chainlesschain 0.166.65 → 0.166.69

package/src/lib/evolution/pm-exploration-recovery-snapshot-store.js

@@ -13,6 +13,12 @@ export const PM_EXPLORATION_RECOVERY_SNAPSHOT_REQUEST_SCHEMA =
   "chainlesschain.pm-exploration-recovery-snapshot-request/v1";
 export const PM_EXPLORATION_RECOVERY_SNAPSHOT_ACK_SCHEMA =
   "chainlesschain.pm-exploration-recovery-snapshot-ack/v1";
+export const PM_EXPLORATION_RECOVERY_SET_REQUEST_SCHEMA =
+  "chainlesschain.pm-exploration-recovery-snapshot-request/v2";
+export const PM_EXPLORATION_RECOVERY_SET_ACK_SCHEMA =
+  "chainlesschain.pm-exploration-recovery-snapshot-ack/v2";
+export const PM_EXPLORATION_RECOVERY_SNAPSHOT_RESOLUTION_SCHEMA =
+  "chainlesschain.pm-exploration-recovery-snapshot-resolution/v1";
 export const PM_EXPLORATION_RECOVERY_SNAPSHOT_CORRUPT_CODE =
   "CC_PM_RECOVERY_SNAPSHOT_CORRUPT";
 
@@ -20,10 +26,17 @@ const DATABASE_SEAL_SCHEMA =
   "chainlesschain.desktop-pm-database-pre-run-seal/v1";
 const DATABASE_SNAPSHOT_DOMAIN =
   "chainlesschain.desktop-pm-database-snapshot/v1";
+const WORKSPACE_SEAL_SCHEMA = "chainlesschain.desktop-pm-workspace-seal/v1";
+const WORKSPACE_SNAPSHOT_DOMAIN =
+  "chainlesschain.desktop-pm-workspace-snapshot/v1";
+const RECOVERY_SET_SCHEMA = "chainlesschain.pm-exploration-recovery-set/v1";
+const RECOVERY_SET_MAGIC = Buffer.from("CCPMRECOVERYSET1\0", "ascii");
 const SNAPSHOT_TYPE = "pm-exploration-database-recovery-snapshot";
+const RECOVERY_SET_TYPE = "pm-exploration-recovery-set";
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 const ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u;
 const MAX_SNAPSHOT_BYTES = 8 * 1024 * 1024 * 1024;
+const MAX_WORKSPACE_SNAPSHOT_BYTES = 2 * 1024 * 1024 * 1024;
 const STORES = new WeakMap();
 
 function canonical(value) {
@@ -146,7 +159,65 @@ function databaseSeal(value) {
   return seal;
 }
 
-function snapshotBytes(value) {
+function workspaceSeal(value, expectedManifestDigest) {
+  exact(
+    value,
+    [
+      "schema",
+      "manifestDigest",
+      "workspaceRootDigest",
+      "capturePolicyDigest",
+      "workspaceSnapshotDigest",
+      "workspaceSnapshotBytes",
+      "workspaceFileCount",
+      "snapshotMethod",
+      "sealDigest",
+    ],
+    "PM recovery workspace seal",
+  );
+  if (
+    value.schema !== WORKSPACE_SEAL_SCHEMA ||
+    value.manifestDigest !== expectedManifestDigest ||
+    value.snapshotMethod !== "bounded-canonical-workspace-archive" ||
+    !Number.isSafeInteger(value.workspaceSnapshotBytes) ||
+    value.workspaceSnapshotBytes < 1 ||
+    value.workspaceSnapshotBytes > MAX_WORKSPACE_SNAPSHOT_BYTES ||
+    !Number.isSafeInteger(value.workspaceFileCount) ||
+    value.workspaceFileCount < 0 ||
+    value.workspaceFileCount > 100_000
+  ) {
+    throw new TypeError("PM recovery workspace seal is invalid");
+  }
+  const core = {
+    schema: value.schema,
+    manifestDigest: digest(value.manifestDigest, "manifestDigest"),
+    workspaceRootDigest: digest(
+      value.workspaceRootDigest,
+      "workspaceRootDigest",
+    ),
+    capturePolicyDigest: digest(
+      value.capturePolicyDigest,
+      "capturePolicyDigest",
+    ),
+    workspaceSnapshotDigest: digest(
+      value.workspaceSnapshotDigest,
+      "workspaceSnapshotDigest",
+    ),
+    workspaceSnapshotBytes: value.workspaceSnapshotBytes,
+    workspaceFileCount: value.workspaceFileCount,
+    snapshotMethod: value.snapshotMethod,
+  };
+  const seal = deepFreeze({
+    ...core,
+    sealDigest: digest(value.sealDigest, "workspace sealDigest"),
+  });
+  if (seal.sealDigest !== hash(WORKSPACE_SEAL_SCHEMA, core)) {
+    throw new Error("PM recovery workspace seal digest mismatch");
+  }
+  return seal;
+}
+
+function snapshotBytes(value, maximum = MAX_SNAPSHOT_BYTES) {
   if (
     !value ||
     typeof value !== "object" ||
@@ -160,11 +231,139 @@ function snapshotBytes(value) {
   ) {
     throw new TypeError("PM recovery snapshot bytes are invalid");
   }
-  if (value.byteLength < 1 || value.byteLength > MAX_SNAPSHOT_BYTES)
+  if (value.byteLength < 1 || value.byteLength > maximum)
     throw new TypeError("PM recovery snapshot bytes exceed the allowed range");
   return Buffer.from(value);
 }
 
+function boundedSnapshotBytes(value, maximum, label) {
+  try {
+    return snapshotBytes(value, maximum);
+  } catch (cause) {
+    throw new TypeError(`${label} bytes exceed the allowed range`, { cause });
+  }
+}
+
+function encodeRecoverySet(request) {
+  const header = Buffer.from(
+    canonical({
+      schema: RECOVERY_SET_SCHEMA,
+      databaseSeal: request.seal,
+      workspaceSeal: request.workspaceSeal,
+    }),
+    "utf8",
+  );
+  if (header.byteLength > 1024 * 1024) {
+    throw new TypeError("PM recovery set header exceeds the allowed range");
+  }
+  const prefix = Buffer.allocUnsafe(20);
+  prefix.writeUInt32BE(header.byteLength, 0);
+  prefix.writeBigUInt64BE(BigInt(request.bytes.byteLength), 4);
+  prefix.writeBigUInt64BE(BigInt(request.workspaceBytes.byteLength), 12);
+  return Buffer.concat([
+    RECOVERY_SET_MAGIC,
+    prefix,
+    header,
+    request.bytes,
+    request.workspaceBytes,
+  ]);
+}
+
+function decodeRecoverySet(value, acknowledgement, manifestDigest) {
+  const bytes = snapshotBytes(
+    value,
+    MAX_SNAPSHOT_BYTES + MAX_WORKSPACE_SNAPSHOT_BYTES + 1024 * 1024,
+  );
+  const prefixOffset = RECOVERY_SET_MAGIC.byteLength;
+  const headerOffset = prefixOffset + 20;
+  if (
+    bytes.byteLength < headerOffset ||
+    !bytes.subarray(0, prefixOffset).equals(RECOVERY_SET_MAGIC)
+  ) {
+    corrupt("PM recovery set magic is invalid");
+  }
+  const headerLength = bytes.readUInt32BE(prefixOffset);
+  const databaseLength = bytes.readBigUInt64BE(prefixOffset + 4);
+  const workspaceLength = bytes.readBigUInt64BE(prefixOffset + 12);
+  if (
+    headerLength < 1 ||
+    headerLength > 1024 * 1024 ||
+    databaseLength < 1n ||
+    databaseLength > BigInt(MAX_SNAPSHOT_BYTES) ||
+    workspaceLength < 1n ||
+    workspaceLength > BigInt(MAX_WORKSPACE_SNAPSHOT_BYTES) ||
+    databaseLength > BigInt(Number.MAX_SAFE_INTEGER) ||
+    workspaceLength > BigInt(Number.MAX_SAFE_INTEGER)
+  ) {
+    corrupt("PM recovery set lengths are invalid");
+  }
+  const databaseBytesLength = Number(databaseLength);
+  const workspaceBytesLength = Number(workspaceLength);
+  const databaseOffset = headerOffset + headerLength;
+  const workspaceOffset = databaseOffset + databaseBytesLength;
+  if (workspaceOffset + workspaceBytesLength !== bytes.byteLength) {
+    corrupt("PM recovery set length binding is invalid");
+  }
+  const headerText = bytes
+    .subarray(headerOffset, databaseOffset)
+    .toString("utf8");
+  let header;
+  try {
+    header = JSON.parse(headerText);
+  } catch (cause) {
+    corrupt("PM recovery set header is invalid JSON", { cause });
+  }
+  if (canonical(header) !== headerText) {
+    corrupt("PM recovery set header is not canonical");
+  }
+  exact(
+    header,
+    ["schema", "databaseSeal", "workspaceSeal"],
+    "PM recovery set header",
+  );
+  if (header.schema !== RECOVERY_SET_SCHEMA) {
+    corrupt("PM recovery set schema is invalid");
+  }
+  const normalizedDatabaseSeal = databaseSeal(header.databaseSeal);
+  const normalizedWorkspaceSeal = workspaceSeal(
+    header.workspaceSeal,
+    manifestDigest,
+  );
+  const databaseBytes = Buffer.from(
+    bytes.subarray(databaseOffset, workspaceOffset),
+  );
+  const workspaceBytes = Buffer.from(bytes.subarray(workspaceOffset));
+  if (
+    normalizedDatabaseSeal.sealDigest !== acknowledgement.sealDigest ||
+    normalizedDatabaseSeal.databaseSnapshotDigest !==
+      acknowledgement.databaseSnapshotDigest ||
+    normalizedDatabaseSeal.databaseSnapshotBytes !== databaseBytesLength ||
+    normalizedWorkspaceSeal.sealDigest !==
+      acknowledgement.workspaceSealDigest ||
+    normalizedWorkspaceSeal.workspaceRootDigest !==
+      acknowledgement.workspaceRootDigest ||
+    normalizedWorkspaceSeal.capturePolicyDigest !==
+      acknowledgement.capturePolicyDigest ||
+    normalizedWorkspaceSeal.workspaceSnapshotDigest !==
+      acknowledgement.workspaceSnapshotDigest ||
+    normalizedWorkspaceSeal.workspaceSnapshotBytes !== workspaceBytesLength ||
+    normalizedWorkspaceSeal.workspaceFileCount !==
+      acknowledgement.workspaceFileCount ||
+    hashBytes(databaseBytes, DATABASE_SNAPSHOT_DOMAIN) !==
+      normalizedDatabaseSeal.databaseSnapshotDigest ||
+    hashBytes(workspaceBytes, WORKSPACE_SNAPSHOT_DOMAIN) !==
+      normalizedWorkspaceSeal.workspaceSnapshotDigest
+  ) {
+    corrupt("PM recovery set contents differ from its acknowledgement");
+  }
+  return {
+    databaseSeal: normalizedDatabaseSeal,
+    databaseBytes,
+    workspaceSeal: normalizedWorkspaceSeal,
+    workspaceBytes,
+  };
+}
+
 function captureAuthority(value) {
   exact(
     value,
@@ -225,23 +424,40 @@ function validateAuthorityReceipt(value, binding, authorityId, schema, label) {
 }
 
 function normalizeRequest(value, expectedManifestDigest) {
+  const composite =
+    value?.schema === PM_EXPLORATION_RECOVERY_SET_REQUEST_SCHEMA;
   exact(
     value,
-    [
-      "schema",
-      "manifestDigest",
-      "transitionKind",
-      "snapshotRole",
-      "evidenceDigest",
-      "seal",
-      "bytes",
-    ],
+    composite
+      ? [
+          "schema",
+          "manifestDigest",
+          "transitionKind",
+          "snapshotRole",
+          "evidenceDigest",
+          "seal",
+          "bytes",
+          "workspaceSeal",
+          "workspaceBytes",
+        ]
+      : [
+          "schema",
+          "manifestDigest",
+          "transitionKind",
+          "snapshotRole",
+          "evidenceDigest",
+          "seal",
+          "bytes",
+        ],
     "PM recovery snapshot request",
   );
   const expectedRole =
     value.transitionKind === "success" ? "post-run" : "pre-run";
   if (
-    value.schema !== PM_EXPLORATION_RECOVERY_SNAPSHOT_REQUEST_SCHEMA ||
+    ![
+      PM_EXPLORATION_RECOVERY_SNAPSHOT_REQUEST_SCHEMA,
+      PM_EXPLORATION_RECOVERY_SET_REQUEST_SCHEMA,
+    ].includes(value.schema) ||
     value.manifestDigest !== expectedManifestDigest ||
     !["success", "failure"].includes(value.transitionKind) ||
     value.snapshotRole !== expectedRole
@@ -256,19 +472,44 @@ function normalizeRequest(value, expectedManifestDigest) {
   ) {
     corrupt("PM recovery snapshot bytes differ from the database seal");
   }
+  const normalizedWorkspaceSeal = composite
+    ? workspaceSeal(value.workspaceSeal, expectedManifestDigest)
+    : null;
+  const workspaceBytes = composite
+    ? boundedSnapshotBytes(
+        value.workspaceBytes,
+        MAX_WORKSPACE_SNAPSHOT_BYTES,
+        "PM recovery workspace snapshot",
+      )
+    : null;
+  if (
+    composite &&
+    (normalizedWorkspaceSeal.workspaceSnapshotBytes !==
+      workspaceBytes.byteLength ||
+      normalizedWorkspaceSeal.workspaceSnapshotDigest !==
+        hashBytes(workspaceBytes, WORKSPACE_SNAPSHOT_DOMAIN))
+  ) {
+    corrupt("PM recovery workspace bytes differ from the workspace seal");
+  }
   return {
+    schema: value.schema,
     manifestDigest: expectedManifestDigest,
     transitionKind: value.transitionKind,
     snapshotRole: value.snapshotRole,
     evidenceDigest: digest(value.evidenceDigest, "evidenceDigest"),
     seal,
     bytes,
+    workspaceSeal: normalizedWorkspaceSeal,
+    workspaceBytes,
   };
 }
 
 function ackCore(binding, request, authorityId, durabilityReceiptDigest) {
-  return {
-    schema: PM_EXPLORATION_RECOVERY_SNAPSHOT_ACK_SCHEMA,
+  const core = {
+    schema:
+      request.workspaceSeal === null
+        ? PM_EXPLORATION_RECOVERY_SNAPSHOT_ACK_SCHEMA
+        : PM_EXPLORATION_RECOVERY_SET_ACK_SCHEMA,
     authenticated: true,
     durable: true,
     readbackVerified: true,
@@ -285,6 +526,16 @@ function ackCore(binding, request, authorityId, durabilityReceiptDigest) {
     durabilityReceiptDigest,
     qualifiesForPromotion: false,
   };
+  if (request.workspaceSeal !== null) {
+    core.workspaceSealDigest = request.workspaceSeal.sealDigest;
+    core.workspaceRootDigest = request.workspaceSeal.workspaceRootDigest;
+    core.capturePolicyDigest = request.workspaceSeal.capturePolicyDigest;
+    core.workspaceSnapshotDigest =
+      request.workspaceSeal.workspaceSnapshotDigest;
+    core.workspaceSnapshotBytes = request.workspaceSeal.workspaceSnapshotBytes;
+    core.workspaceFileCount = request.workspaceSeal.workspaceFileCount;
+  }
+  return core;
 }
 
 export function verifyPmExplorationRecoverySnapshotAck(value, expected = {}) {
@@ -302,6 +553,7 @@ export function verifyPmExplorationRecoverySnapshotAck(value, expected = {}) {
     "transitionKind",
     "evidenceDigest",
     "sealDigest",
+    "workspaceSealDigest",
   ]);
   for (const key of Reflect.ownKeys(expected)) {
     const descriptor = Object.getOwnPropertyDescriptor(expected, key);
@@ -317,27 +569,54 @@ export function verifyPmExplorationRecoverySnapshotAck(value, expected = {}) {
       );
     }
   }
+  const composite = value?.schema === PM_EXPLORATION_RECOVERY_SET_ACK_SCHEMA;
   exact(
     value,
-    [
-      "schema",
-      "authenticated",
-      "durable",
-      "readbackVerified",
-      "manifestDigest",
-      "transitionKind",
-      "snapshotRole",
-      "evidenceDigest",
-      "sealDigest",
-      "databaseSnapshotDigest",
-      "databaseSnapshotBytes",
-      "artifactDigest",
-      "artifactRef",
-      "durabilityAuthorityId",
-      "durabilityReceiptDigest",
-      "qualifiesForPromotion",
-      "snapshotAckDigest",
-    ],
+    composite
+      ? [
+          "schema",
+          "authenticated",
+          "durable",
+          "readbackVerified",
+          "manifestDigest",
+          "transitionKind",
+          "snapshotRole",
+          "evidenceDigest",
+          "sealDigest",
+          "databaseSnapshotDigest",
+          "databaseSnapshotBytes",
+          "workspaceSealDigest",
+          "workspaceRootDigest",
+          "capturePolicyDigest",
+          "workspaceSnapshotDigest",
+          "workspaceSnapshotBytes",
+          "workspaceFileCount",
+          "artifactDigest",
+          "artifactRef",
+          "durabilityAuthorityId",
+          "durabilityReceiptDigest",
+          "qualifiesForPromotion",
+          "snapshotAckDigest",
+        ]
+      : [
+          "schema",
+          "authenticated",
+          "durable",
+          "readbackVerified",
+          "manifestDigest",
+          "transitionKind",
+          "snapshotRole",
+          "evidenceDigest",
+          "sealDigest",
+          "databaseSnapshotDigest",
+          "databaseSnapshotBytes",
+          "artifactDigest",
+          "artifactRef",
+          "durabilityAuthorityId",
+          "durabilityReceiptDigest",
+          "qualifiesForPromotion",
+          "snapshotAckDigest",
+        ],
     "PM recovery snapshot acknowledgement",
   );
   const core = {
@@ -367,8 +646,31 @@ export function verifyPmExplorationRecoverySnapshotAck(value, expected = {}) {
     ),
     qualifiesForPromotion: value.qualifiesForPromotion,
   };
+  if (composite) {
+    core.workspaceSealDigest = digest(
+      value.workspaceSealDigest,
+      "workspaceSealDigest",
+    );
+    core.workspaceRootDigest = digest(
+      value.workspaceRootDigest,
+      "workspaceRootDigest",
+    );
+    core.capturePolicyDigest = digest(
+      value.capturePolicyDigest,
+      "capturePolicyDigest",
+    );
+    core.workspaceSnapshotDigest = digest(
+      value.workspaceSnapshotDigest,
+      "workspaceSnapshotDigest",
+    );
+    core.workspaceSnapshotBytes = value.workspaceSnapshotBytes;
+    core.workspaceFileCount = value.workspaceFileCount;
+  }
   if (
-    core.schema !== PM_EXPLORATION_RECOVERY_SNAPSHOT_ACK_SCHEMA ||
+    ![
+      PM_EXPLORATION_RECOVERY_SNAPSHOT_ACK_SCHEMA,
+      PM_EXPLORATION_RECOVERY_SET_ACK_SCHEMA,
+    ].includes(core.schema) ||
     core.authenticated !== true ||
     core.durable !== true ||
     core.readbackVerified !== true ||
@@ -378,15 +680,28 @@ export function verifyPmExplorationRecoverySnapshotAck(value, expected = {}) {
     !Number.isSafeInteger(core.databaseSnapshotBytes) ||
     core.databaseSnapshotBytes < 1 ||
     core.databaseSnapshotBytes > MAX_SNAPSHOT_BYTES ||
+    (composite &&
+      (!Number.isSafeInteger(core.workspaceSnapshotBytes) ||
+        core.workspaceSnapshotBytes < 1 ||
+        core.workspaceSnapshotBytes > MAX_WORKSPACE_SNAPSHOT_BYTES ||
+        !Number.isSafeInteger(core.workspaceFileCount) ||
+        core.workspaceFileCount < 0 ||
+        core.workspaceFileCount > 100_000)) ||
     core.qualifiesForPromotion !== false
   ) {
     throw new Error("PM recovery snapshot acknowledgement is invalid");
   }
+  if (expected.workspaceSealDigest !== undefined && !composite) {
+    throw new Error(
+      "PM recovery snapshot acknowledgement workspaceSealDigest mismatch",
+    );
+  }
   for (const key of [
     "manifestDigest",
     "transitionKind",
     "evidenceDigest",
     "sealDigest",
+    ...(composite ? ["workspaceSealDigest"] : []),
   ]) {
     if (expected[key] !== undefined && core[key] !== expected[key])
       throw new Error(`PM recovery snapshot acknowledgement ${key} mismatch`);
@@ -395,10 +710,7 @@ export function verifyPmExplorationRecoverySnapshotAck(value, expected = {}) {
     value.snapshotAckDigest,
     "snapshotAckDigest",
   );
-  if (
-    snapshotAckDigest !==
-    hash(PM_EXPLORATION_RECOVERY_SNAPSHOT_ACK_SCHEMA, core)
-  ) {
+  if (snapshotAckDigest !== hash(core.schema, core)) {
     throw new Error("PM recovery snapshot acknowledgement digest mismatch");
   }
   return deepFreeze({ ...core, snapshotAckDigest });
@@ -433,7 +745,11 @@ export function capturePmExplorationRecoverySnapshotStore(value) {
     manifestDigest: captured.manifestDigest,
     retainTransitionSnapshot: (input) => {
       const request = normalizeRequest(input, captured.manifestDigest);
-      const artifactDigest = hashBytes(request.bytes);
+      const artifactBytes =
+        request.workspaceBytes === null
+          ? request.bytes
+          : encodeRecoverySet(request);
+      const artifactDigest = hashBytes(artifactBytes);
       const binding = deepFreeze({
         artifactTenantId: captured.artifactTenantId,
         digest: artifactDigest,
@@ -441,12 +757,13 @@ export function capturePmExplorationRecoverySnapshotStore(value) {
         ref: `cc-pm-recovery-snapshot:${request.manifestDigest.slice(7)}:${request.evidenceDigest.slice(7)}:${request.snapshotRole}`,
         retention: "ledger",
         schema: EVOLUTION_ARTIFACT_DURABILITY_BINDING_SCHEMA,
-        type: SNAPSHOT_TYPE,
+        type:
+          request.workspaceBytes === null ? SNAPSHOT_TYPE : RECOVERY_SET_TYPE,
       });
       const retained = captured.authority.retain(
         Object.freeze({
           binding,
-          bytes: Buffer.from(request.bytes),
+          bytes: Buffer.from(artifactBytes),
           schema: EVOLUTION_ARTIFACT_DURABILITY_RETAIN_REQUEST_SCHEMA,
         }),
       );
@@ -500,8 +817,11 @@ export function capturePmExplorationRecoverySnapshotStore(value) {
         EVOLUTION_ARTIFACT_DURABILITY_RESOLUTION_SCHEMA,
         "PM recovery snapshot durability resolution",
       );
-      const readback = snapshotBytes(resolved.bytes);
-      if (!readback.equals(request.bytes))
+      const readback = snapshotBytes(
+        resolved.bytes,
+        MAX_SNAPSHOT_BYTES + MAX_WORKSPACE_SNAPSHOT_BYTES + 1024 * 1024,
+      );
+      if (!readback.equals(artifactBytes))
         corrupt("PM recovery snapshot durability readback differs");
       const core = ackCore(
         binding,
@@ -511,10 +831,109 @@ export function capturePmExplorationRecoverySnapshotStore(value) {
       );
       return deepFreeze({
         ...core,
-        snapshotAckDigest: hash(
-          PM_EXPLORATION_RECOVERY_SNAPSHOT_ACK_SCHEMA,
-          core,
+        snapshotAckDigest: hash(core.schema, core),
+      });
+    },
+    resolveTransitionSnapshot: (input) => {
+      const acknowledgement = verifyPmExplorationRecoverySnapshotAck(input, {
+        manifestDigest: captured.manifestDigest,
+      });
+      const composite =
+        acknowledgement.schema === PM_EXPLORATION_RECOVERY_SET_ACK_SCHEMA;
+      const binding = deepFreeze({
+        artifactTenantId: captured.artifactTenantId,
+        digest: acknowledgement.artifactDigest,
+        purpose: captured.purpose,
+        ref: acknowledgement.artifactRef,
+        retention: "ledger",
+        schema: EVOLUTION_ARTIFACT_DURABILITY_BINDING_SCHEMA,
+        type: composite ? RECOVERY_SET_TYPE : SNAPSHOT_TYPE,
+      });
+      const resolved = captured.authority.resolve(
+        Object.freeze({
+          artifactTenantId: binding.artifactTenantId,
+          digest: binding.digest,
+          purpose: binding.purpose,
+          ref: binding.ref,
+          retention: binding.retention,
+          schema: EVOLUTION_ARTIFACT_DURABILITY_RESOLVE_REQUEST_SCHEMA,
+        }),
+      );
+      if (isPromise(resolved)) {
+        corrupt("PM recovery snapshot resolve must be synchronous");
+      }
+      exact(
+        resolved,
+        [
+          "schema",
+          "authenticated",
+          "durable",
+          "authorityId",
+          "artifactTenantId",
+          "digest",
+          "purpose",
+          "ref",
+          "retention",
+          "type",
+          "receiptDigest",
+          "bytes",
+        ],
+        "PM recovery snapshot durability resolution",
+      );
+      validateAuthorityReceipt(
+        Object.fromEntries(
+          Reflect.ownKeys(resolved)
+            .filter((key) => key !== "bytes")
+            .map((key) => [key, resolved[key]]),
         ),
+        binding,
+        captured.authority.id,
+        EVOLUTION_ARTIFACT_DURABILITY_RESOLUTION_SCHEMA,
+        "PM recovery snapshot durability resolution",
+      );
+      const artifactBytes = snapshotBytes(
+        resolved.bytes,
+        MAX_SNAPSHOT_BYTES + MAX_WORKSPACE_SNAPSHOT_BYTES + 1024 * 1024,
+      );
+      if (hashBytes(artifactBytes) !== acknowledgement.artifactDigest) {
+        corrupt("PM recovery snapshot resolution digest mismatch");
+      }
+      const decoded = composite
+        ? decodeRecoverySet(
+            artifactBytes,
+            acknowledgement,
+            captured.manifestDigest,
+          )
+        : {
+            databaseSeal: null,
+            databaseBytes: artifactBytes,
+            workspaceSeal: null,
+            workspaceBytes: null,
+          };
+      if (
+        decoded.databaseBytes.byteLength !==
+          acknowledgement.databaseSnapshotBytes ||
+        hashBytes(decoded.databaseBytes, DATABASE_SNAPSHOT_DOMAIN) !==
+          acknowledgement.databaseSnapshotDigest
+      ) {
+        corrupt("PM recovery database snapshot resolution is invalid");
+      }
+      return Object.freeze({
+        schema: PM_EXPLORATION_RECOVERY_SNAPSHOT_RESOLUTION_SCHEMA,
+        authenticated: true,
+        durable: true,
+        readbackVerified: true,
+        manifestDigest: captured.manifestDigest,
+        acknowledgement,
+        databaseSeal: decoded.databaseSeal,
+        databaseBytes: Buffer.from(decoded.databaseBytes),
+        workspaceSeal: decoded.workspaceSeal,
+        workspaceBytes:
+          decoded.workspaceBytes === null
+            ? null
+            : Buffer.from(decoded.workspaceBytes),
+        durabilityReceiptDigest: resolved.receiptDigest,
+        qualifiesForPromotion: false,
       });
     },
   });