harnery 0.34.1 → 0.36.0

package/dist/core/events/v3/control-witness.js

@@ -0,0 +1,233 @@
+import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, existsSync, fsyncSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { fsyncParentDirectory } from "../../workflow/durable-record.js";
+import { canonicalJsonV3, fingerprintV3, sha256V3 } from "./canonical.js";
+import { fingerprintContextV3 } from "./fingerprint-keys.js";
+import { advanceEventV3AppendValidationCheckpointV3, EVENT_V3_CONTROL_CHECKPOINT_RELATIVE_PATH, EVENT_V3_CONTROL_WITNESS_RELATIVE_PATH, eventV3AuthorityStorageVersionV3, eventV3ControlCheckpointPathV3, eventV3ControlWitnessPathV3, parseEventV3AppendValidationCheckpointV3, } from "./reader.js";
+export { EVENT_V3_CONTROL_CHECKPOINT_RELATIVE_PATH, EVENT_V3_CONTROL_WITNESS_RELATIVE_PATH };
+/** True only when one authenticated witness names this exact active control pair and storage. */
+export function activeControlWitnessMatchesV3(coordRoot, binding) {
+    try {
+        const before = eventV3AuthorityStorageVersionV3(coordRoot);
+        const witness = readAuthenticatedWitnessV3(coordRoot);
+        if (!witness)
+            return false;
+        const expected = witnessPayloadV3(binding, before, witness.payload.checkpoint_digest);
+        if (canonicalJsonV3(witness.payload) !== canonicalJsonV3(expected))
+            return false;
+        const after = eventV3AuthorityStorageVersionV3(coordRoot);
+        return sameStorageVersion(before, after);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Publish a witness only when the storage validated by the caller is still current.
+ * Failure is intentionally silent: the next read retains the canonical full-scan fallback.
+ */
+export function publishActiveControlWitnessV3(coordRoot, binding, validatedStorage, checkpoint) {
+    try {
+        const current = eventV3AuthorityStorageVersionV3(coordRoot);
+        if (!sameStorageVersion(validatedStorage, current))
+            return false;
+        return publishWitnessV3(coordRoot, witnessPayloadV3(binding, current, checkpointDigestV3(checkpoint)), checkpoint);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Capture a previously authenticated witness before the append lease mutates storage.
+ * The returned payload is safe to advance only while the caller continues to hold that lease.
+ */
+export function readAdvanceableControlWitnessV3(coordRoot) {
+    try {
+        const storage = eventV3AuthorityStorageVersionV3(coordRoot);
+        const witness = readAuthenticatedWitnessV3(coordRoot);
+        if (!witness || !sameStorageVersion(witness.payload.storage, storage))
+            return undefined;
+        const checkpoint = readAuthenticatedCheckpointV3(coordRoot, witness.payload.checkpoint_digest);
+        return checkpoint && checkpoint.validated_active_bytes === storage.active_bytes
+            ? { payload: witness.payload, checkpoint }
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Advance a lease-held witness after durable appends without changing writer success semantics. */
+export function advanceControlWitnessV3(coordRoot, prior, currentGenesisId) {
+    try {
+        if (currentGenesisId !== prior.payload.genesis_id)
+            return false;
+        const storageBeforeValidation = eventV3AuthorityStorageVersionV3(coordRoot);
+        const checkpoint = advanceEventV3AppendValidationCheckpointV3(coordRoot, prior.checkpoint);
+        if (!checkpoint)
+            return false;
+        const storage = eventV3AuthorityStorageVersionV3(coordRoot);
+        if (storageBeforeValidation.fingerprint !== storage.fingerprint ||
+            prior.payload.storage.stable_fingerprint !== storage.stable_fingerprint ||
+            checkpoint.validated_active_bytes !== storage.active_bytes) {
+            return false;
+        }
+        return publishWitnessV3(coordRoot, {
+            ...prior.payload,
+            storage,
+            checkpoint_digest: checkpointDigestV3(checkpoint),
+        }, checkpoint);
+    }
+    catch {
+        return false;
+    }
+}
+function witnessPayloadV3(binding, storage, checkpointDigest) {
+    const scope = binding.genesis.event.scope;
+    return {
+        format: "harnery-event-v3-control-witness",
+        format_version: 1,
+        genesis_id: binding.genesis.event.payload.genesis_id,
+        activation_id: binding.activation.activation_id,
+        genesis_event_id: binding.genesis.event.event_id,
+        activation_event_id: binding.activation.event.event_id,
+        genesis_manifest_digest: sha256V3(canonicalJsonV3(binding.genesis)),
+        activation_manifest_digest: sha256V3(canonicalJsonV3(binding.activation)),
+        candidate_manifest_digest: binding.candidate_manifest_digest,
+        privacy_key_epoch: binding.genesis.profile.privacy_key_epoch,
+        root_id: scope.root_id,
+        storage,
+        checkpoint_digest: checkpointDigest,
+    };
+}
+function readAuthenticatedWitnessV3(coordRoot) {
+    const path = eventV3ControlWitnessPathV3(coordRoot);
+    if (!existsSync(path))
+        return undefined;
+    const raw = readFileSync(path, "utf8");
+    const value = JSON.parse(raw);
+    const witness = parseWitnessV3(value);
+    if (`${canonicalJsonV3(witness)}\n` !== raw)
+        return undefined;
+    const expected = authenticatePayloadV3(coordRoot, witness.payload);
+    return canonicalJsonV3(witness.authentication) === canonicalJsonV3(expected)
+        ? witness
+        : undefined;
+}
+function publishWitnessV3(coordRoot, payload, checkpoint) {
+    if (!publishCanonicalFileV3(eventV3ControlCheckpointPathV3(coordRoot), checkpoint))
+        return false;
+    const witness = {
+        payload,
+        authentication: authenticatePayloadV3(coordRoot, payload),
+    };
+    return publishCanonicalFileV3(eventV3ControlWitnessPathV3(coordRoot), witness);
+}
+function publishCanonicalFileV3(path, value) {
+    const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+    let fd;
+    try {
+        fd = openSync(temporary, "wx", 0o600);
+        writeFileSync(fd, `${canonicalJsonV3(value)}\n`, "utf8");
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        chmodSync(temporary, 0o600);
+        renameSync(temporary, path);
+        fsyncParentDirectory(path);
+        return true;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        if (existsSync(temporary))
+            unlinkSync(temporary);
+    }
+}
+function readAuthenticatedCheckpointV3(coordRoot, expectedDigest) {
+    try {
+        const raw = readFileSync(eventV3ControlCheckpointPathV3(coordRoot), "utf8");
+        const value = JSON.parse(raw);
+        if (`${canonicalJsonV3(value)}\n` !== raw ||
+            sha256V3(canonicalJsonV3(value)) !== expectedDigest) {
+            return undefined;
+        }
+        return parseEventV3AppendValidationCheckpointV3(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function checkpointDigestV3(checkpoint) {
+    return sha256V3(canonicalJsonV3(checkpoint));
+}
+function authenticatePayloadV3(coordRoot, payload) {
+    const context = fingerprintContextV3(coordRoot, payload.root_id, undefined, payload.privacy_key_epoch);
+    return fingerprintV3(context, "control-state-witness", payload, "root");
+}
+function parseWitnessV3(value) {
+    const envelope = object(value);
+    if (Object.keys(envelope).sort().join("\0") !== "authentication\0payload") {
+        throw new Error("control witness envelope is invalid");
+    }
+    const payload = object(envelope.payload);
+    const expectedPayloadKeys = [
+        "activation_event_id",
+        "activation_id",
+        "activation_manifest_digest",
+        "candidate_manifest_digest",
+        "checkpoint_digest",
+        "format",
+        "format_version",
+        "genesis_event_id",
+        "genesis_id",
+        "genesis_manifest_digest",
+        "privacy_key_epoch",
+        "root_id",
+        "storage",
+    ];
+    if (Object.keys(payload).sort().join("\0") !== expectedPayloadKeys.sort().join("\0")) {
+        throw new Error("control witness payload shape is invalid");
+    }
+    const storage = object(payload.storage);
+    if (Object.keys(storage).sort().join("\0") !== "active_bytes\0fingerprint\0stable_fingerprint") {
+        throw new Error("control witness storage shape is invalid");
+    }
+    if (payload.format !== "harnery-event-v3-control-witness" ||
+        payload.format_version !== 1 ||
+        !token(payload.genesis_id, "gex_") ||
+        !token(payload.activation_id, "act_") ||
+        !token(payload.genesis_event_id, "evt_") ||
+        !token(payload.activation_event_id, "evt_") ||
+        !digest(payload.genesis_manifest_digest) ||
+        !digest(payload.activation_manifest_digest) ||
+        !digest(payload.candidate_manifest_digest) ||
+        !digest(payload.checkpoint_digest) ||
+        !token(payload.privacy_key_epoch, "pep_") ||
+        !token(payload.root_id, "root_") ||
+        !digest(storage.fingerprint) ||
+        !digest(storage.stable_fingerprint) ||
+        !Number.isSafeInteger(storage.active_bytes) ||
+        storage.active_bytes < 0) {
+        throw new Error("control witness payload is invalid");
+    }
+    const authentication = object(envelope.authentication);
+    return {
+        payload: payload,
+        authentication: authentication,
+    };
+}
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("control witness value is not an object");
+    }
+    return value;
+}
+function token(value, prefix) {
+    return (typeof value === "string" && value.startsWith(prefix) && /^[a-zA-Z0-9._-]{1,160}$/.test(value));
+}
+function digest(value) {
+    return typeof value === "string" && /^sha256:[a-f0-9]{64}$/.test(value);
+}
+function sameStorageVersion(left, right) {
+    return left.fingerprint === right.fingerprint && left.active_bytes === right.active_bytes;
+}

package/dist/core/events/v3/control-writer.d.ts

@@ -0,0 +1,4 @@
+import { type EventV3ControlState } from "./control.js";
+/** Repair only a manifest-first crash by appending the exact pre-minted event. */
+export declare function repairEventV3ControlPair(coordRoot: string): EventV3ControlState;
+//# sourceMappingURL=control-writer.d.ts.map

package/dist/core/events/v3/control-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-writer.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/control-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAA2B,MAAM,cAAc,CAAC;AAGjF,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAW/E"}

package/dist/core/events/v3/control-writer.js

@@ -0,0 +1,16 @@
+import { readEventV3ControlState } from "./control.js";
+import { writeEventV3 } from "./writer.js";
+/** Repair only a manifest-first crash by appending the exact pre-minted event. */
+export function repairEventV3ControlPair(coordRoot) {
+    const control = readEventV3ControlState(coordRoot);
+    if (control.state !== "repairable")
+        return control;
+    const event = control.reason === "genesis_event_missing" ? control.genesis.event : control.activation?.event;
+    if (!event)
+        return { state: "invalid", reason: "repair_event_unavailable" };
+    const result = writeEventV3(coordRoot, event);
+    if (result.state !== "committed") {
+        return { state: "invalid", reason: "control_event_repair_not_committed" };
+    }
+    return readEventV3ControlState(coordRoot);
+}

package/dist/core/events/v3/control.d.ts

@@ -101,10 +101,16 @@ export declare function validateActivationManifestV3(value: unknown, candidate:
  * Resolve the session/evidence gate from exact control-file and ledger-event pairs.
  * This function never repairs or creates state. Any ambiguity keeps the gate closed.
  */
+/**
+ * The live epoch's genesis id from the immutable manifest, or undefined when
+ * no valid genesis is published. This is the cheap epoch-identity read the
+ * writer fence uses: one small canonical file, never the event history.
+ */
+export declare function liveGenesisIdV3(coordRoot: string): `gex_${string}` | undefined;
+/** Same read for a caller that already holds the manifest path (the writer's drain). */
+export declare function genesisIdFromManifestV3(genesisPath: string): `gex_${string}` | undefined;
 export declare function readEventV3ControlState(coordRoot: string): EventV3ControlState;
 export declare function eventV3WriteGateOpen(coordRoot: string, mode: EventV3WriteMode): boolean;
-/** Repair only a manifest-first crash by appending the exact pre-minted event. */
-export declare function repairEventV3ControlPair(coordRoot: string): EventV3ControlState;
 export declare function candidateProfileDigestV3(profile: CandidateProfileV3): `sha256:${string}`;
 export declare function candidateManifestDigestV3(manifest: CandidateGenesisManifestV3): `sha256:${string}`;
 export {};

package/dist/core/events/v3/control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/control.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAO7C,eAAO,MAAM,yBAAyB,EAAG,kCAA2C,CAAC;AACrF,eAAO,MAAM,4BAA4B,EAAG,qCAA8C,CAAC;AAE3F,KAAK,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE;IAAE,UAAU,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAAC;AACzE,KAAK,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE;IAAE,UAAU,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,qBAAqB,EAAE,UAAU,MAAM,EAAE,CAAC;IAC1C,sBAAsB,EAAE,UAAU,MAAM,EAAE,CAAC;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kCAAkC,EAAE,MAAM,EAAE,CAAC;IAC7C,aAAa,EAAE,UAAU,MAAM,EAAE,CAAC;IAClC,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,OAAO,MAAM,EAAE,CAAC;IACnC,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,EAAE,CAAC,CAAC;IACpB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,CAAC,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;IAC/B,UAAU,EAAE,OAAO,MAAM,EAAE,CAAC;IAC5B,yBAAyB,EAAE,UAAU,MAAM,EAAE,CAAC;IAC9C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,MAAM,EAAE,CAAC;IAC7B,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,oCAAoC;IACnD,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC9B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,UAAU,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,0BAA0B,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,MAAM,MAAM,mBAAmB,GAC3B;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GAC3C;IACE,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,uBAAuB,GAAG,0BAA0B,CAAC;IAC7D,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC,GACD;IACE,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,0BAA0B,CAAC;IACpC,yBAAyB,EAAE,UAAU,MAAM,EAAE,CAAC;CAC/C,GACD;IACE,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,oBAAoB,CAAC;IACjC,yBAAyB,EAAE,UAAU,MAAM,EAAE,CAAC;CAC/C,GACD;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEtD,wFAAwF;AACxF,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,oCAAoC,GAC1C,0BAA0B,CAmC5B;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,8BAA8B,GACpC,oBAAoB,CAyCtB;AAED,mFAAmF;AACnF,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,GACb,2BAA2B,CAAC,0BAA0B,CAAC,CAEzD;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,0BAA0B,GACpC,2BAA2B,CAAC,oBAAoB,CAAC,CAQnD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAmE9E;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAGvF;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAW/E;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,UAAU,MAAM,EAAE,CAExF;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,0BAA0B,GACnC,UAAU,MAAM,EAAE,CAEpB"}
+{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/control.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAY7C,eAAO,MAAM,yBAAyB,EAAG,kCAA2C,CAAC;AACrF,eAAO,MAAM,4BAA4B,EAAG,qCAA8C,CAAC;AAE3F,KAAK,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE;IAAE,UAAU,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAAC;AACzE,KAAK,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE;IAAE,UAAU,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,qBAAqB,EAAE,UAAU,MAAM,EAAE,CAAC;IAC1C,sBAAsB,EAAE,UAAU,MAAM,EAAE,CAAC;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kCAAkC,EAAE,MAAM,EAAE,CAAC;IAC7C,aAAa,EAAE,UAAU,MAAM,EAAE,CAAC;IAClC,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,OAAO,MAAM,EAAE,CAAC;IACnC,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,EAAE,CAAC,CAAC;IACpB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,CAAC,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;IAC/B,UAAU,EAAE,OAAO,MAAM,EAAE,CAAC;IAC5B,yBAAyB,EAAE,UAAU,MAAM,EAAE,CAAC;IAC9C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,MAAM,EAAE,CAAC;IAC7B,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,oCAAoC;IACnD,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC9B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,UAAU,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,0BAA0B,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,MAAM,MAAM,mBAAmB,GAC3B;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GAC3C;IACE,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,uBAAuB,GAAG,0BAA0B,CAAC;IAC7D,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC,GACD;IACE,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,0BAA0B,CAAC;IACpC,yBAAyB,EAAE,UAAU,MAAM,EAAE,CAAC;CAC/C,GACD;IACE,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,oBAAoB,CAAC;IACjC,yBAAyB,EAAE,UAAU,MAAM,EAAE,CAAC;CAC/C,GACD;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEtD,wFAAwF;AACxF,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,oCAAoC,GAC1C,0BAA0B,CAmC5B;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,8BAA8B,GACpC,oBAAoB,CAyCtB;AAED,mFAAmF;AACnF,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,GACb,2BAA2B,CAAC,0BAA0B,CAAC,CAEzD;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,0BAA0B,GACpC,2BAA2B,CAAC,oBAAoB,CAAC,CAQnD;AAED;;;GAGG;AACH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,MAAM,EAAE,GAAG,SAAS,CAE9E;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,MAAM,EAAE,GAAG,SAAS,CAQxF;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CA4F9E;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAGvF;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,UAAU,MAAM,EAAE,CAExF;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,0BAA0B,GACnC,UAAU,MAAM,EAAE,CAEpB"}

package/dist/core/events/v3/control.js

@@ -2,11 +2,11 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { buildEventV3 } from "./builder.js";
 import { canonicalJsonV3, sha256V3 } from "./canonical.js";
+import { activeControlWitnessMatchesV3, publishActiveControlWitnessV3 } from "./control-witness.js";
 import { EVENT_V3_SCHEMA_DIGEST } from "./generated.js";
 import { activationIdV3, eventIdV3, genesisIdV3 } from "./ids.js";
-import { readLedgerV3 } from "./reader.js";
+import { eventV3AuthorityStorageVersionV3, readEventV3AppendValidationCheckpointV3, readLedgerV3, } from "./reader.js";
 import { validateEventV3 } from "./validate.js";
-import { writeEventV3 } from "./writer.js";
 export const EVENT_V3_GENESIS_MANIFEST = ".harnery/ledgers/v3/genesis.json";
 export const EVENT_V3_ACTIVATION_MANIFEST = ".harnery/ledgers/v3/activation.json";
 /** Build a complete immutable candidate packet without writing it or opening a gate. */
@@ -104,6 +104,26 @@ export function validateActivationManifestV3(value, candidate) {
  * Resolve the session/evidence gate from exact control-file and ledger-event pairs.
  * This function never repairs or creates state. Any ambiguity keeps the gate closed.
  */
+/**
+ * The live epoch's genesis id from the immutable manifest, or undefined when
+ * no valid genesis is published. This is the cheap epoch-identity read the
+ * writer fence uses: one small canonical file, never the event history.
+ */
+export function liveGenesisIdV3(coordRoot) {
+    return genesisIdFromManifestV3(join(coordRoot, EVENT_V3_GENESIS_MANIFEST));
+}
+/** Same read for a caller that already holds the manifest path (the writer's drain). */
+export function genesisIdFromManifestV3(genesisPath) {
+    if (!existsSync(genesisPath))
+        return undefined;
+    const genesis = readGenesisManifest(genesisPath);
+    if (!genesis.ok)
+        return undefined;
+    const genesisId = genesis.value.event.payload.genesis_id;
+    return typeof genesisId === "string" && genesisId.startsWith("gex_")
+        ? genesisId
+        : undefined;
+}
 export function readEventV3ControlState(coordRoot) {
     const genesisPath = join(coordRoot, EVENT_V3_GENESIS_MANIFEST);
     const activationPath = join(coordRoot, EVENT_V3_ACTIVATION_MANIFEST);
@@ -124,6 +144,23 @@ export function readEventV3ControlState(coordRoot) {
         return { state: "invalid", reason: genesisResult.reason };
     const genesis = genesisResult.value;
     const candidateDigest = candidateManifestDigestV3(genesis);
+    const activationForWitness = hasActivation
+        ? readActivationManifest(activationPath, genesis, candidateDigest)
+        : undefined;
+    if (activationForWitness?.ok &&
+        activeControlWitnessMatchesV3(coordRoot, {
+            genesis,
+            activation: activationForWitness.value,
+            candidate_manifest_digest: candidateDigest,
+        })) {
+        return {
+            state: "active",
+            genesis,
+            activation: activationForWitness.value,
+            candidate_manifest_digest: candidateDigest,
+        };
+    }
+    const storageBeforeValidation = eventV3AuthorityStorageVersionV3(coordRoot);
     const ledger = readControlLedger(coordRoot);
     if (!ledger.complete) {
         return { state: "invalid", reason: "ledger_integrity_failure" };
@@ -142,7 +179,7 @@ export function readEventV3ControlState(coordRoot) {
         }
         return { state: "candidate", genesis, candidate_manifest_digest: candidateDigest };
     }
-    const activationResult = readActivationManifest(activationPath, genesis, candidateDigest);
+    const activationResult = activationForWitness ?? readActivationManifest(activationPath, genesis, candidateDigest);
     if (!activationResult.ok)
         return { state: "invalid", reason: activationResult.reason };
     const activation = activationResult.value;
@@ -158,31 +195,22 @@ export function readEventV3ControlState(coordRoot) {
             activation,
         };
     }
-    return {
+    const active = {
         state: "active",
         genesis,
         activation,
         candidate_manifest_digest: candidateDigest,
     };
+    const checkpoint = readEventV3AppendValidationCheckpointV3(coordRoot);
+    if (checkpoint) {
+        publishActiveControlWitnessV3(coordRoot, active, storageBeforeValidation, checkpoint);
+    }
+    return active;
 }
 export function eventV3WriteGateOpen(coordRoot, mode) {
     const control = readEventV3ControlState(coordRoot);
     return mode === "candidate" ? control.state === "candidate" : control.state === "active";
 }
-/** Repair only a manifest-first crash by appending the exact pre-minted event. */
-export function repairEventV3ControlPair(coordRoot) {
-    const control = readEventV3ControlState(coordRoot);
-    if (control.state !== "repairable")
-        return control;
-    const event = control.reason === "genesis_event_missing" ? control.genesis.event : control.activation?.event;
-    if (!event)
-        return { state: "invalid", reason: "repair_event_unavailable" };
-    const result = writeEventV3(coordRoot, event);
-    if (result.state !== "committed") {
-        return { state: "invalid", reason: "control_event_repair_not_committed" };
-    }
-    return readEventV3ControlState(coordRoot);
-}
 export function candidateProfileDigestV3(profile) {
     return sha256V3(canonicalJsonV3(profile));
 }

package/dist/core/events/v3/coordination-transaction-recovery.d.ts

@@ -0,0 +1,42 @@
+export type CoordinationTransactionRecoveryStep = "intent_published" | "transaction_quarantined" | "producer_pending_cleared" | "outbox_ready_removed" | "receipt_committed";
+interface CoordinationTransactionQuarantineCommonV3 {
+    transaction_id: `txn_${string}`;
+    transaction_digest: `sha256:${string}`;
+    event_id: string;
+    event_row_digest: `sha256:${string}`;
+    actor_instance_id: string;
+    subject_instance_id: string;
+    mutation_kind: string;
+    expected_prior_state_digest: `sha256:${string}`;
+    desired_state_digest: `sha256:${string}`;
+    observed_current_state_digest: `sha256:${string}`;
+    approval_record_id: string;
+    producer_state_file: string;
+    reason: "current_state_conflict";
+    created_at: string;
+}
+export interface CoordinationTransactionQuarantineIntentV3 extends CoordinationTransactionQuarantineCommonV3 {
+    format: "harnery-v3-coordination-transaction-quarantine-intent";
+    format_version: 1;
+}
+export interface CoordinationTransactionQuarantineReceiptV3 extends CoordinationTransactionQuarantineCommonV3 {
+    format: "harnery-v3-coordination-transaction-quarantine-receipt";
+    format_version: 1;
+    completed_at: string;
+    quarantine_file: string;
+}
+export interface QuarantineConflictingCoordinationTransactionV3Input {
+    transaction_id: string;
+    actor_instance_id: string;
+    observed_current_state_digest: `sha256:${string}`;
+    approval_record_id: string;
+    now?: () => Date;
+    onStep?: (step: CoordinationTransactionRecoveryStep) => void;
+}
+/**
+ * Abandon one authority transaction only after proving that normal recovery is
+ * impossible and that its event never entered the ledger or ready spool.
+ */
+export declare function quarantineConflictingCoordinationTransactionV3(coordRoot: string, input: QuarantineConflictingCoordinationTransactionV3Input): CoordinationTransactionQuarantineReceiptV3;
+export {};
+//# sourceMappingURL=coordination-transaction-recovery.d.ts.map

package/dist/core/events/v3/coordination-transaction-recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordination-transaction-recovery.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/coordination-transaction-recovery.ts"],"names":[],"mappings":"AAmCA,MAAM,MAAM,mCAAmC,GAC3C,kBAAkB,GAClB,yBAAyB,GACzB,0BAA0B,GAC1B,sBAAsB,GACtB,mBAAmB,CAAC;AAExB,UAAU,yCAAyC;IACjD,cAAc,EAAE,OAAO,MAAM,EAAE,CAAC;IAChC,kBAAkB,EAAE,UAAU,MAAM,EAAE,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,UAAU,MAAM,EAAE,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,EAAE,UAAU,MAAM,EAAE,CAAC;IAChD,oBAAoB,EAAE,UAAU,MAAM,EAAE,CAAC;IACzC,6BAA6B,EAAE,UAAU,MAAM,EAAE,CAAC;IAClD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,wBAAwB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yCACf,SAAQ,yCAAyC;IACjD,MAAM,EAAE,uDAAuD,CAAC;IAChE,cAAc,EAAE,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,0CACf,SAAQ,yCAAyC;IACjD,MAAM,EAAE,wDAAwD,CAAC;IACjE,cAAc,EAAE,CAAC,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mDAAmD;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6BAA6B,EAAE,UAAU,MAAM,EAAE,CAAC;IAClD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mCAAmC,KAAK,IAAI,CAAC;CAC9D;AAED;;;GAGG;AACH,wBAAgB,8CAA8C,CAC5D,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,mDAAmD,GACzD,0CAA0C,CAmG5C"}