approval-md 0.4.5 → 0.4.7

package/SPEC.md

@@ -135,6 +135,8 @@ channels:
 
 **The `delegation` block is reserved.** A policy MAY carry one top-level `delegation` block with the keys `model` (null, or a judge identity `model:<name>@<major>.<minor>.<patch>`), `classes` (exact keys of `classes`), `max_autonomy` (`manual`, `supervised-live` or `supervised-retro`; absent means `manual`), `daily_cap` (an integer from 0 to 1000; absent means 0), `escalate_on` (a subset of `deny`, `low_confidence`, `irreversible`, `unknown_class`), `advice` (boolean; absent means false) and `reviewers` (`human:<approver id>` or `model:<name>@<version>`). Implementations MUST validate the block's relationships to the rest of the file and fail the policy closed when one does not hold: every `classes` entry is an exact key of `classes` whose declared autonomy is neither `human-only` nor `autonomous`; every listed class declares an autonomy at least as strict as `max_autonomy` (a pin between the block and the class rows, so loosening a delegated row without rewriting the block fails the load); a `daily_cap` above 0 requires `escalate_on` to contain `irreversible` and `unknown_class`; a `model:` reviewer equals `model`; a `human:` reviewer names a key of `approvers`; and `advice: true`, a cap above 0 or a `model:` reviewer requires `model`. An implementation that does not implement delegation MUST load the block only when every key is absent or at its off value (`model: null`, `classes: []`, `max_autonomy: manual`, `daily_cap: 0`, `escalate_on: []`, `advice: false`, `reviewers: []`), where it changes nothing, and MUST refuse any other value with the load code `delegation-not-supported`, so the policy resolves every class `manual`. When a block both breaks one of the relationship rules above and is switched on, the relationship rule wins and the load fails `schema-invalid`: `delegation-not-supported` is answered only for a block that is well-formed and switched on. A setting its author believes is in force is never silently ignored. Delegation never changes a class's autonomy; it changes who may supply a decision or a review. (Amended APRV-500, pending sign-off.)
 
+**The `exec` block opens opaque code (proposed).** A policy MAY carry one top-level `exec` block whose only member is `code`, with two keys: `custody` (`attested` or `unattested`) and `execute_code` (`hooked` or `unhooked`). An absent key is the closed answer. `exec.code.custody: attested` opens the `exec.code` class of §7; `exec.code.execute_code: hooked`, beside it, opens a harness tool that runs a program in-process. Any other key or value fails the policy closed at the schema, and so does the block on a core that predates it, which makes the rollout order core first, policy second. (Amended APRV-510, pending sign-off.)
+
 ### 5.2 Policy semantics
 
 - **Matching.** Classes match most-specific-first; `*` is a single-segment wildcard, a trailing `.*` matches any depth. An action whose class matches no rule takes `defaults.autonomy`. Implementations MUST fail closed: unparseable policy means everything is `manual`. A trailing `.*` consumes one or more segments: `read.*` matches `read.web` and `read.web.page`, and it does not match the bare class `read`. The schema admits `read` and `read.*` as two distinct keys a policy may list separately with different autonomy, so neither is an alias of the other, and a policy that wants the bare class covered writes it as its own rule or leaves it to `defaults.autonomy`. A bare `*` is a single-segment wildcard rather than a trailing one, so it matches any one-segment class and nothing deeper, and `*.*` matches any class of two or more segments. (Amended APRV-137.)
@@ -155,7 +157,7 @@ channels:
 - **Request-volume limits.** `limits.max_pending` (per class or global): maximum simultaneously pending requests; further requests are refused at intake with reason `queue-full`. `limits.requests_per_hour` (per origin): rolling-window ceiling on request creation; excess is refused with reason `rate-limited` and logged. Defaults are generous; the purpose is a tripwire against queue-flooding and approver fatigue, which attack the human's attention rather than the action budget. Refused requests consume no budget and no attention beyond the log line. (Policy vocabulary in v0.1; enforcement lands with M4/M5.)
 - **Agents MUST NOT be able to modify `APPROVAL.md`, the log, or channel credentials.** The reference runtime refuses to mint tokens if the policy file's mtime/hash changed without a signed `policy.updated` event from a human session. Attestation makes this mechanical: a human runs `approval policy attest`, which appends a `policy.updated` event carrying the SHA-256 of the policy file's bytes. Gate operations — request intake, grant recording, token minting — MUST refuse, with a distinct machine-readable reason, whenever the live file's hash differs from the latest attestation or no attestation exists. An edited policy is inoperative until a human re-attests it. Attestation also names the rules a decision was made under: gate-written `approval.requested` and `approval.granted` events carry `policy_sha256`, the attested hash in force when the runtime evaluated them. The field is assigned at the write boundary exactly as `ts` is (§8): no caller can supply it, and a value arriving from outside the runtime is refused. When the hash in force at grant time differs from the hash recorded on the matching request, the grant MUST refuse with its own reason, `policy-drift`, distinct from the unattested-file refusal above: the file is attested and is a different policy, so the pending request is void and must be re-requested under the rules now in force. The field is additive per §8: records written before it existed still validate and verify, and a verifier accepts both forms. (Amended APRV-118.)
 - **An attestation stores the bytes it attests.** An attestation records a digest, and a digest alone cannot produce the file it names, so a reader asking what the policy IN FORCE actually says has nothing to read. That matters wherever a rule has to be decided against the policy in force rather than against the one being proposed, which is exactly the privileged-gesture rule of §10.3: whoever edited a proposed file must not be able to map their own account as the one entitled to attest it. Every attestation — at a terminal and from a channel alike — MUST therefore store the attested text in the payload store of §10.4 and bind its hash on the `policy.updated` record it appends, and an implementation that cannot store those bytes MUST refuse the attestation rather than append a record whose bytes are unrecoverable. A reader recovering the text MUST re-hash it against the attested digest from the verified log and MUST treat a mismatch as unrecoverable, so the store is checked rather than trusted. The bytes of the policy currently in force are not prunable under `payload_retention` at any age, for the reason a live approval's material is not: something in force binds them. A chain attested before an implementation adopted this rule carries no such binding, and a reader MUST keep its fail-closed answer for that case rather than assume. (APRV-356.)
-- **Attestation of the gate's organs.** The organs are the harness files that install the enforcement hook (`.claude/settings*`, `.cursor/hooks.json`, `.cursor/hooks/`, `.cursor/agents/`, `.codex/hooks.json`, `.codex/hooks/`, `.codex/config.toml`): the `policy.core` surface outside the approval home and outside the policy file itself. Three organs are not repository-relative: a Hermes Agent home's `$HERMES_HOME/config.yaml`, `$HERMES_HOME/agent-hooks/` and `$HERMES_HOME/shell-hooks-allowlist.json`, with `$HERMES_HOME/.env` and `$HERMES_HOME/auth.json` beside them, a read of which classifies `account.credential`. Their protection is conditional on the spelling: the classifier recognises them by a `.hermes` path segment, so a home whose last segment is spelled otherwise is not protected, and the set is not closed under every `HERMES_HOME`. (Amended APRV-415.) A human attests one by content, exactly as they attest the policy file, with `approval policy attest --organ <path>`, which appends a `gate.organ.attested` event carrying the file's repository-relative path and the SHA-256 of its bytes. The verb is human-only, one path per call, and the digest is computed by the runtime from the file on disk: a caller who could supply the hash could attest bytes nobody read. The organs need this because they are `policy.core` and a policy may resolve `policy.core` to `human-only`, in which case the gate mints no record of any kind for a change to one (§11.1 invariant 9), so grant-shaped evidence for a hand edit cannot exist however carefully the edit was made. What reads these records is the after-the-fact enforcement of §10.1: a checker requiring evidence that a human saw a protected change accepts an organ whose bytes at the commit under review hash to a digest attested FOR THAT SAME PATH, and a digest attested for another path is not evidence. What does NOT read them is the gate: an organ attestation MUST NOT make an unattested policy operative, MUST NOT alter the `policy_sha256` a request or a grant is decided under, and MUST NOT satisfy any check about the policy file. Implementations SHOULD discharge that structurally, by giving the organ record its own event type, rather than by filtering a shared one in every reader. (APRV-272.)
+- **Attestation of the gate's organs.** The organs are the harness files that install the enforcement hook (`.claude/settings*`, `.cursor/hooks.json`, `.cursor/hooks/`, `.cursor/agents/`, `.codex/hooks.json`, `.codex/hooks/`, `.codex/config.toml`): the `policy.core` surface outside the approval home and outside the policy file itself. Five organs are not repository-relative: a Hermes Agent home's `$HERMES_HOME/config.yaml`, `$HERMES_HOME/agent-hooks/`, `$HERMES_HOME/shell-hooks-allowlist.json`, `$HERMES_HOME/hermes-agent/` (the runtime's source install) and `$HERMES_HOME/plugins/` (where its plugins load from), with `$HERMES_HOME/.env`, `$HERMES_HOME/.op.env`, `$HERMES_HOME/auth.json` and `$HERMES_HOME/hermes-agent/.env` beside them, a read of which classifies `account.credential`. (Amended APRV-511, pending sign-off.) Their protection is conditional on the spelling: the classifier recognises them by a `.hermes` path segment (in any case), by an unexpanded `$HERMES_HOME`, and, for the organ and credential rows only, by any other unexpanded variable or command substitution that may stand for the home, so a home whose last segment is spelled otherwise is not protected, and the set is not closed under every `HERMES_HOME`. (Amended APRV-415.) A human attests one by content, exactly as they attest the policy file, with `approval policy attest --organ <path>`, which appends a `gate.organ.attested` event carrying the file's repository-relative path and the SHA-256 of its bytes. The verb is human-only, one path per call, and the digest is computed by the runtime from the file on disk: a caller who could supply the hash could attest bytes nobody read. The organs need this because they are `policy.core` and a policy may resolve `policy.core` to `human-only`, in which case the gate mints no record of any kind for a change to one (§11.1 invariant 9), so grant-shaped evidence for a hand edit cannot exist however carefully the edit was made. What reads these records is the after-the-fact enforcement of §10.1: a checker requiring evidence that a human saw a protected change accepts an organ whose bytes at the commit under review hash to a digest attested FOR THAT SAME PATH, and a digest attested for another path is not evidence. What does NOT read them is the gate: an organ attestation MUST NOT make an unattested policy operative, MUST NOT alter the `policy_sha256` a request or a grant is decided under, and MUST NOT satisfy any check about the policy file. Implementations SHOULD discharge that structurally, by giving the organ record its own event type, rather than by filtering a shared one in every reader. (APRV-272.)
 - **Sign-off on a protected path.** A protected path is a file whose edit classifies `policy.edit` or one of its sub-classes: the built-in prose and configuration set, plus everything `protected_paths` widens to. A human signs one off by content with `approval policy attest --path <path>`, which appends a `gate.path.signed_off` event carrying the file's repository-relative path and the SHA-256 of its bytes. The verb is human-only, takes one path per call, and the digest is computed by the runtime from the file on disk, for the reasons the organ attestation above carries: a caller who could supply the hash could ratify bytes nobody read. This record is what RESOLVES the amendment-provenance suffix stated at the head of this document. Text that reached a protected file without a grant carries `(Amended APRV-n, pending sign-off.)` and holds no more authority than a proposal until a human ratifies it; a sign-off over that file's exact bytes is the ratification, and until one exists the suffix stands. It is WHOLE-FILE evidence, and therefore weaker than a grant, which binds the exact change a human was shown. Two rules follow, and both are normative. The after-the-fact enforcement of §10.1 MUST consult a sign-off only after its search for authorization covering the change has failed, and MUST state in its finding that the verdict rests on whole-file evidence; a change some authorization does cover passes on that authorization and names it. And a sign-off is appropriate only for ratifying text a human has READ at that commit: it answers for an edit the gate never saw, and it is never a substitute for taking an edit to the gate while one still can be. The three content records stay distinct, on the reasoning the organ bullet gives: the policy file is `policy.updated`, an organ is `gate.organ.attested`, a protected path is `gate.path.signed_off`, no reader of one may be answered by another, and the verb MUST refuse the policy file, every `policy.core` surface and the log directory, each with its own machine-readable code. (APRV-338.)
 - **`payload_retention`.** An optional top-level duration bounding how long the payload bytes in `.approval/payloads/` (§9) are kept. A payload is prunable once the action it is bound to has been in a terminal state (`executed`, `rejected`, `expired`, `revoked`) for longer than the duration. A payload whose action is not terminal is never prunable, at any age: a pending or granted approval binds to those exact bytes, and discarding them would leave a live authorization pointing at nothing. When the key is present, orphaned payloads (bytes with no recorded binding) are prunable at any age: the duration governs bound payloads and does not gate residue nothing ever bound. When the key is absent, the pruning subsystem does not run and nothing is deleted, orphaned or not; the store holds the material evidence of what a human approved, so forgetting anything is an operator's explicit choice, and an operator who never made that choice never asked the runtime to delete anything (amended APRV-49 to match the enforcement shipped in APRV-41). Pruning is performed by the daemon and by nothing else, and each removal appends a `payload.pruned` event, so a log states what its store no longer holds. The bytes an attestation binds (§5.2, §10.4) are never prunable while that attestation is the one in force: they are not bound to an action and have no terminal state, and the policy in force binds them exactly as a live approval binds its own material. (Policy vocabulary in v0.1; enforcement lands with the M5 daemon. The attestation sentence is APRV-356.)
 - **`protected_paths`.** An optional top-level list widening the set of files whose edit is classified `policy.edit`, so a project can put its own governing documents (a specification, a constitution, a design directory) behind the gate that already stands in front of `APPROVAL.md`. Entries are repo-relative and literal: an exact file path (`SPEC.md`, `docs/constitution.md`) or a directory prefix ending in `/` (`design/`). Globs, negation, absolute paths and `..` segments are schema violations, because a pattern language the runtime half-implemented would leave an author believing a file is gated when it is not. Matching is by path segments and never resolves against a checkout, so a linked worktree and the primary answer alike: an exact path matches a candidate whose trailing segments are that path (a single-segment entry therefore matches that filename in any directory, exactly as the built-in filenames do), and a directory prefix matches a candidate containing those segments as a contiguous run. The key is ADDITIVE and can only widen: the runtime's built-in protected set (the policy file, the agent instruction files, the approval home, the harness settings, the release configuration) stays protected whatever this list says or omits, and a policy that fails to load leaves those built-ins in force while every class resolves to `manual`. (Amended APRV-107.) Every path a policy adds is `policy.edit`: a policy widening its own protected surface is naming prose and configuration, and cannot mint authority over the gate's organs, whose classes the runtime fixes. (Amended APRV-198.)
@@ -300,7 +302,7 @@ The developer-workstation namespaces below are reserved alongside them. They nam
 | `vcs.*` | `.commit.branch`, `.push.branch`, `.push.main`, `.history.rewrite`, `.ref.delete` | autonomous for branch commits and pushes; supervised for the trunk; manual for history rewrites and for remote ref deletion |
 | `deps.*` | `.add`, `.upgrade`, `.remove` | manual: a dependency change is a supply-chain decision |
 | `release.*` | `.publish`, `.tag`, `.version` | manual, always |
-| `exec.*` | `.local` (tests, lint, build, scripts inside the workspace) | autonomous |
+| `exec.*` | `.local` (tests, lint, build, scripts inside the workspace), `.code` (an opaque program: inline source or an interpreter running a file that is not a skill script; closed unless the attested policy attests credential custody) | autonomous for `.local`; `.code` as the policy says once opened (Amended APRV-510, pending sign-off.) |
 | `network.*` | `.call` (any request beyond package installs) | manual |
 | `policy.*` | `.edit` (agent instructions, CI and release configuration, and the paths a policy protects), `.core` (the policy file itself and the gate's own directory, minus its log) | manual, always; a policy MAY declare `.core` human-only |
 | `log.*` | `.sync`, `.advance` (section 10.1), `.mutate` (any write, redirect, append, truncation or rename aimed at the log directory) | manual, always; a policy MAY declare `.mutate` human-only |
@@ -315,6 +317,8 @@ The `policy.*` split is by consequence rather than by file type. `policy.edit` i
 
 `vcs.ref.delete` is the deletion of a remote ref: `git push <remote> --delete <ref>`, the `-d` spelling, the colon refspec (`:refs/heads/x`, `:x`), and the bulk forms that mix several. It is separate from `vcs.push.main` because a push and a deletion are different acts, and a policy that sampled trunk pushes retrospectively was thereby sampling irreversible removals: a push adds commits that remain visible, while a deletion removes the only name an unmerged branch had, and the reflog that could recover it sits on a server the acting party cannot reach. It is separate from `vcs.history.rewrite`, which guards shared history that is being moved rather than removed. An implementation that offers the class MUST bind the ref names it matched to the classified action, MUST keep a force push in `vcs.history.rewrite` even when the same command deletes, and MUST NOT use the class to loosen a deletion that already takes a stricter one: a tag deletion stays `release.publish` wherever a tag push does, and a deletion whose refs the text cannot read stays in the class with nothing bound rather than falling back to a push class (§11.1, fail closed). A policy that declares no line for the class resolves it by `defaults.autonomy` like any other, so adopting it is an explicit act. (Amended APRV-352.)
 
+`exec.code` is an opaque program an agent runs: an inline program (`python3 -c`, `node -e`, `deno eval` and kin) or an interpreter running a file that is not a skill script. Its effect is unreadable from the text, so an implementation MUST refuse it before policy unless the attested policy declares `exec.code.custody: attested` (§5.2), the operator's statement that credential custody is in place; a policy that never names the class MUST see the refusals it saw before the class existed, unchanged. Once opened, the class resolves like any other. A record of it MUST bind the program's SHA-256 and length and MUST NOT carry the program's text (§11.1 invariant 3), and it records that the program existed, never what it did: it authorizes nothing the program then does through other tools, each of which is its own gated call, and an implementation MUST NOT present it as containment. A harness tool that runs a program in-process (Hermes `execute_code`) MAY be classified `exec.code` only under a second declaration (`exec.code.execute_code: hooked`) that records the operator's acceptance that the harness re-fires its hook for tool calls made inside the program. Shell wrappers (`bash -c`, `sh -c`), `eval`, a program read from stdin, and a program word the shell would still change are outside the class, and an open window does not reach it. (Amended APRV-510, pending sign-off.)
+
 `files.delete.out_of_scope` (destructive deletes outside the task's stated scope, inside the workspace) sits under the existing `files` namespace at manual; `data.delete` remains the class for deletes outside the workspace.
 
 | Namespace | Examples | Default gravity |
@@ -355,6 +359,7 @@ For `record.*` classes, grant means adoption: the action proposes a write to a s
 - **The writing daemon.** A record appended by a daemon MAY carry `daemon`, the id of the daemon instance that wrote it, so that a log hosted by one party for another states which host process acted. The value is the id declared in that process's launch environment or one derived from the instance the log belongs to; it is stamped by the runtime at the write boundary and is never a caller's parameter. It is OPTIONAL and additive: a record written without it validates and verifies unchanged, and its absence is absence rather than a claim that no daemon wrote the record. An implementation MAY let an attested policy list the ids permitted to append (`daemons`, §5.2) and MUST then refuse an append from an unlisted id at the write boundary with a distinct code (`daemon-not-allowed` in the reference runtime), leaving the file byte-identical. The id is self-reported, so §11.1 invariant 4 binds it completely: an implementation MUST NOT let a listed id reduce any scrutiny, and MUST NOT read the field as an input to a verdict, an autonomy, a budget, a floor, a sampling draw or a token. (Amended APRV-383.)
 - **The policy a harness start was resolved under.** An `execution.started` that a harness path records (`execution: "harness"`) carries `payload.policy_sha256`, the SHA-256 of the attested policy bytes the write boundary re-checked the action's class against when it recorded the start, taken from the same attestation check and the same single read of the policy file that the write boundary's class resolution used. The runtime writes it at the write boundary, as it writes `ts`, and no caller parameter, option or field of the action's payload supplies it; a value of that name arriving by any of those routes is ignored. A start under a policy that is not attested, or whose bytes changed since attestation, is refused before anything is appended, so no stamp names bytes nobody attested. A policy-authorized start (autonomous, supervised, an unselected supervised-live draw) has no other record naming its policy, and the field lets a reader of the start alone say which rules were in force when it was recorded. A granted start, which could already recover its policy through `grant_seq`, carries it from the same code path, and there it equals the grant's own pin wherever the grant carries one, since a spend under a different attested policy is refused `policy-drift`. Where a harness adapter computes its verdict from an earlier read of the policy than the write boundary's, a re-attestation between the two leaves the stamp naming the policy in force at the append; an implementation SHOULD carry the verdict's attested hash to the write boundary and refuse a mismatch. It authorizes nothing: no verdict, budget, draw, loop floor or refusal reads it back, so §11.1 invariant 4 is untouched. It is covered by the record hash like every other payload field. It is OPTIONAL and additive: every record written before the field existed still validates and still verifies, a start written by a non-harness path (`approval run`, an adapter's `act`) records none at v0.1, and a reader treats absence as the pre-amendment behaviour, reconstructing the policy from the latest `policy.updated` before the record's seq. (Amended APRV-447.)
 - A harness `execution.started` whose class came from the policy's tool mapping (a `tools` entry, or `harness.tool.unmapped`) MAY carry `payload.harness_tool`, the tool name, so that several tools sharing one class remain distinguishable. It is the name only: the call's arguments are bound by `payload_hash` and MUST NOT be written to the log. (Amended APRV-499, pending sign-off.)
+- **The study record.** An `approval.rejected` MAY carry `payload.study`, which says why a study denied a request; no other event may carry it. It is a closed object whose `reason` is one of two values. `study_withdrawn` means a hosted operator withdrew a still-pending request before it could run: the record names the operator as `operator` (8 lowercase hex: a pseudonymous id the operator's control plane derives from the staff email with a key it alone holds, never the email, so a list of staff emails cannot reverse it) and the withdraw's replay reference as `ref`, its `actor` is `human:study-team` and its `channel` is `study`, so a reader can always tell it from a person's own answer. `looks_wrong` means the approver flagged the card as a suspected study card and denied it: it is the approver's ordinary reject on `telegram`, under the actor the sender mapping resolved, with no `operator` and no `ref`. A hosted operator may DENY a pending request, never grant, alter or reopen one, and the record names it: the field exists on the one decision that denies, a request that is not pending cannot be withdrawn, and a decision surface may write only `looks_wrong` (any other reason is refused `study-reason-not-channel`, §11.2, and nothing is appended). It is a record and never an input: no enforcement path reads it, budgets charge nothing for it as for any reject, and a reader that ignores it reads an ordinary rejection. (Amended APRV-528, pending attestation.)
 - Events MUST validate against the JSON Schemas in `schema/` before append. Validation at the write boundary is itself a control: an agent physically cannot request execution without declaring a class, key, and cost estimate.
 - Every record MUST carry an explicit hash-scheme identifier, `alg`. Version 0.1 defines exactly one value: `sha256/jcs`, meaning SHA-256 over the RFC 8785 (JCS) canonical serialization of the record with `prev` included. Verifiers MUST reject records whose `alg` is missing or unrecognized. Records with different `alg` values MAY coexist in one log, so a future scheme change is a migration, never a schism.
 - Actor identifiers use exactly three prefixes: `human:` for decisions made by a person, `agent:` for actions proposed or performed by an agent, and `system:` for runtime-originated events such as `approval.expired`. Verifiers MUST reject unrecognized prefixes.
@@ -685,7 +690,7 @@ The following hold across every surface of the runtime. They are implicit accept
 
 Invariant 6 above freezes six refusal unions as public API and pins each with a test. It does not say what any member means, and a frozen vocabulary whose triggers are folklore is a vocabulary a second implementation has to guess at. This registry states, for every member of every union, the condition under which that member fires. It is normative, and it is the source the conformance suite's `failure_class` assignments are drawn from (§13): a refusal for the wrong reason is a conformance failure, so the mapping has to live somewhere other than in the reference implementation's source. (Amended APRV-137.)
 
-This registry covers the six gate-facing unions. A verb-local refusal union outside them is still bound by invariant 6: it is exported, frozen, and pinned by a test in the verb's own suite. (Amended APRV-215.) It also covers `channel_decision_refusal_codes`, which is not gate-facing and is registered here anyway: the refusals a decision surface makes are answers a human reads on their phone, and a vocabulary a second implementation has to guess at is exactly what this registry exists to stop. (Amended APRV-324.) It also covers `relay_refusal_codes` (amended APRV-455): the authenticated relay is a transport whose other end is a second implementation (an operator's control plane) that branches on these strings.
+This registry covers the six gate-facing unions. A verb-local refusal union outside them is still bound by invariant 6: it is exported, frozen, and pinned by a test in the verb's own suite. (Amended APRV-215.) It also covers `channel_decision_refusal_codes`, which is not gate-facing and is registered here anyway: the refusals a decision surface makes are answers a human reads on their phone, and a vocabulary a second implementation has to guess at is exactly what this registry exists to stop. (Amended APRV-324.) It also covers `relay_refusal_codes` (amended APRV-455): the authenticated relay is a transport whose other end is a second implementation (an operator's control plane) that branches on these strings. It also covers `study_withdraw_refusal_codes` (amended APRV-527, the study record), for the same reason: the study operator's withdraw is run on the box by that control plane.
 
 Three properties bind the whole registry. A code fires for exactly the condition named and never as a catch-all. Where two conditions could both apply, the order in which an implementation evaluates them is itself normative and is stated with the condition. And a refusal leaves the log untouched unless its row says otherwise: `budget-exceeded` appends a `budget.exceeded` record beside its refusal, `expired` materialises the `approval.expired` record a reader could already derive, and nothing else writes. (Amended APRV-137.)
 
@@ -813,6 +818,7 @@ Three properties bind the whole registry. A code fires for exactly the condition
 | `sender-ambiguous` | The policy in force maps the supplied sender to more than one approver. A policy carrying this does not load (§5.2), so the code is reachable only where a caller supplies a policy that never passed a load; the runtime refuses rather than choosing between two people, and appends the same single audit record. |
 | `sender-key-unavailable` | The attested policy maps that channel's senders in the KEYED form of §5.2 and the deciding process holds no key, so no digest can be computed and no account on the channel can be resolved. It refuses the WHOLE channel, including entries written raw beside keyed ones: the roster's ambiguity check cannot be run over a half nobody can read, and ambiguity resolves to the stricter path (§11.1). An implementation MUST NOT fall back to comparing the observed id against the raw entries. Distinct from `sender-unmapped`, which says the policy answered and did not name this account; this says nothing about the account and everything about the process, and its repair is the key in the environment rather than an amendment. The same single `audit.decision_refused` is appended, carrying the observed id in the RAW form, because there is no key to hash it with and a record naming no account at all would leave an operator unable to say who was in front of a gate that had lost its key. (Amended APRV-370.) |
 | `attest-requires-terminal` | An attestation answer arrived with a sender, and the policy IN FORCE cannot say whether that account may sign for this amendment: either its bytes are not recoverable (an attestation records only their digest), or the amendment changes the `senders` mapping and the policy in force maps no sender for this channel. Attestation answers alone; evaluated before the answer is recorded, so nothing is attested and nothing is declined. The repair is a terminal, which supplies no sender. It is distinct from `sender-unmapped`, which says the policy in force answered and did not name this account. |
+| `study-reason-not-channel` | A decision surface reported a gesture carrying a study reason other than `looks_wrong` (§8, the study record). A channel may flag an approver's deny `looks_wrong` and nothing else; `study_withdrawn` is written only by the study operator's withdraw path. Evaluated before the gate's verbs and before any sender is resolved, so nothing is decided and nothing is appended. (Amended APRV-528.) |
 
 **`relay_refusal_codes`** — every way the authenticated relay (`approval channel relay`, §10.3) can refuse a post, in evaluation order: secret, duplicate header, URL, path, method, body size, JSON, shape, sender, freshness, nonce, then the gesture. None appends to the log. (Amended APRV-455.)
 
@@ -833,6 +839,14 @@ Three properties bind the whole registry. A code fires for exactly the condition
 | `relay-policy-mismatch` | `propose` names a hash that is not the policy file on disk. HTTP 409. |
 | `relay-handler-failed` | Applying the gesture threw. HTTP 500. |
 
+**`study_withdraw_refusal_codes`** — every way the study operator's withdraw (`approval study withdraw`, §8 the study record) refuses on its own, in evaluation order: the switch, then the replay of the same `ref` (which answers success, appending nothing), then the request's state, then the gate. Only `not-pending` writes, and only as its row says: the study team's too-late attempt is a decision a person made, so it is put on the record as `approval reject`'s is. A log that cannot be read or written reaches the caller under the gate's own code, appends nothing, and is not a member here. Registered for the reason `relay_refusal_codes` is: the control plane that runs the verb on the box is a second implementation that branches on these strings. (Amended APRV-527, pending attestation.)
+
+| code | fires when |
+|---|---|
+| `study-mode-off` | The process was not launched with `APPROVAL_STUDY_MODE` exactly `1`. Evaluated before the log is read; the switch is never read from a policy. |
+| `not-pending` | The request named is not awaiting a decision at this instant (granted, rejected, revoked, expired, withdrawn, or never requested), or the gate refused the deny because the request stopped being decidable between the read and the append (a person answered it first). The gate's own code rides beside it (`already-decided`, `expired`, `request-withdrawn`, or what the gate answered). An action ref that names no pending request but exactly one settled one names that request. A study withdrawal never alters, reopens or repeats a decision. When the request exists, the refusal appends ONE `audit.decision_refused` (§5.2) naming `human:study-team` on channel `study` and the gate's code, and on the gate's own refusal it may also leave the lazy `approval.expired` under the preamble's rule; when no request is named, it appends nothing. Before writing, a refusal after the gate re-reads the log: if the same `ref` withdrew the request in the window (a concurrent retry), the answer is the replay's success and nothing is appended. |
+| `action-ref-ambiguous` | The request was named by its action ref (the first 12 hex of the SHA-256 of its key) and more than one pending request carries that ref. Nothing is decided. |
+
 **`append_error_codes`** — every way the write boundary itself can refuse an append, in definition order. Every one of them leaves the file byte-identical. (Amended APRV-137.)
 
 | code | fires when |
@@ -863,6 +877,13 @@ Three properties bind the whole registry. A code fires for exactly the condition
 | `log-corrupt` | The chain does not verify. |
 | `append-failed` | The write boundary refused the record; the writer's own code rides in the detail. |
 
+**Harness-hook refusals for `exec.code`** (Amended APRV-510, pending sign-off). Two members of the harness hook's deny vocabulary, registered here because a second implementation of the class has to produce the same split. Evaluated after classification: a policy that does not name `exec.code` (no `exec` block and no exact `exec.code` class key) gets the refusal the command got before the class existed (`hook-opaque`, `hook-unclassified`, or Hermes's `hook-hermes-execute-code-unbound`), byte for byte, and neither code below fires. Both append nothing.
+
+| code | fires when |
+|---|---|
+| `hook-exec-code-custody-unattested` | The call is an opaque program the class would cover, and the policy names `exec.code` without declaring `exec.code.custody: attested`. The detail names the key. For Hermes `execute_code` it also fires for `execute_code: hooked` without custody; with custody and without `execute_code: hooked`, `execute_code` keeps `hook-hermes-execute-code-unbound`. |
+| `hook-exec-code-unreadable` | The class is open and a program FILE cannot be read and hashed by the hook: it is absent, unreadable by the hook's process, not a regular file, above the size the implementation hashes, or named relatively after a segment that moves the working directory. The same code refuses a file the hook cannot place as the kernel would: a path with a `..` component, or a `.` or empty component after the first; a directory that is not its own realpath (a symlinked working directory included); a line with any segment besides the program's; or a call for which the harness states no absolute working directory. It also refuses a command or Hermes `execute_code` program that is not well-formed text (a lone UTF-16 surrogate), which has no exact bytes to hash. Checked before any resolution. A file that resolves onto a credential or protected path is refused `hook-unclassified` instead. |
+
 ## 12. Interoperability
 
 - **Backlog.md:** native. Tasks live in `backlog/`, the envelope is one preserved frontmatter key, board `status` and approval `state` are independent. approval.md ships no board; use Backlog.md's.

package/dist/src/channels/contract.d.ts

@@ -512,6 +512,21 @@ export interface ChannelDecision {
      * channel's own screen, never an input to a decision.
      */
     rendering?: PromptRendering;
+    /**
+     * The study flag on this gesture (amended SPEC.md §8), recorded as
+     * `payload.study` on the `approval.rejected` it produces.
+     *
+     * A channel may set `looks_wrong` and nothing else: the resident flagged the
+     * card as a suspected study card and skipped it. Any other value, including
+     * `study_withdrawn`, is refused `study-reason-not-channel` before the gate is
+     * called, and nothing is appended. `study_withdrawn` is the study team's
+     * withdraw verb's, which no channel can reach. Like `rendering`, a record of
+     * what the person did and never an input: every check a Deny passes, this
+     * passes too.
+     */
+    study?: {
+        reason: "looks_wrong";
+    };
 }
 /**
  * What the runtime tells the channel became of a reported decision.

package/dist/src/channels/contract.js

@@ -396,12 +396,34 @@ export function recordChannelDecision(logPath, decision, actorOptions, gateOptio
     // The routing lives here rather than in each channel runner for the reason
     // this function exists at all: there is one place a reported gesture becomes a
     // log event, and adding a second would be adding a second decision path.
+    // Amended SPEC.md §8 (the study record), first and before anything is read
+    // or appended: a channel may flag a gesture `looks_wrong` and nothing else.
+    // The value arrives from a channel, so it is checked as data rather than
+    // trusted as a type; anything else, `study_withdrawn` above all, is refused
+    // with no record, because the only writer of a withdrawal is the study
+    // team's own verb.
+    if (decision.study !== undefined &&
+        decision.study.reason !== "looks_wrong") {
+        return {
+            outcome: {
+                ok: false,
+                code: "study-reason-not-channel",
+                message: `decision on ${decision.action_key} refused: a channel may record only the looks_wrong study reason. A study withdrawal is written by the study team's withdraw verb alone, never by a channel. Nothing was decided and nothing was recorded.`,
+            },
+        };
+    }
     if (isAttestationActionKey(decision.action_key)) {
         return recordAttestationDecision(logPath, decision, actorOptions, gateOptions);
     }
-    const options = { ...gateOptions };
+    // The study record comes from the gesture alone: a `study` the runtime's own
+    // gate options carry is dropped here, so the one value that reaches the gate
+    // is the one checked above.
+    const { study: _runtimeStudy, ...runtimeOptions } = gateOptions;
+    const options = { ...runtimeOptions };
     if (decision.note !== undefined)
         options.note = decision.note;
+    if (decision.study !== undefined)
+        options.study = { reason: "looks_wrong" };
     if (decision.batchDeliveryId !== undefined) {
         options.batchDeliveryId = decision.batchDeliveryId;
     }

package/dist/src/channels/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/channels/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,MAAM,EACN,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,4BAA4B,EAC5B,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,aAAa,GAKd,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIxD,OAAO,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,yDAAyD;IACzD,KAAK;IACL,0FAA0F;IAC1F,cAAc;IACd,sDAAsD;IACtD,SAAS;IACT,kEAAkE;IAClE,aAAa;IACb;;;;OAIG;IACH,aAAa;IACb,4EAA4E;IAC5E,iBAAiB;IACjB;;;;;;;;;OASG;IACH,YAAY;IACZ,8DAA8D;IAC9D,OAAO;CACC,CAAC;AAsBX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,4BAA4B,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,mBAAmB;IACnB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,0FAA0F,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,2CAA2C,CAAC;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1C,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,OAAO,iJAAiJ,CAAC;IAC3J,CAAC;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,kNAAkN,CAAC;IAC5N,CAAC;IACD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAI,KAAQ,EAAE,MAA+B;IACnE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAI,KAAQ,EAAE,MAAc;IACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAyND;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,4EAA4E;IAC5E,yBAAyB;IACzB,0DAA0D;IAC1D,gBAAgB;CACR,CAAC;AAcX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+MAA+M;aACtQ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,CAAC,KAAK,wXAAwX;SACna,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8CAA8C,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,eAA2B,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,GAAG,0BAA0B,GAAG,eAAe,EAAE,CAAC;IAC/D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAoLD,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAQ,OAA2B,CAAC,YAAY,KAAK,UAAU,CAAC;AACzE,CAAC;AAiCD;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,OAAe,EACf,WAA0B;IAI1B,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC1G,MAAM,OAAO,GAAG,iBAAiB,CAC/B,IAAI,CAAC,OAAO,EACZ,WAAW,CAAC,eAAe,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAC3D,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,cAAc,CAClB,kBAAkB,CAAC,WAAW,CAAC,IAAI,aAAa,EAChD,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAC7B,MAAqB,EACrB,IAAuC,EACvC,OAAe;IAEf,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,OAAO,iBAAiB,MAAM,CAAC,OAAO,+hBAA+hB;SACllB;QACD,QAAQ,EAAE,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,8EAA8E;IAC9E,+EAA+E;IAC/E,iEAAiE;IACjE,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,EAAE;IACF,2EAA2E;IAC3E,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,GAAG,WAAW,EAAE,CAAC;IAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACrD,CAAC;IACD,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,kDAAkD;IAClD,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,IAAI,KAAK,CAAC;IAEhD,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,YAAY,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,eAAe,QAAQ,CAAC,UAAU,kFAAkF,OAAO,CAAC,MAAM,iDAAiD;iBAC7L;aACF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAC/B,IAAI,EACJ,YAAY,CAAC,KAAK,EAClB,QAAQ,CAAC,MAAM;IACf,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,iBAAiB;IACjB,aAAa,EAAE,CAChB,CAAC;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,gDAAgD;IAChD,IAAI,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACnG,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,eAAe,QAAQ,CAAC,UAAU,mNAAmN;iBAC/P;aACF,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAClD,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,eAAe,QAAQ,CAAC,UAAU,EAAE,CACrC,CAAC;QACF,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YAC7F,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,OAAO,GAA2B;YACtC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,OAAO,EAAE,eAAe,QAAQ,CAAC,UAAU,aAAa,UAAU,CAAC,OAAO,EAAE;SAC7E,CAAC;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,kCAAkC;QAClC,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAChC,WAAW,EACX,OAAO,EACP,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAC9B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAEvF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,0DAA0D;QAC1D,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,EAC1B,WAAW,EACX,MAAM;QACN,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,6BAA6B;QAC7B,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YACnE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;aAChF,CACN,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS;KACxC,CAAC;IACF,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,QAAyB,EACzB,OAA+B,EAC/B,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC;IAC5E,IAAI,UAAiC,CAAC;IACtC,IAAI,CAAC;QACH,UAAU,GAAG,cAAc,CACzB,cAAc,CAAC,WAAW,CAAC,EAC3B,YAAY,CAAC,KAAK,EAClB,QAAQ,CAAC,MAAM,EACf,aAAa,EAAE,CAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;QAClB,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EACvC,WAAW,EACX,OAAO,EACP,UAAU,CAAC,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;aAChF,CACN,CAAC;QACF,OAAO;IACT,CAAC;IACD,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QACxF,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,QAAyB,EACzB,YAA2E,EAC3E,WAA0B,EAC1B,OAA6C,EAC7C,MAAM,GAA4D,EAAE;IAEpE,IAAI,CAAC;QACH,qBAAqB,CACnB,OAAO,EACP;YACE,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,0CAA0C;YAC1C,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,KAAK;YACtC,GAAG,MAAM;SACV,EACD;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,yEAAyE;YACzE,0EAA0E;YAC1E,GAAG,CAAC,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;IACrE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,OAAsB;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAClD,OAAO,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAS,wBAAwB,CAC/B,OAAe,EACf,OAA+B,EAC/B,QAAyB,EACzB,YAAiC,EACjC,WAA0B,EAC1B,UAAyB;IAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;IAEzE,4EAA4E;IAC5E,0EAA0E;IAC1E,2DAA2D;IAC3D,uEAAuE;IACvE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,MAAM,OAAO,GAAG,iBAAiB,CAC/B,OAAO,EACP,WAAW,CAAC,eAAe,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAC3D,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;QACjD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC;YAChD,OAAO,EAAE,kCAAkC,MAAM,CAAC,OAAO,mFAAmF,OAAO,CAAC,MAAM,2PAA2P;SACtZ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAC3B,UAAU,IAAI,aAAa,EAC3B,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;gBAC9C,OAAO,EAAE,8EAA8E,MAAM,CAAC,OAAO,mPAAmP;aACzV,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,0EAA0E;QAC1E,2EAA2E;QAC3E,gDAAgD;QAChD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;gBAC9C,OAAO,EAAE,wJAAwJ;aAClK,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,0IAA0I;aAC1L;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAExF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,2CAA2C,MAAM,iGAAiG;aAC5J;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA6B,EAAE,GAAG,WAAW,EAAE,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC/F,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAEzD,qEAAqE;IACrE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CACvC,OAAO,EACP,IAAI,CAAC,OAAO,EACZ,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,UAAU,CACX,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAA2B;YACtC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,kBAAkB,MAAM,aAAa,QAAQ,CAAC,OAAO,EAAE;SACjE,CAAC;QACF,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,mDAAmD;QACnD,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAChC,WAAW,EACX,OAAO,EACP,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,kDAAkD;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,kBAAkB,MAAM,8IAA8I;iBAChL;aACF,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAClD,QAAQ,CAAC,MAAM,EACf,cAAc,CAAC,WAAW,CAAC,EAC3B,kBAAkB,MAAM,EAAE,CAC3B,CAAC;QACF,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YAC7F,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,OAAO,EACP,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EACpD,QAAQ,CAAC,KAAK,EACd,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE3C,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAC7D,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,KAAK;SACnB;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/channels/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,MAAM,EACN,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,4BAA4B,EAC5B,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,aAAa,GAKd,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIxD,OAAO,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,yDAAyD;IACzD,KAAK;IACL,0FAA0F;IAC1F,cAAc;IACd,sDAAsD;IACtD,SAAS;IACT,kEAAkE;IAClE,aAAa;IACb;;;;OAIG;IACH,aAAa;IACb,4EAA4E;IAC5E,iBAAiB;IACjB;;;;;;;;;OASG;IACH,YAAY;IACZ,8DAA8D;IAC9D,OAAO;CACC,CAAC;AAsBX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,4BAA4B,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,mBAAmB;IACnB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,0FAA0F,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,2CAA2C,CAAC;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,0CAA0C;IAC1C,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,OAAO,iJAAiJ,CAAC;IAC3J,CAAC;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,kNAAkN,CAAC;IAC5N,CAAC;IACD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAI,KAAQ,EAAE,MAA+B;IACnE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,OAAO,CAAI,KAAQ,EAAE,MAAc;IACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAyND;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,4EAA4E;IAC5E,yBAAyB;IACzB,0DAA0D;IAC1D,gBAAgB;CACR,CAAC;AAcX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+MAA+M;aACtQ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,UAAU,MAAM,CAAC,UAAU,CAAC,KAAK,wXAAwX;SACna,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8CAA8C,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAsBD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,eAA2B,EAAE,IAAa;IAClE,MAAM,IAAI,GAAG,GAAG,0BAA0B,GAAG,eAAe,EAAE,CAAC;IAC/D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAiMD,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAQ,OAA2B,CAAC,YAAY,KAAK,UAAU,CAAC;AACzE,CAAC;AAiCD;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,OAAe,EACf,WAA0B;IAI1B,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC1G,MAAM,OAAO,GAAG,iBAAiB,CAC/B,IAAI,CAAC,OAAO,EACZ,WAAW,CAAC,eAAe,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAC3D,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,cAAc,CAClB,kBAAkB,CAAC,WAAW,CAAC,IAAI,aAAa,EAChD,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAC7B,MAAqB,EACrB,IAAuC,EACvC,OAAe;IAEf,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,OAAO,iBAAiB,MAAM,CAAC,OAAO,+hBAA+hB;SACllB;QACD,QAAQ,EAAE,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,8EAA8E;IAC9E,+EAA+E;IAC/E,iEAAiE;IACjE,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,EAAE;IACF,2EAA2E;IAC3E,+EAA+E;IAC/E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,mBAAmB;IACnB,IACE,QAAQ,CAAC,KAAK,KAAK,SAAS;QAC3B,QAAQ,CAAC,KAA8B,CAAC,MAAM,KAAK,aAAa,EACjE,CAAC;QACD,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,eAAe,QAAQ,CAAC,UAAU,4MAA4M;aACxP;SACF,CAAC;IACJ,CAAC;IAED,IAAI,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACjF,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,4BAA4B;IAC5B,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,CAAC;IAChE,MAAM,OAAO,GAAkB,EAAE,GAAG,cAAc,EAAE,CAAC;IACrD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5E,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACrD,CAAC;IACD,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,kDAAkD;IAClD,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,IAAI,KAAK,CAAC;IAEhD,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,YAAY,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,eAAe,QAAQ,CAAC,UAAU,kFAAkF,OAAO,CAAC,MAAM,iDAAiD;iBAC7L;aACF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAC/B,IAAI,EACJ,YAAY,CAAC,KAAK,EAClB,QAAQ,CAAC,MAAM;IACf,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,iBAAiB;IACjB,aAAa,EAAE,CAChB,CAAC;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,gDAAgD;IAChD,IAAI,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACnG,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,eAAe,QAAQ,CAAC,UAAU,mNAAmN;iBAC/P;aACF,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAClD,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,eAAe,QAAQ,CAAC,UAAU,EAAE,CACrC,CAAC;QACF,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YAC7F,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,OAAO,GAA2B;YACtC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,OAAO,EAAE,eAAe,QAAQ,CAAC,UAAU,aAAa,UAAU,CAAC,OAAO,EAAE;SAC7E,CAAC;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,kCAAkC;QAClC,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAChC,WAAW,EACX,OAAO,EACP,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAC9B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAEvF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,0DAA0D;QAC1D,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,EAC1B,WAAW,EACX,MAAM;QACN,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,6BAA6B;QAC7B,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YACnE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;aAChF,CACN,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS;KACxC,CAAC;IACF,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,QAAyB,EACzB,OAA+B,EAC/B,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC;IAC5E,IAAI,UAAiC,CAAC;IACtC,IAAI,CAAC;QACH,UAAU,GAAG,cAAc,CACzB,cAAc,CAAC,WAAW,CAAC,EAC3B,YAAY,CAAC,KAAK,EAClB,QAAQ,CAAC,MAAM,EACf,aAAa,EAAE,CAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;QAClB,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EACvC,WAAW,EACX,OAAO,EACP,UAAU,CAAC,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;aAChF,CACN,CAAC;QACF,OAAO;IACT,CAAC;IACD,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QACxF,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,QAAyB,EACzB,YAA2E,EAC3E,WAA0B,EAC1B,OAA6C,EAC7C,MAAM,GAA4D,EAAE;IAEpE,IAAI,CAAC;QACH,qBAAqB,CACnB,OAAO,EACP;YACE,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,0CAA0C;YAC1C,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,KAAK;YACtC,GAAG,MAAM;SACV,EACD;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,yEAAyE;YACzE,0EAA0E;YAC1E,GAAG,CAAC,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;IACrE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,OAAsB;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAClD,OAAO,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAS,wBAAwB,CAC/B,OAAe,EACf,OAA+B,EAC/B,QAAyB,EACzB,YAAiC,EACjC,WAA0B,EAC1B,UAAyB;IAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;IAEzE,4EAA4E;IAC5E,0EAA0E;IAC1E,2DAA2D;IAC3D,uEAAuE;IACvE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,MAAM,OAAO,GAAG,iBAAiB,CAC/B,OAAO,EACP,WAAW,CAAC,eAAe,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAC3D,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;QACjD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC;YAChD,OAAO,EAAE,kCAAkC,MAAM,CAAC,OAAO,mFAAmF,OAAO,CAAC,MAAM,2PAA2P;SACtZ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAC3B,UAAU,IAAI,aAAa,EAC3B,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;gBAC9C,OAAO,EAAE,8EAA8E,MAAM,CAAC,OAAO,mPAAmP;aACzV,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,0EAA0E;QAC1E,2EAA2E;QAC3E,gDAAgD;QAChD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;gBAC9C,OAAO,EAAE,wJAAwJ;aAClK,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAyB,EACzB,YAAiC,EACjC,WAAW,GAAkB,EAAE;IAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,0IAA0I;aAC1L;SACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAChF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAExF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,2CAA2C,MAAM,iGAAiG;aAC5J;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA6B,EAAE,GAAG,WAAW,EAAE,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9D,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC/F,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAEzD,qEAAqE;IACrE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,QAAQ,GAAG,wBAAwB,CACvC,OAAO,EACP,IAAI,CAAC,OAAO,EACZ,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,UAAU,CACX,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAA2B;YACtC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,kBAAkB,MAAM,aAAa,QAAQ,CAAC,OAAO,EAAE;SACjE,CAAC;QACF,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,mDAAmD;QACnD,mBAAmB,CACjB,OAAO,EACP,QAAQ,EACR,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAChC,WAAW,EACX,OAAO,EACP,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,kDAAkD;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,kBAAkB,MAAM,8IAA8I;iBAChL;aACF,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAClD,QAAQ,CAAC,MAAM,EACf,cAAc,CAAC,WAAW,CAAC,EAC3B,kBAAkB,MAAM,EAAE,CAC3B,CAAC;QACF,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YAC7F,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,OAAO,EACP,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EACpD,QAAQ,CAAC,KAAK,EACd,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE3C,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAC7D,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,KAAK;SACnB;KACF,CAAC;AACJ,CAAC"}

package/dist/src/channels/telegram.d.ts

@@ -296,27 +296,72 @@ export declare const TELEGRAM_STALE_UNKNOWN = "This request is not open here \u2
  */
 export declare const TELEGRAM_PROMPT_HEADING = "APPROVAL REQUIRED";
 /**
- * What the label over the payload chunks names (APRV-162).
+ * What the label over the payload chunks names (APRV-162), in a resident's
+ * words (P-9).
  *
  * The chunks carry the canonical rendering, which is a deterministic function
- * of the bytes and not the bytes themselves; calling it "the exact bytes" told
- * the reader that a diff view and a JSON file were the same object. The
- * rendering names its own `display_hash`, and the store path inside it is the
- * route back to the bytes.
+ * of the bytes and not the bytes themselves, and the rendering names its own
+ * `display_hash` and store path inside the block (SPEC.md §10.3, bound
+ * verbatim by `display_hash`). This label sits OUTSIDE that block, so it is
+ * free to say what the block is for the person reading it: what they are
+ * approving. Before P-9 it said "the canonical rendering this approval's
+ * display_hash names; raw bytes at the store path inside", which is the
+ * block's own first lines restated in the system's vocabulary.
  */
-export declare const PAYLOAD_CHUNK_LABEL_TAIL = "the canonical rendering this approval's display_hash names; raw bytes at the store path inside";
-export declare const PAYLOAD_CHUNK_LABEL = "PAYLOAD \u2014 the canonical rendering this approval's display_hash names; raw bytes at the store path inside";
+export declare const PAYLOAD_CHUNK_LABEL_TAIL = "what you are approving";
+export declare const PAYLOAD_CHUNK_LABEL = "Exactly what you are approving";
+/**
+ * The plain-words label over lines the requesting agent wrote (P-9).
+ *
+ * The same words the minimal card uses for the agent's own summary: the reader
+ * learns that the agent said it and that nobody checked it, which is what the
+ * old "CLAIMED ... NOT verified by the runtime" said in the system's
+ * vocabulary. The author id stays after it, because which agent said a thing
+ * is part of what an approver weighs (APRV-144).
+ */
+export declare const TELEGRAM_CLAIMED_LABEL = "What your agent says (not checked)";
 /**
  * What the claimed block is headed, and what a second claimed message is headed
  * when a rationale overflows one (APRV-165).
  *
- * Both say CLAIMED and both say NOT verified, because a continuation is a
- * message a reader may see first, and a claimed line that arrives under no
- * heading at all reads as the runtime's own.
+ * Both say the lines are the agent's and not checked, because a continuation
+ * is a message a reader may see first, and a claimed line that arrives under
+ * no heading at all reads as the runtime's own.
+ */
+export declare const TELEGRAM_CLAIMED_HEADING_PREFIX = "What your agent says (not checked) \u2014";
+export declare const TELEGRAM_CLAIMED_CONTINUED_HEADING = "What your agent says (continued, not checked)";
+/**
+ * The heading over the rows the runtime derived itself (P-9): the class, the
+ * wait, the budget. Before P-9 it read "COMPUTED — derived by the runtime from
+ * the log, the policy and the payload bytes". The rows keep their origin tags,
+ * which the village relay reads (its quiet hold matches the `ttl` row up to
+ * its `<i>(` tag).
+ */
+export declare const TELEGRAM_COMPUTED_HEADING = "Checked by approval.md";
+/** The most characters of an author id the claimed label shows (fold round 1, S3). */
+export declare const TELEGRAM_CLAIMED_AUTHOR_MAX = 80;
+/**
+ * {@link TELEGRAM_CLAIMED_LABEL} naming who wrote the lines under it.
+ *
+ * The author is the requester's actor id, which the actor rule
+ * (`^(human|agent):.+`) checks only at its start: a line break later in it
+ * passes. Escaping stops markup, but not a second line inside the bold heading
+ * that reads like the runtime's own "Checked by approval.md" (fold round 1,
+ * S3). So every run of whitespace, line breaks included, becomes one space,
+ * control and format characters are dropped, and the id is cut at
+ * {@link TELEGRAM_CLAIMED_AUTHOR_MAX} characters with an ellipsis. The label is
+ * always one line.
+ */
+export declare function claimedLabelFor(author: string): string;
+/**
+ * An author id as one short line (fold round 1, S3): whitespace runs, line
+ * breaks included, become one space; control and format characters go; the id
+ * is cut at {@link TELEGRAM_CLAIMED_AUTHOR_MAX} characters with an ellipsis.
+ * Used by {@link claimedLabelFor} and by the `(author)` tag on each claimed
+ * row, which carries the same id. A computed row's origin is a fixed word, so
+ * this changes nothing there.
  */
-export declare const TELEGRAM_CLAIMED_HEADING_PREFIX = "WHAT THIS DOES \u2014 CLAIMED by";
-export declare const TELEGRAM_CLAIMED_HEADING_SUFFIX = "NOT verified by the runtime";
-export declare const TELEGRAM_CLAIMED_CONTINUED_HEADING = "WHAT THIS DOES (continued) \u2014 CLAIMED, NOT verified by the runtime";
+export declare function oneLineAuthor(author: string): string;
 /**
  * The most members one digest may carry (APRV-115).
  *
@@ -347,6 +392,29 @@ export declare const TELEGRAM_TERMINAL_HEADLINES: {
     readonly expired: "✗ EXPIRED — the approval window closed";
     readonly withdrawn: "WITHDRAWN — no decision is needed";
 };
+/**
+ * The headline a "Looks wrong" tap settles its card on (amended SPEC.md §8,
+ * the study record). The record underneath is an ordinary `approval.rejected`;
+ * this says, in the resident's words, that the card was skipped because they
+ * flagged it. Emoji-free like every other headline here.
+ */
+export declare const TELEGRAM_LOOKS_WRONG_HEADLINE = "SKIPPED \u2014 you flagged this as looks wrong";
+/**
+ * The label of the study-mode button (amended SPEC.md §8, the study record).
+ * Drawn only while the listener was launched with `APPROVAL_STUDY_MODE=1`, on a
+ * row of its own under Approve and Reject. Its verb is `w`, a reject with the
+ * `looks_wrong` flag.
+ */
+export declare const TELEGRAM_LOOKS_WRONG_LABEL = "\uD83D\uDEA9 Looks wrong";
+/**
+ * The headline a card settles on when the study team withdrew its request
+ * (amended SPEC.md §8, the study record: an `approval.rejected` carrying
+ * `payload.study.reason` `study_withdrawn`). It replaces "✗ REJECTED" for that
+ * record only, so the resident reads that nobody they know said no and that
+ * nothing ran. The operator id in the record is never shown. Emoji-free like
+ * every other headline here.
+ */
+export declare const TELEGRAM_STUDY_WITHDRAWN_HEADLINE = "WITHDRAWN BY THE STUDY TEAM";
 /** A state {@link TELEGRAM_TERMINAL_HEADLINES} has a word for. */
 export type TelegramTerminalState = keyof typeof TELEGRAM_TERMINAL_HEADLINES;
 /** Whether a derived request state is one an annotation can settle a message on. */
@@ -506,6 +574,21 @@ export interface TelegramConfig {
      * nothing else: no policy key and nothing in an update can set it.
      */
     staleCopy?: boolean;
+    /**
+     * Study mode (amended SPEC.md §8, the study record). Off unless exactly
+     * `true`.
+     *
+     * On, every per-request card (technical and minimal) carries a second row
+     * with one "Looks wrong" button, and the `w` callback it carries is parsed as
+     * a reject flagged `looks_wrong`. Off, the cards and the callback parser are
+     * exactly what they were before the key existed: no second row, and `w:` is
+     * a malformed callback. Digest cards never carry the button.
+     *
+     * Launch configuration and nothing else, for {@link staleCopy}'s reason: the
+     * verb sets it from `APPROVAL_STUDY_MODE` once, at prepare. No policy key and
+     * nothing in an update can set it.
+     */
+    study?: boolean;
     /**
      * Which layout a prompt is drawn in (APRV-489), from
      * `channels.telegram.prompt.style`. Passed in by the verb, which has already
@@ -909,6 +992,13 @@ export interface DigestMemberState {
     summary: string;
     /** The agent's cost estimate, formatted. Claimed. */
     cost: string;
+    /**
+     * The member's class, computed, set only when the digest's members differ in
+     * class (APRV-287: the several classes of one tool call). Their summaries are
+     * then one command's summary repeated, and the class is what tells the lines
+     * apart and what each "Approve" covers (P-9, in place of the action key).
+     */
+    kind?: string;
     /**
      * The terminal outcome, once one has been observed for this member. Written
      * only from a gate record or the verified log, never inferred here.
@@ -937,8 +1027,28 @@ export interface DigestMemberState {
  * terminal.
  */
 export interface StaleSummary {
-    /** Computed lines: how many, how old the oldest is, which classes. */
+    /**
+     * The reminder this message opens with on a restart (P-9), the first line in
+     * bold: how many requests this cycle re-sends in all, and, when cards follow
+     * it, whether the buttons on older messages still work. It replaces the
+     * separate re-delivery banner for that cycle. Shown only while every member
+     * is still open: once one is decided, the count it states is no longer true.
+     */
+    reminder?: string[];
+    /** Computed lines: how many are listed, and why nobody is waiting on them. */
     lines: string[];
+    /**
+     * How long ago each member was asked, computed, in member order (P-9). Shown
+     * beside each claimed summary so the members can be told apart without an
+     * action key.
+     */
+    ages?: string[];
+    /**
+     * Whether the buttons on earlier copies still decide (APRV-456), which the
+     * footer's advice depends on. Filled from the channel's own setting by
+     * {@link TelegramChannel.notifyStale} when the caller leaves it out.
+     */
+    staleCopy?: boolean;
 }
 /** One digest message, as the delivering process remembers it. */
 export interface DigestState {
@@ -948,12 +1058,11 @@ export interface DigestState {
     batchDeliveryId: DeliveryId;
     /** The nonce the "all" buttons were issued under. */
     allNonce: string;
-    /** The computed facts every member shares, already rendered as text. */
-    facts: {
-        label: string;
-        text: string;
-        origin: string;
-    }[];
+    /**
+     * The one computed line the digest states about its members, already
+     * rendered as text ({@link digestLine}); empty for a stale summary.
+     */
+    line: string;
     /**
      * The collapsed re-delivery this message is, or `null` for an ordinary digest
      * (APRV-287). See {@link StaleSummary}.
@@ -979,19 +1088,22 @@ export interface DigestState {
     windowMs: number | null;
 }
 /**
- * The computed facts a digest's members share, as the digest states them.
+ * The one computed line a digest states about its members (P-9).
  *
- * Every one is read off the first member, which is sound precisely because the
- * grouping key made them equal across the set: a digest whose members disagreed
- * about their class or their task is a digest the listener would not have
- * built. The last line is the one an approver needs most — it says how many
- * payloads are above and that each request has its own.
+ * Read off the members themselves, which is sound precisely because the
+ * grouping key made them alike: a digest whose members disagreed about their
+ * class or their task is a digest the listener would not have built. What the
+ * line says is the thing an approver needs before the buttons: why these are
+ * one message, and that every request it decides is shown in full above it
+ * (SPEC.md §10.3).
+ *
+ * Before P-9 this was five facts with origin tags: the class name, the
+ * autonomy, the task id, the grouping key (`keys:body,from,subject,to`) and the
+ * payload binding. Each is still on every member's own card above, where an
+ * operator who wants it finds it; the digest is where a resident answers, and
+ * there it was ids and vocabulary between them and the buttons.
  */
-export declare function digestFacts(members: ChannelRequest[]): {
-    label: string;
-    text: string;
-    origin: string;
-}[];
+export declare function digestLine(members: ChannelRequest[]): string;
 /**
  * The digest message: text plus the keyboard for whatever is still open.
  *
@@ -1034,6 +1146,15 @@ export declare function renderDigest(digest: DigestState): {
  */
 export declare const ACTION_REF_HEX = 16;
 export declare function actionRefOf(actionKey: string): string;
+/** How many hex characters of the key's sha256 a study log line carries. */
+export declare const STUDY_LOG_REF_HEX = 12;
+/**
+ * The short reference a "Looks wrong" detection line names (amended SPEC.md
+ * §8): the first {@link STUDY_LOG_REF_HEX} hex of the key's sha256, a prefix of
+ * {@link actionRefOf}, so an operator holding the key can match the line and a
+ * reader holding the line cannot recover the key.
+ */
+export declare function studyLogRefOf(actionKey: string): string;
 /**
  * `callback_data` for one button: `<g|r>:<nonce>:<action ref>`.
  *
@@ -1044,7 +1165,7 @@ export declare function actionRefOf(actionKey: string): string;
  * for the copy whose nonce this process never issued, and {@link actionRefOf}
  * states the bound on what that fallback may reach.
  */
-export declare function callbackData(verb: "g" | "r", nonce: string, actionKey: string): string;
+export declare function callbackData(verb: "g" | "r" | "w", nonce: string, actionKey: string): string;
 /**
  * `callback_data` for a digest's "all" button: `<G|R>:<nonce>` (APRV-115).
  *
@@ -1108,8 +1229,13 @@ interface ParsedCallback {
     nonce: string;
     /** {@link actionRefOf} of the action this button was drawn for, when present. */
     actionRef: string | null;
+    /**
+     * Set by the study-mode `w` verb alone (amended SPEC.md §8): the resident
+     * tapped "Looks wrong", which is a reject with this flag recorded.
+     */
+    flag?: "looks_wrong";
 }
-export declare function parseCallbackData(data: unknown): ParsedCallback | null;
+export declare function parseCallbackData(data: unknown, study?: boolean): ParsedCallback | null;
 /**
  * The headline of a retrospective review card.
  *
@@ -1755,6 +1881,11 @@ export declare class TelegramChannel implements TestableChannel {
      * carries can change it.
      */
     private readonly staleCopy;
+    /**
+     * Study mode (amended SPEC.md §8). Fixed at construction from
+     * {@link TelegramConfig.study}; nothing an update carries can change it.
+     */
+    private readonly study;
     /**
      * Where a `nonce-not-issued` refusal is recorded (APRV-456). The runtime's,
      * like every other handler here; absent, the refusal still happens and only
@@ -1887,6 +2018,8 @@ export declare class TelegramChannel implements TestableChannel {
      * copies still decide when they do not.
      */
     staleCopyEnabled(): boolean;
+    /** Whether study mode is on (amended SPEC.md §8): fixed at construction. */
+    studyModeEnabled(): boolean;
     /**
      * Register what to do with a checkpoint tap (APRV-257).
      *
@@ -2026,6 +2159,20 @@ export declare class TelegramChannel implements TestableChannel {
      * exactly two things: the heading, and whether anything is armed.
      */
     private sendPrompt;
+    /**
+     * The study-mode row under a per-request card (amended SPEC.md §8): one
+     * "Looks wrong" button on a row of its own, so the Approve/Reject row keeps
+     * its bytes and layout. Empty when study mode is off, which leaves the
+     * keyboard exactly as it was before study mode existed.
+     *
+     * Empty on a policy attestation prompt too (APRV-528). Such a prompt is
+     * answered by attesting or declining, and `channels/contract.ts` routes its
+     * gesture to the attestation path, which records no study reason: a flag
+     * drawn there would be counted by the detection line yet held by no log
+     * record. The prompt is known by its `policy_diff` and, as the contract
+     * routes it, by its `policy.attest:` key.
+     */
+    private studyRows;
     private deliverOne;
     /**
      * Send `request` as ONE minimal card (APRV-489), or report why it was not.