work has not begun`);
                 }
                 if (known.media !== "started") {
@@ -1317,13 +1319,13 @@ export class TaskStream {
                     refuse("stream.taskEnded.mediaOpen", `${at}.taskId`, `${id} ended with its media still started: the audio ends first, on task-media-ended, whatever the outcome`);
                 }
                 // Off voice there is no media event, so the update that moves a task to completing is the
-                // provider's word that handling ended and the moment the wrap allowance starts. A provider
+                // provider's word that interaction ended and the moment the wrap allowance starts. A provider
                 // that completes the task itself with an allowance to run has to have started the clock:
                 // completed from in-progress, the allowance it stated was never given.
                 ruleEvaluated("stream.taskEnded.unwrapped");
                 if (known.channel !== "voice" && known.completionMode === "provider-automatic" && known.wrapAllowance !== undefined && known.wrapAllowance > 0
                     && known.phase !== "completing" && isRecord(event.outcome) && event.outcome.type === "completed") {
-                    refuse("stream.taskEnded.unwrapped", `${at}.outcome`, `${id} was completed from ${known.phase} with a wrap allowance of ${known.wrapAllowance}s under provider-automatic: off voice, completing is the provider's word that handling ended and the allowance's start, and it was never published`);
+                    refuse("stream.taskEnded.unwrapped", `${at}.outcome`, `${id} was completed from ${known.phase} with a wrap allowance of ${known.wrapAllowance}s under provider-automatic: off voice, completing is the provider's word that interaction ended and the allowance's start, and it was never published`);
                 }
                 this.endedAllocations.add(known.allocation);
                 this.tasks.delete(id);
@@ -1441,7 +1443,7 @@ async function driveOneCall(drive) {
             // is a place the stream's rules keep working, not one where they all stop.
             await drive.snapshotRead(second, snapshot, "drive.reload.snapshot");
             found.push(...drive.streams.stream.resync(snapshot, "drive.reload.snapshot"));
-            drive.streams.breaks.seed(snapshot);
+            found.push(...drive.streams.breaks.seed(snapshot));
             const carried = isRecord(snapshot) && Array.isArray(snapshot.tasks)
                 ? snapshot.tasks.find(task => isRecord(task) && task.id === taskId) : undefined;
             ruleEvaluated("drive.reload.snapshot");
@@ -1454,10 +1456,10 @@ async function driveOneCall(drive) {
             if (carried.allocationId !== allocationOf()) {
                 refuse("drive.reload.allocation", "drive.reload.allocation", `a second adapter built from the same login carries ${taskId} as allocation ${String(carried.allocationId)}; the first published ${allocationOf()}, and a life does not change its name on a reload`);
             }
-            const history = carried.handlingHistory;
+            const history = carried.interactionHistory;
             const steps = isRecord(history) && Array.isArray(history.steps) ? history.steps : [];
             // A record once read is not unread across a reload either: every entry the first adapter published is here.
-            const before = latestTask().handlingHistory;
+            const before = latestTask().interactionHistory;
             const wasRead = isRecord(before) && Array.isArray(before.steps) ? before.steps.filter(isRecord) : [];
             const lost = wasRead.filter(entry => !steps.some(now => isRecord(now) && now.step === entry.step && now.at === entry.at))
                 .map(entry => `${String(entry.step)}@${String(entry.at)}`);
@@ -1610,11 +1612,11 @@ async function driveOneCall(drive) {
         if (await updated(t => t.phase === "in-progress" || t.phase === "completing", "the task leaving preview after Call") === undefined)
             return found;
     }
-    // The other direction of step 4, wherever the task stands outside the handling phases with the
-    // control still declared: a host holds it back (command.phase.handling), and an adapter that
+    // The other direction of step 4, wherever the task stands outside the interaction phases with the
+    // control still declared: a host holds it back (command.phase.interaction), and an adapter that
     // receives it anyway must refuse it -- so the drive sends it past the validator and expects failed.
-    const holdRefusedOutsideHandling = async () => {
-        ruleEvaluated("drive.command.rejected", "drive.command.handling");
+    const holdRefusedOutsideInteraction = async () => {
+        ruleEvaluated("drive.command.rejected", "drive.command.interaction");
         const phase = String(latestTask().phase);
         let answer;
         try {
@@ -1624,12 +1626,12 @@ async function driveOneCall(drive) {
             refuse("drive.command.rejected", "drive.command.hold", `execute rejected rather than answered: ${String(error)}`);
         }
         if (isRecord(answer) && answer.status !== "failed") {
-            refuse("drive.command.handling", "drive.command.hold", `the provider applied hold on a ${phase} task: a control on the contact belongs to in-progress or paused, and the adapter is the second gate`);
+            refuse("drive.command.interaction", "drive.command.hold", `the provider applied hold on a ${phase} task: a control on the contact belongs to in-progress or paused, and the adapter is the second gate`);
         }
     };
     if (latestTask().phase === "confirmed") {
         if (offers("hold"))
-            await holdRefusedOutsideHandling();
+            await holdRefusedOutsideInteraction();
         if (await updated(t => t.phase !== "confirmed", "the task leaving confirmed") === undefined)
             return found;
     }
@@ -1655,12 +1657,13 @@ async function driveOneCall(drive) {
     // 3b. The microphone is the host's. With the audio open, the drive mutes it for a moment and
     // reports the leg the provider's record would otherwise miss -- begun, then ended -- and
     // expects each report recorded. If the provider restates the task's record afterwards, the leg is in it.
+    const canonicalTimes = new Map();
     const reportedLegs = [];
     /** The duration the provider's record states for the leg at `at`, as the task stands now. */
     const closedAs = (at) => {
-        const history = latestTask().handlingHistory;
+        const history = latestTask().interactionHistory;
         const leg = isRecord(history) && Array.isArray(history.steps)
-            ? history.steps.find(entry => isRecord(entry) && entry.step === "muted" && entry.at === at) : undefined;
+            ? history.steps.find(entry => isRecord(entry) && entry.step === "muted" && entry.at === canonicalTimes.get(at)) : undefined;
         return typeof leg?.seconds === "number" ? leg.seconds : undefined;
     };
     const canRecordMute = session !== undefined && typeof session.setMuted === "function" && typeof drive.connection.recordStep === "function";
@@ -1668,7 +1671,7 @@ async function driveOneCall(drive) {
         ruleEvaluated("drive.recordStep.rejected", "drive.recordStep.failed");
         // The drive holds its own report to the contract before it crosses, as a host must.
         const leg = { taskId, allocationId: allocationOf(), step: "muted", mutedBy: "host", ...body };
-        const own = validateHandlingReport(leg, "drive.recordStep.report", drive.manifest);
+        const own = validateInteractionReport(leg, "drive.recordStep.report", drive.manifest);
         found.push(...own);
         if (own.length > 0)
             return;
@@ -1680,7 +1683,15 @@ async function driveOneCall(drive) {
             refuse("drive.recordStep.rejected", "drive.recordStep", `recordStep rejected rather than answered: ${String(error)}`);
             return;
         }
-        found.push(...validateResult(answer, "recordStep", "drive.recordStep.result"));
+        const resultErrors = validateResult(answer, "recordStep", "drive.recordStep.result");
+        found.push(...resultErrors);
+        if (!resultErrors.length && isRecord(answer) && answer.status === "recorded" && typeof answer.at === "string" && typeof body.at === "string") {
+            const prior = canonicalTimes.get(body.at);
+            if (prior !== undefined && prior !== answer.at)
+                refuse("drive.recordStep.identity", "drive.recordStep.result.at", "one reported leg must retain its provider-assigned history instant");
+            else
+                canonicalTimes.set(body.at, answer.at);
+        }
         if (isRecord(answer) && answer.status === "failed") {
             refuse("drive.recordStep.failed", "drive.recordStep", `the provider refused to record the host's muted leg: ${String(isRecord(answer.failure) ? answer.failure.code : answer.failure)}`);
         }
@@ -1705,12 +1716,12 @@ async function driveOneCall(drive) {
         await new Promise(resolve => setTimeout(resolve, 1000));
         setMuted(false);
         await report({ at, seconds: Math.round((Date.now() - began) / 1000), ended: true });
-        reportedLegs.push({ at, task: latestTask() });
+        reportedLegs.push({ at: canonicalTimes.get(at), task: latestTask() });
         // 3c. A host reload destroys the adapter object and keeps the login's store. Built again from
         // the same login, a second adapter carries the task and the leg -- from its platform, or from
         // the store -- or it composed the record in memory and the record died with it.
-        if (drive.rebuild !== undefined) {
-            await recordSurvivesReload(at);
+        if (drive.rebuild !== undefined && canonicalTimes.has(at)) {
+            await recordSurvivesReload(canonicalTimes.get(at));
             // A reload that stood no client ends the run: there is nothing left to drive.
             if (!drive.handOver.isLive())
                 return found;
@@ -1761,10 +1772,10 @@ async function driveOneCall(drive) {
                 // record as it stands now is what every later restatement is held to.
                 const before = closedAs(openLeg.at);
                 await report({ at: openLeg.at, seconds: Math.max(1, Math.round((Date.now() - openLeg.began) / 1000)), ended: true });
-                reportedLegs.push({ at: openLeg.at, task: openLeg.task, closedAs: before });
+                reportedLegs.push({ at: canonicalTimes.get(openLeg.at), task: openLeg.task, closedAs: before });
             }
             if (completing !== undefined && offers("hold")) {
-                await holdRefusedOutsideHandling();
+                await holdRefusedOutsideInteraction();
             }
         }
     }
@@ -1787,11 +1798,11 @@ async function driveOneCall(drive) {
             command.disposition = dispositions.codes[0].id;
         }
         if (await send(command) !== undefined) {
-            // applied says the provider has disposed of the task, and its ending follows within the bound
+            // applied says the provider has completed the task, and its ending follows within the bound
             // the manifest stated. Past it the host resyncs: a snapshot still carrying the task is a task
             // held open by a provider that said it was done, and the desk shows it as unsettled.
-            ruleEvaluated("drive.disposal.unsettled");
-            const settle = Number(drive.manifest.disposalSettleMs);
+            ruleEvaluated("drive.completion.unsettled");
+            const settle = Number(drive.manifest.completionSettleMs);
             let unsettled = false;
             const end = await ended({ ms: settle, onExpiry: () => { unsettled = true; } });
             if (end !== undefined)
@@ -1802,11 +1813,11 @@ async function driveOneCall(drive) {
                     resync = await drive.connection.snapshot();
                 }
                 catch (error) {
-                    refuse("drive.command.rejected", "drive.disposal", `snapshot() after an unsettled disposal rejected: ${String(error)}`);
+                    refuse("drive.command.rejected", "drive.completion", `snapshot() after an unsettled completion rejected: ${String(error)}`);
                 }
                 const still = isRecord(resync) && Array.isArray(resync.tasks) && resync.tasks.some(t => isRecord(t) && t.id === taskId && t.allocationId === allocationOf());
-                refuse("drive.disposal.unsettled", "drive.disposal", still
-                    ? `complete was applied and ${settle}ms later the task-ended has not come and a snapshot still carries ${taskId}: applied says the provider disposed of the task, and it has not`
+                refuse("drive.completion.unsettled", "drive.completion", still
+                    ? `complete was applied and ${settle}ms later the task-ended has not come and a snapshot still carries ${taskId}: applied says the provider completed the task, and it has not`
                     : `complete was applied and ${settle}ms later the task-ended has not come; a snapshot no longer carries ${taskId}, so the ending was owed and never sent`);
             }
         }
@@ -1826,10 +1837,12 @@ async function driveOneCall(drive) {
         return latestTask();
     };
     for (const reported of reportedLegs) {
+        if (reported.at === undefined)
+            continue; // A refused/malformed report provides no accepted history identity.
         const published = lastPublished();
         if (published === reported.task)
             continue;
-        const history = published.handlingHistory;
+        const history = published.interactionHistory;
         if (isRecord(history) && Array.isArray(history.steps)) {
             const { at } = reported;
             const leg = history.steps.find(entry => isRecord(entry) && entry.step === "muted" && entry.at === at);
@@ -1856,62 +1869,56 @@ async function driveOneCall(drive) {
 // starting-after-task | in-effect; work ending goes starting-after-task -> in-effect; a denial,
 // a cancel, an end or a release goes back to not-requested; a placed break arrives in-effect
 // with `imposed`. Nothing else is a move the guide describes.
-const COMMITTED = new Set(["starting-after-task", "in-effect"]);
-const BACKWARDS = {
-    "in-effect": ["awaiting-decision", "granted", "starting-after-task"],
-    "starting-after-task": ["awaiting-decision", "granted"],
-    granted: ["awaiting-decision"],
-};
 /** What a stream has said about the agent's break, and the moves it may not make. */
 export class BreakStream {
-    approval;
-    /** Takes the break state a snapshot carries as the point the stream continues from. */
+    state;
+    recovery = true;
+    /** True until a validated authoritative snapshot establishes a usable baseline. */
+    get needsRecovery() { return this.recovery; }
+    /** Caller establishes snapshot freshness/login scope separately; malformed state never replaces the baseline. */
     seed(snapshot) {
         const state = isRecord(snapshot) ? snapshot.break : undefined;
-        this.approval = isRecord(state) && typeof state.approval === "string" ? state.approval : undefined;
+        const found = validateBreakTransition(state, state, "snapshot.break");
+        if (found.length) {
+            this.recovery = true;
+            return found;
+        }
+        this.state = state;
+        this.recovery = false;
+        return [];
     }
-    /** Applies one envelope and returns the moves it may not make given where the break stood. */
+    /** Rejected transitions keep accepted state and require snapshot recovery before further deltas. */
     apply(envelope, path = "event") {
-        const found = [];
         const event = isRecord(envelope) ? envelope.event : undefined;
         if (!isRecord(event))
-            return found;
-        if (event.type === "snapshot") {
-            this.seed(event.snapshot);
-            return found;
-        }
-        if (event.type !== "break-state" || !isRecord(event.break) || typeof event.break.approval !== "string")
-            return found;
-        const from = this.approval;
-        const to = event.break.approval;
-        const at = `${path}.event.break.approval`;
-        if (from !== undefined) {
-            // A commit's states need a grant behind them. A placed break is the one arrival in a
-            // committed state that nobody asked for -- in effect at once, or starting-after-task while
-            // the member finishes a call -- and it says so with `imposed`.
-            if (COMMITTED.has(to) && (from === "not-requested" || from === "awaiting-decision") && event.break.imposed === undefined) {
-                found.push({ rule: "stream.breakState.commitBeforeGrant", path: at,
-                    message: `${to} follows a commit, and a commit follows granted; the break stood at ${from}` });
-            }
-            if ((BACKWARDS[from] ?? []).includes(to)) {
-                found.push({ rule: "stream.breakState.backwards", path: at,
-                    message: `a break does not go from ${from} back to ${to}; a new request passes through not-requested` });
-            }
+            return [];
+        if (event.type === "transport-status" && event.status !== "active") {
+            this.recovery = true;
+            return [];
         }
-        this.approval = to;
+        if (event.type === "snapshot")
+            return this.seed(event.snapshot);
+        if (event.type !== "break-state")
+            return [];
+        if (this.recovery)
+            return [{ rule: "stream.breakState.baseline", path: `${path}.event.break`,
+                    message: "a validated authoritative snapshot is required before accepting break updates" }];
+        const found = validateBreakTransition(this.state, event.break, `${path}.event.break`);
+        if (found.length)
+            this.recovery = true;
+        else
+            this.state = event.break;
         return found;
     }
 }
 /**
- * A break follows its requests. Given a provider's stream -- optionally seeded with the snapshot
- * it began from -- every `break-state` moves the way the guide describes: a commit's states only
+ * A break follows its requests. Given a provider's stream -- seeded with its initial snapshot,
+ * either supplied separately or carried by a snapshot event -- every `break-state` moves the way the guide describes: a commit's states only
  * after a grant, never backwards, and a break placed on the agent arriving in effect with `imposed`.
  */
 export function assertBreakFollowsItsRequests(envelopes, snapshot) {
     const stream = new BreakStream();
-    if (snapshot !== undefined)
-        stream.seed(snapshot);
-    const found = [];
+    const found = snapshot === undefined ? [] : stream.seed(snapshot);
     envelopes.forEach((envelope, index) => found.push(...stream.apply(envelope, `envelopes[${index}]`)));
     assertNoViolations(found, "A break follows its requests");
 }

package/dist/validation.d.ts

@@ -22,6 +22,13 @@ export declare function validateScheduledActivity(activity: unknown, path?: stri
  * on voice, absent elsewhere.
  */
 export declare function validatePhone(value: unknown, manifest: unknown, path?: string): ProtocolViolation[];
+/** Undefined explicitly means unavailable; a returned estimate is not a clock guarantee. */
+export declare function validateProviderTimeEstimate(value: unknown, scope: unknown, path?: string): ProtocolViolation[];
+/** Validate host-local periodic clock-check configuration. Omission disables checking. */
+export declare function validateProviderTimeCheckPolicy(value: unknown, path?: string): ProtocolViolation[];
+export declare function validateProviderTimeCheckRequest(value: unknown, path?: string): ProtocolViolation[];
+/** Checks response shape/correlation, not source-clock accuracy, round-trip delay or freshness. */
+export declare function validateProviderTimeCheckResult(value: unknown, request: unknown, loginId: string, path?: string): ProtocolViolation[];
 export declare function validateManifest(manifest: unknown, path?: string): ProtocolViolation[];
 export interface TaskValidationContext {
     /** The provider's channel, from its manifest. A task must agree with it. */
@@ -40,6 +47,30 @@ export interface TaskValidationContext {
     locked?: readonly string[];
 }
 export declare function validateTask(task: unknown, context: TaskValidationContext, path?: string): ProtocolViolation[];
+/** Checks break status against the full currently retained task set, after a transaction. */
+export declare function validateBreakStatus(state: unknown, tasks: unknown, path?: string): ProtocolViolation[];
+/**
+ * Checks lead break dispatch using current authentication, transport, roster (`team`) and,
+ * for place/release, the target's full `memberBreak`. The provider must authorize the target
+ * and recheck the decision atomically; a roster is not authority to act after it has changed.
+ */
+export declare function validateTeamBreakCommand(request: unknown, context: unknown, path?: string): ProtocolViolation[];
+/** The four agent break methods; this is a validation API, not a wire command. */
+export type BreakMethod = "requestBreak" | "commitBreak" | "cancelBreak" | "endBreak";
+/**
+ * Validate immediately before dispatch against current provider state. Context must contain
+ * the current authentication and transport. This cannot fence a concurrent backend change;
+ * the provider must recheck atomically. Result validation never replaces authoritative state.
+ */
+export declare function validateBreakCommand(method: BreakMethod, request: unknown, state: unknown, context: unknown, path?: string): ProtocolViolation[];
+/**
+ * Checks two complete break states within one provider/login's ordered event stream.
+ * Call before replacing accepted state; report violations and reconcile on failure.
+ * This is not a freshness check: validate a fresh authoritative snapshot separately and
+ * use it as a new baseline, never as an event transition. Source ordering and connection
+ * fencing remain required; neither timestamps nor approval rank identify a break attempt.
+ */
+export declare function validateBreakTransition(before: unknown, after: unknown, path?: string): ProtocolViolation[];
 /**
  * Who is reading what the adapter published, and what their login declares. The validators check
  * structure without it; given it, they also hold what the adapter publishes to the login.
@@ -91,8 +122,10 @@ export declare function validateHostGuarantees(guarantees: unknown, path?: strin
  * a task, a step, when it began, how long so far if the host says, and an explicit end that
  * carries the final duration.
  */
-export declare function validateHandlingReport(report: unknown, path?: string, manifest?: unknown): ProtocolViolation[];
+export declare function validateInteractionReport(report: unknown, path?: string, manifest?: unknown): ProtocolViolation[];
 export declare function validateHostReport(report: unknown, path?: string): ProtocolViolation[];
+/** Validate the exact interaction/allocation target before provider command dispatch. */
+export declare function validateTaskCommandRequest(request: unknown, task: unknown, path?: string, taskContext?: Omit<TaskValidationContext, "channel">): ProtocolViolation[];
 /**
  * What a command needs to be issuable, checked against the task it names: the capability the
  * guide's table gates it on, the phase it belongs to, and the state that has to stand -- a