gentle-pi 1.2.0 → 2.0.0

package/lib/review-candidate-view.ts

@@ -116,6 +116,18 @@ export interface NativeCandidateProjectionDescriptor {
 	paths: readonly string[];
 	intendedUntracked: readonly string[];
 	projection: "workspace" | "staged";
+	// Optional so Phase 3 stays additive: existing callers keep the legacy
+	// sorted-path behavior until the v2 switchover supplies a manifest.
+	manifest?: readonly ChangedPathEntry[];
+	// The provider artifact-subject's `changed_path_manifest_sha256` claim.
+	// Production callers verify this field across all collect inputs and their
+	// artifact subjects; hand-built descriptors may still use Pi's local digest
+	// as a self-consistency check.
+	manifestSha256?: string;
+	// Set only by the production status adapter after it has checked every
+	// provider-issued collect input and artifact subject for one identical hash.
+	// Provider canonicalization is intentionally not reimplemented here.
+	providerManifestHashVerified?: true;
 }
 
 export class CandidateViewError extends Error {
@@ -233,6 +245,109 @@ function gitPathTokens(cwd: string, arguments_: readonly string[], executor: Can
 	return splitNulTerminated(raw, "candidate scope Git output is not NUL-terminated");
 }
 
+// One manifest entry per changed path, carrying the state contract v2 ships in
+// `changed_path_manifest`. `deriveChangedScope` cannot produce this: it runs
+// `--name-status`, which reports a status and a path but never an old mode, so
+// a mode-only or type change is invisible to it. `--raw` carries both modes and
+// both blob ids, which is what makes `modeOnly` decidable at all.
+export interface ChangedPathEntry {
+	readonly path: string;
+	readonly status: string;
+	readonly oldMode: string;
+	readonly newMode: string;
+	readonly deleted: boolean;
+	readonly typeChanged: boolean;
+	readonly modeOnly: boolean;
+}
+
+export function deriveChangedPathManifest(cwd: string, baseTree: string, candidateTree: string, executor: CandidateGitExecutor = defaultCandidateGitExecutor): readonly ChangedPathEntry[] {
+	const tokens = gitPathTokens(cwd, ["diff", "--raw", "-z", "--abbrev=40", "--no-ext-diff", "--find-renames=100%", baseTree, candidateTree], executor);
+	const entries: ChangedPathEntry[] = [];
+	for (let index = 0; index < tokens.length;) {
+		const header = tokens[index++]?.toString("ascii");
+		if (header === undefined) break;
+		// `:<old_mode> <new_mode> <old_sha> <new_sha> <status>`
+		const match = /^:([0-7]{6}) ([0-7]{6}) ([0-9a-f]{7,64}) ([0-9a-f]{7,64}) ([AMDT]|R[0-9]{3})$/.exec(header);
+		if (match === null) throw new CandidateViewError("candidate manifest Git output contains an unsafe raw header", "manifest-derivation-invalid");
+		const [, oldMode, newMode, oldSha, newSha, status] = match;
+		const firstPath = tokens[index++];
+		if (firstPath === undefined) throw new CandidateViewError("candidate manifest Git output is incomplete", "manifest-derivation-invalid");
+		// A rename emits both the old and the new path; the new one is the scope.
+		const path = status.startsWith("R") ? decodeCanonicalPath(tokens[index++] ?? firstPath) : decodeCanonicalPath(firstPath);
+		entries.push(Object.freeze({
+			path,
+			status: status.startsWith("R") ? "A" : status,
+			oldMode,
+			newMode,
+			deleted: status === "D",
+			typeChanged: status === "T",
+			// Identical blob on both sides with different modes is the case the
+			// sorted-path comparison could never see.
+			modeOnly: oldSha === newSha && oldMode !== newMode,
+		}));
+	}
+	return Object.freeze([...entries].sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0)));
+}
+
+// Pi's own canonical digest of a changed-path manifest: sorted by path, with
+// the wire (snake_case) field names the v2 `changed_path` schema uses. This
+// is deliberately NOT an attempt to reproduce the provider's undocumented
+// `changed_path_manifest_sha256` canonicalization byte-for-byte (design.md's
+// open question). It is Pi's own self-consistency check: does the manifest a
+// descriptor carries digest to the same value the descriptor claims for it?
+// A caller (or a corrupted transport) that supplies a manifest and a claimed
+// digest that disagree with each other is caught here, independent of and
+// before any comparison against live Git content.
+export function digestChangedPathManifest(manifest: readonly ChangedPathEntry[]): string {
+	const canonical = [...manifest]
+		.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))
+		.map((entry) => ({
+			path: entry.path,
+			status: entry.status,
+			old_mode: entry.oldMode,
+			new_mode: entry.newMode,
+			deleted: entry.deleted,
+			type_changed: entry.typeChanged,
+			mode_only: entry.modeOnly,
+		}));
+	return `sha256:${createHash("sha256").update(JSON.stringify(canonical)).digest("hex")}`;
+}
+
+function assertManifestMatchesGit(descriptor: NativeCandidateProjectionDescriptor, derived: readonly ChangedPathEntry[]): void {
+	const claimed = descriptor.manifest;
+	if (claimed === undefined) return;
+
+	// Self-consistency: does the manifest digest to what the subject claims
+	// for it? Checked before any Git comparison, same as input-divergence.
+	if (descriptor.manifestSha256 !== undefined && descriptor.providerManifestHashVerified !== true && digestChangedPathManifest(claimed) !== descriptor.manifestSha256) {
+		throw new CandidateViewError("native manifest does not digest to its own artifact-subject claim", "manifest-subject-drift");
+	}
+
+	// First: is the provider's own input self-consistent? A manifest that does
+	// not describe the descriptor's paths is not a drift observation, it is a
+	// malformed input, and saying so separately keeps the diagnosis honest.
+	const claimedPaths = [...claimed.map((entry) => entry.path)].sort();
+	if (JSON.stringify(claimedPaths) !== JSON.stringify([...descriptor.paths].sort())) {
+		throw new CandidateViewError("native manifest does not describe the same paths as its own projection", "manifest-input-divergence");
+	}
+
+	const derivedByPath = new Map(derived.map((entry) => [entry.path, entry]));
+	if (JSON.stringify(claimedPaths) !== JSON.stringify(derived.map((entry) => entry.path))) {
+		throw new CandidateViewError("native manifest paths do not match Git content", "manifest-path-set-drift");
+	}
+
+	for (const entry of claimed) {
+		const actual = derivedByPath.get(entry.path);
+		if (actual === undefined) throw new CandidateViewError("native manifest paths do not match Git content", "manifest-path-set-drift");
+		if (entry.status !== actual.status || entry.deleted !== actual.deleted) {
+			throw new CandidateViewError(`native manifest status for ${entry.path} does not match Git content`, "manifest-status-drift");
+		}
+		if (entry.oldMode !== actual.oldMode || entry.newMode !== actual.newMode || entry.modeOnly !== actual.modeOnly || entry.typeChanged !== actual.typeChanged) {
+			throw new CandidateViewError(`native manifest mode state for ${entry.path} does not match Git content`, "manifest-mode-drift");
+		}
+	}
+}
+
 function deriveChangedScope(cwd: string, baseCommit: string, candidateTree: string, entries: readonly CandidateTreeEntry[], executor: CandidateGitExecutor): CandidateViewScope {
 	const present = new Map(entries.map((entry) => [entry.path, entry]));
 	const paths = new Set<string>();
@@ -683,9 +798,24 @@ export class CandidateViewRegistry {
 		const base = head.tree === descriptor.baseTree ? head : resolveCandidateBaseTree(root, descriptor.baseTree, this.gitExecutor);
 		const committedOnly = head.tree === descriptor.currentCandidateTree && base.tree !== head.tree;
 		if (!committedOnly && head.tree !== descriptor.baseTree) throw new CandidateViewError("native projection base no longer matches HEAD");
+		// The descriptor's own `projection` label ("staged" = a committed range,
+		// "workspace" = dirty-inclusive) must agree with what Pi independently
+		// derives from the base/candidate/HEAD relationship. Neither trusting
+		// nor silently overriding a mislabeled claim is safe: fail closed.
+		if ((descriptor.projection === "staged") !== committedOnly) {
+			throw new CandidateViewError("native projection commit-state does not match its declared projection kind", "projection-kind-drift");
+		}
 		const tree = parseTree(root, descriptor.currentCandidateTree, this.gitExecutor);
 		const scope = deriveChangedScope(root, descriptor.baseTree, descriptor.currentCandidateTree, [...tree.entries, ...tree.gitlinks], this.gitExecutor);
-		if (JSON.stringify(scope.paths) !== JSON.stringify([...descriptor.paths].sort())) throw new CandidateViewError("native projection paths do not match Git content");
+		// A manifest SUBSUMES the sorted-path comparison rather than stacking on
+		// top of it: it checks the same path set plus the mode, status, and
+		// type state the path set cannot express, and it names which of those
+		// drifted. Descriptors without a manifest keep the legacy check.
+		if (descriptor.manifest !== undefined) {
+			assertManifestMatchesGit(descriptor, deriveChangedPathManifest(root, descriptor.baseTree, descriptor.currentCandidateTree, this.gitExecutor));
+		} else if (JSON.stringify(scope.paths) !== JSON.stringify([...descriptor.paths].sort())) {
+			throw new CandidateViewError("native projection paths do not match Git content");
+		}
 		this.projections.set(lineageId, {
 			contributorRoot: root,
 			baseCommit: base.commit,

package/lib/review-compact-contract.ts

@@ -13,6 +13,7 @@ import {
 import { REVIEW_LENS } from "./review-triggers.ts";
 import { canonicalJsonV1, domainHashV1 } from "./review-canonical.ts";
 import { normalizeRefuterBatch, type RefuterBatch } from "./review-refuter-adapter.ts";
+import { CORRECTION_OUTCOMES, type CorrectionOutcome } from "./review-correction-lifecycle.ts";
 
 const DIGEST = /^[0-9a-f]{64}$/;
 const LINEAGE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
@@ -45,6 +46,7 @@ export interface CompactFinalizeContractInput {
 	validation?: CompactTargetedValidationInput;
 	final_evidence?: string;
 	final_verification_passed?: boolean;
+	final_verification_outcome?: CorrectionOutcome;
 	refuter_batch?: unknown;
 }
 
@@ -263,14 +265,21 @@ export function parseCompactStartInput(value: unknown): CompactStartContractInpu
 }
 
 function parseCompactFinalizeInputValue(value: unknown, preserveFinalEvidence: boolean): CompactFinalizeContractInput {
-	const input = exact(value, "review/finalize", ["cwd"], ["lineageId", "review_result", "correction_line_forecast", "validation_proof", "validation", "final_evidence", "final_verification_passed", "refuter_batch"]);
-	if ((input.final_evidence === undefined) !== (input.final_verification_passed === undefined)) fail("review/finalize", "field-pair", "final evidence and result must appear together");
+	const input = exact(value, "review/finalize", ["cwd"], ["lineageId", "review_result", "correction_line_forecast", "validation_proof", "validation", "final_evidence", "final_verification_passed", "final_verification_outcome", "refuter_batch"]);
+	const outcomeFields = Number(input.final_verification_passed !== undefined) + Number(input.final_verification_outcome !== undefined);
+	if ((input.final_evidence === undefined && outcomeFields !== 0) || (input.final_evidence !== undefined && outcomeFields !== 1)) fail("review/finalize", "field-pair", "final evidence requires exactly one verification result or outcome");
 	let correction_line_forecast: number | undefined;
 	if (input.correction_line_forecast !== undefined) {
 		if (!Number.isSafeInteger(input.correction_line_forecast) || input.correction_line_forecast <= 0) fail("review/finalize.correction_line_forecast", "range", "must be a positive safe integer");
 		correction_line_forecast = input.correction_line_forecast;
 	}
 	if (input.final_verification_passed !== undefined && typeof input.final_verification_passed !== "boolean") fail("review/finalize.final_verification_passed", "type", "must be boolean");
+	let final_verification_outcome: CorrectionOutcome | undefined;
+	if (input.final_verification_outcome !== undefined) {
+		const outcome = string(input.final_verification_outcome, "review/finalize.final_verification_outcome");
+		if (!(CORRECTION_OUTCOMES as readonly string[]).includes(outcome)) fail("review/finalize.final_verification_outcome", "enum", "contains an unsupported value");
+		final_verification_outcome = outcome as CorrectionOutcome;
+	}
 	let final_evidence: string | undefined;
 	if (input.final_evidence !== undefined) {
 		if (preserveFinalEvidence) {
@@ -280,7 +289,7 @@ function parseCompactFinalizeInputValue(value: unknown, preserveFinalEvidence: b
 			final_evidence = string(input.final_evidence, "review/finalize.final_evidence");
 		}
 	}
-	return { cwd: string(input.cwd, "review/finalize.cwd"), ...(optionalLineage(input.lineageId, "review/finalize.lineageId") === undefined ? {} : { lineageId: optionalLineage(input.lineageId, "review/finalize.lineageId")! }), ...(input.review_result === undefined ? {} : { review_result: parseReviewResult(input.review_result, "review/finalize.review_result") }), ...(correction_line_forecast === undefined ? {} : { correction_line_forecast }), ...(input.validation_proof === undefined ? {} : { validation_proof: parseValidationProof(input.validation_proof, "review/finalize.validation_proof") }), ...(input.validation === undefined ? {} : { validation: parseValidation(input.validation, "review/finalize.validation") }), ...(final_evidence === undefined ? {} : { final_evidence }), ...(input.final_verification_passed === undefined ? {} : { final_verification_passed: input.final_verification_passed }), ...(input.refuter_batch === undefined ? {} : { refuter_batch: input.refuter_batch }) };
+	return { cwd: string(input.cwd, "review/finalize.cwd"), ...(optionalLineage(input.lineageId, "review/finalize.lineageId") === undefined ? {} : { lineageId: optionalLineage(input.lineageId, "review/finalize.lineageId")! }), ...(input.review_result === undefined ? {} : { review_result: parseReviewResult(input.review_result, "review/finalize.review_result") }), ...(correction_line_forecast === undefined ? {} : { correction_line_forecast }), ...(input.validation_proof === undefined ? {} : { validation_proof: parseValidationProof(input.validation_proof, "review/finalize.validation_proof") }), ...(input.validation === undefined ? {} : { validation: parseValidation(input.validation, "review/finalize.validation") }), ...(final_evidence === undefined ? {} : { final_evidence }), ...(input.final_verification_passed === undefined ? {} : { final_verification_passed: input.final_verification_passed }), ...(final_verification_outcome === undefined ? {} : { final_verification_outcome }), ...(input.refuter_batch === undefined ? {} : { refuter_batch: input.refuter_batch }) };
 }
 
 export function parseCompactFinalizeInput(value: unknown): CompactFinalizeContractInput {

package/lib/review-consent-latch.ts

@@ -0,0 +1,51 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { assertManagedStorePathV1, resolveRepositoryAuthorityV1 } from "./review-repository.ts";
+
+// Pi-owned, clone-local (Git-common-dir) latch recording that the one-time
+// "run the review now?" question has already been put to the user for this
+// clone. Design Decision #2 (organic-rdd-parity): scope, direction, and
+// asymmetry mirror gentle-ai's own RDDConsentAsked/RecordRDDConsentAsked
+// exactly (per clone, accept-only, never committed, never inherited) —
+// but this is Pi's OWN latch, at Pi's OWN path, never gentle-ai's private
+// rdd-mode/asked.json. Writing another product's private authority store
+// would be a boundary violation.
+export const REVIEW_CONSENT_LATCH_SCHEMA = "gentle-pi.review-consent-asked/v1";
+const REVIEW_CONSENT_LATCH_PAYLOAD = `{"schema":"${REVIEW_CONSENT_LATCH_SCHEMA}"}\n`;
+
+function reviewConsentLatchPath(cwd: string): string {
+	const authority = resolveRepositoryAuthorityV1(cwd);
+	return assertManagedStorePathV1(authority.common_directory, join(authority.common_directory, "gentle-pi", "review-consent", "asked.json"));
+}
+
+/**
+ * Reads whether the one-time consent question has already been asked for
+ * this clone. Returns false when no latch has ever been recorded. Throws
+ * when the repository/Git-common-dir authority cannot be resolved at all
+ * (unresolvable, non-Git, or shallow repository) — callers must treat that
+ * as "no latch write, review proceeds" per the Threat Matrix rather than
+ * silently reporting a latch.
+ */
+export function readReviewConsentLatch(cwd: string): boolean {
+	const path = reviewConsentLatchPath(cwd);
+	let payload: string;
+	try {
+		payload = readFileSync(path, "utf8");
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+		throw error;
+	}
+	return payload === REVIEW_CONSENT_LATCH_PAYLOAD;
+}
+
+/**
+ * Records the one-time consent question as asked for this clone. One-way:
+ * called only on accept, never on decline. Idempotent — recording twice
+ * writes the same exact canonical bytes.
+ */
+export function recordReviewConsentLatch(cwd: string): void {
+	const path = reviewConsentLatchPath(cwd);
+	mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+	writeFileSync(path, REVIEW_CONSENT_LATCH_PAYLOAD, { mode: 0o600 });
+	chmodSync(path, 0o600);
+}

package/lib/review-correction-lifecycle.ts

@@ -0,0 +1,170 @@
+// Evidence-first correction lifecycle, protocol v1.5.
+//
+// An ordinary review permits exactly one bounded correction transaction. Since
+// v1.5 the provider collects candidate-bound verification evidence BEFORE it
+// offers `targeted_validation`, and the outcome it records decides which of
+// three terminal branches follows. Those branches differ in what they consume:
+// only `procedural_tooling_failed` ends the lifecycle, only `passed` unlocks
+// validation, and `verification_failed` must cost nothing at all.
+//
+// This module is deliberately pure — no subprocess, no filesystem, no clock.
+// The provider owns the evidence directory and the budget ledger; what Pi owns
+// is the decision, and a decision made from data can be tested without a live
+// binary. The rejected alternative was inlining these branches beside the
+// existing validation conditionals, where the single-correction invariant would
+// have been enforced by control flow instead of by data.
+
+export const CORRECTION_OUTCOMES = Object.freeze(["passed", "verification_failed", "procedural_tooling_failed"] as const);
+export type CorrectionOutcome = (typeof CORRECTION_OUTCOMES)[number];
+
+export class CorrectionOutcomeError extends Error {
+	constructor(received: unknown) {
+		super(`review correction evidence outcome must be exactly one of ${CORRECTION_OUTCOMES.join(", ")}; received ${JSON.stringify(received)}`);
+		this.name = "CorrectionOutcomeError";
+	}
+}
+
+export class CorrectionEvidenceReplacedError extends Error {
+	constructor(detail: string) {
+		super(`correction-evidence-replaced: ${detail}`);
+		this.name = "CorrectionEvidenceReplacedError";
+	}
+}
+
+export interface CorrectionStatus {
+	readonly lineageId: string;
+	readonly targetIdentity: string;
+	readonly authorityRevision: string;
+	readonly correctionBudget: number;
+	readonly changedLinesCharged: number;
+}
+
+export interface CorrectionEvidence {
+	readonly outcome: string;
+	readonly evidenceIdentity: string;
+	readonly recordDigest: string;
+	readonly candidateTree?: string;
+	readonly rawPayloadSha256?: string;
+}
+
+interface CorrectionStepBase {
+	readonly kind: string;
+	readonly lineageId: string;
+	readonly transactionOpen: boolean;
+	readonly unlocksTargetedValidation: boolean;
+}
+
+export interface RunTargetedValidationStep extends CorrectionStepBase {
+	readonly kind: "run-targeted-validation";
+	readonly transactionOpen: false;
+	readonly unlocksTargetedValidation: true;
+	// The provider issues the request. Pi re-queries STATUS for it instead of
+	// fabricating one, so the step names the operation it expects to collect.
+	readonly expectCaptureOperation: "external.run_targeted_validation";
+	readonly evidenceIdentity: string;
+}
+
+export interface RecaptureRequiredStep extends CorrectionStepBase {
+	readonly kind: "recapture-required";
+	readonly transactionOpen: true;
+	readonly unlocksTargetedValidation: false;
+	readonly attemptConsumed: false;
+	readonly budgetConsumed: 0;
+	readonly changedLinesCharged: number;
+	readonly autoRetry: false;
+	// Carries the identity this capture supersedes. A new capture is mandatory:
+	// there is deliberately no field that would let a caller resubmit the same
+	// candidate bytes under the prior identity.
+	readonly supersedes: string;
+	readonly requiresNewCapture: true;
+	readonly guidance: string;
+}
+
+export interface TerminalEscalationStep extends CorrectionStepBase {
+	readonly kind: "terminal-escalation";
+	readonly transactionOpen: false;
+	readonly unlocksTargetedValidation: false;
+	readonly retryEligible: false;
+	readonly launchesReviewer: false;
+	readonly launchesValidator: false;
+	readonly launchesCorrection: false;
+	readonly escalation: string;
+	readonly evidenceIdentity: string;
+}
+
+export type CorrectionStep = RunTargetedValidationStep | RecaptureRequiredStep | TerminalEscalationStep;
+
+function requireOutcome(value: unknown): CorrectionOutcome {
+	if (typeof value !== "string" || !(CORRECTION_OUTCOMES as readonly string[]).includes(value)) throw new CorrectionOutcomeError(value);
+	return value as CorrectionOutcome;
+}
+
+export function resolveCorrectionStep(status: CorrectionStatus, evidence: CorrectionEvidence): CorrectionStep {
+	const outcome = requireOutcome(evidence?.outcome);
+
+	if (outcome === "passed") {
+		return Object.freeze({
+			kind: "run-targeted-validation",
+			lineageId: status.lineageId,
+			transactionOpen: false,
+			unlocksTargetedValidation: true,
+			expectCaptureOperation: "external.run_targeted_validation",
+			evidenceIdentity: evidence.evidenceIdentity,
+		} as const);
+	}
+
+	if (outcome === "verification_failed") {
+		return Object.freeze({
+			kind: "recapture-required",
+			lineageId: status.lineageId,
+			transactionOpen: true,
+			unlocksTargetedValidation: false,
+			attemptConsumed: false,
+			budgetConsumed: 0,
+			// Reported, never recomputed: a failed verification must not move the
+			// accounting the provider already holds in either direction.
+			changedLinesCharged: status.changedLinesCharged,
+			autoRetry: false,
+			supersedes: evidence.evidenceIdentity,
+			requiresNewCapture: true,
+			guidance: "Verification failed. Change the candidate and capture new evidence; the correction transaction stays open and nothing has been charged. Do not retry the same bytes.",
+		} as const);
+	}
+
+	return Object.freeze({
+		kind: "terminal-escalation",
+		lineageId: status.lineageId,
+		transactionOpen: false,
+		unlocksTargetedValidation: false,
+		retryEligible: false,
+		launchesReviewer: false,
+		launchesValidator: false,
+		launchesCorrection: false,
+		escalation: "Procedural tooling failed while capturing verification evidence. This is a terminal escalation: no reviewer, correction, or validator runs afterwards, and retry eligibility is not considered. It needs one human decision.",
+		evidenceIdentity: evidence.evidenceIdentity,
+	} as const);
+}
+
+export interface DistinctEvidenceCheck {
+	readonly prior: CorrectionEvidence;
+	readonly next: CorrectionEvidence;
+	// Whether the earlier record is still resolvable, and what its bytes hash to
+	// NOW. Both are observations the caller supplies; this function judges them
+	// rather than performing IO, which keeps the invariant unit-testable.
+	readonly priorStillResolvable: boolean;
+	readonly priorRecordDigestNow: string;
+}
+
+export function assertDistinctCorrectionEvidence(check: DistinctEvidenceCheck): void {
+	const { prior, next, priorStillResolvable, priorRecordDigestNow } = check;
+
+	if (next.evidenceIdentity === prior.evidenceIdentity) {
+		throw new CorrectionEvidenceReplacedError(`the provider reused evidence identity ${prior.evidenceIdentity} for a second capture; each capture must land in its own immutable directory`);
+	}
+	if (!priorStillResolvable) {
+		throw new CorrectionEvidenceReplacedError(`the earlier evidence record ${prior.evidenceIdentity} is no longer resolvable; a failed capture must survive alongside its successor, not be replaced`);
+	}
+	if (priorRecordDigestNow !== prior.recordDigest) {
+		throw new CorrectionEvidenceReplacedError(`the earlier evidence record ${prior.evidenceIdentity} now digests to ${priorRecordDigestNow} instead of ${prior.recordDigest}; its bytes must be immutable`);
+	}
+}