dsh-bettertaskgraphs 0.0.0-stage → 0.2.3

package/journal.mjs

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: GPL-3.0-only
+import { FileGraphStore } from './store.mjs'
+import { canonical, copy, digest, GraphError, validateDocument } from './core.mjs'
+export const MAX_CLAIMS = 1024
+const fail = code => { throw new GraphError(code) }
+const integer = value => Number.isSafeInteger(value) && value >= 0
+const hex = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+const fields = (value, keys) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).every(key => keys.includes(key)) && keys.every(key => Object.hasOwn(value, key))
+export function seal(value) { const body = copy(value); delete body.checksum; return { ...body, checksum: digest(body) } }
+export function claimDigest(value) { const body = copy(value); delete body.claimDigest; delete body.intentSeq; return digest(body) }
+export function initialJournal(binding) {
+  return seal({ schema: 4, revision: 0, binding: copy(binding), document: null, activeProof: null, pending: null, claims: [] })
+}
+export function validateJournal(value, binding) {
+  if (!fields(value, ['schema', 'revision', 'binding', 'document', 'activeProof', 'pending', 'claims', 'checksum'])
+      || value.schema !== 4 || !integer(value.revision) || canonical(value.binding) !== canonical(binding)
+      || !hex(value.checksum) || seal(value).checksum !== value.checksum || !Array.isArray(value.claims) || value.claims.length > MAX_CLAIMS)
+    fail('JOURNAL_SCOPE_CHECKSUM_OR_LIMIT')
+  if (value.document) validateDocument(value.document)
+  const operations = new Set()
+  for (const row of value.claims) {
+    if (!fields(row, ['operationId', 'payloadHash', 'status', 'graphRevision', 'graphChecksum', 'resultSeq', 'reason', 'evidenceDigests',
+      'claimDigest', 'intentSeq', 'candidateChecksum', 'expectedGraphRevision', 'operation'])
+        || typeof row.operationId !== 'string' || operations.has(row.operationId) || !hex(row.payloadHash)
+        || !['COMMITTED', 'ABORTED'].includes(row.status) || !integer(row.graphRevision)
+        || (row.graphChecksum !== null && !hex(row.graphChecksum)) || !integer(row.resultSeq)
+        || (row.reason !== null && (typeof row.reason !== 'string' || row.reason.length > 1200))
+        || !hex(row.claimDigest) || !hex(row.candidateChecksum) || !integer(row.intentSeq) || !integer(row.expectedGraphRevision)
+        || !['create', 'begin', 'finish', 'skip', 'reconcile'].includes(row.operation)
+        || !Array.isArray(row.evidenceDigests) || row.evidenceDigests.length > 32 || row.evidenceDigests.some(x => !hex(x)))
+      fail('JOURNAL_CLAIM_INVALID')
+    operations.add(row.operationId)
+    if ((value.document?.state.operations.includes(row.operationId) ?? false) !== (row.status === 'COMMITTED')) fail('JOURNAL_COMMIT_OPERATION_MISMATCH')
+  }
+  if (value.activeProof) {
+    if (!fields(value.activeProof, ['attemptId', 'beginResultSeq', 'beginTurn', 'workStartedAtBegin', 'workExecutedAtBegin']) || !integer(value.activeProof.beginResultSeq)
+        || !integer(value.activeProof.beginTurn) || !integer(value.activeProof.workStartedAtBegin) || !integer(value.activeProof.workExecutedAtBegin)
+        || value.document?.state.active?.attemptId !== value.activeProof.attemptId)
+      fail('JOURNAL_ACTIVE_PROOF_MISMATCH')
+  } else if (value.document?.state.active) fail('JOURNAL_ACTIVE_PROOF_REQUIRED')
+  const p = value.pending
+  if (p) {
+    if (!fields(p, ['operationId', 'payloadHash', 'operation', 'arguments', 'callId', 'rootCallId', 'turn', 'sessionId',
+      'owner', 'bindingDigest', 'expectedGraphRevision', 'candidate', 'resolvedEvidence', 'intentSeq', 'claimDigest', 'clearedWork'])
+        || operations.has(p.operationId) || !hex(p.payloadHash) || !hex(p.bindingDigest) || !hex(p.claimDigest)
+        || claimDigest(p) !== p.claimDigest || p.bindingDigest !== digest(binding) || p.sessionId !== binding.sessionId
+        || !['create', 'begin', 'finish', 'skip', 'reconcile'].includes(p.operation) || !integer(p.turn)
+        || p.expectedGraphRevision !== (value.document?.revision ?? 0) || (p.intentSeq !== null && !integer(p.intentSeq))
+        || !Array.isArray(p.resolvedEvidence) || p.resolvedEvidence.length > 32 || !Array.isArray(p.clearedWork) || p.clearedWork.length > 1024
+        || p.clearedWork.some(row => !fields(row, ['rootCallId', 'callSeq', 'rootResultSeq', 'eventDigest'])
+          || typeof row.rootCallId !== 'string' || !row.rootCallId || row.rootCallId.length > 512 || !integer(row.callSeq)
+          || row.rootResultSeq !== null && !integer(row.rootResultSeq) || !hex(row.eventDigest))) fail('JOURNAL_PENDING_INVALID')
+    validateDocument(p.candidate)
+    if (p.candidate.revision !== p.expectedGraphRevision + 1 || p.candidate.events.at(-1).operationId !== p.operationId
+        || canonical(p.candidate.events.slice(0, -1)) !== canonical(value.document?.events ?? [])) fail('JOURNAL_CANDIDATE_NOT_SINGLE_APPEND')
+  }
+  return true
+}
+
+export class HostJournal {
+  constructor({ projectRoot, directory, binding, store, readOnly = false }) {
+    this.binding = copy(binding)
+    const validate = value => validateJournal(value, this.binding)
+    this.store = store ?? new FileGraphStore({ projectRoot, directory, fileName: 'transaction-host-journal.json', maximumBytes: 12 * 1024 * 1024, readOnly,
+      validator: validate, updateValidator: (previous, next) => {
+        if (next.revision !== (previous?.revision ?? 0) + 1 || previous && canonical(previous.binding) !== canonical(next.binding)) fail('JOURNAL_CAS_REVISION_OR_SCOPE')
+        const oldClaims = previous?.claims ?? []
+        if (canonical(next.claims.slice(0, oldClaims.length)) !== canonical(oldClaims)) fail('JOURNAL_CLAIM_HISTORY_IMMUTABLE')
+      } })
+  }
+  read() {
+    const value = this.store.read() ?? initialJournal(this.binding)
+    validateJournal(value, this.binding)
+    return value
+  }
+  change(expected, update) {
+    return this.store.compareAndSwap(expected, previous => {
+      const before = previous ?? initialJournal(this.binding)
+      validateJournal(before, this.binding)
+      const after = seal({ ...update(copy(before)), schema: 4, binding: copy(this.binding), revision: before.revision + 1 })
+      validateJournal(after, this.binding)
+      return after
+    })
+  }
+  reserve(claim) {
+    const before = this.read()
+    return this.change(before.revision, state => {
+      if (state.pending) fail('PENDING_INTENT_REQUIRES_RECONCILIATION')
+      if (state.claims.some(row => row.operationId === claim.operationId)) fail('HOST_TOOL_CALL_REPLAY')
+      if (state.claims.length >= MAX_CLAIMS) fail('HOST_CLAIM_LIMIT')
+      return { ...state, pending: copy(claim) }
+    })
+  }
+  bindIntent(operationId, intentSeq) {
+    const before = this.read()
+    return this.change(before.revision, state => {
+      if (state.pending?.operationId !== operationId || state.pending.intentSeq !== null && state.pending.intentSeq !== intentSeq) fail('HOST_INTENT_CHANGED')
+      return { ...state, pending: { ...state.pending, intentSeq } }
+    })
+  }
+  resolve(projected, { rejectReason = null } = {}) {
+    const before = this.read(), pending = before.pending
+    if (!pending) return before
+    if (projected.data.operationId !== pending.operationId || projected.data.claimDigest !== pending.claimDigest
+        || projected.data.bindingDigest !== pending.bindingDigest || projected.intentSeq !== pending.intentSeq
+        || projected.data.operation !== pending.operation || projected.data.expectedGraphRevision !== pending.expectedGraphRevision
+        || projected.data.candidateChecksum !== pending.candidate.checksum || projected.data.callId !== pending.callId
+        || projected.data.rootCallId !== pending.rootCallId || projected.data.turn !== pending.turn || projected.data.sessionId !== pending.sessionId
+        || canonical(projected.data.clearedWork) !== canonical(pending.clearedWork))
+      fail('HOST_PERSISTED_INTENT_PROOF_MISMATCH')
+    if (!['SUCCESS', 'FAILED'].includes(projected.status) || !integer(projected.rootResultSeq)) fail('HOST_RESULT_UNKNOWN_NO_COMMIT')
+    return this.change(before.revision, state => {
+      if (canonical(state.pending) !== canonical(pending)) fail('HOST_PENDING_CHANGED')
+      if (rejectReason !== null && (typeof rejectReason !== 'string' || !rejectReason || rejectReason.length > 1200)) fail('INVALID_CANDIDATE_REJECTION')
+      const committed = projected.status === 'SUCCESS' && rejectReason === null, document = committed ? pending.candidate : state.document
+      let activeProof = state.activeProof
+      if (committed && pending.operation === 'begin') activeProof = { attemptId: document.state.active.attemptId,
+        beginResultSeq: projected.rootResultSeq, beginTurn: pending.turn, workStartedAtBegin: projected.workStartedAtRoot,
+        workExecutedAtBegin: projected.workExecutedAtRoot }
+      if (committed && ['finish', 'reconcile'].includes(pending.operation)) activeProof = null
+      const row = { operationId: pending.operationId, payloadHash: pending.payloadHash, status: committed ? 'COMMITTED' : 'ABORTED',
+        graphRevision: document?.revision ?? 0, graphChecksum: document?.checksum ?? null, resultSeq: projected.rootResultSeq,
+        reason: committed ? null : rejectReason ?? 'Root/ancestor execution or typed-result qualification failed; candidate not applied. Original tool/result unchanged.',
+        claimDigest: pending.claimDigest, intentSeq: pending.intentSeq, candidateChecksum: pending.candidate.checksum,
+        expectedGraphRevision: pending.expectedGraphRevision, operation: pending.operation,
+        evidenceDigests: pending.resolvedEvidence.map(digest) }
+      return { ...state, document, activeProof, pending: null, claims: [...state.claims, row] }
+    })
+  }
+}

package/package.json

@@ -1,6 +1,80 @@
 {
   "name": "dsh-bettertaskgraphs",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.3",
+  "description": "Transactional task graphs with a conversation panel for DeepSeek Harness",
+  "license": "GPL-3.0-only",
+  "keywords": ["dsh", "deepseek-harness", "cordis", "task-graph"],
+  "homepage": "https://github.com/oldcitynight/dsh-bettertaskgraphs#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oldcitynight/dsh-bettertaskgraphs.git"
+  },
+  "bugs": {
+    "url": "https://github.com/oldcitynight/dsh-bettertaskgraphs/issues"
+  },
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs",
+    "./client": "./client.js"
+  },
+  "files": [
+    "client.js",
+    "client.source.mjs",
+    "cordis.patch.yml",
+    "core.mjs",
+    "host.mjs",
+    "index.mjs",
+    "journal.mjs",
+    "projection.mjs",
+    "remote.mjs",
+    "scripts/build-client.mjs",
+    "store.mjs",
+    "tools.mjs",
+    "view-model.mjs",
+    "work-policy.mjs"
+  ],
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0",
+    "dsh": "0.2.1-rc.5"
+  },
+  "scripts": {
+    "build": "node scripts/build-client.mjs",
+    "check": "node scripts/build-client.mjs --check",
+    "test": "npm run check && node --test",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm test",
+    "pack:bundle": "node -e \"require('node:fs').mkdirSync('dist', { recursive: true })\" && npm pack --pack-destination dist"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "dependencies": {
+    "zod": "4.6.7"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-session": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.5"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.5"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-api-remotes"
+      ]
+    }
+  }
+}

package/projection.mjs

@@ -0,0 +1,225 @@
+// SPDX-License-Identifier: GPL-3.0-only
+import { z } from 'zod'
+import { TOOL_NOT_STARTED, TOOL_OUTCOME_UNKNOWN } from '@deepseek-ai/dsh-session'
+import { canonical, copy, digest, GraphError } from './core.mjs'
+import { administrative, workKey } from './work-policy.mjs'
+export const KEY = 'projectTransactionGraphV4'
+export const INTENT = 'plugin:project-transaction-graph/intent-v4'
+export const RECEIPT = 'plugin:project-transaction-graph/receipt-v4'
+export const RECOVERY = 'plugin:project-transaction-graph/operator-recovery-v4'
+export const MAX_PROOFS = 1024
+const bounded = n => z.string().min(1).max(n)
+const hex = z.string().regex(/^[a-f0-9]{64}$/)
+const seq = z.number().int().nonnegative()
+const workSchema = z.object({ rootCallId: bounded(512), callSeq: seq, rootResultSeq: seq.nullable(), eventDigest: hex }).strict()
+const bashFailureSchema = z.object({ rootCallId: bounded(512), callId: bounded(512) }).strict()
+const factSchema = z.object({ seq, callId: bounded(512), tool: bounded(300), isError: z.boolean(),
+  outcome: z.enum(['UNVERIFIED', 'FAIL', 'NOT_RUN', 'UNKNOWN']) }).strict()
+const intentSchema = z.object({ version: z.literal(4), operationId: bounded(80), callId: bounded(512),
+  rootCallId: bounded(512), turn: seq, sessionId: bounded(512), bindingDigest: hex, claimDigest: hex,
+  operation: z.enum(['create', 'begin', 'finish', 'skip', 'reconcile']), expectedGraphRevision: seq, candidateChecksum: hex,
+  clearedWork: z.array(workSchema).max(1024) }).strict()
+const dispatchSchema = z.object({ seq, subCallId: bounded(512), parentCallId: bounded(512), rootCallId: bounded(512),
+  tool: bounded(300), isError: z.boolean(), outcome: z.enum(['UNVERIFIED', 'FAIL', 'NOT_RUN', 'UNKNOWN']), eventDigest: hex, turn: seq }).strict()
+const proofSchema = z.object({ seq, callId: bounded(512), rootCallId: bounded(512), rootCallSeq: seq, rootResultSeq: seq,
+  tool: bounded(300), successful: z.boolean(), qualification: z.enum(['SUCCESS', 'FAILED', 'UNKNOWN']), isError: z.boolean(),
+  outcome: z.enum(['UNVERIFIED', 'FAIL', 'NOT_RUN', 'UNKNOWN']), ownOutcome: z.enum(['UNVERIFIED', 'FAIL', 'NOT_RUN', 'UNKNOWN']),
+  ancestorOutcomes: z.array(factSchema).max(33), eventDigest: hex, turn: seq }).strict()
+const pendingSchema = z.object({ intentSeq: seq, data: intentSchema,
+  intentDigest: hex, status: z.enum(['PENDING', 'SUCCESS', 'FAILED', 'UNKNOWN']),
+  rootResultSeq: seq.nullable(), rootResultDigest: hex.nullable(), workStartedAtRoot: seq.nullable(), workExecutedAtRoot: seq.nullable() }).strict()
+export const stateSchema = z.object({ sessionId: bounded(512), ownFrom: seq, turn: seq, lastSeq: z.number().int().min(-1),
+  workStarted: seq, workExecuted: seq, uncertainties: z.array(workSchema).max(1024), acknowledgedWork: z.array(workSchema).max(1024),
+  calls: z.record(z.string(), z.object({ tool: bounded(300), turn: seq, seq, eventDigest: hex }).strict()),
+  bashFailures: z.array(bashFailureSchema).max(256),
+  dispatches: z.array(dispatchSchema).max(256), intents: z.array(pendingSchema).max(1024),
+  proofs: z.array(proofSchema).max(MAX_PROOFS), receipts: z.array(z.object({ operationId: bounded(80), seq,
+    status: z.enum(['COMMITTED', 'ABORTED']), graphRevision: seq, graphChecksum: hex.nullable(), eventDigest: hex }).strict()).max(1024), failure: z.string().nullable() }).strict()
+export function initialState(header, inheritedEventCount = 0) {
+  return { sessionId: header.id, ownFrom: inheritedEventCount, turn: 0, lastSeq: -1, workStarted: 0, workExecuted: 0,
+    uncertainties: [], acknowledgedWork: [],
+    calls: {}, bashFailures: [], dispatches: [], intents: [], proofs: [], receipts: [], failure: null }
+}
+export function outcomeOfContent(content = []) {
+  const outcomes = new Set()
+  for (const block of content) {
+    if (block.type !== 'text' || typeof block.text !== 'string') continue
+    if (block.text.length > 32768) return 'UNKNOWN' // No bounded parser means no positive completion qualification.
+    let value
+    try { value = JSON.parse(block.text) } catch { continue }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) continue
+    if (value.passed === false || value.ok === false || value.success === false) outcomes.add('FAIL')
+    for (const status of [value.goalVerification?.status, value.verification?.status, value.status, value.state]) if (typeof status === 'string') {
+      if (['FAIL', 'FAILED', 'ERROR'].includes(status.toUpperCase())) outcomes.add('FAIL')
+      if (['NOT_RUN', 'UNKNOWN'].includes(status.toUpperCase())) outcomes.add(status.toUpperCase())
+    }
+  }
+  // A first FAIL/NOT_RUN block may not hide a later UNKNOWN/contradiction.
+  return outcomes.has('UNKNOWN') || outcomes.size > 1 ? 'UNKNOWN' : [...outcomes][0] ?? 'UNVERIFIED'
+}
+function toolOutcome(state, tool, rootCallId, callId, content) {
+  const outcome = outcomeOfContent(content)
+  if (tool !== 'bash' || !state.bashFailures.some(row => row.rootCallId === rootCallId && row.callId === callId)) return outcome
+  return outcome === 'UNKNOWN' || outcome === 'NOT_RUN' ? 'UNKNOWN' : 'FAIL'
+}
+export function chainQualification(start, root, dispatches) {
+  let child = start
+  const visited = new Set()
+  let failed = false, unknown = false
+  while (child !== root) {
+    if (visited.has(child) || visited.size >= 32) return 'UNKNOWN'
+    visited.add(child)
+    const matches = dispatches.filter(row => row.subCallId === child && row.rootCallId === root)
+    if (matches.length !== 1) return 'UNKNOWN'
+    const row = matches[0]
+    if (row.isError || ['FAIL', 'NOT_RUN'].includes(row.outcome)) failed = true
+    if (row.outcome === 'UNKNOWN' || !['UNVERIFIED', 'FAIL', 'NOT_RUN'].includes(row.outcome)) unknown = true
+    child = row.parentCallId
+  }
+  return unknown ? 'UNKNOWN' : failed ? 'FAILED' : 'SUCCESS'
+}
+export const chainSucceeded = (start, root, dispatches) => chainQualification(start, root, dispatches) === 'SUCCESS'
+function ancestryFacts(start, root, dispatches) {
+  const facts = [], visited = new Set()
+  let cursor = start
+  while (cursor !== root && !visited.has(cursor) && facts.length < 32) {
+    visited.add(cursor)
+    const matches = dispatches.filter(row => row.subCallId === cursor && row.rootCallId === root)
+    if (matches.length !== 1) break
+    const row = matches[0]
+    if (cursor !== start) facts.push({ seq: row.seq, callId: row.subCallId, tool: row.tool, isError: row.isError, outcome: row.outcome })
+    cursor = row.parentCallId
+  }
+  return facts
+}
+const qualifiedStatus = (root, chain) => root === 'UNKNOWN' || chain === 'UNKNOWN' ? 'UNKNOWN'
+  : root === 'FAILED' || chain === 'FAILED' ? 'FAILED' : 'SUCCESS'
+const internal = administrative
+export function applyEvent(state, event) {
+  if (state.failure) return state
+  try {
+    if (event.seq < state.ownFrom) return state // Fork parents cannot authorize a child's graph.
+    if (event.type.startsWith('plugin:project-transaction-graph/') && ![INTENT, RECEIPT, RECOVERY].includes(event.type))
+      throw new GraphError('LEGACY_GRAPH_REQUIRES_EXPLICIT_MIGRATION')
+    if (!['turn/start', 'turn/end', 'tool/call', 'tool/ptc-dispatch', 'tool/result', 'job/settled', INTENT, RECEIPT, RECOVERY].includes(event.type)) return state
+    const d = event.data
+    let next = { ...state, lastSeq: event.seq }
+    if (event.type === 'turn/start') return { ...next, turn: d.turn }
+    if (event.type === 'tool/call') {
+      if (Object.hasOwn(state.calls, d.callId) || Object.keys(state.calls).length >= 256) throw new GraphError('CALL_ID_REPLAY_OR_LIMIT')
+      return { ...next, workStarted: state.workStarted + (!internal(d.name) && d.name !== 'run_code' ? 1 : 0),
+        calls: { ...state.calls, [d.callId]: { tool: d.name, turn: state.turn, seq: event.seq, eventDigest: digest(event) } } }
+    }
+    if (event.type === INTENT || event.type === RECOVERY) {
+      const data = intentSchema.parse(d)
+      if (data.sessionId !== state.sessionId || data.turn !== state.turn || (event.type === INTENT && !state.turn)
+          || state.intents.some(row => row.data.operationId === data.operationId) || state.intents.length >= 1024) throw new GraphError('INTENT_SCOPE_REPLAY_OR_LIMIT')
+      if (event.type === INTENT && data.clearedWork.length) throw new GraphError('MODEL_INTENT_CANNOT_ACKNOWLEDGE_WORK')
+      let uncertainties = state.uncertainties, acknowledgedWork = state.acknowledgedWork
+      if (event.type === RECOVERY) {
+        for (const work of data.clearedWork) {
+          const unknown = uncertainties.find(row => canonical(row) === canonical(work))
+          const open = state.calls[work.rootCallId]
+          if (!unknown && !(work.rootResultSeq === null && open?.seq === work.callSeq && open.eventDigest === work.eventDigest))
+            throw new GraphError('OPERATOR_WORK_ACK_NOT_OWN_RECORDED_FACT')
+        }
+        const keys = new Set(data.clearedWork.map(workKey))
+        uncertainties = uncertainties.filter(row => !keys.has(workKey(row)))
+        acknowledgedWork = [...acknowledgedWork, ...data.clearedWork.filter(row => !acknowledgedWork.some(old => workKey(old) === workKey(row)))]
+        if (acknowledgedWork.length > 1024) throw new GraphError('ACKNOWLEDGED_WORK_LIMIT')
+      }
+      return { ...next, uncertainties, acknowledgedWork, intents: [...state.intents, { intentSeq: event.seq, data,
+        intentDigest: digest(event), status: event.type === RECOVERY ? 'SUCCESS' : 'PENDING',
+        rootResultSeq: event.type === RECOVERY ? event.seq : null, rootResultDigest: event.type === RECOVERY ? digest(event) : null,
+        workStartedAtRoot: event.type === RECOVERY ? state.workStarted : null, workExecutedAtRoot: event.type === RECOVERY ? state.workExecuted : null }] }
+    }
+    if (event.type === 'job/settled') {
+      const origin = d.toolCall
+      if (d.kind !== 'bash' || d.owner !== state.sessionId || !origin || !Object.hasOwn(state.calls, origin.rootCallId)
+          || d.status !== 'completed' || d.producerReported !== true) return next
+      // Native Bash reports a nonzero exit in the owned job log even when its tool message is not an error.
+      const exit = /^exit code: (-?\d+)(?:;|$)/.exec(d.detail ?? '')
+      if (!exit || Number(exit[1]) === 0) return next
+      const failure = bashFailureSchema.parse({ rootCallId: origin.rootCallId, callId: origin.callId })
+      if (state.bashFailures.some(row => row.rootCallId === failure.rootCallId && row.callId === failure.callId)) return next
+      if (state.bashFailures.length >= 256) throw new GraphError('BASH_FAILURE_RECORD_LIMIT')
+      return { ...next, bashFailures: [...state.bashFailures, failure] }
+    }
+    if (event.type === 'tool/ptc-dispatch') {
+      const rootCallId = d.rootCallId ?? d.parentCallId
+      if (!Object.hasOwn(state.calls, rootCallId)) {
+        // Only a child of an open, owned root can become evidence. Once a
+        // graph has history, an unexplained dispatch could hide actual work.
+        if (state.intents.length || state.receipts.length) throw new GraphError('UNATTRIBUTED_PTC_DISPATCH_IN_GRAPH_SESSION')
+        return next
+      }
+      const dispatch = dispatchSchema.parse({ seq: event.seq, subCallId: d.subCallId, parentCallId: d.parentCallId,
+        rootCallId, tool: d.name, isError: d.isError,
+        outcome: toolOutcome(state, d.name, rootCallId, d.subCallId, d.content), eventDigest: digest(event), turn: state.turn })
+      if (state.dispatches.some(row => row.subCallId === dispatch.subCallId && row.rootCallId === dispatch.rootCallId)
+          || state.dispatches.length >= 256) throw new GraphError('PTC_DISPATCH_REPLAY_OR_LIMIT')
+      return { ...next, workStarted: state.workStarted + (!internal(d.name) && d.name !== 'run_code' ? 1 : 0),
+        dispatches: [...state.dispatches, dispatch] }
+    }
+    if (event.type === 'tool/result') {
+      const root = d.message.source.callId, success = d.message.isError !== true // Optional false in the published ToolResultMessage API.
+      const syntheticUnknown = [TOOL_OUTCOME_UNKNOWN, TOOL_NOT_STARTED].includes(d.error?.code)
+      const sources = state.dispatches.filter(row => row.rootCallId === root)
+      const call = state.calls[root]
+      if (!call) {
+        if (state.intents.some(row => row.data.rootCallId === root && ['PENDING', 'UNKNOWN'].includes(row.status)))
+          throw new GraphError('OWN_INTENT_RESULT_WITHOUT_OWN_TOOL_CALL')
+        // Fork/restore seeds may synthesize child-owned closers for an inherited
+        // call. They are not child work, evidence, or authority for a candidate.
+        return next
+      }
+      const standaloneCode = call.tool === 'run_code' && !sources.length
+      const rootOutcome = toolOutcome(state, call.tool, root, root, d.message.content)
+      const rootQualification = syntheticUnknown || rootOutcome === 'UNKNOWN' ? 'UNKNOWN'
+        : !success || ['FAIL', 'NOT_RUN'].includes(rootOutcome) ? 'FAILED' : 'SUCCESS'
+      const leafCode = sources.filter(row => row.tool === 'run_code' && !sources.some(child => child.parentCallId === row.subCallId))
+      const workStarted = state.workStarted + (standaloneCode ? 1 : 0) + leafCode.length
+      const executed = sources.filter(row => !internal(row.tool) && (row.tool !== 'run_code' || leafCode.includes(row)) && !['NOT_RUN', 'UNKNOWN'].includes(row.outcome)).length
+        + (!internal(call.tool) && (call.tool !== 'run_code' || standaloneCode) && !['NOT_RUN', 'UNKNOWN'].includes(rootOutcome) && !syntheticUnknown ? 1 : 0)
+      const workExecuted = state.workExecuted + executed
+      const intents = state.intents.map(row => row.data.rootCallId !== root ? row : {
+        ...row, status: qualifiedStatus(rootQualification, chainQualification(row.data.callId, root, sources)),
+        rootResultSeq: event.seq, rootResultDigest: digest(event), workStartedAtRoot: workStarted, workExecutedAtRoot: workExecuted })
+      const rootFact = { seq: event.seq, callId: root, tool: call.tool, isError: !success, outcome: syntheticUnknown ? 'UNKNOWN' : rootOutcome }
+      const proofs = sources.filter(row => !internal(row.tool) && (row.tool !== 'run_code' || leafCode.includes(row))).map(row => {
+        const qualification = qualifiedStatus(rootQualification, chainQualification(row.subCallId, root, sources))
+        return { seq: row.seq, callId: row.subCallId, rootCallId: root, rootResultSeq: event.seq, rootCallSeq: call.seq,
+          tool: row.tool, successful: qualification === 'SUCCESS', qualification, isError: row.isError,
+          outcome: row.outcome, ownOutcome: row.outcome, ancestorOutcomes: [...ancestryFacts(row.subCallId, root, sources), rootFact],
+          eventDigest: row.eventDigest, turn: row.turn }
+      })
+      if (!internal(call.tool) && (call.tool !== 'run_code' || !sources.length)) proofs.push({ seq: event.seq,
+        callId: root, rootCallId: root, rootResultSeq: event.seq, tool: call.tool,
+        rootCallSeq: call.seq,
+        successful: rootQualification === 'SUCCESS', qualification: rootQualification, isError: !success,
+        outcome: syntheticUnknown ? 'UNKNOWN' : rootOutcome, ownOutcome: syntheticUnknown ? 'UNKNOWN' : rootOutcome, ancestorOutcomes: [],
+        eventDigest: digest(event), turn: call.turn })
+      const calls = { ...state.calls }; delete calls[root]
+      let uncertainties = state.uncertainties
+      if (rootQualification === 'UNKNOWN' || sources.some(row => row.outcome === 'UNKNOWN') || proofs.some(row => row.qualification === 'UNKNOWN')) {
+        const work = { rootCallId: root, callSeq: call.seq, rootResultSeq: event.seq, eventDigest: digest(event) }
+        if (!state.acknowledgedWork.some(row => workKey(row) === workKey(work)) && !uncertainties.some(row => workKey(row) === workKey(work)))
+          uncertainties = [...uncertainties, work]
+        if (uncertainties.length > 1024) throw new GraphError('UNRESOLVED_WORK_LIMIT')
+      }
+      return { ...next, calls, intents, workStarted, workExecuted, uncertainties, dispatches: state.dispatches.filter(row => row.rootCallId !== root),
+        bashFailures: state.bashFailures.filter(row => row.rootCallId !== root),
+        proofs: [...state.proofs, ...proofs].slice(-MAX_PROOFS) }
+    }
+    if (event.type === RECEIPT) {
+      const row = z.object({ operationId: bounded(80), status: z.enum(['COMMITTED', 'ABORTED']),
+        graphRevision: seq, graphChecksum: hex.nullable() }).strict().parse(d)
+      const previous = state.receipts.find(old => old.operationId === row.operationId)
+      if (previous && ['status', 'graphRevision', 'graphChecksum'].some(key => previous[key] !== row[key])) throw new GraphError('RECEIPT_CONFLICT')
+      return previous ? next : { ...next, receipts: [...state.receipts, { ...row, seq: event.seq, eventDigest: digest(event) }].slice(-1024) }
+    }
+    if (event.type === 'turn/end') return { ...next, turn: 0, intents: state.intents.map(row => row.status === 'PENDING' ? { ...row, status: 'UNKNOWN' } : row) }
+    return next
+  } catch (error) { return { ...state, failure: `Transaction projection failed at ${event.seq}: ${error.message}` } }
+}
+export const projection = { key: KEY, stateVersion: 6, stateSchema, init: initialState, apply: applyEvent }

package/remote.mjs

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Shared by the Host registration and the lazy browser module.
+export function createRemoteContribution(z) {
+  const packageName = 'dsh-bettertaskgraphs'
+  const id = z.string().min(1).max(128)
+  const input = z.object({ sessionId: id }).strict()
+  const node = z.object({
+    id, label: z.string().min(1).max(512), kind: z.enum(['container', 'leaf']),
+    parent: id.nullable(),
+    status: z.enum(['COMPLETE', 'CONTAINER_INCOMPLETE', 'ACTIVE', 'INACTIVE', 'INCOMPLETE', 'PENDING', 'SKIPPED']),
+    blocked: z.literal(true).optional(),
+    disposition: z.enum(['COMPLETED', 'SKIPPED_NOT_RUN', 'UNSATISFIED', 'FAILED']).optional(),
+    branchState: z.enum(['SELECTED', 'WAITING', 'NOT_SELECTED']).optional(),
+    selectedBranch: z.object({
+      outcome: z.enum(['complete', 'incomplete']), case: z.string().min(1).max(64).optional(), targetId: id.optional(),
+    }).strict().optional(),
+  }).strict()
+  const edge = z.discriminatedUnion('kind', [
+    z.object({ from: id, to: id, kind: z.literal('prerequisite') }).strict(),
+    z.object({ from: id, to: id, kind: z.literal('route'), outcome: z.enum(['complete', 'incomplete']) }).strict(),
+    z.object({ from: id, to: id, kind: z.literal('case'), case: z.string().min(1).max(64) }).strict(),
+  ])
+  const choice = z.object({ id, choice: z.number().int().min(0).max(127) }).strict()
+  const graph = z.object({
+    revision: z.number().int().min(1).max(1024), title: z.string().min(1).max(512),
+    nodes: z.array(node).min(2).max(128), edges: z.array(edge).max(512),
+    active: z.object({ nodeId: id, recoveryRequired: z.boolean() }).strict().nullable(),
+    pending: z.object({ operation: z.string().min(1).max(64), qualification: z.string().min(1).max(128) }).strict().nullable(),
+    legalNext: z.array(choice).max(128), skipChoices: z.array(choice).max(128),
+  }).strict()
+  const output = z.discriminatedUnion('status', [
+    z.object({ sessionId: id, status: z.literal('ready'), graph }).strict(),
+    z.object({ sessionId: id, status: z.literal('empty'), graph: z.null() }).strict(),
+    z.object({ sessionId: id, status: z.literal('unavailable'), graph: z.null() }).strict(),
+  ])
+  const codec = (key, schema) => ({ mode: 'strict', typeSymbol: `${packageName}#${key}`, create: () => schema })
+  return {
+    package: packageName,
+    descriptors: [{
+      id: `${packageName}#transactionGraphView/status`,
+      service: 'transactionGraph', namespace: 'transactionGraphView', method: 'status', invocation: { kind: 'direct' },
+      parameters: [{
+        name: 'request', wire: 'request', source: 'json',
+        codec: codec('TransactionGraphStatusRequest', input),
+        strictCodec: codec('TransactionGraphStatusStrictRequest', input),
+      }],
+      cancellation: { parameter: 'signal' },
+      result: codec('TransactionGraphStatusResult', output),
+    }],
+  }
+}

package/scripts/build-client.mjs

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: GPL-3.0-only
+import { readFileSync, writeFileSync } from 'node:fs'
+
+const root = new URL('../', import.meta.url)
+const { name: packageName, version, license, repository } = JSON.parse(readFileSync(new URL('package.json', root), 'utf8'))
+const sourceUrl = repository.url.replace(/^git\+/, '').replace(/\.git$/, '')
+const sources = ['remote.mjs', 'view-model.mjs', 'client.source.mjs'].map(name => {
+  const source = readFileSync(new URL(name, root), 'utf8')
+  if (/^import\s/m.test(source)) throw new Error(`${name} must be self-contained for the DSH lazy client factory`)
+  return source.replace(/^export\s+(?=(?:function|const|class)\b)/gm, '')
+})
+const output = `// SPDX-License-Identifier: ${license}
+// Corresponding source: ${sourceUrl}/tree/v${version}
+// Generated by scripts/build-client.mjs.
+window.__ModuleLoader__.load({id:${JSON.stringify(packageName)},factory(require){
+${sources.join('\n')}
+return createClientPlugin(require('react'),require('zod').z,createRemoteContribution,graphPresentation,branchLayout);
+}});
+`
+if (process.argv.slice(2).join(' ') === '--check') {
+  if (readFileSync(new URL('client.js', root), 'utf8') !== output) throw new Error('Transaction graph client bundle is stale')
+} else if (process.argv.length === 2) {
+  writeFileSync(new URL('client.js', root), output)
+} else {
+  throw new Error('Use no arguments to build, or --check to verify')
+}