looply-cli 0.0.0-stage → 0.3.0

package/dist/integration-runtime.js

@@ -0,0 +1,681 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asCheckReport = asCheckReport;
+exports.reviewsOwed = reviewsOwed;
+exports.integrationLogPath = integrationLogPath;
+exports.recordAttempt = recordAttempt;
+exports.readAttempts = readAttempts;
+exports.initialiseIntegration = initialiseIntegration;
+exports.admitCandidateChecks = admitCandidateChecks;
+exports.integrationBaselinePath = integrationBaselinePath;
+exports.recordBaseline = recordBaseline;
+exports.readBaseline = readBaseline;
+exports.integrationTick = integrationTick;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const git_driver_1 = require("./git-driver");
+const checkout_carry_1 = require("./checkout-carry");
+const integration_1 = require("./integration");
+const exclusive_lock_1 = require("./exclusive-lock");
+const core_1 = require("@looply/core");
+/**
+ * The commit a ref points at.
+ *
+ * ⚠️ THROUGH `mergeBase(ref, ref)`, WHICH IS THE DRIVER'S OWN RESOLVER. Adding a
+ * `rev-parse <ref>` verb would widen the trusted surface for something the
+ * existing convergence verbs already answer: the merge base of a ref with
+ * itself IS that ref's commit.
+ */
+async function shaOf(git, ref) {
+    const sha = await git.mergeBase(ref, ref);
+    if (sha === null)
+        throw new Error(`could not resolve ${ref} to a commit`);
+    return sha;
+}
+/**
+ * Normalise either arm into the report shape.
+ *
+ * 🔴 `'checks' in r`, NOT `Array.isArray(r)`. Measured with this repository's own
+ * TypeScript under `strict`: the `Array.isArray` form does not narrow a
+ * `readonly T[]` union member — its lib predicate is `arg is any[]` — and the
+ * result is a type error in both branches rather than a narrowing.
+ */
+function asCheckReport(r) {
+    return 'checks' in r ? r : { checks: r };
+}
+/**
+ * Every attempt that owes an evaluator verdict, newest first.
+ *
+ * 🔴 THE `unresolvedOf` OF THIS SEAM. `coverageOf` could not carry an open
+ * question, so a reader was added beside it rather than the question being
+ * forced into a shape that did not fit; the same move, for the same reason. An
+ * obligation nothing can enumerate is an obligation nobody will discharge.
+ *
+ * ⚠️ AN ATTEMPT THAT WAS NEVER PUBLISHED STILL OWES NOTHING YET. The verdict is
+ * owed on what went onto the integration branch; a refused attempt put nothing
+ * there. Callers that want both can ask for `published` themselves — this
+ * answers the question the charter asked.
+ */
+function reviewsOwed(attempts) {
+    return attempts
+        .filter((a) => a.reviewOwed !== undefined && a.published !== undefined)
+        .sort((a, b) => (a.at < b.at ? 1 : a.at > b.at ? -1 : 0));
+}
+function integrationLogPath(cwd) {
+    return (0, node_path_1.join)((0, git_driver_1.projectStateDir)(cwd), 'integration.jsonl');
+}
+function integrationLockPath(cwd) {
+    return (0, node_path_1.join)((0, git_driver_1.projectStateDir)(cwd), '.integration.lock');
+}
+/**
+ * ⚠️ LED BY A NEWLINE, for the reason every ledger here is: a torn write must
+ * cost one record rather than two.
+ */
+function recordAttempt(cwd, attempt) {
+    const path = integrationLogPath(cwd);
+    try {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true });
+        (0, node_fs_1.appendFileSync)(path, `\n${JSON.stringify(attempt)}\n`, 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function readAttempts(cwd) {
+    let raw;
+    try {
+        raw = (0, node_fs_1.readFileSync)(integrationLogPath(cwd), 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const line of raw.split('\n')) {
+        const text = line.trim();
+        if (text === '')
+            continue;
+        try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed?.attemptId === 'string' && typeof parsed?.commitSha === 'string')
+                out.push(parsed);
+        }
+        catch {
+            /* a fragment from a torn write; the leading newline is what bounds it */
+        }
+    }
+    return out;
+}
+/**
+ * CREATE THE INTEGRATION BASE, FROM A BASE SOMEBODY CHOSE.
+ *
+ * 🔴 NOT FROM WHATEVER HEAD HAPPENS TO BE NEARBY. Where every future run starts
+ * is a decision about the project, and inferring it from the cwd's current
+ * checkout would make it depend on which branch somebody left themselves on.
+ * The ref is named explicitly and resolved before anything is written.
+ */
+async function initialiseIntegration(cwd, from, git = new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(cwd))) {
+    if (await git.refExists(integration_1.INTEGRATION_BRANCH)) {
+        const sha = await shaOf(git, integration_1.INTEGRATION_BRANCH);
+        return { ok: true, ref: integration_1.INTEGRATION_BRANCH, sha, already: true };
+    }
+    if (!(await git.refExists(from))) {
+        return { ok: false, because: `there is no such ref to start integration from: ${from}` };
+    }
+    const sha = await shaOf(git, from);
+    const created = await git.compareAndSetRef(integration_1.INTEGRATION_BRANCH, sha, null);
+    return created
+        ? { ok: true, ref: integration_1.INTEGRATION_BRANCH, sha, already: false }
+        : {
+            ok: false,
+            because: `${integration_1.INTEGRATION_BRANCH} could not be created at ${sha} — something else created it first`,
+        };
+}
+/** The rule itself, on facts somebody else gathered. Pure. */
+function admitCandidateChecks(checks, rule) {
+    const refusing = [];
+    const notYetMet = [];
+    for (const check of checks) {
+        if (check.ok)
+            continue;
+        const before = rule.baseline?.get(check.name);
+        const because = !rule.admission.declared.has(check.name)
+            ? 'undeclared'
+            : rule.admission.required.has(check.name)
+                ? 'required'
+                : rule.claimed.has(check.name)
+                    ? 'claimed'
+                    : check.inconclusive !== undefined
+                        ? 'inconclusive'
+                        : before === undefined
+                            ? 'no-baseline'
+                            : before
+                                ? 'passed-on-base'
+                                : null;
+        if (because === null)
+            notYetMet.push(check.name);
+        else
+            refusing.push({ check, because });
+    }
+    /**
+     * ⚠️ A DECLARED STEP THAT DID NOT RUN AGAINST THE CANDIDATE REFUSES IT. The rule above judges the
+     * red checks it is shown; a pass that silently lacks one would otherwise be judged on less than the
+     * map declares — and a candidate that could not even be prepared reports one synthetic check.
+     */
+    const ran = new Set(checks.map((c) => c.name));
+    for (const name of rule.admission.declared) {
+        if (!ran.has(name))
+            refusing.push({ check: { name, ok: false, detail: 'did not run against the candidate' }, because: 'did-not-run' });
+    }
+    return { refusing, notYetMet };
+}
+const ADMISSION_WORDS = {
+    required: 'required',
+    'passed-on-base': 'passed on the base',
+    claimed: 'claimed by this candidate',
+    undeclared: 'not in the acceptance map',
+    'no-baseline': 'no baseline',
+    inconclusive: 'it reached no verdict',
+    'did-not-run': 'it did not run against the candidate',
+    unclaimed: 'no claim reached the lane, so nothing says what this candidate proves',
+};
+/** One line per base the lane has measured, keyed by revision AND acceptance map. */
+function integrationBaselinePath(cwd) {
+    return (0, node_path_1.join)((0, git_driver_1.projectStateDir)(cwd), 'integration-baseline.jsonl');
+}
+/** ⚠️ LED BY A NEWLINE, like every ledger here. */
+function recordBaseline(cwd, record) {
+    const path = integrationBaselinePath(cwd);
+    try {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true });
+        (0, node_fs_1.appendFileSync)(path, `\n${JSON.stringify(record)}\n`, 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The newest baseline for this revision under THIS acceptance map, or null.
+ *
+ * ⚠️ THE DIGEST IS PART OF THE KEY. A check name is not its command: under a
+ * different map "R3 was red on the base" may be about a different check.
+ */
+function readBaseline(cwd, sha, acceptanceDigest) {
+    let raw;
+    try {
+        raw = (0, node_fs_1.readFileSync)(integrationBaselinePath(cwd), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let found = null;
+    for (const line of raw.split('\n')) {
+        const text = line.trim();
+        if (text === '')
+            continue;
+        try {
+            const r = JSON.parse(text);
+            /**
+             * ⚠️ EVERY ENTRY OR NONE. A record whose checks are not all `{ name: string, ok: boolean }` is
+             * skipped whole: `ok` read loosely would turn "not sure" into "red on the base", which is the
+             * permissive answer.
+             */
+            const wellFormed = Array.isArray(r?.checks) &&
+                r.checks.every((c) => c !== null && typeof c === 'object' && typeof c.name === 'string' && typeof c.ok === 'boolean');
+            if (r?.sha === sha && r.acceptanceDigest === acceptanceDigest && wellFormed)
+                found = r;
+        }
+        catch {
+            /* a fragment from a torn write */
+        }
+    }
+    return found === null ? null : new Map(found.checks.map((c) => [c.name, c.ok]));
+}
+/**
+ * THE BASE, MEASURED THE WAY A CANDIDATE IS — its own throwaway checkout, the
+ * same carry, the same `check` — when no baseline is on record for it.
+ *
+ * ⚠️ NULL ON ANY FAILURE, AND NULL FAILS CLOSED in `admitCandidateChecks`. A base
+ * whose checks could not be run proves nothing about which of them were red.
+ */
+async function measureBaseline(cwd, deps, carry, base, attemptId) {
+    const dir = (0, node_path_1.join)((0, git_driver_1.projectStateDir)(cwd), 'integration-candidates', `${attemptId}-base`);
+    try {
+        await deps.git.addWorktree(dir, `looply/candidate-${attemptId}-base`, base);
+        if (carry.length > 0)
+            (0, checkout_carry_1.carryIntoCheckout)(cwd, dir, carry);
+        const report = asCheckReport(await deps.check({ dir, sha: base }));
+        if (report.abort !== undefined || report.checks.length === 0)
+            return null;
+        return [...report.checks];
+    }
+    catch {
+        return null;
+    }
+    finally {
+        try {
+            await deps.git.removeWorktree(dir);
+        }
+        catch {
+            /* a checkout left behind is not a verdict */
+        }
+        try {
+            (0, node_fs_1.rmSync)(dir, { recursive: true, force: true, maxRetries: 2 });
+        }
+        catch {
+            /* same */
+        }
+    }
+}
+/** The rule, with the base it needs: read from the record, measured once when missing. */
+async function admitAgainstBase(cwd, deps, admission, checks, candidate, at) {
+    /**
+     * 🔴 NO CLAIM, NO ADMISSION. Rule (c) — "a check this candidate cites as proof must pass" — is the
+     * lane's only hold on the goal's OWN proof, and it needs the claim. A candidate with none (a person's
+     * `integrate` of a branch nothing recorded, a delivery record that failed to write, a tip that moved)
+     * gets the strict lane: every red check refuses, and says why.
+     */
+    if (candidate.claim === undefined) {
+        return { refusing: checks.filter((c) => !c.ok).map((check) => ({ check, because: 'unclaimed' })), notYetMet: [] };
+    }
+    const claimed = new Set(candidate.claim.servings.flatMap((s) => s.serves.map((x) => x.provenBy)));
+    const judge = (baseline) => admitCandidateChecks(checks, { admission, baseline, claimed });
+    const verdict = judge(readBaseline(cwd, at.base, admission.acceptanceDigest));
+    if (!verdict.refusing.some((r) => r.because === 'no-baseline'))
+        return verdict;
+    // Refused already for a reason no baseline can change: measuring the base would buy nothing.
+    if (verdict.refusing.some((r) => r.because !== 'no-baseline'))
+        return verdict;
+    const measured = await measureBaseline(cwd, deps, at.carry, at.base, at.attemptId);
+    if (measured === null)
+        return verdict;
+    // Only checks that reached a verdict are evidence about the base; the rest stay unknown, and unknown refuses.
+    const checksAtBase = measured.filter((c) => c.inconclusive === undefined).map((c) => ({ name: c.name, ok: c.ok }));
+    recordBaseline(cwd, { sha: at.base, acceptanceDigest: admission.acceptanceDigest, at: at.when, checks: checksAtBase });
+    return judge(new Map(checksAtBase.map((c) => [c.name, c.ok])));
+}
+/**
+ * ONE CANDIDATE, ONE INVOCATION, ONE AT A TIME.
+ *
+ * ⚠️ SERIALISED ON THE PROJECT'S OWN LOCK, so two daemons cannot both validate
+ * against the same base and both publish. The shared mutex is the one in
+ * `exclusive-lock`; there is no second implementation.
+ */
+async function integrationTick(cwd, candidate, enabled, deps) {
+    if (!enabled)
+        return { kind: 'off' };
+    const { git } = deps;
+    const carry = deps.carry ?? [];
+    if (!(await git.refExists(integration_1.INTEGRATION_BRANCH))) {
+        return {
+            kind: 'uninitialised',
+            because: `${integration_1.INTEGRATION_BRANCH} does not exist — nothing can be integrated until it is created`,
+        };
+    }
+    if (!(await git.refExists(candidate.branch))) {
+        return { kind: 'idle', because: `there is no branch ${candidate.branch} to integrate` };
+    }
+    const attemptId = deps.newId();
+    const at = new Date(deps.now()).toISOString();
+    /**
+     * ALREADY DONE IS NOT DONE AGAIN.
+     *
+     * 🔴 RESTART MUST NOT REPUBLISH. A crash between publishing and recording
+     * leaves a moved ref and no line saying so; a crash the other way round
+     * cannot happen, because the record is written after the swap. So the check
+     * that matters is against the REF, not the log: if integration already
+     * contains this commit, the work is in and this is a no-op.
+     */
+    const commitSha = await shaOf(git, candidate.branch);
+    const base = await shaOf(git, integration_1.INTEGRATION_BRANCH);
+    const mergeBase = await git.mergeBase(integration_1.INTEGRATION_BRANCH, candidate.branch);
+    if (mergeBase === commitSha) {
+        return {
+            kind: 'idle',
+            because: `${candidate.branch} is already contained in ${integration_1.INTEGRATION_BRANCH}`,
+        };
+    }
+    const verdict = await (0, integration_1.canIntegrate)(git, candidate.branch, true);
+    /**
+     * 🔴 R3 — A REFUSAL IS NO LONGER THE END OF THE WORK.
+     *
+     * The base moved, so this candidate cannot fast-forward and never will. The
+     * forbidden answer is to rebase it onto the new base; the honest one is to
+     * carry the CHANGE across as a new candidate and make it earn its own way
+     * through this same function.
+     *
+     * ⚠️ THE ORIGINAL REFUSAL IS STILL RECORDED. What the ledger says about this
+     * branch does not change: it was offered, it was behind, it was refused. The
+     * replay is a different candidate with a different sha, and it is written
+     * down as one.
+     *
+     * ⚠️ ONE REPLAY PER TICK, ENFORCED BY DROPPING THE DEP ON THE WAY IN. A
+     * replayed candidate that is itself refused — because a third worker landed
+     * while this one was being prepared — must not spawn another replay, or a
+     * busy lane would chase its own tail instead of reporting that it is busy.
+     */
+    if (verdict.kind === 'needs-rebase' && deps.replay !== undefined) {
+        const carried = await deps.replay({ branch: candidate.branch, attemptId });
+        if (carried.kind === 'replayed') {
+            recordAttempt(cwd, {
+                attemptId,
+                at,
+                ...(candidate.goalId === undefined ? {} : { goalId: candidate.goalId }),
+                ...(candidate.runId === undefined ? {} : { runId: candidate.runId }),
+                branch: candidate.branch,
+                commitSha,
+                expectedBase: base,
+                candidateSha: commitSha,
+                verdict: verdict.kind,
+                replayedAs: carried.branch,
+                /**
+                 * The same fact the sentence below carries, in a shape something can
+                 * read. Set when and only when the verdict did not carry.
+                 */
+                ...(carried.judgement === 'stands' || carried.contract === 'independent'
+                    ? {}
+                    : {
+                        reviewOwed: {
+                            reason: carried.contract,
+                            because: carried.because,
+                        },
+                    }),
+                because: `${verdict.because} — carried onto ${integration_1.INTEGRATION_BRANCH} as ${carried.branch}, which is offered next` +
+                    (carried.judgement === 'stands'
+                        ? ''
+                        : '; its evaluator verdict does not carry across and must be taken again'),
+            });
+            deps.log(`integrate: ${candidate.branch} was behind; carried it onto ${integration_1.INTEGRATION_BRANCH} as ${carried.branch}` +
+                (carried.judgement === 'stands' ? '' : ' — its verdict must be taken again'));
+            const { replay: _dropped, ...once } = deps;
+            return integrationTick(cwd, {
+                ...candidate,
+                branch: carried.branch,
+                ...(carried.judgement === 'stands' || carried.contract === 'independent'
+                    ? {}
+                    : { reviewOwed: { reason: carried.contract, because: carried.because } }),
+                ...(carried.disjoint === true ? { replayDisjoint: true } : {}),
+            }, enabled, once);
+        }
+        /**
+         * 🔴 A STALE EVALUATOR VERDICT IS RECORDED, NOT A REASON TO REFUSE — AND
+         * THIS REVERSES WHAT THIS FUNCTION DID WHEN THE REPLAY LANDED.
+         *
+         * The first version refused to publish a carried change whose judgement no
+         * longer stood. Two things were wrong with it.
+         *
+         * ⚠️ IT WAS STRICTER THAN THE PRODUCT'S OWN ANSWER TO THE SAME QUESTION.
+         * `check` exists because *"between them the base may have moved and the
+         * run's evidence is about a different tree"* — and the lane's answer to
+         * that is to RE-GATE the commit that would actually be published, which is
+         * exactly what still happens here. Refusing on top of re-gating applied a
+         * second, harsher rule to the same fact.
+         *
+         * 🔴 AND IT MADE THE FEATURE INERT WHERE IT MATTERS. The verdict comes from
+         * `revalidationVerdict`, which answers `unmeasurable` whenever no project
+         * graph is held — so in any project without one, every carried change would
+         * have been refused and R2-J-1's measured loss would have stood unchanged.
+         * A safeguard that only ever fires is not a safeguard.
+         *
+         * So the change is published on a GREEN GATE, as any candidate is, and the
+         * disposition of the model's verdict is written into the attempt where a
+         * person or a later evaluator can act on it. Nothing is hidden: the ledger
+         * says the verdict did not carry.
+         */
+    }
+    if (verdict.kind !== 'fast-forward') {
+        const attempt = {
+            attemptId,
+            at,
+            ...(candidate.goalId === undefined ? {} : { goalId: candidate.goalId }),
+            ...(candidate.runId === undefined ? {} : { runId: candidate.runId }),
+            branch: candidate.branch,
+            commitSha,
+            expectedBase: base,
+            candidateSha: commitSha,
+            verdict: verdict.kind,
+            because: verdict.kind === 'needs-rebase'
+                ? verdict.because
+                : `nothing to integrate from ${candidate.branch}`,
+        };
+        recordAttempt(cwd, attempt);
+        return { kind: 'refused', attempt };
+    }
+    /**
+     * THE CANDIDATE IS CHECKED IN ITS OWN CHECKOUT, AT THE COMMIT THAT WOULD BE
+     * PUBLISHED — never in the run's workspace, and never at an older sha.
+     */
+    const dir = (0, node_path_1.join)((0, git_driver_1.projectStateDir)(cwd), 'integration-candidates', attemptId);
+    let checks = [];
+    /**
+     * What those checks ran under, and why there were none. Both stay undefined
+     * for a `check` that returns a bare array, which is every existing caller.
+     */
+    let environment;
+    let abort;
+    try {
+        // A throwaway branch for a throwaway checkout: `worktree add` needs one,
+        // and it is removed with the directory a few lines below.
+        await git.addWorktree(dir, `looply/candidate-${attemptId}`, commitSha);
+        /**
+         * 🔴 THE CANDIDATE'S CHECKOUT NEEDS WHAT GIT DOES NOT CARRY, TOO.
+         *
+         * This tree is made in order to be gated, and a worktree holds only what git
+         * tracks — so for any project with a dependency the checks below failed for
+         * a reason that had nothing to do with the candidate. Measured: two finished
+         * branches refused with "2 required check(s) failed against the candidate:
+         * tsc, test", while the identical commit passed 8/8 in a checkout that
+         * happened to have `node_modules`. A lane that refuses correct work for a
+         * missing toolchain is worse than one that refuses nothing.
+         *
+         * ⚠️ A COPY, NEVER A LINK: this directory is deleted recursively in the
+         * `finally` a few lines below, and a recursive delete walks a junction.
+         */
+        if (carry.length > 0)
+            (0, checkout_carry_1.carryIntoCheckout)(cwd, dir, carry);
+        const report = asCheckReport(await deps.check({ dir, sha: commitSha }));
+        checks = [...report.checks];
+        environment = report.environment;
+        abort = report.abort;
+    }
+    catch (e) {
+        checks = [{ name: 'candidate', ok: false, detail: `the candidate could not be prepared: ${e.message}` }];
+    }
+    finally {
+        try {
+            await git.removeWorktree(dir);
+        }
+        catch {
+            /* a checkout left behind is not a reason to publish or to refuse */
+        }
+        try {
+            (0, node_fs_1.rmSync)(dir, { recursive: true, force: true, maxRetries: 2 });
+        }
+        catch {
+            /* same */
+        }
+    }
+    const failed = checks.filter((c) => !c.ok);
+    /**
+     * WHICH RED CHECKS REFUSE: every one — unless programme mode's admission rule
+     * says a check was red on the base too and nothing makes this candidate
+     * answer for it. See `LaneAdmission`.
+     */
+    const admitted = deps.admission === undefined || checks.length === 0 || failed.length === 0
+        ? null
+        : await admitAgainstBase(cwd, deps, deps.admission, checks, candidate, { base, attemptId, when: at, carry });
+    const notYetMet = admitted?.notYetMet ?? [];
+    /**
+     * THE OWNER'S REPLAY POLICY (F23; owner decision 2026-09-24, clarified): a replay owes
+     * no fresh evaluator verdict when its change touched no file the base had moved AND
+     * the lane publishes it under programme admission — which already means every
+     * required, claimed and previously-green check passed, only checks no goal has met
+     * yet staying red. Programme mode only; anywhere else, and on any overlap, the
+     * verdict is still owed and the controller holds for it.
+     */
+    const settledByPolicy = candidate.reviewOwed !== undefined && candidate.replayDisjoint === true && deps.admission !== undefined;
+    if ((admitted === null ? failed.length > 0 : admitted.refusing.length > 0) || checks.length === 0) {
+        const attempt = {
+            attemptId,
+            at,
+            ...(candidate.goalId === undefined ? {} : { goalId: candidate.goalId }),
+            ...(candidate.runId === undefined ? {} : { runId: candidate.runId }),
+            branch: candidate.branch,
+            commitSha,
+            expectedBase: base,
+            candidateSha: commitSha,
+            verdict: 'fast-forward',
+            checks,
+            ...(environment === undefined ? {} : { environment }),
+            ...(abort === undefined ? {} : { abort }),
+            because: checks.length === 0
+                ? // ⚠️ THE INTERLOCK'S REASON, WHEN THERE WAS ONE. The empty check set
+                    // already refuses; what it could not say was why nothing ran.
+                    `no required check ran against the candidate, so nothing showed it was safe to publish${abort === undefined ? '' : ` — ${abort.reason}`}`
+                : admitted === null
+                    ? `${failed.length} required check(s) failed against the candidate: ${failed.map((c) => c.name).join(', ')}`
+                    : `${admitted.refusing.length} check(s) this candidate must pass failed against it: ` +
+                        admitted.refusing.map((r) => `${r.check.name} (${ADMISSION_WORDS[r.because]})`).join(', '),
+            ...(notYetMet.length === 0 ? {} : { notYetMet }),
+        };
+        recordAttempt(cwd, attempt);
+        return { kind: 'refused', attempt };
+    }
+    /**
+     * 🔴 PUBLICATION IS A COMPARE-AND-SWAP AGAINST THE BASE WE VALIDATED.
+     *
+     * Between the checks and this line the base may have moved — another daemon,
+     * a person, another candidate. Advancing it anyway would publish validation
+     * that describes a different tree. `compareAndSetRef` hands git the old value
+     * it must still have, so git itself refuses atomically and this code never
+     * has to re-read and hope.
+     */
+    /**
+     * 🔴 RULE #2 — REQUIREMENT ACCEPTANCE, REGENERATED ON THE COMMIT ABOUT TO BE
+     * PUBLISHED.
+     *
+     * Read OUTSIDE the lock because it reaches the server and a lock held across a
+     * network call is a lane one unreachable host can stop. The fold itself is
+     * pure and runs inside, on the sha that actually swapped.
+     *
+     * ⚠️ EVERY ABSENCE ANSWERS "NO RECEIPT", NEVER "REFUSED": no `currency` dep
+     * (simple mode), no claim on the candidate (a project that holds none), or a
+     * goal the server cannot answer for. Completion is then withheld — or not —
+     * by the coverage gate, which is where that decision belongs.
+     */
+    let currency = null;
+    if (deps.currency !== undefined && candidate.claim !== undefined) {
+        try {
+            currency = await deps.currency({ goalId: candidate.claim.goalId });
+        }
+        catch {
+            // An unreachable server is not evidence that a claim is stale.
+            currency = null;
+        }
+    }
+    return (0, exclusive_lock_1.withExclusiveLock)(integrationLockPath(cwd), async () => {
+        const stillThere = await shaOf(git, integration_1.INTEGRATION_BRANCH);
+        const swapped = stillThere === base ? await git.compareAndSetRef(integration_1.INTEGRATION_BRANCH, commitSha, base) : false;
+        /**
+         * ⚠️ ONLY WHEN THE SWAP HAPPENED. A receipt naming a sha this project is
+         * not standing on would be a claim about a tree that was never published.
+         */
+        const requirements = swapped && currency !== null && candidate.claim !== undefined
+            ? (0, core_1.integratedReceipt)({
+                claim: candidate.claim,
+                now: currency,
+                sha: commitSha,
+                laneChecks: new Map(checks.map((c) => [c.name, c.ok ? 'passed' : 'failed'])),
+                environment: environment === undefined
+                    ? // The specification requires facts and the gate observed
+                        // none: unknown is not evidence, so every fact it names is
+                        // refused rather than waved through.
+                        Object.keys(currency.requiredProfile).map((fact) => ({
+                            kind: 'fact-unobserved',
+                            fact,
+                            required: (0, core_1.describePredicate)(currency.requiredProfile[fact]),
+                        }))
+                    : (0, core_1.matchProfile)(currency.requiredProfile, environment.facts),
+            })
+            : undefined;
+        const attempt = {
+            attemptId,
+            at,
+            ...(candidate.goalId === undefined ? {} : { goalId: candidate.goalId }),
+            ...(candidate.runId === undefined ? {} : { runId: candidate.runId }),
+            branch: candidate.branch,
+            commitSha,
+            expectedBase: base,
+            candidateSha: commitSha,
+            verdict: 'fast-forward',
+            checks,
+            ...(notYetMet.length === 0 ? {} : { notYetMet }),
+            /**
+             * 🔴 ON THE PUBLISHING ATTEMPT, WHICH IS THE ONE AN ACCEPTANCE IS ABOUT.
+             * Rule #1 binds a receipt to the observed profile AND the integrated
+             * revision; `published.to` below is that revision, and this is that
+             * profile, on the same record.
+             */
+            ...(environment === undefined ? {} : { environment }),
+            ...(requirements === undefined ? {} : { requirements }),
+            // Stamped on the attempt that actually publishes, which is the one an
+            // obligation is about — unless the owner's replay policy settles it (F23).
+            ...(candidate.reviewOwed === undefined
+                ? {}
+                : settledByPolicy
+                    ? {
+                        reviewSettled: {
+                            by: 'owner-policy',
+                            because: 'the carried change touched no file the base had moved, and the lane published it on its full acceptance pass ' +
+                                '(every required, claimed and previously-green check passed) — owner decision 2026-09-24',
+                        },
+                    }
+                    : { reviewOwed: candidate.reviewOwed }),
+            ...(swapped ? { published: { ref: integration_1.INTEGRATION_BRANCH, from: base, to: commitSha } } : {}),
+            ...(swapped
+                ? {}
+                : {
+                    because: `${integration_1.INTEGRATION_BRANCH} moved from ${base} to ${stillThere} while this candidate was ` +
+                        'being checked, so its validation describes a tree that is no longer the base. ' +
+                        'Nothing was published; the branch is offered again from the new base',
+                }),
+        };
+        recordAttempt(cwd, attempt);
+        /**
+         * The published revision is the next base, and these are its checks under
+         * this map — recorded so the next candidate is judged against them without
+         * measuring the base again.
+         */
+        if (swapped && deps.admission !== undefined) {
+            recordBaseline(cwd, {
+                sha: commitSha,
+                acceptanceDigest: deps.admission.acceptanceDigest,
+                at,
+                // Only checks that reached a verdict describe the new base.
+                checks: checks.filter((c) => c.inconclusive === undefined).map((c) => ({ name: c.name, ok: c.ok })),
+            });
+        }
+        deps.log(swapped
+            ? `integrate: ${candidate.branch} → ${integration_1.INTEGRATION_BRANCH} (${base.slice(0, 7)}..${commitSha.slice(0, 7)})` +
+                (notYetMet.length === 0
+                    ? ''
+                    : ` — not yet met on the lane: ${notYetMet.join(', ')} (red on the base and still red; not credited)`)
+            : `integrate: not published — ${attempt.because}`);
+        return swapped ? { kind: 'published', attempt } : { kind: 'refused', attempt };
+    }, (why) => Promise.resolve({
+        kind: 'refused',
+        attempt: {
+            attemptId,
+            at,
+            branch: candidate.branch,
+            commitSha,
+            expectedBase: base,
+            candidateSha: commitSha,
+            verdict: 'fast-forward',
+            checks,
+            because: `publication could not be serialised (${why}), so nothing was published`,
+        },
+    }));
+}
+//# sourceMappingURL=integration-runtime.js.map