create-agdf 0.20.2 → 0.31.0

package/generated/plugins/copilot/agdf/runtime/create-agdf/runtime/core/lib/control-state/run-step-transaction.js

@@ -1,3 +1,6 @@
+import { runDocumentPath, runEvidencePath, runControlPath } from './run-identity.js';
+import { assertInputConfigurationCurrent } from '../resources/configuration.js';
+import { bindInputResolution, resolutionRecord, resolutionRecordVersion, recordedInputResolution } from './input-resolution.js';
 import { validOwnedOutputs, publishOwnedOutputs, recoverOwnedOutputs, ownedOutputText } from "./run-owned-outputs.js";
 import { readRunOperations } from "./run-operations.js";
 import { readApprovalOperations } from "./approval-operations.js";
@@ -8,14 +11,15 @@ import { dirname, join } from "node:path";
 import { parseRunState } from "./run-state-parser.js";
 import { artefactFileDigest, listedArtefactPaths, runSealState, computeRunSeals, canonicalRunText } from "./run-seal.js";
 import { atomicWrite, withOwnedFileLock, writeRunLocked } from "./run-state-writer.js";
-import { pendingRunStepPath } from "./run-step-pending.js";
+import { pendingRunStepPath, pendingRunStepIds } from "./run-step-pending.js";
 import { readSourceRevisions, revisionHistoryPrefix } from "./run-source-revisions.js";
 import { REVISION_ID_PATTERN } from "./run-identity.js";
-import { DIGEST_PATTERN, exactObject, resolveControlCommandTarget } from "./approval-command-contract.js";
+import { DIGEST_PATTERN, exactObject, resolveControlCommandTarget, canonicalJson } from "./approval-command-contract.js";
 import { byteDigest, readHistoryBytes, collectRevisionHistory, validateRevisionHistory, validateEarlyPrdHistory } from "./run-revision-history.js";
 import { hasSymlinkComponent, isSafeControlRelativePath } from "./contained-file.js";
 import { renameSyncWithRetry } from "../fs-swap.js";
 import { fsyncDirectory } from "./run-state-writer.js";
+import { readControlLayout, CURRENT_LAYOUT, withControlRecovery, markControlMutationEffect, currentControlMutationId, markControlMutationRollbackKnown } from './control-layout.js';
 
 const digest = (value) => createHash("sha256").update(value, "utf8").digest("hex");
 
@@ -44,36 +48,56 @@ function invalidJournalArchive(journal, runId) {
     || new Set(journal.archive.sources.map(row => row.path)).size !== journal.archive.sources.length;
 }
 
+// The current journal owns the immutable staged proposal needed to reconstruct
+// its archive after interruption. No caller-selected filesystem output is added.
+function validJournalProposal(journal) {
+  const p = journal.proposal_material;
+  return exactObject(p, ['path', 'digest', 'content']) && typeof p.content === 'string' && Buffer.byteLength(p.content) <= 131072
+    && p.digest === byteDigest(Buffer.from(canonicalRunText(p.content)))
+    && p.path === runEvidencePath(journal.run_id, `EVIDENCE-${p.digest.slice(7)}.json`)
+    && journal.archive.sources.some(row => row.path === p.path && row.digest === byteDigest(Buffer.from(p.content)));
+}
+
+export const RUN_TRANSACTION_VERSION = 7;
+const commandKinds = ['step.record', 'ur_draft.replace', 'artefact.record', 'approval.record', 'presentation_decision.record', 'prd_revision.reopen', 'closeout.record', 'lifecycle_close.record'];
+const sourceJournal = journal => resolutionRecordVersion(journal) === RUN_TRANSACTION_VERSION && journal.kind === 'source_revision';
+const outputJournal = journal => resolutionRecordVersion(journal) === RUN_TRANSACTION_VERSION && commandKinds.includes(journal.kind);
+
+function validJournalOutputs(journal) {
+  if (!validOwnedOutputs(journal.run_id, journal.outputs)) return false;
+  const paths = journal.outputs.map(row => row.path), doc = name => runDocumentPath(journal.run_id, name);
+  if (journal.kind === 'ur_draft.replace') return paths.length === 1 && paths[0] === doc('UR.md');
+  if (journal.kind === 'artefact.record') return paths.length === 1 && ['PRD.md', 'SD.md', 'TP.md', 'QA_REPORT.md'].some(name => paths[0] === doc(name));
+  if (journal.kind === 'closeout.record') return paths.length === 1 && ['OR.md', 'VERIFIED_CHANGE.md'].some(name => paths[0] === doc(name));
+  if (journal.kind === 'step.record') return paths.length <= 1 && !paths.includes(doc('OR.md'));
+  return paths.length === 0;
+}
+function validJournal(root, journal, runId) {
+  const source = journal.kind === 'source_revision', update = journal.kind === 'run.update';
+  const fields = ['schema_version', 'run_id', 'operation_id', 'old_revision_id', 'next_revision_id', 'old_run_digest', 'kind', 'target_id', 'request_digest', 'outputs'];
+  if (source) fields.push('preview_digest', 'archive', ...(Object.hasOwn(journal, 'proposal_material') ? ['proposal_material'] : []));
+  else if (journal.kind === 'prd_revision.reopen') fields.push('archive');
+  return exactObject(journal, fields) && journal.schema_version === RUN_TRANSACTION_VERSION && journal.run_id === runId
+    && [journal.operation_id, journal.old_revision_id, journal.next_revision_id].every(value => REVISION_ID_PATTERN.test(value))
+    && journal.old_revision_id !== journal.next_revision_id
+    && /^[a-f0-9]{64}$/u.test(journal.old_run_digest) && DIGEST_PATTERN.test(journal.request_digest)
+    && journal.target_id === resolveControlCommandTarget(root).target_id
+    && (source || update || commandKinds.includes(journal.kind))
+    && (source || update ? Array.isArray(journal.outputs) && journal.outputs.length === 0 : validJournalOutputs(journal))
+    && (!source || DIGEST_PATTERN.test(journal.preview_digest))
+    && (!(source || journal.kind === 'prd_revision.reopen') || !invalidJournalArchive(journal, runId))
+    && (!Object.hasOwn(journal, 'proposal_material') || source && validJournalProposal(journal));
+}
 function journalState(root, runId, { readJournal } = {}) {
   const path = pendingRunStepPath(root, runId);
-  let journal;
+  let stored;
   try {
-    if (hasSymlinkComponent(root, `.agdf/control/runs/${runId}/RUN_STEP_PENDING.json`)) throw recoveryError(runId);
-    journal = JSON.parse(readJournal ? readJournal(path) : checkedFile(path));
+    if (hasSymlinkComponent(root, runControlPath(runId, 'RUN_STEP_PENDING.json'))) throw recoveryError(runId);
+    stored = JSON.parse(readJournal ? readJournal(path) : checkedFile(path));
   } catch { throw recoveryError(runId); }
-  if (![1, 2, 3].includes(journal?.schema_version) || journal.run_id !== runId
-      || typeof journal.old_run_digest !== "string" || typeof journal.old_revision_id !== "string"
-      || typeof journal.next_revision_id !== "string" || typeof journal.operation_id !== "string"
-      || (journal.backlog !== null && (typeof journal.backlog?.old !== "string" || typeof journal.backlog?.next !== "string"))
-      || (journal.or !== null && (journal.or?.old !== null && typeof journal.or?.old !== "string"
-        || typeof journal.or?.next !== "string"))) throw recoveryError(runId);
-  if (journal.schema_version === 2 && (!exactObject(journal, ["schema_version", "run_id", "operation_id", "old_revision_id", "next_revision_id", "old_run_digest", "backlog", "or", "kind", "target_id", "request_digest", "preview_digest", "archive"])
-      || journal.kind !== "source_revision" || journal.or !== null
-      || ![journal.operation_id, journal.old_revision_id, journal.next_revision_id].every(value => REVISION_ID_PATTERN.test(value))
-      || !/^[a-f0-9]{64}$/u.test(journal.old_run_digest)
-      || journal.target_id !== resolveControlCommandTarget(root).target_id
-      || ![journal.request_digest, journal.preview_digest].every(value => DIGEST_PATTERN.test(value))
-      || invalidJournalArchive(journal, runId))) throw recoveryError(runId);
-  if (journal.schema_version === 3 && (!exactObject(journal, ["schema_version", "run_id", "operation_id", "old_revision_id", "next_revision_id", "old_run_digest", "backlog", "or", "kind", "target_id", "request_digest", "outputs", ...(journal.kind === "prd_revision.reopen" ? ["archive"] : [])])
-      || !["step.record", "artefact.record", "approval.record", "presentation_decision.record", "prd_revision.reopen", "closeout.record"].includes(journal.kind)
-      || journal.or !== null || ![journal.operation_id, journal.old_revision_id, journal.next_revision_id].every(value => REVISION_ID_PATTERN.test(value))
-      || !/^[a-f0-9]{64}$/u.test(journal.old_run_digest) || journal.target_id !== resolveControlCommandTarget(root).target_id
-      || !DIGEST_PATTERN.test(journal.request_digest) || !validOwnedOutputs(runId, journal.outputs)
-      || journal.kind === "prd_revision.reopen" && invalidJournalArchive(journal, runId)
-      || journal.kind === "step.record" && journal.outputs.some(row => row.path.endsWith("/OR.md"))
-      || journal.kind === "closeout.record" && (journal.outputs.length !== 1 || journal.outputs[0].path !== `.agdf/control/artefacts/${runId}/OR.md`)
-      || !["step.record", "closeout.record"].includes(journal.kind) && journal.outputs.length)) throw recoveryError(runId);
-  return { path, journal };
+  const journal = resolutionRecord(stored);
+  if (!journal || !validJournal(root, journal, runId)) throw recoveryError(runId);
+  return { path, journal: stored };
 }
 
 // Read-only bounded observation; never rolls back, forwards or retires an intent.
@@ -81,27 +105,31 @@ export function readPendingRunStepJournal(root, runId, options = {}) {
   const { journal } = journalState(root, runId, options); return journal;
 }
 
-function v3ReceiptMatches(journal, runText) {
+function sameInputResolution(first, second) {
+  const a = recordedInputResolution(first), b = recordedInputResolution(second);
+  return a !== null && b !== null && canonicalJson(a) === canonicalJson(b);
+}
+function currentReceiptMatches(journal, runText) {
+  const sameResolution = record => sameInputResolution(journal, record);
   if (journal.kind === "artefact.record") {
     const r = readArtefactBindings(runText).receipts.find(row => row.operation.id === journal.operation_id);
     return r && r.operation.previous_revision_id === journal.old_revision_id && r.operation.resulting_revision_id === journal.next_revision_id
-      && r.operation.request_digest === journal.request_digest && r.target_id === journal.target_id;
+      && r.operation.request_digest === journal.request_digest && r.target_id === journal.target_id && sameResolution(r);
   }
   if (journal.kind === "approval.record") {
     const r = readApprovalOperations(runText).receipts.find(row => row.operation_id === journal.operation_id);
     return r && r.binding.expected_revision_id === journal.old_revision_id && r.effect.resulting_revision_id === journal.next_revision_id
-      && r.request_digest === journal.request_digest && r.binding.target_id === journal.target_id;
+      && r.request_digest === journal.request_digest && r.binding.target_id === journal.target_id && sameResolution(r);
   }
   const r = readRunOperations(runText).receipts.find(row => row.operation_id === journal.operation_id);
   return r && r.kind === journal.kind && r.expected_revision_id === journal.old_revision_id && r.effect.resulting_revision_id === journal.next_revision_id
-    && r.request_digest === journal.request_digest && r.target_id === journal.target_id;
+    && r.request_digest === journal.request_digest && r.target_id === journal.target_id && sameResolution(r);
 }
 
-// A journal embeds both Backlog versions; it is not an artefact JSON input. Keep its
-// own strict transaction schema and contained-path checks for revision observations.
+// The same current journal codec serves explicit source-revision observations.
 export function readPendingSourceRevisionJournal(root, runId) {
   const { journal } = journalState(root, runId);
-  if (journal.schema_version !== 2) throw recoveryError(runId);
+  if (!sourceJournal(journal)) throw recoveryError(runId);
   return journal;
 }
 
@@ -115,7 +143,7 @@ function archiveDirectories(root, journal) {
 function discardOwnedArchive(root, journal) {
   const dirs = archiveDirectories(root, journal);
   const tempSuffix = `.tmp-${journal.operation_id}`;
-  const expected = collectRevisionHistory(root, journal.run_id, journal.operation_id, journal.archive.sources.map(row => row.path));
+  const expected = collectRevisionHistory(root, journal.run_id, journal.operation_id, journal.archive.sources.map(row => row.path), { proposalMaterial: journal.proposal_material });
   if (expected.digest !== journal.archive.digest) throw recoveryError(journal.run_id);
   const partialMatches = (path, bytes) => {
     const stats = lstatSync(path);
@@ -155,7 +183,7 @@ function publishArchive(root, journal, history, afterWrite) {
   atomicWrite(join(dirs.stage, "OWNER.json"), JSON.stringify({ operation_id: journal.operation_id, manifest_digest: journal.archive.digest }) + "\n");
   mkdirSync(join(dirs.stage, "files")); afterWrite("archive_intent");
   for (const file of history.files) {
-    if (byteDigest(readHistoryBytes(root, file.path)) !== file.digest) throw Error("AGDF_STALE_RUN_REVISION");
+    if (byteDigest(journal.proposal_material?.path === file.path ? Buffer.from(journal.proposal_material.content) : readHistoryBytes(root, file.path)) !== file.digest) throw Error("AGDF_STALE_RUN_REVISION");
     atomicWrite(join(dirs.stage, "files", file.snapshot.split("/").at(-1)), file.bytes,
       { temporaryPath: join(dirs.stage, 'files', file.snapshot.split('/').at(-1) + `.tmp-${journal.operation_id}`),
         checkpoint: stage => afterWrite(`archive_${stage}`) });
@@ -168,30 +196,26 @@ function publishArchive(root, journal, history, afterWrite) {
   fsyncDirectory(dirname(dirs.final)); afterWrite("archive_published");
 }
 
-// Called only while the selected Run lock and then the shared Backlog lock are held.
+// Called with the selected Run lock. Only current Run-owned intent is recoverable.
 export function recoverPendingRunStepLocked(root, runId, { sourceRevision = false } = {}) {
   const path = pendingRunStepPath(root, runId);
   if (!existsSync(path)) return { status: "none" };
   const { journal } = journalState(root, runId);
-  if (journal.schema_version === 2 && !sourceRevision) throw recoveryError(runId);
-  const runPath = join(dirname(path), "RUN_STATE.md");
-  const backlogPath = join(root, ".agdf", "control", "MASTER_BACKLOG.md");
-  const orPath = join(root, ".agdf", "control", "artefacts", runId, "OR.md");
+  if (sourceJournal(journal) && !sourceRevision) throw recoveryError(runId);
+  markControlMutationEffect();
+  const runPath = join(dirname(dirname(path)), "RUN_STATE.md");
   const runText = checkedFile(runPath);
-  const backlogText = journal.backlog ? checkedFile(backlogPath) : null;
-  const orText = journal.or ? checkedFile(orPath) : null;
   if (runText === null) throw recoveryError(runId);
 
   if (digest(runText) === journal.old_run_digest) {
     const current = parseRunState(runText, runId);
     if (!current.valid || current.meta.revision_id !== journal.old_revision_id
-        || journal.schema_version === 2 && runSealState(root, runText).status !== "valid"
-        || (journal.backlog && backlogText !== journal.backlog.old)) throw recoveryError(runId);
-    if (journal.schema_version === 2 || journal.kind === "prd_revision.reopen") {
-      if (journal.archive.sources.some(row => byteDigest(readHistoryBytes(root, row.path)) !== row.digest)) throw recoveryError(runId);
+        || sourceJournal(journal) && runSealState(root, runText).status !== "valid") throw recoveryError(runId);
+    if (sourceJournal(journal) || journal.kind === "prd_revision.reopen") {
+      if (journal.archive.sources.some(row => byteDigest(journal.proposal_material?.path === row.path ? Buffer.from(journal.proposal_material.content) : readHistoryBytes(root, row.path)) !== row.digest)) throw recoveryError(runId);
       discardOwnedArchive(root, journal);
     }
-    if (journal.schema_version === 3) {
+    if (outputJournal(journal)) {
       const original = computeRunSeals(root, runText, { artefactDigests: new Map(journal.outputs.map(row => [row.path,
         row.old === null ? "missing" : `sha256:${digest(canonicalRunText(row.old))}`])) });
       if (original.content_seal !== current.meta.content_seal || original.approval_seal !== current.meta.approval_seal
@@ -199,90 +223,82 @@ export function recoverPendingRunStepLocked(root, runId, { sourceRevision = fals
       recoverOwnedOutputs(root, journal, false);
       if (runSealState(root, runText).status !== "valid") throw recoveryError(runId);
     }
-    if (journal.or) {
-      if (orText !== journal.or.next && orText !== journal.or.old) throw recoveryError(runId);
-      if (orText === journal.or.next) {
-        if (journal.or.old === null) unlinkSync(orPath);
-        else atomicWrite(orPath, journal.or.old);
-      }
-    }
     unlinkSync(path);
-    if (journal.schema_version >= 2) fsyncDirectory(dirname(path));
+    fsyncDirectory(dirname(path));
     return { status: "rolled_back", operation_id: journal.operation_id };
   }
 
   const committed = parseRunState(runText, runId);
   if (!committed.valid || committed.meta.revision_id !== journal.next_revision_id
-      || runSealState(root, runText).status !== "valid"
-      || (journal.or && orText !== journal.or.next)) throw recoveryError(runId);
-  if (journal.schema_version === 2) {
+      || runSealState(root, runText).status !== "valid") throw recoveryError(runId);
+  if (sourceJournal(journal)) {
     const receipt = readSourceRevisions(runText).receipts.find(row => row.operation_id === journal.operation_id);
     if (!receipt || receipt.archive.digest !== journal.archive.digest || receipt.target_id !== journal.target_id
         || receipt.previous_revision_id !== journal.old_revision_id || receipt.resulting_revision_id !== journal.next_revision_id
         || receipt.request_digest !== journal.request_digest || receipt.preview_digest !== journal.preview_digest
-        || !validateRevisionHistory(root, receipt)) throw recoveryError(runId);
+        || !sameInputResolution(journal, receipt) || !validateRevisionHistory(root, receipt)) throw recoveryError(runId);
   }
-  if (journal.schema_version === 3) {
-    if (!v3ReceiptMatches(journal, runText)) throw recoveryError(runId);
+  if (outputJournal(journal)) {
+    if (!currentReceiptMatches(journal, runText)) throw recoveryError(runId);
     recoverOwnedOutputs(root, journal, true);
     if (journal.kind === "prd_revision.reopen") {
       const receipt = readRunOperations(runText).receipts.find(row => row.operation_id === journal.operation_id);
       if (!receipt || receipt.effect.record.archive.digest !== journal.archive.digest || !validateEarlyPrdHistory(root, receipt)) throw recoveryError(runId);
     }
   }
-  if (journal.backlog) {
-    if (backlogText !== journal.backlog.old && backlogText !== journal.backlog.next) throw recoveryError(runId);
-    if (backlogText === journal.backlog.old) atomicWrite(backlogPath, journal.backlog.next);
-  }
   unlinkSync(path);
-  if (journal.schema_version >= 2) fsyncDirectory(dirname(path));
+  fsyncDirectory(dirname(path));
   return { status: "completed", operation_id: journal.operation_id, revision_id: journal.next_revision_id };
 }
 
+// Independent Run-only journals have no shared output. Unknown journals stay fail-closed.
+export function pendingRunStepConflictIds(root, runId) {
+  return pendingRunStepIds(root).filter(id => {
+    if (id === runId) return true;
+    try { readPendingRunStepJournal(root, id); return false; }
+    catch { return true; }
+  });
+}
+
+export function withRunStepRecoveryLock(root, runId, work) {
+  return withOwnedFileLock(join(root, '.agdf/control/runs', runId, 'RUN_STATE.md'), work);
+}
 export function recoverPendingRunStep(root, runId) {
-  const runPath = join(root, ".agdf", "control", "runs", runId, "RUN_STATE.md");
-  const backlogPath = join(root, ".agdf", "control", "MASTER_BACKLOG.md");
-  return withOwnedFileLock(runPath, () => withOwnedFileLock(backlogPath,
-    () => recoverPendingRunStepLocked(root, runId)));
+  const path = join(root, '.agdf/control/runs', runId, 'RUN_STATE.md');
+  return withRunStepRecoveryLock(root, runId, () => {
+    if (!existsSync(pendingRunStepPath(root, runId))) return { status: 'none' };
+    const pending = readPendingRunStepJournal(root, runId);
+    return withControlRecovery(root, { resource: `run:${runId}`, operation_id: pending.operation_id,
+      proveOutcome: result => ['completed', 'rolled_back'].includes(result.status) && runSealState(root, checkedFile(path)).status === 'valid' }, () => recoverPendingRunStepLocked(root, runId));
+  });
 }
 
-// Called only with both locks held. The Run revision is the commit point; the journal lets a
-// retry restore OR before it or finish Backlog after it without inventing another authority.
-export function commitRunStepLocked(root, { runId, runPath, content, revisionId, expectedContent, backlog, or, afterWrite = () => {}, nextRevisionId = randomUUID(), writeOptions = {}, history, operationContext, outputs = [] }) {
+// The Run revision is the commit point. The current journal binds exact owned
+// outputs and the original normalized command through commit or rollback.
+export function commitRunStepLocked(root, { runId, runPath, content, revisionId, expectedContent, afterWrite = () => {}, nextRevisionId = randomUUID(), writeOptions = {}, history, operationContext, outputs = [] }) {
+  assertInputConfigurationCurrent(root);
+  readControlLayout(root);
   const path = pendingRunStepPath(root, runId);
   if (existsSync(path)) throw recoveryError(runId);
-  const backlogPath = join(root, ".agdf", "control", "MASTER_BACKLOG.md");
-  const orPath = join(root, ".agdf", "control", "artefacts", runId, "OR.md");
-  if (checkedFile(runPath) !== expectedContent || (backlog && checkedFile(backlogPath) !== backlog.old)) {
+  if (checkedFile(runPath) !== expectedContent) {
     throw new Error("AGDF_STALE_RUN_REVISION");
   }
   const seal = runSealState(root, expectedContent);
   if (seal.status !== "valid" && !(seal.status === "content_changed" && writeOptions.allowContentChange)) throw new Error("AGDF_RUN_SEAL_INVALID");
   const listedBefore = listedArtefactPaths(expectedContent).map((artefact) =>
     [artefact, artefactFileDigest(root, artefact)]);
-  const oldOr = or ? checkedFile(orPath) : null;
   const journal = {
-    schema_version: operationContext ? 3 : history ? 2 : 1,
-    run_id: runId,
-    operation_id: operationContext?.operation_id ?? (history ? writeOptions.appendedRevision.operation_id : randomUUID()),
-    old_revision_id: revisionId,
-    next_revision_id: nextRevisionId,
-    old_run_digest: digest(expectedContent),
-    backlog: backlog ? { old: backlog.old, next: backlog.next } : null,
-    or: or ? { old: oldOr, next: or } : null,
+    schema_version: RUN_TRANSACTION_VERSION, run_id: runId,
+    operation_id: operationContext?.operation_id ?? (history ? writeOptions.appendedRevision.operation_id : currentControlMutationId() ?? randomUUID()),
+    old_revision_id: revisionId, next_revision_id: nextRevisionId, old_run_digest: digest(expectedContent),
+    kind: operationContext?.kind ?? (history ? 'source_revision' : 'run.update'),
+    target_id: operationContext?.target_id ?? resolveControlCommandTarget(root).target_id,
+    request_digest: operationContext?.request_digest ?? writeOptions.appendedRevision?.request_digest
+      ?? `sha256:${digest(canonicalJson({ expectedContent, content }))}`,
+    outputs,
   };
-  if (operationContext) {
-    if (or || history && operationContext.kind !== "prd_revision.reopen") throw recoveryError(runId);
-    Object.assign(journal, { kind: operationContext.kind, target_id: operationContext.target_id, request_digest: operationContext.request_digest, outputs });
-    // Validate the strict descriptor and ownership before publishing intent or any output.
-    const allowed = ["step.record", "artefact.record", "approval.record", "presentation_decision.record", "prd_revision.reopen", "closeout.record"];
-    if (!allowed.includes(journal.kind) || !REVISION_ID_PATTERN.test(journal.operation_id) || !DIGEST_PATTERN.test(journal.request_digest)
-        || journal.target_id !== resolveControlCommandTarget(root).target_id || !validOwnedOutputs(runId, outputs)
-        || journal.kind === "step.record" && outputs.some(row => row.path.endsWith("/OR.md"))
-        || journal.kind === "closeout.record" && (outputs.length !== 1 || outputs[0].path !== `.agdf/control/artefacts/${runId}/OR.md`)
-        || !["step.record", "closeout.record"].includes(journal.kind) && outputs.length
-        || outputs.some(row => ownedOutputText(root, runId, row.path) !== row.old)) throw recoveryError(runId);
-  }
+  if (operationContext && (history && operationContext.kind !== 'prd_revision.reopen'
+    || !validJournalOutputs(journal) || outputs.some(row => ownedOutputText(root, runId, row.path) !== row.old))) throw recoveryError(runId);
   if (history) {
     const receipt = writeOptions.appendedRevision ?? writeOptions.appendedOperation;
     if (!operationContext) {
@@ -293,43 +309,38 @@ export function commitRunStepLocked(root, { runId, runPath, content, revisionId,
     }
     journal.archive = { ...(receipt.archive ?? receipt.effect.record.archive),
       files: history.files.map(file => file.snapshot.split("/").at(-1)), sources: history.files.map(({ path, digest }) => ({ path, digest })) };
-    if (invalidJournalArchive(journal, runId)) throw recoveryError(runId);
+    if (history.proposalMaterial) journal.proposal_material = history.proposalMaterial;
+    if (invalidJournalArchive(journal, runId) || journal.proposal_material && !validJournalProposal(journal)) throw recoveryError(runId);
     // A pre-existing directory is not owned by this transaction, even with the same UUID.
     const dirs = archiveDirectories(root, journal);
     if (existsSync(dirs.final) || existsSync(dirs.stage)) throw Error("AGDF_REVISION_HISTORY_INVALID");
   }
+  if (!validJournal(root, journal, runId)) throw recoveryError(runId);
+  const controlDirectory = dirname(path);
+  if (hasSymlinkComponent(root, runControlPath(runId, ''))) throw recoveryError(runId);
+  if (!existsSync(controlDirectory)) { mkdirSync(controlDirectory); fsyncDirectory(dirname(controlDirectory)); }
   let committed = false;
   try {
-    atomicWrite(path, `${JSON.stringify(journal)}\n`, history || operationContext ? { checkpoint: stage => afterWrite(`intent_${stage}`) } : {});
+    markControlMutationEffect();
+    atomicWrite(path, `${JSON.stringify(bindInputResolution(journal))}\n`, history || operationContext ? { checkpoint: stage => afterWrite(`intent_${stage}`) } : {});
     afterWrite("intent");
     if (history) publishArchive(root, journal, history, afterWrite);
     if (operationContext) publishOwnedOutputs(root, journal, afterWrite);
-    if (or) {
-      atomicWrite(orPath, or);
-      afterWrite("or");
-    }
     const state = writeRunLocked(runPath, content, revisionId, {
       ...writeOptions,
       ...(history || operationContext ? { checkpoint: stage => afterWrite(`run_${stage}`) } : {}),
       expectedContent, nextRevisionId, allowPendingTransaction: true, allowContentChange: true,
       validateBeforeWrite: () => {
         writeOptions.validateBeforeWrite?.();
-        if (backlog && checkedFile(backlogPath) !== backlog.old) throw recoveryError(runId);
-        if (or && checkedFile(orPath) !== or) throw recoveryError(runId);
         if (operationContext && outputs.some(row => ownedOutputText(root, runId, row.path) !== row.next)) throw recoveryError(runId);
         for (const [artefact, beforeDigest] of listedBefore) {
-          if (artefact !== `.agdf/control/artefacts/${runId}/OR.md` && !outputs.some(row => row.path === artefact)
+          if (artefact !== `${runDocumentPath(runId, '')}/OR.md` && !outputs.some(row => row.path === artefact)
               && artefactFileDigest(root, artefact) !== beforeDigest) throw recoveryError(runId);
         }
       },
     });
     committed = true;
     afterWrite("run");
-    if (backlog) {
-      if (checkedFile(backlogPath) !== backlog.old) throw recoveryError(runId);
-      atomicWrite(backlogPath, backlog.next, history || operationContext ? { checkpoint: stage => afterWrite(`backlog_${stage}`) } : {});
-      afterWrite("backlog");
-    }
     const recovered = recoverPendingRunStepLocked(root, runId, { sourceRevision: Boolean(history) });
     if (recovered.status !== "completed") throw recoveryError(runId);
     if (history || operationContext) afterWrite("retired");
@@ -348,7 +359,7 @@ export function commitRunStepLocked(root, { runId, runPath, content, revisionId,
     if (!committed) {
       try {
         const recovered = recoverPendingRunStepLocked(root, runId, { sourceRevision: Boolean(history) });
-        if (recovered.status === "rolled_back") throw error;
+        if (recovered.status === "rolled_back") { markControlMutationRollbackKnown(); throw error; }
       } catch (recoveryFailure) {
         if (recoveryFailure === error) throw error;
         throw recoveryError(runId);