dsh-switchman 1.10.2 → 1.11.0

package/host/context-trim/surface.js

@@ -68,6 +68,17 @@
  * - Never append while a durable compaction/start..compaction/end lock pair
  *   is open for the session (design constraint).
  *
+ * LADDER SHIP (docs/ladder-fold.md): tier ≥ 2 blocks ride the same pair,
+ * but their material is the REPLACEMENT NODES their consumed blocks shipped
+ * (each consumed block's surfaceReplaced marker carries atSeq). The span
+ * from the first to the last replacement node must contain EXACTLY the
+ * consumed replacement nodes — engine folds are frontier-ordered, nothing
+ * can legitimately interleave, and any mismatch tombstones
+ * (ladder-span-mismatch / ladder-span-gone / ladder-consumed-skipped)
+ * instead of guessing. A ladder block whose consumed blocks have not
+ * shipped yet stays pending: they sit EARLIER in the same sweep (ledger
+ * order) and ship before it is reached again on a later sweep.
+ *
  * Everything fails open: a missing agents service / session.append / surface
  * support degrades to today's behavior (wire=raw banner + tally watermark),
  * and every no-op with pending work is logged to decisions.log.
@@ -75,6 +86,136 @@
 
 import { refOf, summaryMessageOf } from "./view.js";
 
+/** Ladder-block probe (tier ≥ 2): a distillation whose surface material is
+ * the REPLACEMENT NODES of its consumed blocks, not a raw ref range. */
+function isLadderBlock(block) {
+	return block !== null && typeof block === "object" && (block.tier === 2 || block.tier === 3);
+}
+
+// ---- tool-pair closure ------------------------------------------------------
+
+/** Call ids OPENED by one message, across every wire shape the plugin can
+ *  see: the DSH-native content block {type:'tool-call', id} (the shape that
+ *  reaches real captures — packages/llm/llm/src/types.ts ToolCallBlock), the
+ *  provider-shaped {type:'tool_use', id} block, and the OpenAI
+ *  message.tool_calls array. Duplicate ids are kept — the caller only asks
+ *  "is this id answered somewhere in the span". */
+function toolCallIdsOf(message) {
+	const ids = [];
+	if (message === null || typeof message !== "object") return ids;
+	if (Array.isArray(message.tool_calls)) {
+		for (const call of message.tool_calls) {
+			if (typeof call?.id === "string" && call.id !== "") ids.push(call.id);
+		}
+	}
+	if (Array.isArray(message.content)) {
+		for (const block of message.content) {
+			if ((block?.type === "tool-call" || block?.type === "tool_use") && typeof block.id === "string" && block.id !== "") ids.push(block.id);
+		}
+	}
+	return ids;
+}
+
+/** Call ids ANSWERED by one message: the DSH-native role:'tool' message's
+ *  toolCallId, the provider-shaped tool_call_id field, and tool_result /
+ *  tool-result content blocks' tool_use_id. */
+function toolResultIdsOf(message) {
+	const ids = [];
+	if (message === null || typeof message !== "object") return ids;
+	if (typeof message.toolCallId === "string" && message.toolCallId !== "") ids.push(message.toolCallId);
+	if (typeof message.tool_call_id === "string" && message.tool_call_id !== "") ids.push(message.tool_call_id);
+	if (Array.isArray(message.content)) {
+		for (const block of message.content) {
+			if (block?.type !== "tool_result" && block?.type !== "tool-result") continue;
+			const id = block.tool_use_id ?? block.toolCallId ?? block.tool_call_id;
+			if (typeof id === "string" && id !== "") ids.push(id);
+		}
+	}
+	return ids;
+}
+
+/** Dense node-index-aligned message list built from derivingPairsOf: entry i
+ *  is the message surface node i derives, or null for a node that derives
+ *  none (empty assistant step, ...). closeToolPairSpan indexes this list by
+ *  SURFACE NODE INDEX while derivingPairsOf compacts that space — this is the
+ *  bridge, and it reuses the already-resolved messages. */
+function denseMessagesOf(pairs, nodeCount) {
+	const messages = new Array(nodeCount).fill(null);
+	for (const pair of pairs) messages[pair.nodeIndex] = pair.message;
+	return messages;
+}
+
+/** Close a surface span over complete tool pairs. A shipped fold must never
+ *  separate an assistant tool call from its tool results: the provider wire
+ *  serializers reject the orphan half ("DeepSeek Messages tool result has no
+ *  matching call", llm-deepseek/src/serialize.ts:130-150), and the host's own
+ *  compaction validates the same rule (dsh-compaction/lib/index.js:557).
+ *  view.js segments pairwise, but a fold block's range can still be captured
+ *  or resolved off a surface whose boundary sits between the two halves
+ *  (trigger.js computeFoldableRange stops at a segment end; a pre-fix capture,
+ *  a host compaction, or a later block all can leave the boundary there), so
+ *  this pass re-closes the span against the LIVE node list.
+ *
+ *  pairs: DENSE message list aligned to surface node indexes (null entries for
+ *  nodes that derive no message); nodeCount: surface node count (indices past
+ *  pairs.length are treated as absent). Returns { startIdx, endIdx } or null
+ *  when the span cannot be closed without leaving the surface.
+ *
+ *  FORWARD: every call opened INSIDE the span must be answered inside it;
+ *  otherwise the results directly following the span end are pulled in (one
+ *  node per iteration, so several consecutive role:'tool' nodes for one
+ *  assistant step all land). A call whose next surface node does not answer it
+ *  (the surface ends first, or a different message sits between) is
+ *  unclosable: null.
+ *
+ *  BACKWARD: a result at the span start whose call still lives earlier on the
+ *  surface pulls the start back over that assistant node (and the run of
+ *  results after it), so shipping the fold cannot orphan a result it leaves
+ *  behind. When that call node is already shadowed/absent, the leading result
+ *  is a PRE-EXISTING orphan: removing it is the healing direction and the
+ *  span stays as captured (the earlier fold's shadowed set already owns the
+ *  call). A node that both opens calls and carries results is handled by both
+ *  passes defensively. */
+function closeToolPairSpan(pairs, startIdx, endIdx, nodeCount) {
+	const count = Number.isInteger(nodeCount) ? nodeCount : pairs.length;
+	if (!Number.isInteger(startIdx) || !Number.isInteger(endIdx)) return null;
+	if (startIdx < 0 || endIdx < startIdx || endIdx >= count) return null;
+	const messageAt = (index) => (index >= 0 && index < count ? pairs[index] ?? null : null);
+	let start = startIdx;
+	let end = endIdx;
+
+	// Backward pass (bounded by count: every step moves start strictly earlier).
+	for (let guard = 0; guard <= count; guard++) {
+		const resultIds = toolResultIdsOf(messageAt(start));
+		if (resultIds.length === 0) break;
+		let owner = -1;
+		for (let i = start - 1; i >= 0; i--) {
+			const callIds = toolCallIdsOf(messageAt(i));
+			if (callIds.some((id) => resultIds.includes(id))) {
+				owner = i;
+				break;
+			}
+		}
+		if (owner < 0) break; // call already shadowed/absent: healing direction, span unchanged
+		start = owner;
+	}
+
+	// Forward pass: recompute the open calls over the current span each
+	// iteration, so a multi-result assistant step extends over all of them.
+	for (let guard = 0; guard <= count; guard++) {
+		const open = new Set();
+		for (let i = start; i <= end; i++) for (const id of toolCallIdsOf(messageAt(i))) open.add(id);
+		for (let i = start; i <= end; i++) for (const id of toolResultIdsOf(messageAt(i))) open.delete(id);
+		if (open.size === 0) return { startIdx: start, endIdx: end };
+		const next = end + 1;
+		if (next >= count) return null; // surface ends before the results: unclosable
+		const nextIds = toolResultIdsOf(messageAt(next));
+		if (!nextIds.some((id) => open.has(id))) return null; // next node answers a different call: unclosable
+		end = next;
+	}
+	return null;
+}
+
 /** Config field reader (fail-open default), same pattern as index.js. */
 function readBool(config, key, fallback) {
 	try {
@@ -429,10 +570,11 @@ export function createSurfaceFoldPass(deps = {}) {
 			const session = sessionOf(sessionId);
 			if (!surfaceCapable(session)) return false;
 			const nodes = session.surface.nodes.slice();
-			const located = locateOnSurface(derivingPairsOf(session, nodes), block);
+			const pairs = derivingPairsOf(session, nodes);
+			const located = locateOnSurface(pairs, block);
 			if (located === null) return false;
 			let startIdx = located[0];
-			const endIdx = located[1];
+			let endIdx = located[1];
 			// Head clamp at CAPTURE time: the stored range must never include
 			// the leading system message, so a block captured here stays clean
 			// even when it ships from a later process. surfaceHeadClamped tells
@@ -443,6 +585,13 @@ export function createSurfaceFoldPass(deps = {}) {
 				startIdx = 1;
 				block.surfaceHeadClamped = true;
 			}
+			// NOTE: the capture stores the LOCATED span only — it must not be
+			// pre-closed over tool pairs. The ship-time closure runs after
+			// validateStoredSeqs re-checks the stored endpoints against the
+			// block's refRange, so an extended capture (whose endpoints no
+			// longer derive the ref ids) would fail validation, fall back to
+			// live location and tombstone as a relocated range — a silently
+			// unshippable block. The sweep is the authoritative closure pass.
 			block.surfaceSeqs = nodes.slice(startIdx, endIdx + 1);
 			try {
 				store.persist(store.ledgerOf(sessionId));
@@ -486,12 +635,25 @@ export function createSurfaceFoldPass(deps = {}) {
 		if (typeof sessionId !== "string" || sessionId === "") return 0;
 		const ledger = store.ledgerOf(sessionId);
 		const blocks = Array.isArray(ledger.blocks) ? ledger.blocks : [];
+		// [2026-11-07]-[hintless sweeps used a null generation, so
+		// generation-keyed tombstones could NEVER re-open]-[the idle sweep
+		// passes no sessionHint: every tombstone (incomplete-seqs,
+		// tool-pair-unclosed, append-rejected, ...) was filtered out forever
+		// even after the surface changed (inspection P1-8). Fall back to the
+		// live session's generation when the hint does not carry one.]
 		const generation = (() => {
 			try {
-				return Number.isFinite(sessionHint?.surface?.contentGeneration) ? sessionHint.surface.contentGeneration : null;
+				if (Number.isFinite(sessionHint?.surface?.contentGeneration)) return sessionHint.surface.contentGeneration;
+			} catch {
+				/* fall through to the live lookup */
+			}
+			try {
+				const live = surfaceCapable(sessionHint) ? sessionHint : sessionOf(sessionId);
+				if (live !== null && typeof live === "object" && Number.isFinite(live.surface?.contentGeneration)) return live.surface.contentGeneration;
 			} catch {
-				return null;
+				/* unreadable session: null, fail-open */
 			}
+			return null;
 		})();
 		const pending = blocks.filter((block) => {
 			if (block?.surfaceReplaced !== null && block?.surfaceReplaced !== undefined) return false;
@@ -517,16 +679,214 @@ export function createSurfaceFoldPass(deps = {}) {
 			skip(sessionId, "compaction-lock", via, `blocks=${pending.length}`);
 			return 0;
 		}
-		const nodes = surface.nodes.slice();
-		const pairs = derivingPairsOf(session, nodes);
-		const liveGeneration = Number.isFinite(surface.contentGeneration) ? surface.contentGeneration : 0;
+		// Live surface snapshot — REFRESHED after every successful ship: the
+		// shadowed seqs leave surface.nodes, so the next pending block must
+		// resolve/close against the new node list (a stale snapshot validated
+		// or closed a span that no longer exists).
+		let nodes = surface.nodes.slice();
+		let pairs = derivingPairsOf(session, nodes);
+		let nodeMessages = denseMessagesOf(pairs, nodes.length);
+		// A ship is a replace op, which bumps surface.contentGeneration: refresh
+		// it with the snapshot so a tombstone written later in this sweep keys
+		// on the post-ship generation instead of re-opening on the next sweep.
+		let liveGeneration = Number.isFinite(surface.contentGeneration) ? surface.contentGeneration : 0;
 		// The host rejects a replace op over node 0 only when node 0 actually
 		// carries the system prompt (assertSystemHeadRewrite). Resolve that
 		// head role once per sweep — sessions without a leading system
 		// message fold their head node like any other.
-		const headIsSystem = headNodeIsSystem(session, nodes);
+		let headIsSystem = headNodeIsSystem(session, nodes);
 		let shipped = 0;
 		for (const block of pending) {
+			// ---- LADDER BRANCH (tier ≥ 2, docs/ladder-fold.md) --------------
+			// A distillation's surface material is the REPLACEMENT NODES of its
+			// consumed blocks (each carries a surfaceReplaced marker with the
+			// replacement event seq). The span from the first to the last
+			// replacement node must contain EXACTLY those nodes — engine folds
+			// are frontier-ordered, so nothing can legitimately interleave —
+			// and every mismatch tombstones instead of guessing.
+			if (isLadderBlock(block)) {
+				const consumedIds = Array.isArray(block.consumes) ? block.consumes : [];
+				const byId = new Map(blocks.map((entry) => [entry?.id, entry]));
+				const consumed = consumedIds.map((id) => byId.get(id));
+				if (consumed.some((entry) => entry === undefined || entry === null)) {
+					block.surfaceSkip = { reason: "ladder-consumed-skipped", contentGeneration: liveGeneration, at: Date.now() };
+					try {
+						store.persist(ledger);
+					} catch {
+						/* best effort */
+					}
+					skip(sessionId, "ladder-consumed-skipped", via, `block=${block.id}`);
+					continue;
+				}
+				const waiting = consumed.find((entry) => entry.surfaceReplaced === null || entry.surfaceReplaced === undefined);
+				if (waiting !== undefined) {
+					if (tombstoneOf(waiting) !== null) {
+						// A consumed block is hard-skipped on this generation: its
+						// replacement node can never materialize, so the ladder span
+						// can never be exact. Generation-keyed like every skip — a
+						// surface change re-opens both blocks.
+						block.surfaceSkip = { reason: "ladder-consumed-skipped", contentGeneration: liveGeneration, at: Date.now() };
+						try {
+							store.persist(ledger);
+						} catch {
+							/* best effort */
+						}
+						skip(sessionId, "ladder-consumed-skipped", via, `block=${block.id} consumed=${waiting.id}`);
+					}
+					// Otherwise the consumed block is still pending and sits EARLIER
+					// in this loop (ledger order): it ships — or skips — before this
+					// iteration reaches the ladder block again on a later sweep.
+					continue;
+				}
+				const indexOfSeq = new Map(nodes.map((seq, index) => [seq, index]));
+				// Summary-message id positions on the LIVE surface: the
+				// replacement message (acp_summary_<blockId>, deterministic body)
+				// is content-stable, so a branch/compaction that re-projected the
+				// surface invalidates the stored atSeqs but NOT the identity of
+				// the replacement nodes — the same re-location-not-re-target rule
+				// the T1 stale-capture path follows.
+				// [2026-11-07]-[observed live: a DSH branch rebuilt the surface
+				// projection, orphaning every T1 atSeq and tombstoning the pending
+				// T2 as ladder-span-gone forever]-[id re-location lets the ladder
+				// ship after any surface re-projection; the spanExact id-set check
+				// below keeps it exact.]
+				const idIndexOf = new Map();
+				for (let i = 0; i < nodeMessages.length; i++) {
+					const message = nodeMessages[i];
+					if (message !== null && typeof message === "object" && typeof message.id === "string" && message.id.startsWith("acp_summary_")) {
+						idIndexOf.set(message.id, i);
+					}
+				}
+				const atSeqs = [];
+				let unresolved = null;
+				for (const entry of consumed) {
+					const atSeq = Number.isFinite(entry.surfaceReplaced.atSeq) ? entry.surfaceReplaced.atSeq : null;
+					if (atSeq !== null && indexOfSeq.has(atSeq)) {
+						atSeqs.push(atSeq);
+						continue;
+					}
+					const relocatedIdx = idIndexOf.get(`acp_summary_${entry.id}`);
+					if (relocatedIdx === undefined) {
+						unresolved = entry;
+						break;
+					}
+					atSeqs.push(nodes[relocatedIdx]);
+				}
+				if (unresolved !== null) {
+					// A consumed replacement node left the live surface (host
+					// compaction shadowed it): the span is unreconstructable.
+					block.surfaceSkip = { reason: "ladder-span-gone", contentGeneration: liveGeneration, at: Date.now() };
+					try {
+						store.persist(ledger);
+					} catch {
+						/* best effort */
+					}
+					skip(sessionId, "ladder-span-gone", via, `block=${block.id} consumed=${unresolved.id}`);
+					continue;
+				}
+				const nodeIndexes = atSeqs.map((seq) => indexOfSeq.get(seq));
+				const ladderFirstIdx = Math.min(...nodeIndexes);
+				const ladderLastIdx = Math.max(...nodeIndexes);
+				const spanSeqs = nodes.slice(ladderFirstIdx, ladderLastIdx + 1);
+				const expectedSeqs = new Set(atSeqs);
+				let spanExact = spanSeqs.length === atSeqs.length && spanSeqs.every((seq) => expectedSeqs.has(seq));
+				// Id-set exactness: after id re-location the span must contain
+				// EXACTLY the consumed blocks' summary messages — a span that
+				// picked up a stranger's acp_summary node is not this fold's
+				// material (the length check alone cannot tell them apart).
+				if (spanExact) {
+					const expectedIds = new Set(consumed.map((entry) => `acp_summary_${entry.id}`));
+					for (let i = ladderFirstIdx; i <= ladderLastIdx; i++) {
+						const message = nodeMessages[i];
+						if (message === null || message === undefined || typeof message.id !== "string" || !expectedIds.has(message.id)) {
+							spanExact = false;
+							break;
+						}
+					}
+				}
+				if (spanExact) {
+					for (let i = ladderFirstIdx; i <= ladderLastIdx; i++) {
+						const message = nodeMessages[i];
+						if (message === null || message === undefined || typeof message.id !== "string" || !message.id.startsWith("acp_summary_")) {
+							spanExact = false;
+							break;
+						}
+					}
+				}
+				if (!spanExact) {
+					block.surfaceSkip = { reason: "ladder-span-mismatch", contentGeneration: liveGeneration, at: Date.now() };
+					try {
+						store.persist(ledger);
+					} catch {
+						/* best effort */
+					}
+					skip(sessionId, "ladder-span-mismatch", via, `block=${block.id}`);
+					continue;
+				}
+				// Defensive system-head clamp (a summary node can never be node
+				// 0 — T1 folds start after the head — but a drift-hostile guard
+				// costs one comparison).
+				if (headIsSystem && ladderFirstIdx === 0) {
+					block.surfaceSkip = { reason: "system-head", contentGeneration: liveGeneration, at: Date.now() };
+					try {
+						store.persist(ledger);
+					} catch {
+						/* best effort */
+					}
+					skip(sessionId, "system-head", via, `block=${block.id} ladder`);
+					continue;
+				}
+				const ladderStartSeq = nodes[ladderFirstIdx];
+				const ladderEndSeq = nodes[ladderLastIdx];
+				const ladderKey = replacedKey(sessionId, ladderStartSeq, ladderEndSeq, liveGeneration);
+				if (wasReplaced(ladderKey)) continue; // belt over the durable marker
+				try {
+					session.append("compaction/prune", {
+						shadowedRange: { start: ladderStartSeq, end: ladderEndSeq },
+						shadowedSeqs: spanSeqs,
+						shadowedTokenCount: Number.isFinite(block.approxTokens) && block.approxTokens > 0 ? Math.round(block.approxTokens) : spanSeqs.length,
+					});
+					const event = session.append("user/message", replacementMessageOf(block), {
+						surfaceOp: { op: "replace", startSeq: ladderStartSeq, endSeq: ladderEndSeq },
+						sourceEventSeqs: spanSeqs,
+					});
+					block.surfaceReplaced = {
+						startSeq: ladderStartSeq,
+						endSeq: ladderEndSeq,
+						seqs: spanSeqs.slice(),
+						contentGeneration: liveGeneration,
+						atSeq: Number.isFinite(event?.seq) ? event.seq : null,
+						via,
+						at: Date.now(),
+					};
+					delete block.surfaceSkip;
+					rememberReplaced(ladderKey);
+					shipped += 1;
+					// Same post-ship snapshot refresh as the T1 branch: the
+					// shadowed seqs left surface.nodes.
+					nodes = surface.nodes.slice();
+					pairs = derivingPairsOf(session, nodes);
+					nodeMessages = denseMessagesOf(pairs, nodes.length);
+					headIsSystem = headNodeIsSystem(session, nodes);
+					liveGeneration = Number.isFinite(surface.contentGeneration) ? surface.contentGeneration : 0;
+					decisionLog(`session=${sessionId} surface-replace startSeq=${ladderStartSeq} endSeq=${ladderEndSeq} seqs=${spanSeqs.length} tokens=${Number.isFinite(block.approxTokens) ? Math.round(block.approxTokens) : "?"} generation=${liveGeneration} ladder=${block.tier} via=${via}`);
+					try {
+						store.persist(ledger);
+					} catch {
+						/* the in-memory marker still guards this process */
+					}
+				} catch (error) {
+					const message = String(error?.message ?? error).replace(/\s+/g, " ").slice(0, 160);
+					block.surfaceSkip = { reason: `append-rejected:${message}`, contentGeneration: liveGeneration, at: Date.now() };
+					try {
+						store.persist(ledger);
+					} catch {
+						/* best effort */
+					}
+					skip(sessionId, `append-rejected:${message}`, via, `block=${block.id} ladder=${block.tier}`);
+				}
+				continue;
+			}
 			// Resolve the shadow range: stored capture first (validated dense
 			// against the LIVE surface). A stale/incomplete capture — or a
 			// capture-less legacy block — falls back to live location, but ONLY
@@ -536,10 +896,12 @@ export function createSurfaceFoldPass(deps = {}) {
 			// are simply gone): never a silent re-target onto a different range.
 			let startSeq = null;
 			let endSeq = null;
+			let startIdx = null;
+			let endIdx = null;
 			let seqs = null;
 			const stored = Array.isArray(block.surfaceSeqs) ? validateStoredSeqs(session, nodes, block.surfaceSeqs, block) : null;
 			if (stored !== null) {
-				({ startSeq, endSeq, seqs } = stored);
+				({ startIdx, endIdx, startSeq, endSeq, seqs } = stored);
 			} else {
 				const located = locateOnSurface(pairs, block);
 				if (located === null) {
@@ -578,10 +940,43 @@ export function createSurfaceFoldPass(deps = {}) {
 					skip(sessionId, "incomplete-seqs", via, `block=${block.id} overlap`, false);
 					continue;
 				}
-				startSeq = nodes[located[0]];
-				endSeq = nodes[located[1]];
+				startIdx = located[0];
+				endIdx = located[1];
+				startSeq = nodes[startIdx];
+				endSeq = nodes[endIdx];
 				seqs = locatedSeqs;
 			}
+			// Tool-pair closure over the LIVE surface (both resolution paths):
+			// a shipped range must never separate an assistant's tool call from
+			// its results — the provider wire serializers reject the orphan half
+			// ("DeepSeek Messages tool result has no matching call",
+			// llm-deepseek/src/serialize.ts:130-150). Extend forward over the
+			// results of calls opened inside the range, and backward over the
+			// live call of an orphan result at the range start. Unclosable (a
+			// call with no result on this surface, a range whose next node
+			// answers a different call) tombstones as tool-pair-unclosed — the
+			// same safe hard-skip family as incomplete-seqs: never ship a
+			// pair-splitting range. The block re-opens on the next surface
+			// content change (tool-pair-unclosed is generation-keyed like every
+			// other skip).
+			const closed = closeToolPairSpan(nodeMessages, startIdx, endIdx, nodes.length);
+			if (closed === null) {
+				block.surfaceSkip = { reason: "tool-pair-unclosed", contentGeneration: liveGeneration, at: Date.now() };
+				try {
+					store.persist(ledger);
+				} catch {
+					/* best effort */
+				}
+				skip(sessionId, "tool-pair-unclosed", via, `block=${block.id}`);
+				continue;
+			}
+			if (closed.startIdx !== startIdx || closed.endIdx !== endIdx) {
+				startIdx = closed.startIdx;
+				endIdx = closed.endIdx;
+				startSeq = nodes[startIdx];
+				endSeq = nodes[endIdx];
+				seqs = nodes.slice(startIdx, endIdx + 1);
+			}
 			// System head clamp (ship time, BOTH resolution paths): when the
 			// first surface node carries the system prompt, the v4 validator
 			// rejects any prune whose shadowedSeqs contain it
@@ -658,6 +1053,15 @@ export function createSurfaceFoldPass(deps = {}) {
 				delete block.surfaceSkip;
 				rememberReplaced(key);
 				shipped += 1;
+				// The shadowed seqs have just left surface.nodes: refresh the
+				// snapshot every later pending block resolves against, so its
+				// dense validation / re-location / pair closure reads the
+				// POST-ship surface instead of a range that no longer exists.
+				nodes = surface.nodes.slice();
+				pairs = derivingPairsOf(session, nodes);
+				nodeMessages = denseMessagesOf(pairs, nodes.length);
+				headIsSystem = headNodeIsSystem(session, nodes);
+				liveGeneration = Number.isFinite(surface.contentGeneration) ? surface.contentGeneration : 0;
 				decisionLog(`session=${sessionId} surface-replace startSeq=${startSeq} endSeq=${endSeq} seqs=${seqs.length} tokens=${Number.isFinite(block.approxTokens) ? Math.round(block.approxTokens) : "?"} generation=${liveGeneration} via=${via}`);
 				try {
 					store.persist(ledger);