oh-my-super-agent 0.1.0

package/dist/src/tickets/store.js

@@ -0,0 +1,2025 @@
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { assertActorId, assertLeaseToken, assertLockId, assertOpaqueId, assertRecordId, assertTransitionNonce, recordLockId, } from "../domain/records.js";
+import { assertEvidenceStore, } from "../evidence/store.js";
+import { assertFileInside, openStableDirectory, readImmutableFile, writeImmutableFile, } from "../evidence/immutable-file.js";
+import { assertTrackedRolePolicyGate, ROLE_IDS, } from "../domain/role-policy.js";
+import { findPackageRoot } from "../package-root.js";
+import { freezeTrackedVerificationPlan } from "../verification/plan.js";
+import { MAX_QUEUE_ATTEMPTS, assertTimestamp, canonicalTimestamp, initialQueueLifecycle, isActiveTicketState, isIdleTicketState, isTerminalTicketState, isTicketState, } from "../queue/model.js";
+import { assertExhaustedQuotaGate, assertFreshQuotaGate, } from "../runtime/quota.js";
+import { acquireDirectoryLock, LockBusyError } from "../runtime/lock.js";
+import { createRecordStore } from "../runtime/record-store.js";
+import { assertSchema, loadJsonSchema } from "../runtime/schema.js";
+import { createStableId, createTransitionNonce } from "../runtime/stable-id.js";
+import { isRecord, validateExistingDirectory } from "../utils/fs.js";
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const COMMIT_PATTERN = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/;
+const TIMESTAMP_PATTERN = /^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})(?:\.([0-9]{1,3}))?Z$/;
+const MAX_TICKET_BYTES = 2 * 1024 * 1024;
+const MAX_SYNC_OUTCOMES = 64;
+const SYNC_LOCK_ATTEMPTS = 20;
+const SYNC_LOCK_RETRY_MS = 10;
+const TICKET_QUEUE_STORE = Symbol("OMS ticket queue store");
+const TICKET_CONTENT_STORES = new WeakSet();
+const QUEUE_INTERNALS = new WeakMap();
+export function assertTicketQueueStore(value) {
+    if (typeof value !== "object" || value === null || !QUEUE_INTERNALS.has(value)) {
+        throw new Error("ticket operation requires the canonical OMS ticket queue store");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("ticket queue store lost its frozen authority boundary");
+}
+const MATERIALIZER_INTERNALS = new WeakMap();
+export function deriveGitHubTicketIdentity(input) {
+    const issueId = assertGitHubNodeId(input.issue_node_id);
+    const sourceRefSha256 = sha256(Buffer.from(`github\0${issueId}`, "utf8"));
+    return {
+        ticket_id: assertTicketRecordId(`gh-${sourceRefSha256.slice(0, 48)}`),
+        source_ref_sha256: sourceRefSha256,
+    };
+}
+export function createTicketQueueStore(options) {
+    const packageRoot = options.packageRoot ?? findPackageRoot();
+    const policyRoot = options.policyRoot ?? packageRoot;
+    const recordsRoot = options.recordsRoot;
+    const evidenceStore = options.evidenceStore;
+    const policyGate = options.policyGate;
+    const queueSchema = loadJsonSchema(join(packageRoot, "schemas", "ticket-queue-payload.schema.json"));
+    const locksRoot = validateExistingDirectory(options.locksRoot, "ticket queue locks root");
+    const systemActors = new Set([...options.systemActors].map((actor) => assertActorId(actor, "system actor")));
+    if (systemActors.size === 0)
+        throw new Error("ticket queue requires at least one system actor");
+    assertTrackedRolePolicyGate(policyGate, policyRoot);
+    const policyIdentity = Object.freeze({
+        policy_version: policyGate.version,
+        policy_digest: policyGate.digest,
+    });
+    if (evidenceStore !== undefined)
+        assertEvidenceStore(evidenceStore);
+    let syncMutationDepth = 0;
+    let lifecycleMutationDepth = 0;
+    let authorityRepairMutationDepth = 0;
+    const store = createRecordStore({
+        recordsRoot,
+        locksRoot,
+        recordValidator: (record) => validateTicketRuntimeRecord(record, queueSchema, evidenceStore),
+        createValidator: (record) => validateInitialTicketRecord(record, systemActors, policyIdentity),
+        transitionValidator: (current, next) => validateTicketTransition(current, next, queueSchema, syncMutationDepth > 0, lifecycleMutationDepth > 0, authorityRepairMutationDepth > 0, systemActors, evidenceStore),
+    });
+    const publicStore = Object.freeze({
+        [TICKET_QUEUE_STORE]: true,
+        read(recordId) {
+            return store.read(recordId);
+        },
+        readIfExists(recordId) {
+            return store.readIfExists(recordId);
+        },
+        list() {
+            return store.list();
+        },
+    });
+    QUEUE_INTERNALS.set(publicStore, {
+        store,
+        systemActors,
+        policyIdentity,
+        evidenceStore,
+        assertCurrentPolicy() {
+            assertTrackedRolePolicyGate(policyGate, policyRoot);
+        },
+        currentVerificationGateDigest() {
+            return freezeTrackedVerificationPlan(policyRoot).digest;
+        },
+        synchronized(ticketId, ownerId, operation) {
+            assertTrackedRolePolicyGate(policyGate, policyRoot);
+            const validatedTicketId = assertTicketRecordId(ticketId);
+            const actor = assertActorId(ownerId);
+            const controllerLock = acquireSyncLockWithRetry({
+                locksRoot,
+                lockId: assertLockId("run-controller"),
+                ownerId: actor,
+                note: `queue-watermark:${validatedTicketId}`,
+            });
+            try {
+                const lock = acquireSyncLockWithRetry({
+                    locksRoot,
+                    lockId: assertLockId(`sync-${validatedTicketId}`),
+                    ownerId: actor,
+                    note: `ticket-sync:${validatedTicketId}`,
+                });
+                try {
+                    assertTrackedRolePolicyGate(policyGate, policyRoot);
+                    return operation();
+                }
+                finally {
+                    lock.release();
+                }
+            }
+            finally {
+                controllerLock.release();
+            }
+        },
+        transitionSync(transition) {
+            assertTrackedRolePolicyGate(policyGate, policyRoot);
+            syncMutationDepth += 1;
+            try {
+                return store.transition(transition);
+            }
+            finally {
+                syncMutationDepth -= 1;
+            }
+        },
+        transitionLifecycle(transition) {
+            assertTrackedRolePolicyGate(policyGate, policyRoot);
+            lifecycleMutationDepth += 1;
+            try {
+                return store.transition(transition);
+            }
+            finally {
+                lifecycleMutationDepth -= 1;
+            }
+        },
+        transitionAuthorityRepair(transition) {
+            authorityRepairMutationDepth += 1;
+            try {
+                return store.transition(transition);
+            }
+            finally {
+                authorityRepairMutationDepth -= 1;
+            }
+        },
+        validatePayload(value) {
+            return validateTicketQueuePayload(value, queueSchema);
+        },
+    });
+    return publicStore;
+}
+export function createTicketLifecycleService(store) {
+    const internal = QUEUE_INTERNALS.get(store);
+    if (!internal)
+        throw new Error("ticket lifecycle service requires the canonical ticket queue store");
+    const authority = internal;
+    function read(ticketId) {
+        return store.read(assertRecordId(ticketId, "ticket id"));
+    }
+    function mutate(action, input, identityParts, build) {
+        authority.assertCurrentPolicy();
+        const normalized = validateMutationInput(input);
+        const commandId = createStableId("command", action, normalized.operationId, String(normalized.expectedVersion), String(normalized.expectedAttempt), normalized.expectedActor, normalized.ownerId, normalized.expectedLeaseToken === null ? "lease:null" : `lease:${normalized.expectedLeaseToken}`, normalized.at, ...identityParts);
+        const nonce = createTransitionNonce(action, normalized.ticketId, commandId);
+        const current = read(normalized.ticketId);
+        if (current.payload.policy_version !== authority.policyIdentity.policy_version
+            || current.payload.policy_digest !== authority.policyIdentity.policy_digest) {
+            throw new Error("stale role policy cannot authorize a ticket transition");
+        }
+        if (current.payload.gate_digest !== null
+            && current.payload.gate_digest !== authority.currentVerificationGateDigest()) {
+            throw new Error("stale verification gate cannot authorize a ticket transition");
+        }
+        if (current.transition_outcomes.some((outcome) => outcome.nonce === nonce)) {
+            return authority.transitionLifecycle({
+                recordId: current.record_id,
+                ownerId: normalized.ownerId,
+                expectedVersion: current.version,
+                nonce,
+                expectedActor: current.actor,
+                expectedAttempt: current.attempt,
+                expectedLeaseToken: current.lease_token,
+                fromStates: [current.state],
+                toState: current.state,
+            });
+        }
+        assertExpectedMutation(current, normalized);
+        return authority.transitionLifecycle(build(current, nonce, normalized));
+    }
+    function mutateActive(action, input, fromState, toState, updatePayload) {
+        return mutate(action, input, [], (current, nonce, normalized) => {
+            assertWorkerOwner(current, normalized, action);
+            assertActiveAvailable(current, normalized.at);
+            assertLifecycleTimeAdvances(current, normalized.at);
+            if (current.state !== fromState)
+                throw new Error(`ticket cannot ${action} from ${current.state}`);
+            return lifecycleTransitionOptions(nonce, normalized, current, toState, {
+                updatePayload: (payload) => ({
+                    ...(updatePayload ? updatePayload(payload) : payload),
+                    lifecycle_updated_at: normalized.at,
+                }),
+            });
+        });
+    }
+    return Object.freeze({
+        read,
+        authorityStatus(ticketId) {
+            authority.assertCurrentPolicy();
+            const current = read(ticketId);
+            if (current.payload.policy_version !== authority.policyIdentity.policy_version
+                || current.payload.policy_digest !== authority.policyIdentity.policy_digest)
+                return "stale-policy";
+            if (current.payload.gate_digest !== null
+                && current.payload.gate_digest !== authority.currentVerificationGateDigest())
+                return "stale-gate";
+            return "current";
+        },
+        prepare(input) {
+            const gateDigest = resolvePreparedGateDigest(authority, input.ticketId, input.verificationPlanRef);
+            if (gateDigest !== authority.currentVerificationGateDigest()) {
+                throw new Error("ticket preparation requires the current verification gate");
+            }
+            return mutate("prepare", input, [evidenceKey(input.verificationPlanRef), worktreeKey(input.worktree), gateDigest], (current, nonce, normalized) => {
+                assertSystemOwner(normalized.ownerId, authority.systemActors, "prepare");
+                assertLifecycleTimeAdvances(current, normalized.at);
+                if (current.state !== "pending")
+                    throw new Error(`ticket cannot be prepared from ${current.state}`);
+                if (current.payload.verification_plan_ref !== null || current.payload.worktree !== null) {
+                    throw new Error("ticket is already prepared");
+                }
+                return lifecycleTransitionOptions(nonce, normalized, current, "pending", {
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        gate_digest: gateDigest,
+                        verification_plan_ref: input.verificationPlanRef,
+                        worktree: input.worktree,
+                    }),
+                });
+            });
+        },
+        lease(input) {
+            const leaseExpiresAt = canonicalTimestamp(input.leaseExpiresAt, "lease expiry");
+            return mutate("lease", input, [input.workerId, input.sessionId, leaseExpiresAt], (current, nonce, normalized) => {
+                assertSystemOwner(normalized.ownerId, authority.systemActors, "lease");
+                assertLifecycleTimeAdvances(current, normalized.at);
+                if (current.state !== "pending" && current.state !== "retryable") {
+                    throw new Error(`ticket cannot be leased from ${current.state}`);
+                }
+                if (current.payload.verification_plan_ref === null || current.payload.worktree === null) {
+                    throw new Error("ticket must be prepared before leasing");
+                }
+                if (current.state === "retryable"
+                    && retryFailureRequiresReflection(current, authority.evidenceStore)
+                    && current.payload.prior_reflection_evidence === null) {
+                    throw new Error("retry lease requires the bounded reflection for its verification failure");
+                }
+                if (assertTimestamp(leaseExpiresAt, "lease expiry") <= assertTimestamp(normalized.at, "lease timestamp")) {
+                    throw new Error("lease expiry must be after the lease timestamp");
+                }
+                const nextAttempt = current.state === "retryable" ? current.attempt + 1 : current.attempt;
+                if (nextAttempt > current.max_attempts)
+                    throw new Error("attempt budget exhausted");
+                const worker = assertActorId(input.workerId, "worker id");
+                const sessionId = assertOpaqueId(input.sessionId, "session id");
+                const leaseToken = assertLeaseToken(createStableId("lease", current.record_id, worker, nonce));
+                return lifecycleTransitionOptions(nonce, normalized, current, "leased", {
+                    nextActor: worker,
+                    nextAttempt,
+                    nextLeaseToken: leaseToken,
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        lease_expires_at: leaseExpiresAt,
+                        resume_at: null,
+                        resume_state: null,
+                        park_reason: null,
+                        resume_gate: null,
+                        session_id: sessionId,
+                        last_error: null,
+                        executor_evidence: null,
+                        verification_evidence: null,
+                        grade_evidence: null,
+                    }),
+                });
+            });
+        },
+        renew(input) {
+            const leaseExpiresAt = canonicalTimestamp(input.leaseExpiresAt, "lease expiry");
+            return mutate("renew", input, [leaseExpiresAt], (current, nonce, normalized) => {
+                assertWorkerOwner(current, normalized, "renew");
+                assertActiveAvailable(current, normalized.at);
+                assertLifecycleTimeAdvances(current, normalized.at);
+                const currentExpiry = current.payload.lease_expires_at;
+                if (currentExpiry === null || assertTimestamp(leaseExpiresAt, "lease expiry") <= assertTimestamp(currentExpiry, "stored lease expiry")) {
+                    throw new Error("renewed lease expiry must extend the current lease");
+                }
+                return lifecycleTransitionOptions(nonce, normalized, current, current.state, {
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        lease_expires_at: leaseExpiresAt,
+                    }),
+                });
+            });
+        },
+        start(input) {
+            return mutateActive("start", input, "leased", "running");
+        },
+        beginVerification(input) {
+            return mutateActive("verify", input, "running", "verifying", (payload) => ({ ...payload, executor_evidence: input.executorEvidence }));
+        },
+        complete(input) {
+            return mutate("complete", input, [evidenceKey(input.verificationEvidence), evidenceKey(input.gradeEvidence)], (current, nonce, normalized) => {
+                assertWorkerOwner(current, normalized, "complete");
+                assertActiveAvailable(current, normalized.at);
+                assertLifecycleTimeAdvances(current, normalized.at);
+                if (current.state !== "verifying")
+                    throw new Error(`ticket cannot complete from ${current.state}`);
+                return lifecycleTransitionOptions(nonce, normalized, current, "completed", {
+                    nextLeaseToken: null,
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        lease_expires_at: null,
+                        session_id: null,
+                        last_error: null,
+                        verification_evidence: input.verificationEvidence,
+                        grade_evidence: input.gradeEvidence,
+                    }),
+                });
+            });
+        },
+        failAttempt(input) {
+            return mutate("fail", input, [
+                input.error,
+                optionalEvidenceKey(input.executorEvidence),
+                optionalEvidenceKey(input.verificationEvidence),
+                optionalEvidenceKey(input.gradeEvidence),
+                optionalEvidenceKey(input.failureEvidence),
+                optionalEvidenceKey(input.reflectionEvidence),
+            ], (current, nonce, normalized) => {
+                assertWorkerOwner(current, normalized, "fail attempt");
+                assertActiveAvailable(current, normalized.at);
+                assertLifecycleTimeAdvances(current, normalized.at);
+                if (!isActiveTicketState(current.state))
+                    throw new Error(`ticket cannot fail an attempt from ${current.state}`);
+                const target = current.attempt >= current.max_attempts ? "blocked" : "retryable";
+                const failureEvidence = input.failureEvidence
+                    ?? input.gradeEvidence
+                    ?? input.verificationEvidence
+                    ?? input.executorEvidence
+                    ?? payloadFailureReference(current.payload);
+                if (failureEvidence === null)
+                    throw new Error("failed attempt requires immutable failure evidence");
+                return lifecycleTransitionOptions(nonce, normalized, current, target, {
+                    nextLeaseToken: null,
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        lease_expires_at: null,
+                        resume_at: null,
+                        resume_state: null,
+                        park_reason: null,
+                        resume_gate: null,
+                        session_id: null,
+                        last_error: assertBoundedText(input.error, "attempt error", 2048),
+                        executor_evidence: input.executorEvidence ?? payload.executor_evidence,
+                        verification_evidence: input.verificationEvidence ?? payload.verification_evidence,
+                        grade_evidence: input.gradeEvidence ?? payload.grade_evidence,
+                        prior_failure_evidence: failureEvidence,
+                        prior_reflection_evidence: input.reflectionEvidence ?? null,
+                    }),
+                });
+            });
+        },
+        blockVerification(input) {
+            return mutate("block-verification", input, [input.error, optionalEvidenceKey(input.verificationEvidence), optionalEvidenceKey(input.gradeEvidence)], (current, nonce, normalized) => {
+                assertSystemOwner(normalized.ownerId, authority.systemActors, "block verification");
+                assertActiveAvailable(current, normalized.at);
+                assertLifecycleTimeAdvances(current, normalized.at);
+                if (current.state !== "verifying") {
+                    throw new Error(`ticket verification cannot be blocked from ${current.state}`);
+                }
+                return lifecycleTransitionOptions(nonce, normalized, current, "blocked", {
+                    nextActor: normalized.ownerId,
+                    nextLeaseToken: null,
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        lease_expires_at: null,
+                        session_id: null,
+                        last_error: assertBoundedText(input.error, "verification block reason", 2048),
+                        verification_evidence: input.verificationEvidence ?? payload.verification_evidence,
+                        grade_evidence: input.gradeEvidence ?? payload.grade_evidence,
+                    }),
+                });
+            });
+        },
+        attachRetryReflection(input) {
+            return mutate("attach-retry-reflection", input, [evidenceKey(input.reflectionEvidence)], (current, nonce, normalized) => {
+                assertSystemOwner(normalized.ownerId, authority.systemActors, "attach retry reflection");
+                assertLifecycleTimeAdvances(current, normalized.at);
+                if (current.state !== "retryable") {
+                    throw new Error(`retry reflection cannot attach during ${current.state}`);
+                }
+                if (current.payload.prior_failure_evidence === null) {
+                    throw new Error("retry reflection requires prior failure evidence");
+                }
+                if (current.payload.prior_reflection_evidence !== null) {
+                    throw new Error("retry reflection is already attached");
+                }
+                return lifecycleTransitionOptions(nonce, normalized, current, "retryable", {
+                    nextActor: normalized.ownerId,
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        prior_reflection_evidence: input.reflectionEvidence,
+                    }),
+                });
+            });
+        },
+        park(input) {
+            const resumeAt = canonicalTimestamp(input.resumeAt, "resume timestamp");
+            const quotaGate = input.quotaGate;
+            if (quotaGate !== undefined)
+                assertExhaustedQuotaGate(quotaGate);
+            const resumeGate = quotaGate === undefined
+                ? {
+                    kind: "time",
+                    role_id: null,
+                    engine: null,
+                    session_id: null,
+                    limited_session_version: null,
+                    limited_observation_id: null,
+                    limited_observed_at: null,
+                }
+                : {
+                    kind: "quota",
+                    role_id: quotaGate.role_id,
+                    engine: quotaGate.engine,
+                    session_id: quotaGate.session_id,
+                    limited_session_version: quotaGate.source_session_version,
+                    limited_observation_id: quotaGate.observation.observation_id,
+                    limited_observed_at: quotaGate.observed_at,
+                };
+            return mutate("park", input, [resumeAt, input.reason, JSON.stringify(resumeGate)], (current, nonce, normalized) => {
+                assertSystemOwner(normalized.ownerId, authority.systemActors, "park");
+                assertLifecycleTimeAdvances(current, normalized.at);
+                if (isTerminalTicketState(current.state))
+                    throw new Error(`terminal ticket cannot be parked: ${current.state}`);
+                if (current.state === "parked")
+                    throw new Error("ticket is already parked");
+                if (isActiveTicketState(current.state))
+                    assertActiveAvailable(current, normalized.at);
+                if (assertTimestamp(resumeAt, "resume timestamp") <= assertTimestamp(normalized.at, "park timestamp")) {
+                    throw new Error("resume timestamp must be after the park timestamp");
+                }
+                if (quotaGate !== undefined) {
+                    if (!isActiveTicketState(current.state) || current.payload.session_id !== quotaGate.session_id) {
+                        throw new Error("quota park gate is not bound to the active ticket session");
+                    }
+                    if (quotaGate.resume_at !== resumeAt
+                        || quotaGate.checked_at !== normalized.at
+                        || quotaGate.policy_version !== current.payload.policy_version
+                        || quotaGate.policy_digest !== current.payload.policy_digest) {
+                        throw new Error("quota park gate does not match ticket policy or schedule");
+                    }
+                }
+                const resumeState = current.state === "retryable" ? "retryable" : "pending";
+                const clearAttemptEvidence = isActiveTicketState(current.state);
+                return lifecycleTransitionOptions(nonce, normalized, current, "parked", {
+                    nextActor: normalized.ownerId,
+                    nextLeaseToken: null,
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        lease_expires_at: null,
+                        resume_at: resumeAt,
+                        resume_state: resumeState,
+                        park_reason: assertBoundedText(input.reason, "park reason", 512),
+                        resume_gate: resumeGate,
+                        session_id: null,
+                        ...(clearAttemptEvidence
+                            ? { executor_evidence: null, verification_evidence: null, grade_evidence: null }
+                            : {}),
+                    }),
+                });
+            });
+        },
+        resume(input) {
+            const quotaGate = input.quotaGate;
+            if (quotaGate !== undefined)
+                assertFreshQuotaGate(quotaGate);
+            return mutate("resume", input, [quotaGate?.observation.observation_id ?? "quota:null"], (current, nonce, normalized) => {
+                assertSystemOwner(normalized.ownerId, authority.systemActors, "resume");
+                assertLifecycleTimeAdvances(current, normalized.at);
+                if (current.state !== "parked")
+                    throw new Error(`ticket is not parked: ${current.state}`);
+                const resumeAt = current.payload.resume_at;
+                const resumeState = current.payload.resume_state;
+                if (resumeAt === null || resumeState === null || current.payload.park_reason === null) {
+                    throw new Error("ticket is not durably parked");
+                }
+                if (assertTimestamp(normalized.at, "resume timestamp") < assertTimestamp(resumeAt, "stored resume timestamp")) {
+                    throw new Error("ticket resume is not due");
+                }
+                const storedGate = current.payload.resume_gate;
+                if (storedGate === null)
+                    throw new Error("parked ticket is missing its resume gate");
+                if (storedGate.kind === "quota") {
+                    if (quotaGate === undefined)
+                        throw new Error("quota-parked ticket requires a fresh quota gate");
+                    if (quotaGate.role_id !== storedGate.role_id
+                        || quotaGate.engine !== storedGate.engine
+                        || quotaGate.session_id !== storedGate.session_id
+                        || quotaGate.source_session_version <= storedGate.limited_session_version
+                        || quotaGate.policy_version !== current.payload.policy_version
+                        || quotaGate.policy_digest !== current.payload.policy_digest
+                        || quotaGate.checked_at !== normalized.at
+                        || quotaGate.observation.observation_id === storedGate.limited_observation_id
+                        || Date.parse(quotaGate.observed_at) <= Date.parse(storedGate.limited_observed_at)) {
+                        throw new Error("fresh quota gate does not satisfy the parked ticket resume authority");
+                    }
+                }
+                else if (quotaGate !== undefined) {
+                    throw new Error("time-parked ticket must not consume quota authority");
+                }
+                return lifecycleTransitionOptions(nonce, normalized, current, resumeState, {
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        lease_expires_at: null,
+                        resume_at: null,
+                        resume_state: null,
+                        park_reason: null,
+                        resume_gate: null,
+                        session_id: null,
+                    }),
+                });
+            });
+        },
+        quarantineStaleAuthority(input) {
+            const normalized = validateMutationInput(input);
+            const reason = assertBoundedText(input.reason, "quarantine reason", 2048);
+            const commandId = createStableId("command", "quarantine-stale-authority", normalized.operationId, String(normalized.expectedVersion), String(normalized.expectedAttempt), normalized.expectedActor, normalized.ownerId, normalized.expectedLeaseToken === null ? "lease:null" : `lease:${normalized.expectedLeaseToken}`, normalized.at, reason);
+            const nonce = createTransitionNonce("quarantine", normalized.ticketId, commandId);
+            const current = read(normalized.ticketId);
+            if (current.transition_outcomes.some((outcome) => outcome.nonce === nonce)) {
+                return authority.transitionAuthorityRepair({
+                    recordId: current.record_id,
+                    ownerId: normalized.ownerId,
+                    expectedVersion: current.version,
+                    nonce,
+                    expectedActor: current.actor,
+                    expectedAttempt: current.attempt,
+                    expectedLeaseToken: current.lease_token,
+                    fromStates: [current.state],
+                    toState: current.state,
+                });
+            }
+            assertExpectedMutation(current, normalized);
+            assertSystemOwner(normalized.ownerId, authority.systemActors, "quarantine stale ticket authority");
+            let stalePolicy = current.payload.policy_version !== authority.policyIdentity.policy_version
+                || current.payload.policy_digest !== authority.policyIdentity.policy_digest;
+            try {
+                authority.assertCurrentPolicy();
+            }
+            catch {
+                stalePolicy = true;
+            }
+            let staleGate = false;
+            try {
+                staleGate = current.payload.gate_digest !== authority.currentVerificationGateDigest();
+            }
+            catch {
+                staleGate = true;
+            }
+            if (!stalePolicy && !staleGate) {
+                throw new Error("ticket authority quarantine requires stale policy or verification gate evidence");
+            }
+            if (current.payload.gate_digest === null) {
+                throw new Error("unprepared tickets cannot use the prepared-ticket quarantine path");
+            }
+            return authority.transitionAuthorityRepair(lifecycleTransitionOptions(nonce, normalized, current, "blocked", {
+                nextActor: normalized.ownerId,
+                nextLeaseToken: null,
+                updatePayload: (payload) => ({
+                    ...payload,
+                    lifecycle_updated_at: normalized.at,
+                    lease_expires_at: null,
+                    resume_at: null,
+                    resume_state: null,
+                    park_reason: null,
+                    resume_gate: null,
+                    session_id: null,
+                    last_error: reason,
+                    executor_evidence: null,
+                    verification_evidence: null,
+                    grade_evidence: null,
+                }),
+            }));
+        },
+        rebindUnpreparedAuthority(input) {
+            const normalized = validateMutationInput(input);
+            const commandId = createStableId("command", "rebind-unprepared-authority", normalized.operationId, String(normalized.expectedVersion), normalized.ownerId, normalized.at);
+            const nonce = createTransitionNonce("authority-rebind", normalized.ticketId, commandId);
+            const current = read(normalized.ticketId);
+            if (current.transition_outcomes.some((outcome) => outcome.nonce === nonce)) {
+                return authority.transitionAuthorityRepair({
+                    recordId: current.record_id,
+                    ownerId: normalized.ownerId,
+                    expectedVersion: current.version,
+                    nonce,
+                    expectedActor: current.actor,
+                    expectedAttempt: current.attempt,
+                    expectedLeaseToken: current.lease_token,
+                    fromStates: [current.state],
+                    toState: current.state,
+                });
+            }
+            assertExpectedMutation(current, normalized);
+            assertSystemOwner(normalized.ownerId, authority.systemActors, "rebind unprepared ticket authority");
+            authority.assertCurrentPolicy();
+            if (current.state !== "pending"
+                || current.payload.gate_digest !== null
+                || current.payload.verification_plan_ref !== null
+                || current.payload.worktree !== null) {
+                throw new Error("only an unprepared pending ticket can rebind current authority");
+            }
+            if (current.payload.policy_version === authority.policyIdentity.policy_version
+                && current.payload.policy_digest === authority.policyIdentity.policy_digest) {
+                throw new Error("unprepared ticket already has the current authority");
+            }
+            return authority.transitionAuthorityRepair(lifecycleTransitionOptions(nonce, normalized, current, "pending", {
+                nextActor: normalized.ownerId,
+                updatePayload: (payload) => ({
+                    ...payload,
+                    lifecycle_updated_at: normalized.at,
+                    policy_version: authority.policyIdentity.policy_version,
+                    policy_digest: authority.policyIdentity.policy_digest,
+                    last_error: "unprepared ticket authority rebound to current policy",
+                }),
+            }));
+        },
+        recoverExpiredLease(input) {
+            return mutate("recover", input, [], (current, nonce, normalized) => {
+                assertSystemOwner(normalized.ownerId, authority.systemActors, "recover expired lease");
+                assertLifecycleTimeAdvances(current, normalized.at);
+                if (!isActiveTicketState(current.state))
+                    throw new Error(`ticket has no active lease in ${current.state}`);
+                const expiresAt = current.payload.lease_expires_at;
+                if (expiresAt === null || assertTimestamp(expiresAt, "stored lease expiry") > assertTimestamp(normalized.at, "recovery timestamp")) {
+                    throw new Error("ticket lease has not expired");
+                }
+                const leaseToken = current.lease_token;
+                const worktree = current.payload.worktree;
+                const evidenceStore = authority.evidenceStore;
+                if (leaseToken === null || worktree === null || evidenceStore === undefined) {
+                    throw new Error("expired lease recovery lacks trusted retry authority");
+                }
+                const reason = `lease expired at ${expiresAt}`;
+                const worktreeStartCommit = activeAttemptStartCommit(current, evidenceStore);
+                const failureEvidence = evidenceStore.write({
+                    schema_version: 1,
+                    evidence_id: createStableId("lease-expiry", current.record_id, String(current.attempt), leaseToken),
+                    evidence_kind: "lease-expiry",
+                    ticket_id: current.record_id,
+                    producer_role: "oms.watchdog",
+                    created_at: normalized.at,
+                    payload: {
+                        ticket_id: current.record_id,
+                        attempt: current.attempt,
+                        lease_token: leaseToken,
+                        worktree_start_commit: worktreeStartCommit,
+                        expired_at: expiresAt,
+                        reason,
+                    },
+                }).ref;
+                const target = current.attempt >= current.max_attempts ? "blocked" : "retryable";
+                return lifecycleTransitionOptions(nonce, normalized, current, target, {
+                    nextActor: normalized.ownerId,
+                    nextLeaseToken: null,
+                    updatePayload: (payload) => ({
+                        ...payload,
+                        lifecycle_updated_at: normalized.at,
+                        lease_expires_at: null,
+                        resume_at: null,
+                        resume_state: null,
+                        park_reason: null,
+                        resume_gate: null,
+                        session_id: null,
+                        last_error: reason,
+                        prior_failure_evidence: failureEvidence,
+                        prior_reflection_evidence: null,
+                    }),
+                });
+            });
+        },
+    });
+}
+export function createTicketMaterializer(options) {
+    const queueStore = options.queueStore;
+    const ticketStore = options.ticketStore;
+    const queueInternal = QUEUE_INTERNALS.get(queueStore);
+    if (!queueInternal)
+        throw new Error("ticket materializer requires the canonical ticket queue store");
+    assertTicketContentStore(ticketStore);
+    const actorId = assertActorId(options.actorId, "ticket materializer actor");
+    if (!queueInternal.systemActors.has(actorId)) {
+        throw new Error("ticket materializer actor must be an allowed system actor");
+    }
+    const materializer = Object.freeze({
+        syncGitHub(input) {
+            return syncGitHubTicket({
+                ticketStore,
+                queueStore,
+                actorId,
+                input,
+            });
+        },
+        syncLocal(input) {
+            return syncLocalTicket({
+                ticketStore,
+                queueStore,
+                actorId,
+                input,
+            });
+        },
+        readContent(ref) {
+            return ticketStore.read(ref);
+        },
+        read(recordId) {
+            return queueStore.read(recordId);
+        },
+        readIfExists(recordId) {
+            return queueStore.readIfExists(recordId);
+        },
+    });
+    MATERIALIZER_INTERNALS.set(materializer, {
+        queueStore,
+        ticketStore,
+    });
+    return materializer;
+}
+export function assertTicketMaterializer(value) {
+    if (typeof value !== "object" || value === null || !MATERIALIZER_INTERNALS.has(value)) {
+        throw new Error("ticket operation requires a real OMS TicketMaterializer");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("ticket materializer lost its frozen authority boundary");
+}
+export function assertTicketMaterializerEvidenceStore(materializer, evidenceStore) {
+    assertTicketMaterializer(materializer);
+    assertEvidenceStore(evidenceStore);
+    const materializerInternal = MATERIALIZER_INTERNALS.get(materializer);
+    const queueInternal = materializerInternal && QUEUE_INTERNALS.get(materializerInternal.queueStore);
+    if (!queueInternal || queueInternal.evidenceStore !== evidenceStore) {
+        throw new Error("ticket materializer is not bound to the supplied evidence store");
+    }
+}
+function assertTicketContentStore(value) {
+    if (typeof value !== "object" || value === null || !TICKET_CONTENT_STORES.has(value)) {
+        throw new Error("ticket operation requires a real ticket content store");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("ticket content store lost its frozen authority boundary");
+}
+function lifecycleTransitionOptions(nonce, input, current, toState, options = {}) {
+    return {
+        recordId: current.record_id,
+        ownerId: input.ownerId,
+        expectedVersion: input.expectedVersion,
+        nonce,
+        expectedActor: input.expectedActor,
+        expectedAttempt: input.expectedAttempt,
+        expectedLeaseToken: input.expectedLeaseToken,
+        nextActor: options.nextActor,
+        nextAttempt: options.nextAttempt,
+        nextLeaseToken: options.nextLeaseToken,
+        fromStates: [current.state],
+        toState,
+        updatePayload: options.updatePayload
+            ? (record) => options.updatePayload?.(record.payload) ?? record.payload
+            : undefined,
+    };
+}
+function validateMutationInput(input) {
+    assertRecordId(input.ticketId, "ticket id");
+    assertOpaqueId(input.operationId, "operation id");
+    assertActorId(input.ownerId, "operation owner id");
+    assertActorId(input.expectedActor, "expected actor");
+    if (input.expectedLeaseToken !== null)
+        assertLeaseToken(input.expectedLeaseToken, "expected lease token");
+    if (!Number.isSafeInteger(input.expectedVersion) || input.expectedVersion < 0)
+        throw new Error("invalid expected version");
+    if (!Number.isSafeInteger(input.expectedAttempt) || input.expectedAttempt < 1)
+        throw new Error("invalid expected attempt");
+    return { ...input, at: canonicalTimestamp(input.at, "operation timestamp") };
+}
+function assertExpectedMutation(current, input) {
+    if (current.version !== input.expectedVersion)
+        throw new Error("stale version");
+    if (current.attempt !== input.expectedAttempt)
+        throw new Error("attempt mismatch");
+    if (current.actor !== input.expectedActor)
+        throw new Error("actor mismatch");
+    if (current.lease_token !== input.expectedLeaseToken)
+        throw new Error("lease token mismatch");
+}
+function assertLifecycleTimeAdvances(current, at) {
+    if (assertTimestamp(at, "operation timestamp") <= assertTimestamp(current.payload.lifecycle_updated_at, "lifecycle timestamp")) {
+        throw new Error("ticket lifecycle timestamp must advance");
+    }
+}
+function assertActiveAvailable(current, at) {
+    if (!isActiveTicketState(current.state))
+        throw new Error(`ticket is not active: ${current.state}`);
+    const expiresAt = current.payload.lease_expires_at;
+    if (expiresAt === null || assertTimestamp(expiresAt, "stored lease expiry") <= assertTimestamp(at, "operation timestamp")) {
+        throw new Error("ticket lease has expired");
+    }
+}
+function assertWorkerOwner(current, input, action) {
+    if (input.ownerId !== current.actor)
+        throw new Error(`${action} requires the current worker actor`);
+}
+function assertSystemOwner(ownerId, systemActors, action) {
+    if (!systemActors.has(ownerId))
+        throw new Error(`${action} requires an allowed system actor`);
+}
+function assertBoundedText(value, label, maxLength) {
+    if (typeof value !== "string" || value.length < 1 || value.length > maxLength)
+        throw new Error(`invalid ${label}`);
+    return value;
+}
+function evidenceKey(reference) {
+    return `${reference.evidence_id}:${reference.sha256}:${reference.file_name}`;
+}
+function optionalEvidenceKey(reference) {
+    return reference ? evidenceKey(reference) : "evidence:null";
+}
+function payloadFailureReference(payload) {
+    return payload.grade_evidence ?? payload.verification_evidence ?? payload.executor_evidence;
+}
+function worktreeKey(worktree) {
+    return `${worktree.branch}:${worktree.base_commit}`;
+}
+function resolvePreparedGateDigest(internal, ticketId, reference) {
+    if (!internal.evidenceStore)
+        throw new Error("ticket preparation requires an evidence store");
+    const evidence = internal.evidenceStore.read(reference);
+    if (evidence.evidence_kind !== "verification-plan" || evidence.ticket_id !== assertRecordId(ticketId, "ticket id")) {
+        throw new Error("ticket preparation requires its own verification plan evidence");
+    }
+    const digest = evidence.payload.digest;
+    if (typeof digest !== "string")
+        throw new Error("verification plan evidence is missing its gate digest");
+    validateSha256(digest, "verification gate digest");
+    return digest;
+}
+function acquireSyncLockWithRetry(options) {
+    let lastBusy;
+    for (let attempt = 1; attempt <= SYNC_LOCK_ATTEMPTS; attempt += 1) {
+        try {
+            return acquireDirectoryLock(options);
+        }
+        catch (error) {
+            if (!(error instanceof LockBusyError))
+                throw error;
+            lastBusy = error;
+            if (attempt < SYNC_LOCK_ATTEMPTS)
+                sleepSync(SYNC_LOCK_RETRY_MS);
+        }
+    }
+    throw new Error(`ticket sync lock remained busy after ${SYNC_LOCK_ATTEMPTS} attempts`, { cause: lastBusy });
+}
+function sleepSync(milliseconds) {
+    const signal = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+    Atomics.wait(signal, 0, 0, milliseconds);
+}
+export function createTicketContentStore(options) {
+    const root = openStableDirectory(options.ticketsRoot, "tickets root");
+    const packageRoot = options.packageRoot ?? findPackageRoot();
+    const contentSchema = loadJsonSchema(join(packageRoot, "schemas", "ticket-content.schema.json"));
+    function prepareContent(content, sourceRefSha256) {
+        root.assertUnchanged();
+        validateTicketContent(content, contentSchema);
+        validateSha256(sourceRefSha256, "ticket source digest");
+        if (sourceRefForContent(content) !== sourceRefSha256)
+            throw new Error("ticket source identity failed verification");
+        const bytes = canonicalJson(content);
+        if (bytes.byteLength > MAX_TICKET_BYTES)
+            throw new Error(`ticket content exceeds ${MAX_TICKET_BYTES} bytes`);
+        const digest = sha256(bytes);
+        return {
+            content,
+            source_ref_sha256: sourceRefSha256,
+            bytes,
+            ref: {
+                ticket_id: content.ticket_id,
+                sha256: digest,
+                file_name: `${content.ticket_id}.${digest}.json`,
+            },
+        };
+    }
+    function readStored(ref) {
+        validateTicketRef(ref);
+        const path = join(root.path, ref.file_name);
+        assertFileInside(root, path);
+        const bytes = readImmutableFile(path, MAX_TICKET_BYTES);
+        if (sha256(bytes) !== ref.sha256)
+            throw new Error(`ticket content digest mismatch: ${ref.ticket_id}`);
+        const content = validateTicketContent(parseJson(bytes, "ticket content"), contentSchema);
+        if (content.ticket_id !== ref.ticket_id)
+            throw new Error("stored ticket content has the wrong ticket id");
+        return freezeJsonSnapshot(content);
+    }
+    const store = Object.freeze({
+        prepareGitHub(input) {
+            const repository = assertGitHubRepository(input.repository);
+            const identity = deriveGitHubTicketIdentity(input);
+            return prepareContent({
+                schema_version: 1,
+                ticket_id: identity.ticket_id,
+                source: "github",
+                repository,
+                issue_node_id: input.issue_node_id,
+                title: input.title,
+                body: input.body,
+                labels: normalizeLabels(input.labels),
+                url: input.url,
+                updated_at: input.updated_at,
+            }, identity.source_ref_sha256);
+        },
+        prepareLocal(input) {
+            const ticketId = assertTicketRecordId(input.ticket_id);
+            const sourceRefSha256 = sha256(Buffer.from(`local\0${ticketId}`, "utf8"));
+            return prepareContent({
+                schema_version: 1,
+                ticket_id: ticketId,
+                source: "local",
+                repository: null,
+                issue_node_id: null,
+                title: input.title,
+                body: input.body,
+                labels: normalizeLabels(input.labels),
+                url: input.url,
+                updated_at: input.updated_at,
+            }, sourceRefSha256);
+        },
+        write(prepared) {
+            validateTicketRef(prepared.ref);
+            validateTicketContent(prepared.content, contentSchema);
+            if (sourceRefForContent(prepared.content) !== prepared.source_ref_sha256) {
+                throw new Error("prepared ticket source identity failed verification");
+            }
+            const expected = canonicalJson(prepared.content);
+            if (!expected.equals(prepared.bytes) || sha256(prepared.bytes) !== prepared.ref.sha256) {
+                throw new Error("prepared ticket content failed digest verification");
+            }
+            const path = join(root.path, prepared.ref.file_name);
+            assertFileInside(root, path);
+            const status = writeImmutableFile(path, prepared.bytes);
+            readStored(prepared.ref);
+            return status;
+        },
+        read(ref) {
+            return readStored(ref);
+        },
+    });
+    TICKET_CONTENT_STORES.add(store);
+    return store;
+}
+export function syncGitHubTicket(options) {
+    assertTicketContentStore(options.ticketStore);
+    if (!Array.isArray(options.input.labels) || !options.input.labels.includes("oms:ready")) {
+        throw new Error("GitHub ticket is missing ready-label intent: oms:ready");
+    }
+    return freezeSyncTicketResult(syncPreparedTicket(options, options.ticketStore.prepareGitHub(options.input)));
+}
+export function syncLocalTicket(options) {
+    assertTicketContentStore(options.ticketStore);
+    return freezeSyncTicketResult(syncPreparedTicket(options, options.ticketStore.prepareLocal(options.input)));
+}
+function syncPreparedTicket(options, prepared) {
+    assertTicketContentStore(options.ticketStore);
+    const internal = QUEUE_INTERNALS.get(options.queueStore);
+    if (!internal)
+        throw new Error("ticket sync requires a validated ticket queue store");
+    const actor = assertActorId(options.actorId);
+    if (!internal.systemActors.has(actor))
+        throw new Error("ticket sync requires an allowed system actor");
+    const maxAttempts = options.maxAttempts ?? MAX_QUEUE_ATTEMPTS;
+    if (maxAttempts !== MAX_QUEUE_ATTEMPTS) {
+        throw new Error(`ticket maxAttempts must equal ${MAX_QUEUE_ATTEMPTS}`);
+    }
+    return internal.synchronized(prepared.ref.ticket_id, actor, () => {
+        const current = options.queueStore.readIfExists(prepared.ref.ticket_id);
+        if (!current) {
+            const operationSha256 = syncOperationFingerprint(prepared, maxAttempts, internal.policyIdentity);
+            const nonce = assertTransitionNonce(`sync-${operationSha256.slice(0, 59)}`);
+            options.ticketStore.write(prepared);
+            const record = initialTicketRecord(prepared, actor, nonce, maxAttempts, operationSha256, internal.policyIdentity);
+            return { status: "created", ref: prepared.ref, record: internal.store.create(record) };
+        }
+        const currentPayload = internal.validatePayload(current.payload);
+        const boundPolicy = policyIdentityFromPayload(currentPayload);
+        const operationSha256 = syncOperationFingerprint(prepared, maxAttempts, boundPolicy);
+        const nonce = assertTransitionNonce(`sync-${operationSha256.slice(0, 59)}`);
+        assertQueuePayload(current, currentPayload, prepared);
+        if (current.max_attempts !== maxAttempts) {
+            throw new Error(`maxAttempts conflicts with the stored ticket record: ${current.max_attempts}`);
+        }
+        const replay = currentPayload.sync_outcomes.find((outcome) => outcome.nonce === nonce);
+        if (replay)
+            return replaySyncOutcome(replay, operationSha256, current, options.ticketStore);
+        if (current.transition_outcomes.some((outcome) => outcome.nonce === nonce)) {
+            throw new Error(`sync nonce was already used by another transition: ${nonce}`);
+        }
+        const incomingTime = timestampEpoch(prepared.content.updated_at, "incoming ticket timestamp");
+        const currentTime = timestampEpoch(currentPayload.source_updated_at, "stored ticket timestamp");
+        if (incomingTime < currentTime)
+            throw new Error("ticket source update is older than the stored version");
+        if (incomingTime === currentTime && currentPayload.content_sha256 !== prepared.ref.sha256) {
+            throw new Error("ticket source timestamp conflicts with different content");
+        }
+        const status = currentPayload.content_sha256 === prepared.ref.sha256 ? "unchanged" : "refreshed";
+        if (status === "refreshed" && current.state !== "pending") {
+            throw new Error(`ticket content refresh requires pending state: ${prepared.ref.ticket_id} is ${current.state}`);
+        }
+        if (status === "refreshed")
+            options.ticketStore.write(prepared);
+        else
+            options.ticketStore.read(prepared.ref);
+        const syncOutcome = makeSyncOutcome(nonce, operationSha256, status, prepared.ref, current.version + 1);
+        const transitioned = internal.transitionSync({
+            recordId: current.record_id,
+            ownerId: actor,
+            expectedVersion: current.version,
+            nonce,
+            expectedActor: current.actor,
+            expectedAttempt: current.attempt,
+            expectedLeaseToken: current.lease_token,
+            fromStates: [current.state],
+            toState: current.state,
+            updatePayload: () => appendSyncOutcome(currentPayload, prepared, syncOutcome),
+        });
+        const storedOutcome = internal.validatePayload(transitioned.record.payload).sync_outcomes.find((outcome) => outcome.nonce === nonce);
+        if (!storedOutcome || storedOutcome.operation_sha256 !== operationSha256) {
+            throw new Error(`ticket sync outcome was not durably recorded: ${nonce}`);
+        }
+        return { status, ref: prepared.ref, record: transitioned.record };
+    });
+}
+function replaySyncOutcome(outcome, operationSha256, current, ticketStore) {
+    if (outcome.operation_sha256 !== operationSha256) {
+        throw new Error(`sync nonce is bound to a different operation: ${outcome.nonce}`);
+    }
+    const ref = {
+        ticket_id: current.record_id,
+        sha256: outcome.content_sha256,
+        file_name: outcome.content_file,
+    };
+    ticketStore.read(ref);
+    return { status: outcome.status, ref, record: current };
+}
+function initialTicketRecord(prepared, actor, nonce, maxAttempts, operationSha256, policyIdentity) {
+    return {
+        schema_version: 1,
+        record_id: assertRecordId(prepared.ref.ticket_id),
+        record_kind: assertOpaqueId("ticket"),
+        version: 0,
+        state: "pending",
+        attempt: 1,
+        max_attempts: maxAttempts,
+        actor,
+        lease_token: null,
+        transition_nonce: nonce,
+        payload: initialQueuePayload(prepared, makeSyncOutcome(nonce, operationSha256, "created", prepared.ref, 0), policyIdentity),
+        transition_outcomes: [{ nonce, version: 0, state: "pending", attempt: 1, actor, lease_token: null }],
+    };
+}
+function initialQueuePayload(prepared, syncOutcome, policyIdentity) {
+    return {
+        ...sourceQueuePayload(prepared),
+        ...initialQueueLifecycle(prepared.content.updated_at),
+        ...policyIdentity,
+        gate_digest: null,
+        verification_plan_ref: null,
+        worktree: null,
+        executor_evidence: null,
+        verification_evidence: null,
+        grade_evidence: null,
+        prior_failure_evidence: null,
+        prior_reflection_evidence: null,
+        merge_disposition: "human_hold",
+        sync_outcomes: [syncOutcome],
+    };
+}
+function appendSyncOutcome(current, prepared, outcome) {
+    if (current.sync_outcomes.length >= MAX_SYNC_OUTCOMES)
+        throw new Error("ticket sync outcome history is full");
+    const source = outcome.status === "refreshed" ? sourceQueuePayload(prepared) : {};
+    return { ...current, ...source, sync_outcomes: [...current.sync_outcomes, outcome] };
+}
+function sourceQueuePayload(prepared) {
+    return {
+        ticket_id: prepared.ref.ticket_id,
+        source: prepared.content.source,
+        source_ref_sha256: prepared.source_ref_sha256,
+        content_sha256: prepared.ref.sha256,
+        content_file: prepared.ref.file_name,
+        source_updated_at: prepared.content.updated_at,
+        ready_intent: true,
+    };
+}
+function makeSyncOutcome(nonce, operationSha256, status, ref, recordVersion) {
+    return {
+        nonce,
+        operation_sha256: operationSha256,
+        status,
+        content_sha256: ref.sha256,
+        content_file: ref.file_name,
+        record_version: recordVersion,
+    };
+}
+function syncOperationFingerprint(prepared, maxAttempts, policyIdentity) {
+    return sha256(canonicalJson({
+        ticket_id: prepared.ref.ticket_id,
+        source: prepared.content.source,
+        source_ref_sha256: prepared.source_ref_sha256,
+        content_sha256: prepared.ref.sha256,
+        source_updated_at: prepared.content.updated_at,
+        max_attempts: maxAttempts,
+        policy_version: policyIdentity.policy_version,
+        policy_digest: policyIdentity.policy_digest,
+    }));
+}
+function assertQueuePayload(current, payload, prepared) {
+    if (current.record_kind !== "ticket" || payload.ticket_id !== current.record_id) {
+        throw new Error(`record is not a ticket queue record: ${current.record_id}`);
+    }
+    if (payload.source !== prepared.content.source
+        || payload.source_ref_sha256 !== prepared.source_ref_sha256
+        || payload.ready_intent !== true) {
+        throw new Error(`ticket source identity mismatch: ${current.record_id}`);
+    }
+}
+function validateTicketRuntimeRecord(record, schema, evidenceStore) {
+    if (record.record_kind !== "ticket" || !isTicketState(record.state))
+        throw new Error("invalid ticket runtime record");
+    if (record.max_attempts !== MAX_QUEUE_ATTEMPTS) {
+        throw new Error(`ticket max_attempts must equal ${MAX_QUEUE_ATTEMPTS}`);
+    }
+    for (const outcome of record.transition_outcomes) {
+        if (!isTicketState(outcome.state))
+            throw new Error("ticket transition contains an invalid lifecycle state");
+    }
+    const payload = validateTicketQueuePayload(record.payload, schema);
+    if (payload.ticket_id !== record.record_id)
+        throw new Error("ticket queue payload id does not match its record");
+    validateStateInvariants(record, payload);
+    const resolved = resolveLifecycleEvidence(payload, record, evidenceStore);
+    validateStatePayloadRequirements(record.state, payload, resolved);
+    const firstSync = payload.sync_outcomes[0];
+    if (!firstSync || firstSync.status !== "created" || firstSync.record_version !== 0) {
+        throw new Error("ticket sync history must begin with record creation");
+    }
+    for (const outcome of payload.sync_outcomes) {
+        const transition = record.transition_outcomes.find((candidate) => candidate.nonce === outcome.nonce);
+        if (!transition || transition.version !== outcome.record_version) {
+            throw new Error(`ticket sync outcome is not bound to a runtime transition: ${outcome.nonce}`);
+        }
+    }
+}
+function validateInitialTicketRecord(record, systemActors, policyIdentity) {
+    if (record.version !== 0
+        || record.state !== "pending"
+        || record.attempt !== 1
+        || record.max_attempts !== MAX_QUEUE_ATTEMPTS
+        || record.lease_token !== null
+        || record.transition_outcomes.length !== 1) {
+        throw new Error("initial ticket record must be pending at version zero and attempt one of three");
+    }
+    if (!systemActors.has(record.actor))
+        throw new Error("initial ticket actor must be an allowed system actor");
+    const payload = record.payload;
+    if (payload.policy_version !== policyIdentity.policy_version
+        || payload.policy_digest !== policyIdentity.policy_digest
+        || payload.gate_digest !== null) {
+        throw new Error("initial ticket policy identity does not match the materializer policy");
+    }
+}
+function validateStatePayloadRequirements(state, payload, resolved) {
+    if (["leased", "running", "verifying", "retryable", "blocked", "completed"].includes(state)) {
+        if (payload.verification_plan_ref === null || payload.worktree === null || payload.gate_digest === null || !resolved.plan) {
+            throw new Error(`ticket state ${state} requires a verification plan and worktree`);
+        }
+    }
+    if (["verifying", "completed"].includes(state) && (payload.executor_evidence === null || !resolved.executor)) {
+        throw new Error(`ticket state ${state} requires executor evidence`);
+    }
+    if (["verifying", "completed"].includes(state) && resolved.executor && !executorSucceeded(resolved.executor)) {
+        throw new Error(`ticket state ${state} requires successful executor evidence`);
+    }
+    if (state === "completed" && (payload.verification_evidence === null
+        || payload.grade_evidence === null
+        || !resolved.verification
+        || !resolved.grade)) {
+        throw new Error("completed ticket requires verification and grade evidence");
+    }
+    if (state === "completed" && resolved.verification?.payload.passed !== true) {
+        throw new Error("completed ticket requires a passing deterministic check");
+    }
+    if (state === "completed" && resolved.verification?.payload.certification !== "live") {
+        throw new Error("completed ticket requires protected live deterministic evidence");
+    }
+    if (state === "completed" && resolved.grade?.payload.verdict !== "pass") {
+        throw new Error("completed ticket requires a passing grader verdict");
+    }
+    if (payload.prior_reflection_evidence !== null && !resolved.priorReflection) {
+        throw new Error("ticket prior reflection reference is invalid");
+    }
+}
+function validateTicketTransition(currentRecord, nextRecord, schema, syncMutation, lifecycleMutation, authorityRepairMutation, systemActors, evidenceStore) {
+    if (Number(syncMutation) + Number(lifecycleMutation) + Number(authorityRepairMutation) !== 1) {
+        throw new Error("ticket transition requires exactly one authorized mutation path");
+    }
+    const current = validateTicketQueuePayload(currentRecord.payload, schema);
+    const next = validateTicketQueuePayload(nextRecord.payload, schema);
+    const prefix = next.sync_outcomes.slice(0, current.sync_outcomes.length);
+    if (JSON.stringify(prefix) !== JSON.stringify(current.sync_outcomes)) {
+        throw new Error("ticket sync outcome history is immutable");
+    }
+    const added = next.sync_outcomes.length - current.sync_outcomes.length;
+    if (added < 0 || added > 1)
+        throw new Error("ticket transition changed sync outcome history illegally");
+    if (authorityRepairMutation) {
+        if (added !== 0)
+            throw new Error("ticket authority repair cannot append sync outcomes");
+        if (!sameSourceMetadata(current, next))
+            throw new Error("ticket authority repair cannot modify source metadata");
+        validateAuthorityRepairTransition(currentRecord, nextRecord, current, next, systemActors, evidenceStore);
+        return;
+    }
+    if (lifecycleMutation) {
+        if (added !== 0)
+            throw new Error("ticket lifecycle transition cannot append sync outcomes");
+        if (!sameSourceMetadata(current, next))
+            throw new Error("ticket lifecycle transition cannot modify source metadata");
+        validateLifecycleTransition(currentRecord, nextRecord, current, next, systemActors, evidenceStore);
+        return;
+    }
+    if (currentRecord.state !== nextRecord.state
+        || currentRecord.attempt !== nextRecord.attempt
+        || currentRecord.actor !== nextRecord.actor
+        || currentRecord.lease_token !== nextRecord.lease_token
+        || !sameLifecycleFields(current, next)) {
+        throw new Error("ticket sync must preserve lifecycle authority");
+    }
+    if (added === 0) {
+        if (!sameSourceMetadata(current, next))
+            throw new Error("ticket source metadata requires a sync transition");
+        return;
+    }
+    const outcome = next.sync_outcomes.at(-1);
+    if (!outcome || outcome.nonce !== nextRecord.transition_nonce || outcome.record_version !== nextRecord.version) {
+        throw new Error("ticket sync outcome does not match its runtime transition");
+    }
+    if (outcome.status === "created")
+        throw new Error("created sync outcomes are only valid on record creation");
+    if (outcome.status === "unchanged" && !sameSourceMetadata(current, next)) {
+        throw new Error("unchanged sync outcome modified source metadata");
+    }
+    if (outcome.status === "refreshed") {
+        if (currentRecord.state !== "pending" || nextRecord.state !== "pending") {
+            throw new Error("ticket refresh transition requires pending state");
+        }
+        if (timestampEpoch(next.source_updated_at, "next source timestamp") <= timestampEpoch(current.source_updated_at, "current source timestamp")) {
+            throw new Error("ticket refresh timestamp must advance");
+        }
+    }
+}
+function validateAuthorityRepairTransition(currentRecord, nextRecord, current, next, systemActors, evidenceStore) {
+    const from = currentRecord.state;
+    if (from === "pending" && nextRecord.state === "pending" && current.gate_digest === null) {
+        if (current.verification_plan_ref !== null
+            || current.worktree !== null
+            || next.gate_digest !== null
+            || next.verification_plan_ref !== null
+            || next.worktree !== null
+            || nextRecord.attempt !== currentRecord.attempt
+            || nextRecord.lease_token !== null
+            || !systemActors.has(nextRecord.actor)) {
+            throw new Error("unprepared ticket authority rebind changed lifecycle ownership");
+        }
+        if (current.policy_version === next.policy_version
+            && current.policy_digest === next.policy_digest) {
+            throw new Error("unprepared ticket authority rebind must change its policy identity");
+        }
+        if (assertTimestamp(next.lifecycle_updated_at, "authority rebind timestamp") <= assertTimestamp(current.lifecycle_updated_at, "current lifecycle timestamp")) {
+            throw new Error("unprepared ticket authority rebind timestamp must advance");
+        }
+        const expected = {
+            ...current,
+            lifecycle_updated_at: next.lifecycle_updated_at,
+            policy_version: next.policy_version,
+            policy_digest: next.policy_digest,
+            last_error: "unprepared ticket authority rebound to current policy",
+        };
+        if (JSON.stringify(next) !== JSON.stringify(expected)) {
+            throw new Error("unprepared ticket authority rebind changed fields outside its projection");
+        }
+        return;
+    }
+    if (isTerminalTicketState(from) || nextRecord.state !== "blocked") {
+        throw new Error(`ticket authority quarantine is not valid from ${from}`);
+    }
+    if (current.gate_digest === null || current.verification_plan_ref === null || current.worktree === null) {
+        throw new Error("only a prepared ticket can be quarantined for stale authority");
+    }
+    if (nextRecord.attempt !== currentRecord.attempt
+        || nextRecord.lease_token !== null
+        || !systemActors.has(nextRecord.actor)) {
+        throw new Error("ticket authority quarantine must release ownership to a system actor");
+    }
+    if (current.policy_version !== next.policy_version || current.policy_digest !== next.policy_digest) {
+        throw new Error("ticket authority quarantine cannot rewrite policy history");
+    }
+    if (assertTimestamp(next.lifecycle_updated_at, "quarantine timestamp") <= assertTimestamp(current.lifecycle_updated_at, "current lifecycle timestamp")) {
+        throw new Error("ticket authority quarantine timestamp must advance");
+    }
+    if (next.last_error === null)
+        throw new Error("ticket authority quarantine requires a reason");
+    assertBoundedText(next.last_error, "quarantine reason", 2048);
+    const expected = {
+        ...current,
+        lifecycle_updated_at: next.lifecycle_updated_at,
+        lease_expires_at: null,
+        resume_at: null,
+        resume_state: null,
+        park_reason: null,
+        resume_gate: null,
+        session_id: null,
+        last_error: next.last_error,
+        executor_evidence: null,
+        verification_evidence: null,
+        grade_evidence: null,
+    };
+    if (JSON.stringify(next) !== JSON.stringify(expected)) {
+        throw new Error("ticket authority quarantine changed fields outside its fail-closed projection");
+    }
+    resolveLifecycleEvidence(next, nextRecord, evidenceStore);
+}
+const LEGAL_TICKET_EDGES = {
+    pending: ["pending", "leased", "parked"],
+    leased: ["leased", "running", "retryable", "blocked", "parked"],
+    running: ["running", "verifying", "retryable", "blocked", "parked"],
+    verifying: ["verifying", "completed", "retryable", "blocked", "parked"],
+    retryable: ["retryable", "leased", "parked"],
+    parked: ["parked", "pending", "retryable"],
+    blocked: [],
+    completed: [],
+};
+function validateLifecycleTransition(currentRecord, nextRecord, current, next, systemActors, evidenceStore) {
+    const from = currentRecord.state;
+    const to = nextRecord.state;
+    if (!LEGAL_TICKET_EDGES[from].includes(to))
+        throw new Error(`illegal ticket lifecycle transition: ${from} -> ${to}`);
+    if (current.policy_version !== next.policy_version || current.policy_digest !== next.policy_digest) {
+        throw new Error("ticket policy identity is immutable");
+    }
+    const retryLease = from === "retryable" && to === "leased";
+    const expectedAttempt = retryLease ? currentRecord.attempt + 1 : currentRecord.attempt;
+    if (nextRecord.attempt !== expectedAttempt)
+        throw new Error("ticket lifecycle attempt changed illegally");
+    if (to === "retryable" && isActiveTicketState(from) && currentRecord.attempt >= MAX_QUEUE_ATTEMPTS) {
+        throw new Error("attempt three must become blocked");
+    }
+    const explicitVerificationBlock = from === "verifying" && to === "blocked" && systemActors.has(nextRecord.actor);
+    const systemRecoveryBlock = to === "blocked"
+        && isActiveTicketState(from)
+        && systemActors.has(nextRecord.actor)
+        && next.prior_failure_evidence !== null
+        && !sameNullableEvidenceReference(current.prior_failure_evidence, next.prior_failure_evidence);
+    if (to === "blocked"
+        && isActiveTicketState(from)
+        && currentRecord.attempt < MAX_QUEUE_ATTEMPTS
+        && !explicitVerificationBlock
+        && !systemRecoveryBlock) {
+        throw new Error("attempts one and two must remain retryable");
+    }
+    const acquiringLease = (from === "pending" || from === "retryable") && to === "leased";
+    const parking = to === "parked" && from !== "parked";
+    const failedOrRecovered = isActiveTicketState(from) && (to === "retryable" || to === "blocked");
+    const completing = from === "verifying" && to === "completed";
+    const attachingRetryReflection = from === "retryable"
+        && to === "retryable"
+        && systemActors.has(nextRecord.actor)
+        && current.prior_reflection_evidence === null
+        && next.prior_reflection_evidence !== null
+        && sameNullableEvidenceReference(current.prior_failure_evidence, next.prior_failure_evidence);
+    if (acquiringLease) {
+        if (currentRecord.lease_token !== null || nextRecord.lease_token === null) {
+            throw new Error("ticket lease acquisition requires a new lease token");
+        }
+    }
+    else if (parking) {
+        if (nextRecord.lease_token !== null || !systemActors.has(nextRecord.actor)) {
+            throw new Error("ticket park must release ownership to an allowed system actor");
+        }
+    }
+    else if (failedOrRecovered) {
+        if (nextRecord.lease_token !== null || (nextRecord.actor !== currentRecord.actor && !systemActors.has(nextRecord.actor))) {
+            throw new Error("ticket failure or recovery must release the active lease");
+        }
+    }
+    else if (completing) {
+        if (nextRecord.lease_token !== null || nextRecord.actor !== currentRecord.actor) {
+            throw new Error("ticket completion must release the current worker lease");
+        }
+    }
+    else if (attachingRetryReflection) {
+        if (nextRecord.lease_token !== null)
+            throw new Error("retry reflection cannot acquire a lease");
+    }
+    else if (nextRecord.actor !== currentRecord.actor
+        || nextRecord.lease_token !== currentRecord.lease_token) {
+        throw new Error("ticket lifecycle actor or lease changed illegally");
+    }
+    if (isActiveTicketState(to) && nextRecord.lease_token === null)
+        throw new Error("active ticket transition requires a lease");
+    if (to === "parked") {
+        const expectedResumeState = from === "retryable" ? "retryable" : "pending";
+        if (next.resume_state !== expectedResumeState)
+            throw new Error(`parked ticket must resume to ${expectedResumeState}`);
+    }
+    if (from === "parked" && to !== "parked" && to !== current.resume_state) {
+        throw new Error("parked ticket resumed to a state other than its durable target");
+    }
+    if (JSON.stringify(lifecycleFields(current)) === JSON.stringify(lifecycleFields(next))) {
+        throw new Error("ticket lifecycle transition must update lifecycle fields");
+    }
+    if (assertTimestamp(next.lifecycle_updated_at, "next lifecycle timestamp") <= assertTimestamp(current.lifecycle_updated_at, "current lifecycle timestamp")) {
+        throw new Error("ticket lifecycle timestamp must advance");
+    }
+    validateMonotonicField("verification_plan_ref", current.verification_plan_ref, next.verification_plan_ref);
+    validateMonotonicField("worktree", current.worktree, next.worktree);
+    validateMonotonicField("gate_digest", current.gate_digest, next.gate_digest);
+    const activePark = isActiveTicketState(from) && to === "parked";
+    if (retryLease || activePark) {
+        if (next.executor_evidence !== null || next.verification_evidence !== null || next.grade_evidence !== null) {
+            throw new Error(`ticket ${activePark ? "active park" : "retry lease"} must clear current-attempt evidence`);
+        }
+    }
+    else {
+        validateMonotonicField("executor_evidence", current.executor_evidence, next.executor_evidence);
+        validateMonotonicField("verification_evidence", current.verification_evidence, next.verification_evidence);
+        validateMonotonicField("grade_evidence", current.grade_evidence, next.grade_evidence);
+    }
+    const workerFailedAttempt = failedOrRecovered && nextRecord.actor === currentRecord.actor;
+    const systemRecoveredAttempt = failedOrRecovered
+        && systemActors.has(nextRecord.actor)
+        && nextRecord.actor !== currentRecord.actor
+        && next.prior_failure_evidence !== null
+        && !sameNullableEvidenceReference(current.prior_failure_evidence, next.prior_failure_evidence);
+    if (!workerFailedAttempt && !systemRecoveredAttempt && !attachingRetryReflection && (!sameNullableEvidenceReference(current.prior_failure_evidence, next.prior_failure_evidence)
+        || !sameNullableEvidenceReference(current.prior_reflection_evidence, next.prior_reflection_evidence))) {
+        throw new Error("ticket retry lineage can change only when an active attempt fails");
+    }
+    if ((workerFailedAttempt || systemRecoveredAttempt) && next.prior_failure_evidence === null) {
+        throw new Error("failed ticket attempt requires prior failure evidence");
+    }
+    validateAttachmentPhase("verification_plan_ref", current.verification_plan_ref, next.verification_plan_ref, from, ["pending"]);
+    validateAttachmentPhase("worktree", current.worktree, next.worktree, from, ["pending"]);
+    validateAttachmentPhase("gate_digest", current.gate_digest, next.gate_digest, from, ["pending"]);
+    validateAttachmentPhase("executor_evidence", current.executor_evidence, next.executor_evidence, from, ["running"]);
+    validateAttachmentPhase("verification_evidence", current.verification_evidence, next.verification_evidence, from, ["verifying"]);
+    validateAttachmentPhase("grade_evidence", current.grade_evidence, next.grade_evidence, from, ["verifying"]);
+    const resolved = resolveLifecycleEvidence(next, nextRecord, evidenceStore);
+    if ((workerFailedAttempt || systemRecoveredAttempt) && resolved.priorFailure) {
+        const failedAttempt = priorFailureAttempt(resolved.priorFailure, evidenceStore, nextRecord.record_id);
+        if (failedAttempt !== currentRecord.attempt) {
+            throw new Error("ticket prior failure does not belong to the active failed attempt");
+        }
+    }
+    if (retryLease && resolved.priorFailure) {
+        const failedAttempt = priorFailureAttempt(resolved.priorFailure, evidenceStore, nextRecord.record_id);
+        if (failedAttempt !== nextRecord.attempt - 1) {
+            throw new Error("retry lease lineage does not belong to the immediately prior attempt");
+        }
+    }
+    if (to === "leased" && (next.verification_plan_ref === null || next.worktree === null)) {
+        throw new Error("ticket lease requires a verification plan and worktree");
+    }
+    if (["verifying", "completed"].includes(to) && next.executor_evidence === null) {
+        throw new Error("ticket verification requires executor evidence");
+    }
+    const workerReleasedAttempt = nextRecord.actor === currentRecord.actor;
+    if (from === "running" && ["verifying", "retryable", "blocked"].includes(to) && workerReleasedAttempt && next.executor_evidence === null) {
+        throw new Error(`ticket ${to} transition requires executor evidence`);
+    }
+    if (from === "verifying" && ["completed", "retryable", "blocked"].includes(to) && workerReleasedAttempt && next.verification_evidence === null) {
+        throw new Error(`ticket ${to} transition requires verification evidence`);
+    }
+    if (to === "completed" && (next.verification_evidence === null || next.grade_evidence === null)) {
+        throw new Error("ticket completion requires verification and grade evidence");
+    }
+    if (next.verification_evidence !== null) {
+        if (!resolved.plan || !resolved.verification)
+            throw new Error("verification evidence requires its verification plan");
+        if (resolved.verification.payload.plan_digest !== resolved.plan.payload.digest) {
+            throw new Error("verification evidence plan digest does not match the ticket plan");
+        }
+    }
+}
+function validateStateInvariants(record, payload) {
+    const state = record.state;
+    assertTimestamp(payload.lifecycle_updated_at, "lifecycle timestamp");
+    if (payload.lease_expires_at !== null)
+        assertTimestamp(payload.lease_expires_at, "lease expiry");
+    if (payload.resume_at !== null)
+        assertTimestamp(payload.resume_at, "resume timestamp");
+    if (payload.session_id !== null)
+        assertOpaqueId(payload.session_id, "session id");
+    validateResumeGate(payload.resume_gate);
+    if ((payload.verification_plan_ref === null) !== (payload.worktree === null)) {
+        throw new Error("ticket verification plan and worktree must be prepared together");
+    }
+    if ((payload.verification_plan_ref === null) !== (payload.gate_digest === null)) {
+        throw new Error("ticket verification plan and gate digest must be prepared together");
+    }
+    if (isActiveTicketState(state)) {
+        if (record.lease_token === null || payload.lease_expires_at === null || payload.session_id === null) {
+            throw new Error(`ticket state ${state} requires lease and session ownership`);
+        }
+        if (payload.resume_at !== null || payload.resume_state !== null || payload.park_reason !== null || payload.resume_gate !== null) {
+            throw new Error("active ticket must not retain parked state");
+        }
+    }
+    else if (isIdleTicketState(state)) {
+        if (record.lease_token !== null
+            || payload.lease_expires_at !== null
+            || payload.resume_at !== null
+            || payload.resume_state !== null
+            || payload.park_reason !== null
+            || payload.resume_gate !== null
+            || payload.session_id !== null) {
+            throw new Error("idle ticket must not retain lease, session, or resume state");
+        }
+    }
+    else if (state === "parked") {
+        if (record.lease_token !== null
+            || payload.lease_expires_at !== null
+            || payload.resume_at === null
+            || payload.resume_state === null
+            || payload.park_reason === null
+            || payload.resume_gate === null
+            || payload.session_id !== null) {
+            throw new Error("parked ticket must retain only its resume schedule");
+        }
+    }
+    else if (isTerminalTicketState(state) && (record.lease_token !== null
+        || payload.lease_expires_at !== null
+        || payload.resume_at !== null
+        || payload.resume_state !== null
+        || payload.park_reason !== null
+        || payload.resume_gate !== null
+        || payload.session_id !== null)) {
+        throw new Error("terminal ticket must not retain lease, session, or resume state");
+    }
+}
+function validateResumeGate(value) {
+    if (value === null)
+        return;
+    if (value.kind === "time") {
+        if (value.role_id !== null
+            || value.engine !== null
+            || value.session_id !== null
+            || value.limited_session_version !== null
+            || value.limited_observation_id !== null
+            || value.limited_observed_at !== null) {
+            throw new Error("time resume gate must not carry quota identity");
+        }
+        return;
+    }
+    if (value.kind !== "quota")
+        throw new Error("invalid ticket resume gate kind");
+    if (!ROLE_IDS.includes(value.role_id))
+        throw new Error("invalid quota resume role id");
+    if (value.engine !== "claude" && value.engine !== "codex")
+        throw new Error("invalid quota resume engine");
+    assertOpaqueId(value.session_id, "quota resume session id");
+    if (!Number.isSafeInteger(value.limited_session_version) || value.limited_session_version < 0) {
+        throw new Error("invalid limited quota session version");
+    }
+    if (!/^quota-[a-f0-9]{48}$/.test(value.limited_observation_id)) {
+        throw new Error("invalid limited quota observation id");
+    }
+    assertTimestamp(value.limited_observed_at, "limited quota observation timestamp");
+}
+function validateMonotonicField(label, current, next) {
+    if (current !== null && JSON.stringify(current) !== JSON.stringify(next)) {
+        throw new Error(`${label} is immutable once established`);
+    }
+}
+function validateAttachmentPhase(label, current, next, from, allowedFrom) {
+    if (current === null && next !== null && !allowedFrom.includes(from)) {
+        throw new Error(`${label} cannot be attached during ${from}`);
+    }
+}
+function resolveLifecycleEvidence(payload, record, evidenceStore) {
+    const ticketId = record.record_id;
+    const resolved = {};
+    resolved.plan = resolveEvidence(payload.verification_plan_ref, ["verification-plan"], ticketId, evidenceStore);
+    resolved.executor = resolveEvidence(payload.executor_evidence, ["executor-result", "goal-executor-result"], ticketId, evidenceStore);
+    resolved.verification = resolveEvidence(payload.verification_evidence, ["deterministic-check"], ticketId, evidenceStore);
+    resolved.grade = resolveEvidence(payload.grade_evidence, ["grader-output"], ticketId, evidenceStore);
+    resolved.priorFailure = resolveEvidence(payload.prior_failure_evidence, ["executor-result", "goal-executor-result", "lease-expiry", "deterministic-check", "grader-output"], ticketId, evidenceStore);
+    resolved.priorReflection = resolveEvidence(payload.prior_reflection_evidence, ["reflection"], ticketId, evidenceStore);
+    if (resolved.plan && payload.gate_digest !== resolved.plan.payload.digest) {
+        throw new Error("ticket gate digest does not match its prepared verification plan");
+    }
+    if (resolved.executor)
+        validateAttemptLeaseBinding(resolved.executor, record, "executor");
+    if (resolved.verification)
+        validateAttemptLeaseBinding(resolved.verification, record, "verification");
+    if (resolved.verification && resolved.plan && resolved.verification.payload.plan_digest !== resolved.plan.payload.digest) {
+        throw new Error("verification evidence plan digest does not match the ticket plan");
+    }
+    if (resolved.verification)
+        validateVerificationPolicyBinding(resolved.verification, payload);
+    if (resolved.grade) {
+        if (!resolved.executor)
+            throw new Error("grader evidence requires executor evidence");
+        if (!payload.verification_evidence)
+            throw new Error("grader evidence requires deterministic verification evidence");
+        if (!sameEvidenceReference(resolved.grade.payload.deterministic_evidence, payload.verification_evidence)) {
+            throw new Error("grader evidence is not bound to the ticket deterministic check");
+        }
+        const expectedProducer = resolved.executor.evidence_kind === "executor-result"
+            ? "oms.grader.codex"
+            : "oms.grader.claude";
+        if (resolved.grade.producer_role !== expectedProducer) {
+            throw new Error("cross-engine grader mismatch for executor evidence");
+        }
+    }
+    if (resolved.priorReflection && payload.prior_failure_evidence === null) {
+        throw new Error("ticket prior reflection requires prior failure evidence");
+    }
+    if (resolved.priorReflection && resolved.priorFailure && payload.prior_failure_evidence) {
+        const reflectedFailure = resolved.priorReflection.payload.failure_evidence;
+        if (!sameEvidenceReference(reflectedFailure, payload.prior_failure_evidence)) {
+            throw new Error("ticket prior reflection does not reference the exact prior failure");
+        }
+        const failureAttempt = priorFailureAttempt(resolved.priorFailure, evidenceStore, ticketId);
+        if (resolved.priorReflection.payload.attempt !== failureAttempt) {
+            throw new Error("ticket prior reflection attempt does not match the prior failure");
+        }
+    }
+    return resolved;
+}
+function priorFailureAttempt(failure, evidenceStore, ticketId) {
+    if (failure.evidence_kind !== "grader-output")
+        return failure.payload.attempt;
+    if (!evidenceStore)
+        throw new Error("grader failure lineage requires the ticket evidence store");
+    const deterministic = resolveEvidence(failure.payload.deterministic_evidence, ["deterministic-check"], ticketId, evidenceStore);
+    if (!deterministic)
+        throw new Error("grader failure lineage lacks deterministic evidence");
+    return deterministic.payload.attempt;
+}
+function activeAttemptStartCommit(record, evidenceStore) {
+    const worktree = record.payload.worktree;
+    if (worktree === null)
+        throw new Error("active ticket lacks its worktree authority");
+    if (record.attempt === 1)
+        return worktree.base_commit;
+    const reference = record.payload.prior_failure_evidence;
+    if (reference === null)
+        throw new Error("retry attempt lacks prior failure authority");
+    const failure = evidenceStore.read(reference);
+    let commit;
+    if (failure.evidence_kind === "executor-result" || failure.evidence_kind === "goal-executor-result") {
+        commit = failure.payload.worktree_commit;
+    }
+    else if (failure.evidence_kind === "lease-expiry") {
+        commit = failure.payload.worktree_start_commit;
+    }
+    else {
+        const deterministicReference = failure.evidence_kind === "deterministic-check"
+            ? reference
+            : failure.evidence_kind === "grader-output"
+                ? failure.payload.deterministic_evidence
+                : null;
+        if (deterministicReference === null)
+            throw new Error("retry failure cannot establish its active worktree start");
+        const deterministic = evidenceStore.read(deterministicReference);
+        const binding = deterministic.payload.binding;
+        commit = isRecord(binding) ? binding.expected_commit : null;
+    }
+    if (typeof commit !== "string" || !COMMIT_PATTERN.test(commit)) {
+        throw new Error("retry attempt lacks a trusted worktree start commit");
+    }
+    return commit;
+}
+function validateAttemptLeaseBinding(evidence, record, label) {
+    if (evidence.payload.attempt !== record.attempt) {
+        throw new Error(`${label} evidence attempt does not match the ticket attempt`);
+    }
+    const leaseToken = authoritativeLeaseToken(record);
+    if (evidence.payload.lease_token !== leaseToken) {
+        throw new Error(`${label} evidence lease token does not match the ticket attempt lease`);
+    }
+}
+function authoritativeLeaseToken(record) {
+    for (let index = record.transition_outcomes.length - 1; index >= 0; index -= 1) {
+        const outcome = record.transition_outcomes[index];
+        if (outcome?.attempt === record.attempt && outcome.state === "leased" && outcome.lease_token !== null) {
+            return outcome.lease_token;
+        }
+    }
+    throw new Error(`ticket attempt ${record.attempt} has no authoritative lease token`);
+}
+function resolveEvidence(reference, expectedKinds, ticketId, evidenceStore) {
+    if (reference === null)
+        return undefined;
+    if (!evidenceStore)
+        throw new Error("ticket evidence store is required before attaching lifecycle references");
+    assertEvidenceStore(evidenceStore);
+    const evidence = evidenceStore.read(reference);
+    if (!expectedKinds.includes(evidence.evidence_kind)) {
+        throw new Error(`ticket evidence has wrong kind: expected ${expectedKinds.join(" or ")}`);
+    }
+    if (evidence.ticket_id !== ticketId)
+        throw new Error("ticket evidence belongs to a different ticket");
+    return evidence;
+}
+function retryFailureRequiresReflection(record, evidenceStore) {
+    const reference = record.payload.prior_failure_evidence;
+    if (reference === null || evidenceStore === undefined)
+        return false;
+    const evidence = evidenceStore.read(reference);
+    return evidence.evidence_kind === "deterministic-check" || evidence.evidence_kind === "grader-output";
+}
+function executorSucceeded(evidence) {
+    return evidence.evidence_kind === "executor-result"
+        ? evidence.payload.status === "done"
+        : evidence.payload.status === "complete";
+}
+function validateVerificationPolicyBinding(evidence, payload) {
+    if (evidence.payload.policy_version !== payload.policy_version
+        || evidence.payload.policy_digest !== payload.policy_digest
+        || evidence.payload.plan_digest !== payload.gate_digest) {
+        throw new Error("deterministic verification evidence does not match the ticket policy identity");
+    }
+}
+function sameEvidenceReference(left, right) {
+    return left.evidence_id === right.evidence_id && left.sha256 === right.sha256 && left.file_name === right.file_name;
+}
+function sameNullableEvidenceReference(left, right) {
+    return left === null ? right === null : right !== null && sameEvidenceReference(left, right);
+}
+function validateTicketContent(value, schema) {
+    assertSchema(value, schema, "ticket content");
+    const content = value;
+    assertTicketRecordId(content.ticket_id);
+    timestampEpoch(content.updated_at, "ticket content timestamp");
+    if (content.source === "github") {
+        if (content.repository === null || content.issue_node_id === null || content.url === null) {
+            throw new Error("GitHub ticket content is missing source metadata");
+        }
+        assertGitHubRepository(content.repository);
+        const identity = deriveGitHubTicketIdentity({ issue_node_id: content.issue_node_id });
+        if (identity.ticket_id !== content.ticket_id)
+            throw new Error("GitHub ticket content has the wrong ticket id");
+    }
+    else if (content.repository !== null || content.issue_node_id !== null) {
+        throw new Error("local ticket content must not contain GitHub source metadata");
+    }
+    return content;
+}
+function validateTicketQueuePayload(value, schema) {
+    assertSchema(value, schema, "ticket queue payload");
+    const payload = value;
+    assertTicketRecordId(payload.ticket_id);
+    validateSha256(payload.source_ref_sha256, "queue source digest");
+    validateSha256(payload.content_sha256, "queue content digest");
+    timestampEpoch(payload.source_updated_at, "queue source timestamp");
+    validatePolicyIdentity(payload, "ticket queue policy identity");
+    if (payload.gate_digest !== null)
+        validateSha256(payload.gate_digest, "ticket gate digest");
+    if (payload.content_file !== `${payload.ticket_id}.${payload.content_sha256}.json`) {
+        throw new Error("ticket queue content filename does not match its id and digest");
+    }
+    validateEvidenceRef(payload.verification_plan_ref, "verification plan reference");
+    validateEvidenceRef(payload.executor_evidence, "executor evidence reference");
+    validateEvidenceRef(payload.verification_evidence, "verification evidence reference");
+    validateEvidenceRef(payload.grade_evidence, "grade evidence reference");
+    if (payload.worktree !== null) {
+        if (!isSafeBranch(payload.worktree.branch))
+            throw new Error("invalid ticket worktree branch");
+        if (!COMMIT_PATTERN.test(payload.worktree.base_commit))
+            throw new Error("invalid ticket worktree base commit");
+    }
+    const seenNonces = new Set();
+    let previousVersion = -1;
+    for (const outcome of payload.sync_outcomes) {
+        assertTransitionNonce(outcome.nonce, "ticket sync nonce");
+        validateSha256(outcome.operation_sha256, "ticket sync operation fingerprint");
+        if (outcome.nonce !== `sync-${outcome.operation_sha256.slice(0, 59)}`) {
+            throw new Error("ticket sync nonce does not match its operation fingerprint");
+        }
+        validateSha256(outcome.content_sha256, "ticket sync content digest");
+        if (outcome.content_file !== `${payload.ticket_id}.${outcome.content_sha256}.json`) {
+            throw new Error("ticket sync outcome content filename is invalid");
+        }
+        if (!Number.isSafeInteger(outcome.record_version) || outcome.record_version < 0 || outcome.record_version <= previousVersion) {
+            throw new Error("ticket sync outcome versions must increase");
+        }
+        if (seenNonces.has(outcome.nonce))
+            throw new Error("ticket sync outcome nonces must be unique");
+        seenNonces.add(outcome.nonce);
+        previousVersion = outcome.record_version;
+    }
+    return payload;
+}
+function validateEvidenceRef(ref, label) {
+    if (ref === null)
+        return;
+    const evidenceId = assertOpaqueId(ref.evidence_id, label);
+    validateSha256(ref.sha256, label);
+    if (ref.file_name !== `${evidenceId}.json`)
+        throw new Error(`invalid ${label} filename`);
+}
+function sourceRefForContent(content) {
+    if (content.source === "github") {
+        if (content.issue_node_id === null)
+            throw new Error("GitHub source metadata is missing");
+        return deriveGitHubTicketIdentity({ issue_node_id: content.issue_node_id }).source_ref_sha256;
+    }
+    return sha256(Buffer.from(`local\0${content.ticket_id}`, "utf8"));
+}
+function validateTicketRef(ref) {
+    const ticketId = assertTicketRecordId(ref.ticket_id);
+    validateSha256(ref.sha256, "ticket content digest");
+    const expected = `${ticketId}.${ref.sha256}.json`;
+    if (ref.file_name !== expected)
+        throw new Error("ticket content filename does not match its id and digest");
+}
+function assertTicketRecordId(value) {
+    const ticketId = assertRecordId(value, "ticket id");
+    recordLockId(ticketId);
+    assertLockId(`sync-${ticketId}`);
+    return ticketId;
+}
+function assertGitHubRepository(value) {
+    if (typeof value !== "string" || value.length > 201)
+        throw new Error("invalid GitHub repository");
+    const segments = value.split("/");
+    const owner = segments[0];
+    const name = segments[1];
+    if (segments.length !== 2
+        || !owner
+        || !name
+        || !/^[A-Za-z0-9][A-Za-z0-9-]{0,38}$/.test(owner)
+        || !/^[A-Za-z0-9._-]{1,100}$/.test(name)
+        || name === "."
+        || name === "..") {
+        throw new Error("invalid GitHub repository");
+    }
+    return value;
+}
+function assertGitHubNodeId(value) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9_=-]{1,512}$/.test(value))
+        throw new Error("invalid GitHub issue node id");
+    return value;
+}
+function normalizeLabels(value) {
+    if (!Array.isArray(value) || value.length > 100)
+        throw new Error("invalid ticket labels");
+    const labels = new Set();
+    for (const label of value) {
+        if (typeof label !== "string" || label.length < 1 || label.length > 100)
+            throw new Error("invalid ticket label");
+        labels.add(label);
+    }
+    return [...labels].sort();
+}
+function validateSha256(value, label) {
+    if (!SHA256_PATTERN.test(value))
+        throw new Error(`invalid ${label}`);
+}
+function validatePolicyIdentity(value, label) {
+    if (typeof value !== "object" || value === null)
+        throw new Error(`invalid ${label}`);
+    const candidate = value;
+    if (!Number.isSafeInteger(candidate.policy_version) || candidate.policy_version < 1) {
+        throw new Error(`invalid ${label} policy_version`);
+    }
+    if (typeof candidate.policy_digest !== "string")
+        throw new Error(`invalid ${label} policy_digest`);
+    validateSha256(candidate.policy_digest, `${label} policy_digest`);
+    return {
+        policy_version: candidate.policy_version,
+        policy_digest: candidate.policy_digest,
+    };
+}
+function policyIdentityFromPayload(payload) {
+    return validatePolicyIdentity(payload, "stored ticket policy identity");
+}
+function timestampEpoch(value, label) {
+    if (typeof value !== "string")
+        throw new Error(`invalid ${label}`);
+    const match = TIMESTAMP_PATTERN.exec(value);
+    if (!match)
+        throw new Error(`invalid ${label}`);
+    const [, yearRaw, monthRaw, dayRaw, hourRaw, minuteRaw, secondRaw, fractionRaw = ""] = match;
+    const year = Number(yearRaw);
+    const month = Number(monthRaw);
+    const day = Number(dayRaw);
+    const hour = Number(hourRaw);
+    const minute = Number(minuteRaw);
+    const second = Number(secondRaw);
+    const millisecond = Number(fractionRaw.padEnd(3, "0").slice(0, 3));
+    const date = new Date(Date.UTC(year, month - 1, day, hour, minute, second, millisecond));
+    if (date.getUTCFullYear() !== year
+        || date.getUTCMonth() !== month - 1
+        || date.getUTCDate() !== day
+        || date.getUTCHours() !== hour
+        || date.getUTCMinutes() !== minute
+        || date.getUTCSeconds() !== second) {
+        throw new Error(`invalid ${label}`);
+    }
+    return date.getTime();
+}
+function sameSourceMetadata(left, right) {
+    return [
+        "ticket_id",
+        "source",
+        "source_ref_sha256",
+        "content_sha256",
+        "content_file",
+        "source_updated_at",
+        "ready_intent",
+    ].every((field) => JSON.stringify(left[field]) === JSON.stringify(right[field]));
+}
+function sameLifecycleFields(left, right) {
+    return [
+        "policy_version",
+        "policy_digest",
+        "gate_digest",
+        "lifecycle_updated_at",
+        "lease_expires_at",
+        "resume_at",
+        "resume_state",
+        "park_reason",
+        "resume_gate",
+        "session_id",
+        "last_error",
+        "verification_plan_ref",
+        "worktree",
+        "executor_evidence",
+        "verification_evidence",
+        "grade_evidence",
+        "merge_disposition",
+    ].every((field) => JSON.stringify(left[field]) === JSON.stringify(right[field]));
+}
+function lifecycleFields(payload) {
+    return {
+        lifecycle_updated_at: payload.lifecycle_updated_at,
+        lease_expires_at: payload.lease_expires_at,
+        resume_at: payload.resume_at,
+        resume_state: payload.resume_state,
+        park_reason: payload.park_reason,
+        resume_gate: payload.resume_gate,
+        session_id: payload.session_id,
+        last_error: payload.last_error,
+    };
+}
+function isSafeBranch(value) {
+    return typeof value === "string"
+        && /^[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$/.test(value)
+        && !value.includes("..")
+        && !value.includes("//")
+        && !value.includes("@{")
+        && !value.endsWith("/")
+        && !value.endsWith(".")
+        && !value.endsWith(".lock");
+}
+function canonicalJson(value) {
+    return Buffer.from(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+function freezeSyncTicketResult(result) {
+    return freezeJsonSnapshot(result);
+}
+function freezeJsonSnapshot(value) {
+    return deepFreeze(structuredClone(value));
+}
+function deepFreeze(value, seen = new Set()) {
+    if (typeof value !== "object" || value === null || seen.has(value))
+        return value;
+    seen.add(value);
+    for (const child of Object.values(value))
+        deepFreeze(child, seen);
+    return Object.freeze(value);
+}
+function parseJson(bytes, label) {
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch (error) {
+        throw new Error(`invalid JSON in ${label}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+//# sourceMappingURL=store.js.map