omc-core 0.4.36 → 0.4.38

package/dist/ticket10-test-field-publish.js

@@ -1,886 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { canonicalCloudPivotBaselineFingerprint, canonicalCloudPivotEnvironmentFingerprint } from "./cloudpivot-fingerprints.js";
-import { canonicalFormalDiscoveryFingerprint } from "./formal-capability-discovery.js";
-import { CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH } from "./cloudpivot-low-code.js";
-import { compileNativeOperations, runNativeConfigurationPackage } from "./cloudpivot-native-configuration.js";
-import { buildKnowledgePack } from "./knowledge-pack-builder.js";
-import { KnowledgePackRuntime } from "./knowledge-pack-runtime.js";
-import { createDeliveryPlanApproval, deliveryPlanApprovalHash, proposeDeliveryPlan } from "./two-stage-change-package.js";
-import { validateConfigurationIntent } from "./configuration-intent.js";
-import { SENSITIVE_SECRET_VALUE } from "./delivery-graph.js";
-import { appendApprovalHumanBlock } from "./approval-frame-readability.js";
-import { activeFieldFamily, fieldFamilyMemberNamesProse } from "./families/registry.js";
-import { isTicket08TargetSchema } from "./ticket08-test-model-mutation.js";
-import { isTicket09TargetField, ticket09TargetFieldCodes, TICKET09_FIELD_FAMILY, TICKET09_FIELD_MUTATION_ROUTE } from "./ticket09-test-field-mutation.js";
-/**
- * Ticket 10 (usable-model ladder, rung 2) — AMENDED IN PLACE (Ticket 19,
- * numeric-logical family rung): the model-scoped publish now publishes the
- * run's own registered draft fixture family fields in ONE
- * model-level publication (the SchemaPublishedVO wire payload is
- * model-scoped and unchanged); the preflight, readback gates, and behavior
- * checks are per family field. Cleanup probes force_delete per owned
- * published family field. The route and capability ids are unchanged. The composite chain runs the executable
- * Ticket 08 model-create and Ticket 09 field-create capabilities first; the
- * publish package consumes the completed, behavior-validated field-create
- * execution report plus a fresh authoritative two-state readback (draft
- * present, published absent) and is itself an independently immutable,
- * independently dual-approved package. No evidence is inferred from the
- * field-create capability; form draft/publish, app publish, Environment
- * release, production, staging, tenant administration, Redis, restart,
- * deployment, and runtime CRUD stay rejected.
- *
- * Authoritative 8.6.26 contract (decompiled engine + live probe ledger):
- * - publish is POST /api/api/app/bizproperty/publish with the exact
- *   `SchemaPublishedVO` DTO {bizSchemaCode, sendMessage:false}, errcode=0,
- *   guarded by @RequireAdmin (BizPropertyController.java:1130-1167,
- *   SchemaPublishedVO.java:9-31); the controller calls publishBizSchema and
- *   logs EDIT_AND_PUBLISH_DATA_MODEL — a model-level data-item publication,
- *   never an app publish, form publish, or Environment release;
- * - after publication the field is visible in BOTH the isPublish=false and
- *   isPublish=true readback states (probe ledger); "published" means the
- *   runtime-visible state, not a flag;
- * - the ledger warns "字段发布后表单可能仍未更新": model, field, and form are
- *   not one transaction, so form consistency lag is recorded as an explicit
- *   partial state rather than assumed cascade consistency;
- * - cleanup is stated explicitly per the spec: the owned published field is
- *   the force_delete probe (the decompiled forceDelete passes the published
- *   flag to removeBizPropertyByCode, BizPropertyController.java:1532-1565).
- *   If the server accepts it, cleanup stays staged (field force_delete +
- *   two-state exact absence readback, then the model physical delete). If
- *   published-field deletion semantics differ, this rung's cleanup is the
- *   model physical delete cascade plus field-level two-state absence
- *   confirmation — written down, never silently assumed.
- */
-export const TICKET10_FIELD_PUBLISH_ROUTE = "ticket10-test-field-publish";
-export const TICKET10_FIELD_CLEANUP_ROUTE = "ticket10-test-field-cleanup";
-export const TICKET10_FIELD_PUBLISH_CAPABILITY_ID = "cloudpivot.test.field-publish-8.6.26";
-export const TICKET10_FIELD_CLEANUP_CAPABILITY_ID = "cloudpivot.test.field-publish-cleanup-8.6.26";
-export const TICKET10_FIELD_PUBLISH_KNOWLEDGE_PACK_ID = "cloudpivot-8.6-ticket10-test-field-publish";
-export const TICKET10_TEST_ENVIRONMENT_NAME = "test";
-export const TICKET10_TEST_APPLICATION_CODE = "test";
-export const TICKET10_REFERENCE_EVIDENCE_VERSION = "8.6.26";
-export const TICKET10_FIELD_PUBLISH_ENDPOINT = "/api/api/app/bizproperty/publish";
-export const TICKET10_FIELD_READBACK_ENDPOINT = "/api/api/app/bizproperty/list";
-export const TICKET10_FIELD_CLEANUP_ENDPOINT = "/api/api/app/bizproperty/force_delete";
-export const TICKET10_PROHIBITED_MUTATION_TERMS = Object.freeze([
-    "app-publish", "form", "deploy", "restart", "release", "redis", "tenant-admin", "runtime-crud",
-    "model:", "view", "folder-create", "folder-delete",
-]);
-const TICKET10_UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-const SHA256 = /^[a-f0-9]{64}$/i;
-/** The named `test` environment and its dedicated test application are hard preconditions. */
-export function assertTicket10TestFieldPublishEnvironment(settings) {
-    if (settings.environmentName !== "test")
-        throw new Error("Ticket 10 field publish is restricted to the named test environment; production and staging are rejected.");
-    if (!settings.baseUrl.trim() || !/^https?:\/\/\S+$/i.test(settings.baseUrl.trim()))
-        throw new Error("Ticket 10 field publish requires an absolute configured test environment endpoint.");
-    if (settings.testApplicationCode !== "test")
-        throw new Error("Ticket 10 field publish requires the dedicated test application to be test.");
-}
-export function ticket10DeliveryId(testRunId) { return `ticket10-field-publish-${testRunId}`; }
-export function ticket10FieldCleanupDeliveryId(testRunId) { return `ticket10-field-cleanup-${testRunId}`; }
-export function ticket10FieldPublishScope(targetSchemaCode, familyFieldCodesKey) { return `cloudpivot:fields:${targetSchemaCode}/${familyFieldCodesKey}`; }
-export function ticket10FieldCleanupScope(targetSchemaCode, targetFieldCode) { return `cloudpivot:field:${targetSchemaCode}/${targetFieldCode}`; }
-/** Design-time designer direct URL; the fixture stays inspectable here regardless of publication state. */
-export function ticket10DesignerDirectUrl(targetSchemaCode) { return `/admin/#/apps/model/${TICKET10_TEST_APPLICATION_CODE}/${targetSchemaCode}/`; }
-export function buildTicket10FieldCleanupContract(testRunId, targetSchemaCode, targetFieldCodes) {
-    if (!TICKET10_UUID_V4.test(testRunId) || !isTicket08TargetSchema(targetSchemaCode) || targetFieldCodes.length !== TICKET09_FIELD_FAMILY.length || targetFieldCodes.some((code) => !isTicket09TargetField(code)) || new Set(targetFieldCodes).size !== TICKET09_FIELD_FAMILY.length)
-        throw new Error("Ticket 10 field cleanup contract requires the exact host-owned testRunId, fixture schema, and one distinct family field code per active family member.");
-    return Object.freeze({
-        capabilityId: TICKET10_FIELD_CLEANUP_CAPABILITY_ID,
-        testRunId,
-        targetSchemaCode,
-        targetFieldCodes,
-        probe: { method: "POST", endpoint: TICKET10_FIELD_CLEANUP_ENDPOINT, payload: "query:bizSchemaCode+bizPropertyCode-per-family-field", evidence: "decompiled forceDelete passes the published flag to removeBizPropertyByCode (BizPropertyController.java:1532-1565); each owned published family field is the probe, disambiguated by authoritative two-state readback" },
-        postDeleteAbsenceReadback: { method: "GET", endpoint: TICKET10_FIELD_READBACK_ENDPOINT, expected: "two-state-exact-absence" },
-        variants: {
-            forceDeleteSupported: "published-field-force-delete: field force_delete plus two-state exact absence readback, then the separately approved model physical delete with model absence readback",
-            forceDeleteRejected: "model-cascade-plus-field-absence-confirmation: stop the field-level delete (retain, no retry); the separately approved model physical delete cascades, then field-level two-state exact absence confirmation closes the contract",
-        },
-        ownership: "field-code-schema-and-published-state-bound-to-testRunId",
-        replayPolicy: "absent-is-no-op",
-        uncertainPolicy: "stop-retain-report-no-retry",
-    });
-}
-/** Deterministic, run-independent contract identities pinned by the Knowledge Pack promotion. */
-export function ticket10FieldPublishContractHash() { return digest(ticket10FieldPublishContract()); }
-export function ticket10FieldCleanupContractHash() { return digest(ticket10FieldCleanupContractTemplate()); }
-function ticket10FieldPublishContract() {
-    return {
-        capabilityId: TICKET10_FIELD_PUBLISH_CAPABILITY_ID,
-        operationKind: "field-publish",
-        method: "POST",
-        endpoint: CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH.endpoint,
-        readbackEndpoint: CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH.readbackEndpoint,
-        preflight: CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH.preflight,
-        dto: "SchemaPublishedVO:bizSchemaCode,sendMessage",
-        sendMessage: false,
-        scope: "model-scoped-field-publish",
-        permission: "@RequireAdmin",
-        readbackStates: ["isPublish=false:present", "isPublish=true:present"],
-        publishedFlagDecode: "published===true-in-published-state",
-        auditSurface: "server-side operation log LogOperationActionType.EDIT_AND_PUBLISH_DATA_MODEL recorded by the publish endpoint (BizPropertyController.java:1156-1162); no separate audit read API is evidenced",
-        formConsistency: "model/field/form-are-not-one-transaction;form-lag-recorded-as-explicit-partial-state",
-        transportMode: "serialized-server-field-publish-8.6.26",
-        capability: CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH,
-        evidence: [...CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH.evidence],
-        requiredPermissions: ["configuration-write"],
-        prohibited: [...TICKET10_PROHIBITED_MUTATION_TERMS],
-    };
-}
-function ticket10FieldCleanupContractTemplate() {
-    return {
-        capabilityId: TICKET10_FIELD_CLEANUP_CAPABILITY_ID,
-        operationKind: "owned-published-field-force-delete-probe",
-        method: "POST",
-        endpoint: TICKET10_FIELD_CLEANUP_ENDPOINT,
-        payload: "query:bizSchemaCode+bizPropertyCode-per-family-field",
-        postDeleteAbsenceReadback: `${TICKET10_FIELD_READBACK_ENDPOINT}?isPublish=false+isPublish=true:two-state-exact-absence-per-family-field`,
-        variants: ["published-field-force-delete", "model-cascade-plus-field-absence-confirmation"],
-        ownership: "field-code-schema-and-published-state-bound-to-testRunId",
-        replayPolicy: "absent-is-no-op",
-        uncertainPolicy: "stop-retain-report-no-retry",
-    };
-}
-/** Publish packages are exactly ONE model-scoped publication binding both family field codes; cleanup packages are exactly the two per-field published-field force-delete probes. */
-export function assertTicket10OperationsBounded(input) {
-    const familyKey = input.targetFieldCodes.join("+");
-    const expectedCount = input.route === TICKET10_FIELD_PUBLISH_ROUTE ? 1 : TICKET09_FIELD_FAMILY.length;
-    if (input.operations.length !== expectedCount)
-        throw new Error(`Ticket 10 ${input.route} packages must contain exactly ${expectedCount} bounded operation(s).`);
-    input.operations.forEach((operation, index) => {
-        const identity = `${operation.id} ${operation.target} ${operation.path}`.toLowerCase();
-        const expectedPrefix = input.route === TICKET10_FIELD_PUBLISH_ROUTE ? "field-publish:" : "cleanup:published-field:";
-        if (TICKET10_PROHIBITED_MUTATION_TERMS.some((term) => identity.includes(term)) || !operation.id.startsWith(expectedPrefix))
-            throw new Error(`Ticket 10 operation ${operation.id} is outside the bounded operation set; prohibited families (app publish, form writes, deploy, restart, release, redis, tenant administration, runtime CRUD, model/view/folder writes) remain rejected.`);
-        const expected = input.route === TICKET10_FIELD_PUBLISH_ROUTE
-            ? { id: `field-publish:${input.targetSchemaCode}/${familyKey}`, target: `fields:${input.targetSchemaCode}/${familyKey}`, path: TICKET10_FIELD_PUBLISH_ENDPOINT, transportMode: "serialized-server-field-publish-8.6.26" }
-            : { id: `cleanup:published-field:${input.targetSchemaCode}/${input.targetFieldCodes[index]}`, target: `field:${input.targetSchemaCode}/${input.targetFieldCodes[index]}`, path: TICKET10_FIELD_CLEANUP_ENDPOINT, transportMode: "cloudpivot-published-field-force-delete-8.6.26" };
-        if (operation.id !== expected.id || operation.path !== expected.path || operation.transportMode !== expected.transportMode || operation.target !== expected.target)
-            throw new Error(`Ticket 10 operation ${operation.id} does not match the exact target binding for ${expected.target}.`);
-    });
-}
-/** Builds the signed, version-bound pack promoting exactly the single test field-publish capability. */
-export function buildTicket10FieldPublishKnowledgePack(input) {
-    const compiler = { id: "src/ticket10-test-field-publish.ts:createTicket10FieldPublishPlanApproval", sha256: digest("omc-ticket10-compiler-v1") };
-    const decoder = { id: "src/dsh-host-plugin.ts:createCloudPivotWriteTransport", sha256: digest("omc-ticket10-decoder-v1") };
-    return buildKnowledgePack({
-        packId: TICKET10_FIELD_PUBLISH_KNOWLEDGE_PACK_ID,
-        packVersion: "1.0.0",
-        sourceVersion: TICKET10_REFERENCE_EVIDENCE_VERSION,
-        sourceArtifacts: [{ id: "cloudpivot-8.6.26-serialized-field-publish-capability", sha256: digest(CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH) }],
-        references: [
-            { id: "yunshu-probe-ledger-field-publish-two-state-readback", sha256: digest("yunshu-probe-ledger-field-publish") },
-            { id: TICKET10_FIELD_PUBLISH_ENDPOINT, sha256: digest(TICKET10_FIELD_PUBLISH_ENDPOINT) },
-            { id: TICKET10_FIELD_READBACK_ENDPOINT, sha256: digest(TICKET10_FIELD_READBACK_ENDPOINT) },
-            { id: TICKET10_FIELD_CLEANUP_ENDPOINT, sha256: digest(TICKET10_FIELD_CLEANUP_ENDPOINT) },
-        ],
-        compilers: [compiler],
-        decoders: [decoder],
-        capabilities: [{
-                id: TICKET10_FIELD_PUBLISH_CAPABILITY_ID,
-                status: "runtime-verified",
-                promote: true,
-                compilerRef: compiler.id,
-                decoderRef: decoder.id,
-                sourceEvidence: [...CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH.evidence, TICKET10_FIELD_PUBLISH_ENDPOINT, TICKET10_FIELD_READBACK_ENDPOINT, "BizPropertyController.java:1130-1167", "SchemaPublishedVO.java:9-31", "BizPropertyController.java:1532-1565"],
-                runtimeEvidence: ["yunshu-probe-ledger-field-publish-two-state-readback", "cloudpivot.field-publish.serialized-server-8.6.26"],
-                operationPromotions: [{
-                        id: "field-publish",
-                        status: "promoted",
-                        operationContractHash: ticket10FieldPublishContractHash(),
-                        sourceRefs: [...CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH.evidence, TICKET10_FIELD_PUBLISH_ENDPOINT, TICKET10_FIELD_READBACK_ENDPOINT, TICKET10_FIELD_CLEANUP_ENDPOINT],
-                        versionFamily: "8.6",
-                        referenceVersion: TICKET10_REFERENCE_EVIDENCE_VERSION,
-                        requiredEvidence: ["cleanup", "discovery", "permission", "readback", "test", "write"],
-                        evidence: ["cleanup", "discovery", "permission", "readback", "test", "write"],
-                        blockedReasons: [],
-                    }],
-            }],
-        signerKeyId: input.signerKeyId,
-        signingKey: input.signingKey,
-        createdAt: input.createdAt,
-    });
-}
-/** Loads the pack against CloudPivot 8.6.26 and pins the single executable capability and contract hash. */
-export function loadTicket10KnowledgePack(artifact, trustedKeys) {
-    const runtime = new KnowledgePackRuntime(trustedKeys);
-    const load = runtime.load(artifact, TICKET10_REFERENCE_EVIDENCE_VERSION);
-    if (!load.accepted)
-        throw new Error(`Ticket 10 Knowledge Pack is not authoritative: ${load.blockingReasons.join(", ")}.`);
-    const active = runtime.active();
-    const capabilities = active.capabilities;
-    if (capabilities.length !== 1 || capabilities[0].id !== TICKET10_FIELD_PUBLISH_CAPABILITY_ID)
-        throw new Error("Ticket 10 Knowledge Pack must promote exactly the single test field-publish capability; evidence inference from field-create or to any other capability is rejected.");
-    const hashes = capabilities[0].operationContractHashes;
-    if (hashes.length !== 1 || hashes[0] !== ticket10FieldPublishContractHash())
-        throw new Error("Ticket 10 Knowledge Pack operation contract hash does not match the canonical field-publish contract.");
-    return { runtime, packId: active.manifest.packId, contentDigest: active.manifest.contentSha256, executableCapabilities: capabilities.map(({ id }) => id) };
-}
-/** The "+''-joined family field-code key carried by the publish operation id and scope. */
-export function ticket10FamilyFieldKey(evidence) { return evidence.targetFieldCodes.join("+"); }
-/** Host-owned composite-chain evidence capture: consumes the completed family field-create handoff and proves BOTH draft family fields are present and still unpublished. */
-export function captureTicket10FieldPublishEvidence(input) {
-    assertTicket10TestFieldPublishEnvironment(input.settings);
-    if (!TICKET10_UUID_V4.test(input.testRunId))
-        throw new Error("Ticket 10 evidence capture requires the run's host-owned UUID v4 testRunId.");
-    const handoff = input.handoff;
-    const report = handoff.fieldCreateExecutionReport;
-    const fieldCreateEvidence = handoff.fieldCreateEvidence;
-    if (!handoff.fieldCreatePackageId || !SHA256.test(handoff.fieldCreatePackageHash) || !/[1-9a-f]/i.test(handoff.fieldCreatePackageHash) || report.route !== TICKET09_FIELD_MUTATION_ROUTE || report.status !== "completed" || report.mutationExecuted !== true || report.behavior?.status !== "validated")
-        throw new Error("Ticket 10 field publish requires the completed, behavior-validated field-create handoff; serial writes never assume state.");
-    if (report.testRunId !== input.testRunId || fieldCreateEvidence.testRunId !== input.testRunId)
-        throw new Error("Ticket 10 composite chain requires the single run testRunId across the model, field, and publish packages.");
-    const targetSchemaCode = fieldCreateEvidence.targetSchemaCode;
-    const targetFieldCodes = ticket09TargetFieldCodes(fieldCreateEvidence);
-    if (!isTicket08TargetSchema(targetSchemaCode) || report.targetSchemaCode !== targetSchemaCode || report.targetFields.length !== targetFieldCodes.length || report.targetFields.some((field, index) => field.targetFieldCode !== targetFieldCodes[index]))
-        throw new Error("Ticket 10 fixture family field identity diverges from the completed field-create handoff.");
-    const modelPresence = input.modelPresence;
-    if (modelPresence.classification !== "present" || modelPresence.query.schemaCode !== targetSchemaCode)
-        throw new Error("Ticket 10 field publish requires the fixture model to be present in fresh authoritative readback.");
-    targetFieldCodes.forEach((targetFieldCode, index) => {
-        const member = TICKET09_FIELD_FAMILY[index];
-        const draftPresence = input.draftPresence[index];
-        if (draftPresence.classification !== "present" || draftPresence.reason !== "exact-presence" || draftPresence.query.schemaCode !== targetSchemaCode || draftPresence.query.propertyCode !== targetFieldCode || draftPresence.query.isPublish !== "false")
-            throw new Error(`Ticket 10 evidence capture requires exact authenticated draft presence for the ${member.propertyTypeName} handoff field.`);
-        if (!draftPresence.field || draftPresence.field.code !== targetFieldCode || draftPresence.field.schemaCode !== targetSchemaCode || draftPresence.field.published === true)
-            throw new Error(`Ticket 10 evidence capture requires the ${member.propertyTypeName} field to still be an unpublished draft before publication.`);
-        const publishedAbsence = input.publishedAbsence[index];
-        if (publishedAbsence.classification !== "absent" || publishedAbsence.reason !== "exact-absence" || publishedAbsence.query.schemaCode !== targetSchemaCode || publishedAbsence.query.propertyCode !== targetFieldCode || publishedAbsence.query.isPublish !== "true")
-            throw new Error(`Ticket 10 evidence capture requires exact authenticated published-state absence for the ${member.propertyTypeName} handoff field; duplicate publication is rejected.`);
-    });
-    const authoritativeOrigin = input.discovery.authoritativeOrigin;
-    const enterpriseId = input.discovery.enterpriseId;
-    if (!authoritativeOrigin || !enterpriseId)
-        throw new Error("Ticket 10 evidence capture requires authenticated environment fingerprint evidence.");
-    const environmentFingerprint = canonicalCloudPivotEnvironmentFingerprint({ environment: TICKET10_TEST_ENVIRONMENT_NAME, authoritativeOrigin, applicationCode: TICKET10_TEST_APPLICATION_CODE, enterpriseId });
-    if (environmentFingerprint !== fieldCreateEvidence.environmentFingerprint)
-        throw new Error("Ticket 10 field publish is outside the field-create handoff environment fingerprint.");
-    const evidence = Object.freeze({
-        route: TICKET10_FIELD_PUBLISH_ROUTE,
-        capabilityId: TICKET10_FIELD_PUBLISH_CAPABILITY_ID,
-        environmentName: TICKET10_TEST_ENVIRONMENT_NAME,
-        applicationCode: TICKET10_TEST_APPLICATION_CODE,
-        folder: fieldCreateEvidence.folder,
-        targetSchemaCode,
-        targetFieldCodes,
-        testRunId: input.testRunId,
-        environmentFingerprint,
-        baselineFingerprint: canonicalCloudPivotBaselineFingerprint({ environmentFingerprint, applicationCode: TICKET10_TEST_APPLICATION_CODE, discovery: input.discovery }),
-        discoveryFingerprint: canonicalFormalDiscoveryFingerprint(input.discovery),
-        handoff,
-        modelPresence,
-        draftPresence: Object.freeze([...input.draftPresence]),
-        publishedAbsence: Object.freeze([...input.publishedAbsence]),
-        cleanupContract: buildTicket10FieldCleanupContract(input.testRunId, targetSchemaCode, targetFieldCodes),
-        designerDirectUrl: ticket10DesignerDirectUrl(targetSchemaCode),
-        capturedAt: new Date((input.now ?? Date.now)()).toISOString(),
-    });
-    if ([evidence.environmentFingerprint, evidence.baselineFingerprint, evidence.discoveryFingerprint].some((value) => !SHA256.test(value)))
-        throw new Error("Ticket 10 evidence fingerprints are not canonical.");
-    if (SENSITIVE_SECRET_VALUE.test(stable(evidence)))
-        throw new Error("Ticket 10 evidence contains prohibited sensitive data.");
-    return evidence;
-}
-export const TICKET10_EVIDENCE_DEFAULT_TTL_MS = 25 * 60_000;
-export const TICKET10_EVIDENCE_MAX_TTL_MS = 30 * 60_000;
-/** Single-use, TTL-bounded evidence store; consumed exactly once by plan creation. */
-export class Ticket10EvidenceStore {
-    records = new Map();
-    now;
-    ttlMs;
-    lastNow;
-    constructor(options = {}) {
-        this.now = options.now ?? Date.now;
-        this.ttlMs = options.ttlMs ?? TICKET10_EVIDENCE_DEFAULT_TTL_MS;
-        if (!Number.isFinite(this.ttlMs) || this.ttlMs < 1 || this.ttlMs > TICKET10_EVIDENCE_MAX_TTL_MS)
-            throw new Error("Ticket 10 evidence TTL must be between 1ms and its safety maximum.");
-    }
-    capture(evidence) {
-        validateTicket10Evidence(evidence);
-        const evidenceId = `ticket10-evidence-${randomUUID()}`;
-        const expiresAt = this.readClock() + this.ttlMs;
-        const stored = Object.freeze({ ...evidence, evidenceArtifactId: evidenceId });
-        this.records.set(evidenceId, { evidence: stored, expiresAt, consumed: false });
-        return { evidenceId, expiresAt, evidence: stored };
-    }
-    consume(evidenceId) {
-        const record = this.records.get(evidenceId);
-        if (!record)
-            throw new Error("Ticket 10 evidence artifact is missing or divergent.");
-        if (record.consumed)
-            throw new Error("Ticket 10 evidence has already been consumed.");
-        if (record.expiresAt <= this.readClock())
-            throw new Error("Ticket 10 evidence is stale or expired.");
-        record.consumed = true;
-        return record.evidence;
-    }
-    resolve(evidenceId) {
-        const record = this.records.get(evidenceId);
-        if (!record || !record.consumed)
-            throw new Error("Ticket 10 evidence artifact is missing or has not been consumed by planning.");
-        if (record.expiresAt <= this.readClock())
-            throw new Error("Ticket 10 evidence artifact is stale or expired.");
-        return record.evidence;
-    }
-    readClock() {
-        const currentTime = this.now();
-        if (!Number.isFinite(currentTime))
-            throw new Error("Ticket 10 evidence clock is invalid; fail closed.");
-        if (this.lastNow !== undefined && currentTime < this.lastNow)
-            throw new Error("Ticket 10 evidence clock moved backwards; fail closed.");
-        this.lastNow = currentTime;
-        return currentTime;
-    }
-}
-/** The exact evidenced SchemaPublishedVO publish DTO: {bizSchemaCode, sendMessage:false}. */
-export function buildTicket10FieldPublishPayload(evidence) {
-    validateTicket10Evidence(evidence);
-    return { bizSchemaCode: evidence.targetSchemaCode, sendMessage: false };
-}
-export function buildTicket10ConfigurationIntent(evidence) {
-    validateTicket10Evidence(evidence);
-    const target = `${evidence.targetSchemaCode}/${evidence.targetFieldCodes.join("+")}`;
-    return {
-        intentVersion: 1,
-        targetFamily: "8.6",
-        environmentBinding: { application: evidence.applicationCode, model: evidence.targetSchemaCode, baselineFingerprint: evidence.baselineFingerprint },
-        sourceRequirement: `Ticket 10 maintainer test (${activeFieldFamily().familyId} family rung): publish the run's ${fieldFamilyMemberNamesProse()} draft fixture family fields through the single model-scoped field publish (SchemaPublishedVO sendMessage:false), verified across the isPublish=false/true readback states per field, with per-type behavior validation and staged owned cleanup.`,
-        resources: [{ id: target, kind: "field", state: "publish", properties: { schemaCode: evidence.targetSchemaCode, publishScope: "model-scoped-field-publish-family", familyFieldCodes: [...evidence.targetFieldCodes] } }],
-        relationships: [],
-        lifecycle: [{ resourceId: target, transitions: ["publish"], order: 1, idempotent: false, dependencyChecks: ["completed-field-create-handoff", "draft-presence-and-published-absence-preflight-per-family-field"], recoveryBoundary: `fields:${target}` }],
-        behavior: [{ id: "published-family-field-two-state", kind: "structure", requiredCapabilityIds: [TICKET10_FIELD_PUBLISH_CAPABILITY_ID], resourceIds: [target], obligations: ["published (isPublish=true) readback carries BOTH family fields with the published flag decoded", "draft (isPublish=false) readback still carries both family fields", "form consistency lag is recorded as an explicit partial state; model/field/form are not one transaction", "designer direct URL stays inspectable"] }],
-        acceptance: [{ id: "ticket10-publish-readback", scenario: "family-field-publish-two-state-readback-behavior", actor: "omc-maintainer-opencode", assertions: ["both family fields are present in the draft and published readback states after the single model-scoped publication", "the published flag decodes per family field from the authoritative published readback", "fixture remains inspectable at the designer direct URL"], readbackInvariants: [`${TICKET10_FIELD_READBACK_ENDPOINT}?schemaCode=<model>&isPublish=false lists both family fields`, `${TICKET10_FIELD_READBACK_ENDPOINT}?schemaCode=<model>&isPublish=true lists both family fields`], outcome: "validated" }],
-        cleanup: [{ id: "ticket10-owned-family-field-cleanup", boundary: `ticket10:${evidence.testRunId}:published-family-field-force-delete-probe`, dependencyChecks: ["published family field ownership readback per field", "two-state exact absence readback per field"], resources: evidence.targetFieldCodes.map((fieldCode) => `field:${evidence.targetSchemaCode}/${fieldCode}`) }],
-        implementationConstraints: { nativePreferred: true, backendRequired: false, prohibitedPaths: ["form.online-js", "business-rule", "integration", "backend.extension"], approvalExceptions: [] },
-        evidenceRefs: [TICKET10_FIELD_PUBLISH_CAPABILITY_ID, TICKET10_FIELD_PUBLISH_ENDPOINT, TICKET10_FIELD_READBACK_ENDPOINT, TICKET10_FIELD_CLEANUP_ENDPOINT, ...CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH.evidence],
-        unresolved: [],
-    };
-}
-function ticket10FieldPublishOperation(evidence) {
-    const familyKey = evidence.targetFieldCodes.join("+");
-    const target = `fields:${evidence.targetSchemaCode}/${familyKey}`;
-    return {
-        id: `field-publish:${evidence.targetSchemaCode}/${familyKey}`,
-        method: "POST",
-        path: TICKET10_FIELD_PUBLISH_ENDPOINT,
-        target,
-        payload: buildTicket10FieldPublishPayload(evidence),
-        expectedReadback: `${target}:published`,
-        evidence: [TICKET10_FIELD_PUBLISH_CAPABILITY_ID, ...CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH.evidence, TICKET10_FIELD_READBACK_ENDPOINT],
-        transportMode: "serialized-server-field-publish-8.6.26",
-        capability: CLOUDPIVOT_8_6_26_SERIALIZED_FIELD_PUBLISH,
-    };
-}
-function ticket10FieldCleanupOperations(evidence) {
-    return evidence.targetFieldCodes.map((fieldCode) => {
-        const target = `field:${evidence.targetSchemaCode}/${fieldCode}`;
-        return {
-            id: `cleanup:published-field:${evidence.targetSchemaCode}/${fieldCode}`,
-            method: "POST",
-            path: TICKET10_FIELD_CLEANUP_ENDPOINT,
-            target,
-            payload: { bizSchemaCode: evidence.targetSchemaCode, bizPropertyCode: fieldCode },
-            expectedReadback: `${target}:deleted`,
-            evidence: [TICKET10_FIELD_CLEANUP_CAPABILITY_ID, "BizPropertyController.java:1532-1565", TICKET10_FIELD_READBACK_ENDPOINT],
-            transportMode: "cloudpivot-published-field-force-delete-8.6.26",
-        };
-    });
-}
-/** Creates and proposes the immutable Ticket 10 Delivery Plan Approval for the single model-scoped field-publish step. */
-export function createTicket10FieldPublishPlanApproval(input) {
-    const evidence = validateTicket10Evidence(input.evidence);
-    assertDigest(input.knowledgePackDigest, "knowledge pack digest");
-    const operation = ticket10FieldPublishOperation(evidence);
-    const operations = [operation];
-    assertTicket10OperationsBounded({ route: TICKET10_FIELD_PUBLISH_ROUTE, operations, targetSchemaCode: evidence.targetSchemaCode, targetFieldCodes: evidence.targetFieldCodes });
-    const intent = buildTicket10ConfigurationIntent(evidence);
-    if (validateConfigurationIntent(intent).length)
-        throw new Error("Ticket 10 Configuration Intent is invalid; planning is blocked.");
-    const binding = {
-        deliveryId: ticket10DeliveryId(evidence.testRunId),
-        environment: TICKET10_TEST_ENVIRONMENT_NAME,
-        baselineFingerprint: evidence.baselineFingerprint,
-        environmentFingerprint: evidence.environmentFingerprint,
-        discoveryFingerprint: evidence.discoveryFingerprint,
-        ...(evidence.evidenceArtifactId ? { evidenceArtifactId: evidence.evidenceArtifactId } : {}),
-    };
-    const familyKey = evidence.targetFieldCodes.join("+");
-    const planHash = digest({ route: TICKET10_FIELD_PUBLISH_ROUTE, capabilityId: TICKET10_FIELD_PUBLISH_CAPABILITY_ID, target: `${evidence.targetSchemaCode}/${familyKey}`, testRunId: evidence.testRunId, operation: { id: operation.id, readback: operation.expectedReadback }, familyFieldCodes: [...evidence.targetFieldCodes], fieldHandoff: { packageId: evidence.handoff.fieldCreatePackageId, packageHash: evidence.handoff.fieldCreatePackageHash }, folder: evidence.folder, fingerprints: { baseline: evidence.baselineFingerprint, environment: evidence.environmentFingerprint, discovery: evidence.discoveryFingerprint }, cleanupContractHash: ticket10FieldCleanupContractHash(), knowledgePackDigest: input.knowledgePackDigest, prohibited: [...TICKET10_PROHIBITED_MUTATION_TERMS] });
-    const base = createDeliveryPlanApproval({
-        binding,
-        requirementHash: digest({ target: `${evidence.targetSchemaCode}/${familyKey}`, publish: true }),
-        clarificationHash: digest("ticket10-test-field-publish-family-numeric-logical"),
-        intentHash: digest(intent),
-        decisionHash: digest(TICKET10_FIELD_PUBLISH_ROUTE),
-        graphHash: digest([operation.id]),
-        riskHash: digest(TICKET10_RISKS),
-        validationPlanHash: digest("authoritative-two-state-family-field-publish-readback-and-form-lag-observation"),
-        cleanupPlanHash: ticket10FieldCleanupContractHash(),
-        allowedOperationScope: [ticket10FieldPublishScope(evidence.targetSchemaCode, familyKey)],
-        planHash,
-        applicationCode: TICKET10_TEST_APPLICATION_CODE,
-        folderId: evidence.folder.id,
-        folderName: evidence.folder.name,
-        targets: [`${evidence.targetSchemaCode}/${familyKey}`],
-    });
-    const approval = {
-        ...base,
-        route: TICKET10_FIELD_PUBLISH_ROUTE,
-        testRunId: evidence.testRunId,
-        targetSchemaCode: evidence.targetSchemaCode,
-        targetFieldCodes: evidence.targetFieldCodes,
-        capabilityId: TICKET10_FIELD_PUBLISH_CAPABILITY_ID,
-        knowledgePackDigest: input.knowledgePackDigest,
-        cleanupContractHash: ticket10FieldCleanupContractHash(),
-        environmentName: TICKET10_TEST_ENVIRONMENT_NAME,
-    };
-    const proposal = { ...approval, approvalHash: deliveryPlanApprovalHash(approval) };
-    proposeDeliveryPlan(input.ledger, proposal);
-    return { approval: proposal, operations, cleanupContract: evidence.cleanupContract, intent, binding };
-}
-const TICKET10_RISKS = [
-    `Exactly one model-scoped field publish of the run's own draft fixture family fields (${fieldFamilyMemberNamesProse()}, one SchemaPublishedVO wire call) is in scope; this is a model-level data-item publication, never an app publish, form publish, or Environment release; model, view, runtime, folder, deployment, restart, release, Redis, and tenant administration remain rejected.`,
-    "Owned published-family-field cleanup is separately approved and bounded to the fields published by this testRunId with the explicit two-variant contract (per-field force_delete with two-state absence, or model cascade plus per-field absence confirmation); the model fixture is physically deleted afterwards through the existing owned model cleanup.",
-];
-/** Proves the fixture family fields were published by this run: exact codes, present in BOTH readback states per field, published flag decoded, dedicated application model. */
-export function validateTicket10FieldCleanupOwnership(input) {
-    const evidence = validateTicket10Evidence(input.evidence);
-    const fieldIds = [];
-    evidence.targetFieldCodes.forEach((targetFieldCode, index) => {
-        const member = TICKET09_FIELD_FAMILY[index];
-        const published = input.published[index];
-        if (published.classification !== "present" || published.reason !== "exact-presence" || published.query.schemaCode !== evidence.targetSchemaCode || published.query.propertyCode !== targetFieldCode || published.query.isPublish !== "true")
-            throw new Error(`Ticket 10 field cleanup requires the published ${member.propertyTypeName} field to be present in the authoritative published readback.`);
-        const field = published.field;
-        if (!field || field.code !== targetFieldCode || field.schemaCode !== evidence.targetSchemaCode)
-            throw new Error(`Ticket 10 field cleanup ownership readback returned the wrong ${member.propertyTypeName} field.`);
-        if (field.published !== true)
-            throw new Error("Ticket 10 field cleanup only owns fields whose published flag decodes from the authoritative published readback; unpublished draft semantics are the Ticket 09 rung.");
-        const draft = input.draft[index];
-        if (draft.classification !== "present" || draft.query.schemaCode !== evidence.targetSchemaCode || draft.query.propertyCode !== targetFieldCode || draft.query.isPublish !== "false")
-            throw new Error(`Ticket 10 field cleanup requires two-state visibility: the published ${member.propertyTypeName} field must remain present in the draft readback as well.`);
-        if (field.id)
-            fieldIds.push(field.id);
-    });
-    return {
-        ...(fieldIds.length ? { fieldIds } : {}),
-        testRunId: evidence.testRunId,
-        postPublishBaselineFingerprint: canonicalCloudPivotBaselineFingerprint({ environmentFingerprint: evidence.environmentFingerprint, applicationCode: evidence.applicationCode, discovery: input.discovery }),
-    };
-}
-/** Creates and proposes the separately gated published-field cleanup Delivery Plan Approval bound to the owned fixture field. */
-export function createTicket10FieldCleanupPlanApproval(input) {
-    const evidence = validateTicket10Evidence(input.evidence);
-    assertDigest(input.knowledgePackDigest, "knowledge pack digest");
-    if (input.ownership.testRunId !== evidence.testRunId || !SHA256.test(input.ownership.postPublishBaselineFingerprint))
-        throw new Error("Ticket 10 field cleanup approval requires the exact validated ownership binding.");
-    const operations = ticket10FieldCleanupOperations(evidence);
-    assertTicket10OperationsBounded({ route: TICKET10_FIELD_CLEANUP_ROUTE, operations, targetSchemaCode: evidence.targetSchemaCode, targetFieldCodes: evidence.targetFieldCodes });
-    const binding = {
-        deliveryId: ticket10FieldCleanupDeliveryId(evidence.testRunId),
-        environment: TICKET10_TEST_ENVIRONMENT_NAME,
-        baselineFingerprint: input.ownership.postPublishBaselineFingerprint,
-        environmentFingerprint: evidence.environmentFingerprint,
-        ...(evidence.evidenceArtifactId ? { evidenceArtifactId: evidence.evidenceArtifactId } : {}),
-    };
-    const planHash = digest({ route: TICKET10_FIELD_CLEANUP_ROUTE, capabilityId: TICKET10_FIELD_CLEANUP_CAPABILITY_ID, target: `${evidence.targetSchemaCode}/${evidence.targetFieldCodes.join("+")}`, testRunId: evidence.testRunId, fieldIds: input.ownership.fieldIds ?? [], operations: operations.map((operation) => ({ id: operation.id, readback: operation.expectedReadback })), cleanupContractHash: ticket10FieldCleanupContractHash(), knowledgePackDigest: input.knowledgePackDigest, prohibited: [...TICKET10_PROHIBITED_MUTATION_TERMS] });
-    const base = createDeliveryPlanApproval({
-        binding,
-        requirementHash: digest({ target: `${evidence.targetSchemaCode}/${evidence.targetFieldCodes.join("+")}`, cleanup: true }),
-        clarificationHash: digest("ticket10-owned-published-family-field-cleanup"),
-        intentHash: digest({ cleanup: true, target: `${evidence.targetSchemaCode}/${evidence.targetFieldCodes.join("+")}` }),
-        decisionHash: digest(TICKET10_FIELD_CLEANUP_ROUTE),
-        graphHash: digest(operations.map((operation) => operation.id)),
-        riskHash: digest(TICKET10_CLEANUP_RISKS),
-        validationPlanHash: digest("published-family-field-force-delete-probe-two-variant-contract"),
-        cleanupPlanHash: ticket10FieldCleanupContractHash(),
-        allowedOperationScope: evidence.targetFieldCodes.map((fieldCode) => ticket10FieldCleanupScope(evidence.targetSchemaCode, fieldCode)),
-        planHash,
-        applicationCode: TICKET10_TEST_APPLICATION_CODE,
-        folderId: evidence.folder.id,
-        folderName: evidence.folder.name,
-        targets: [`${evidence.targetSchemaCode}/${evidence.targetFieldCodes.join("+")}`],
-    });
-    const approval = {
-        ...base,
-        route: TICKET10_FIELD_CLEANUP_ROUTE,
-        testRunId: evidence.testRunId,
-        targetSchemaCode: evidence.targetSchemaCode,
-        targetFieldCodes: evidence.targetFieldCodes,
-        capabilityId: TICKET10_FIELD_CLEANUP_CAPABILITY_ID,
-        knowledgePackDigest: input.knowledgePackDigest,
-        cleanupContractHash: ticket10FieldCleanupContractHash(),
-        environmentName: TICKET10_TEST_ENVIRONMENT_NAME,
-    };
-    const proposal = { ...approval, approvalHash: deliveryPlanApprovalHash(approval) };
-    proposeDeliveryPlan(input.ledger, proposal);
-    return { approval: proposal, operations, cleanupContract: evidence.cleanupContract, intent: buildTicket10ConfigurationIntent(evidence), binding };
-}
-const TICKET10_CLEANUP_RISKS = [
-    "Field cleanup probes force_delete on exactly the registered published family fields owned by this testRunId after per-field two-state ownership readback; the adopted variant (published-field force_delete, or model cascade plus field-level absence confirmation) is recorded explicitly.",
-    "Uncertain delete outcomes stop, retain, and report the fixture; replay and unbounded deletion are rejected.",
-];
-/** Compiles the immutable one-step field-publish package bound to the approved plan, pack digest, and pinned contract hash. */
-export function prepareTicket10FieldPublishPackage(input) {
-    const evidence = validateTicket10Evidence(input.evidence);
-    const approval = requireTicket10Approval(input.approval, TICKET10_FIELD_PUBLISH_ROUTE, TICKET10_FIELD_PUBLISH_CAPABILITY_ID);
-    const persisted = requirePersistedApprovedPlan(input.ledger, approval);
-    assertTicket10BindingMatchesEvidence(persisted.binding, evidence);
-    const scope = ticket10FieldPublishScope(evidence.targetSchemaCode, evidence.targetFieldCodes.join("+"));
-    if (!persisted.allowedOperationScope.includes(scope))
-        throw new Error(`Ticket 10 package step is outside the approved operation scope: ${scope}.`);
-    if (input.pinnedFieldPublishContractHash !== ticket10FieldPublishContractHash())
-        throw new Error("Ticket 10 pinned field-publish contract hash does not match the canonical 8.6.26 capability contract.");
-    assertDigest(input.knowledgePackDigest, "knowledge pack digest");
-    if (input.knowledgePackDigest !== approval.knowledgePackDigest)
-        throw new Error("Ticket 10 knowledge pack digest diverges from the approved plan binding.");
-    const operation = ticket10FieldPublishOperation(evidence);
-    const operations = [operation];
-    assertTicket10OperationsBounded({ route: TICKET10_FIELD_PUBLISH_ROUTE, operations, targetSchemaCode: evidence.targetSchemaCode, targetFieldCodes: evidence.targetFieldCodes });
-    const pkg = compileTicket10Package({ ledger: input.ledger, planApproval: persisted, operations, knowledgePackDigest: input.knowledgePackDigest, packageId: `ticket10-field-publish-${digest(persisted.approvalId).slice(0, 32)}`, recoveryPolicyHash: digest("ticket10-family-field-publish-step-only"), capabilityEvidence: [TICKET10_FIELD_PUBLISH_CAPABILITY_ID, "cloudpivot.field-publish.serialized-server-8.6.26", TICKET10_FIELD_READBACK_ENDPOINT, ...evidence.targetFieldCodes.map((fieldCode) => `familyField:${fieldCode}`), `fieldHandoff:${evidence.handoff.fieldCreatePackageId}`, `folder:${evidence.folder.id}`, `testRunId:${evidence.testRunId}`, `baselineFingerprint:${persisted.binding.baselineFingerprint}`] });
-    return { package: pkg, operations, planApproval: persisted, dryRun: ticket10DryRun(evidence, operations), evidence };
-}
-/** Compiles the immutable one-step owned published-field cleanup package bound to the separately approved cleanup plan. */
-export function prepareTicket10FieldCleanupPackage(input) {
-    const evidence = validateTicket10Evidence(input.evidence);
-    const approval = requireTicket10Approval(input.approval, TICKET10_FIELD_CLEANUP_ROUTE, TICKET10_FIELD_CLEANUP_CAPABILITY_ID);
-    const persisted = requirePersistedApprovedPlan(input.ledger, approval);
-    if (persisted.binding.environmentFingerprint !== evidence.environmentFingerprint)
-        throw new Error("Ticket 10 field cleanup approval is outside the evidence environment binding.");
-    for (const fieldCode of evidence.targetFieldCodes) {
-        const scope = ticket10FieldCleanupScope(evidence.targetSchemaCode, fieldCode);
-        if (!persisted.allowedOperationScope.includes(scope))
-            throw new Error(`Ticket 10 field cleanup step is outside the approved operation scope: ${scope}.`);
-    }
-    if (input.pinnedCleanupContractHash !== ticket10FieldCleanupContractHash())
-        throw new Error("Ticket 10 pinned field cleanup contract hash does not match the canonical owned-cleanup contract.");
-    assertDigest(input.knowledgePackDigest, "knowledge pack digest");
-    if (input.knowledgePackDigest !== approval.knowledgePackDigest)
-        throw new Error("Ticket 10 knowledge pack digest diverges from the approved field cleanup plan binding.");
-    if (input.ownership.testRunId !== evidence.testRunId)
-        throw new Error("Ticket 10 field cleanup package requires the exact validated ownership binding.");
-    const operations = ticket10FieldCleanupOperations(evidence);
-    assertTicket10OperationsBounded({ route: TICKET10_FIELD_CLEANUP_ROUTE, operations, targetSchemaCode: evidence.targetSchemaCode, targetFieldCodes: evidence.targetFieldCodes });
-    const pkg = compileTicket10Package({ ledger: input.ledger, planApproval: persisted, operations, knowledgePackDigest: input.knowledgePackDigest, packageId: `ticket10-field-cleanup-${digest(persisted.approvalId).slice(0, 32)}`, recoveryPolicyHash: digest("ticket10-family-field-cleanup-steps-only"), capabilityEvidence: [TICKET10_FIELD_CLEANUP_CAPABILITY_ID, TICKET10_FIELD_CLEANUP_ENDPOINT, TICKET10_FIELD_READBACK_ENDPOINT, ...(input.ownership.fieldIds ?? []).map((fieldId) => `fieldId:${fieldId}`), `testRunId:${evidence.testRunId}`] });
-    return { package: pkg, operations, planApproval: persisted, dryRun: ticket10DryRun(evidence, operations), evidence };
-}
-function compileTicket10Package(input) {
-    const snapshots = input.operations.map((operation) => {
-        const snapshotBase = { id: `snapshot:${operation.id}`, target: operation.target, identity: operation.target, recoveryBoundary: operation.target, state: "absent", baselineFingerprint: input.planApproval.binding.baselineFingerprint };
-        return { ...snapshotBase, snapshotHash: digest(snapshotBase) };
-    });
-    const pkg = compileNativeOperations({
-        operations: [...input.operations],
-        binding: input.planApproval.binding,
-        planApproval: input.planApproval,
-        snapshotManifest: snapshots,
-        releasePlanHash: digest("ticket10-no-release"),
-        recoveryPolicyHash: input.recoveryPolicyHash,
-        knowledgePack: { id: TICKET10_FIELD_PUBLISH_KNOWLEDGE_PACK_ID, digest: input.knowledgePackDigest },
-        capabilityEvidence: input.capabilityEvidence,
-        requiredPermissions: ["configuration-write"],
-        packageId: input.packageId,
-        ledger: input.ledger,
-    });
-    input.ledger.createPackage(pkg);
-    return pkg;
-}
-/** Read-only dry-run projection; never a CloudPivot write and never an app/form publish operation. */
-function ticket10DryRun(evidence, operations) {
-    const readbackOperations = [
-        { id: `readback:fields:${evidence.targetSchemaCode}:draft`, method: "GET", path: TICKET10_FIELD_READBACK_ENDPOINT, target: `fields:${evidence.targetSchemaCode}:draft`, payload: { schemaCode: evidence.targetSchemaCode, isPublish: "false" }, expectedReadback: `fields:${evidence.targetSchemaCode}:draft:read`, evidence: ["BizPropertyController.java:161-207"] },
-        { id: `readback:fields:${evidence.targetSchemaCode}:published`, method: "GET", path: TICKET10_FIELD_READBACK_ENDPOINT, target: `fields:${evidence.targetSchemaCode}:published`, payload: { schemaCode: evidence.targetSchemaCode, isPublish: "true" }, expectedReadback: `fields:${evidence.targetSchemaCode}:published:read`, evidence: ["BizPropertyController.java:161-207"] },
-    ];
-    const body = JSON.stringify({ execution: "read-only-dry-run", operations, readbackOperations, blocked: [], prohibitedActions: ["cloudpivot-write"] }, null, 2) + "\n";
-    return { execution: "read-only-dry-run", operations, readbackOperations, blocked: [], prohibitedActions: ["cloudpivot-write"], artifact: { name: "cloudpivot-ticket10-field-publish-dry-run.json", body, sha256: digest(body), mimeType: "application/json" } };
-}
-export function formatTicket10DeliveryPlanApprovalFrame(approval) {
-    const value = requireTicket10Approval(approval, TICKET10_FIELD_PUBLISH_ROUTE, TICKET10_FIELD_PUBLISH_CAPABILITY_ID);
-    return appendApprovalHumanBlock(`Approve Ticket 10 field publish Delivery Plan Approval ${value.approvalId} hash ${value.approvalHash}; plan hash ${value.planHash}; capability ${value.capabilityId}; environment test; application test; environment fingerprint ${value.binding.environmentFingerprint}; baseline fingerprint ${value.binding.baselineFingerprint}; folder ${value.folderId} (${value.folderName}); fixture model ${value.targetSchemaCode}; family fields ${value.targetFieldCodes.join(" + ")} (${fieldFamilyMemberNamesProse()}); testRunId ${value.testRunId}; exact scope ${value.allowedOperationScope[0]}; one model-scoped family field publish step (POST ${TICKET10_FIELD_PUBLISH_ENDPOINT} with SchemaPublishedVO sendMessage:false publishing the draft family fields in one model-level data-item publication, never an app publish, form publish, or Environment release) — with authoritative per-field two-state readback, per-type behavior validation, and separately approved staged owned cleanup.`, { capability: "ticket10-field-publish", kind: "delivery-plan", identities: [value.targetSchemaCode, ...value.targetFieldCodes], scope: [value.allowedOperationScope[0]] });
-}
-export function formatTicket10EnvironmentChangeApprovalFrame(input) {
-    const value = requireTicket10Approval(input.approval, TICKET10_FIELD_PUBLISH_ROUTE, TICKET10_FIELD_PUBLISH_CAPABILITY_ID);
-    return appendApprovalHumanBlock(`Approve Ticket 10 field publish Environment Change Approval for package ${input.packageId} hash ${input.packageHash}; plan approval ${value.approvalId} hash ${value.approvalHash}; environment test; folder ${value.folderId} (${value.folderName}); fixture model ${value.targetSchemaCode}; family fields ${value.targetFieldCodes.join(" + ")}; testRunId ${value.testRunId}; exact scope ${value.allowedOperationScope[0]}; exactly one model-scoped family field publish step (never an app publish, form publish, or Environment release) executed by the single Forge configuration writer lease with authoritative per-field two-state readback.`, { capability: "ticket10-field-publish", kind: "environment-change", identities: [value.targetSchemaCode, ...value.targetFieldCodes], scope: [value.allowedOperationScope[0]] });
-}
-export function formatTicket10FieldCleanupDeliveryPlanApprovalFrame(approval) {
-    const value = requireTicket10Approval(approval, TICKET10_FIELD_CLEANUP_ROUTE, TICKET10_FIELD_CLEANUP_CAPABILITY_ID);
-    return appendApprovalHumanBlock(`Approve Ticket 10 field cleanup Delivery Plan Approval ${value.approvalId} hash ${value.approvalHash}; plan hash ${value.planHash}; capability ${value.capabilityId}; environment test; application test; environment fingerprint ${value.binding.environmentFingerprint}; post-publish baseline fingerprint ${value.binding.baselineFingerprint}; folder ${value.folderId} (${value.folderName}); fixture model ${value.targetSchemaCode}; family fields ${value.targetFieldCodes.join(" + ")}; testRunId ${value.testRunId}; exact scopes ${value.allowedOperationScope.join("; ")}; probe force_delete on only the owned published family fields after per-field two-state ownership readback; if published-field deletion semantics differ, the stated contract is the model-cascade plus field-level absence confirmation; uncertain outcomes stop, retain, and report.`, { capability: "ticket10-field-cleanup", kind: "delivery-plan", identities: [value.targetSchemaCode, ...value.targetFieldCodes], scope: [...value.allowedOperationScope] });
-}
-export function formatTicket10FieldCleanupEnvironmentChangeApprovalFrame(input) {
-    const value = requireTicket10Approval(input.approval, TICKET10_FIELD_CLEANUP_ROUTE, TICKET10_FIELD_CLEANUP_CAPABILITY_ID);
-    return appendApprovalHumanBlock(`Approve Ticket 10 field cleanup Environment Change Approval for package ${input.packageId} hash ${input.packageHash}; plan approval ${value.approvalId} hash ${value.approvalHash}; environment test; fixture model ${value.targetSchemaCode}; family fields ${value.targetFieldCodes.join(" + ")}; testRunId ${value.testRunId}; one owned published-family-field force-delete probe per active family member with per-field two-state exact absence readback; a deterministic rejection falls back to the stated model-cascade contract; uncertain outcomes stop, retain, and report.`, { capability: "ticket10-field-cleanup", kind: "environment-change", identities: [value.targetSchemaCode, ...value.targetFieldCodes], scope: [...value.allowedOperationScope] });
-}
-function validateOneTicket10Field(propertyTypeName, targetFieldCode, suffix, evidence, draft, published, checks) {
-    const add = (id, ok, detail) => checks.push({ id, status: ok ? "validated" : "blocked", detail });
-    const publishedPresent = published.classification === "present" && published.query.schemaCode === evidence.targetSchemaCode && published.query.propertyCode === targetFieldCode && published.query.isPublish === "true" && published.field?.code === targetFieldCode && published.field?.schemaCode === evidence.targetSchemaCode;
-    add(`published-field-present-${suffix}`, publishedPresent, publishedPresent ? `the published (isPublish=true) readback lists the ${propertyTypeName} field; publication means the runtime-visible state.` : `the published readback did not list the ${propertyTypeName} field after the publish step returned success.`);
-    add(`published-flag-decoded-${suffix}`, published.field?.published === true, `the ${propertyTypeName} published flag decodes as ${String(published.field?.published)} from the authoritative published readback.`);
-    const draftPresent = draft.classification === "present" && draft.query.schemaCode === evidence.targetSchemaCode && draft.query.propertyCode === targetFieldCode && draft.query.isPublish === "false" && draft.field?.code === targetFieldCode && draft.field?.schemaCode === evidence.targetSchemaCode;
-    add(`draft-field-present-${suffix}`, draftPresent, draftPresent ? `the draft (isPublish=false) readback still lists the published ${propertyTypeName} field.` : `the draft readback no longer lists the ${propertyTypeName} field after publication.`);
-}
-/** Validates real family publication behavior beyond HTTP 2xx: per-field two-state presence plus the published flag; form lag is an explicit recorded observation. */
-export function validateTicket10FieldPublishBehavior(input) {
-    const evidence = validateTicket10Evidence(input.evidence);
-    const checks = [];
-    evidence.targetFieldCodes.forEach((targetFieldCode, index) => {
-        const member = TICKET09_FIELD_FAMILY[index];
-        const suffix = member.propertyTypeName.toLowerCase();
-        validateOneTicket10Field(member.propertyTypeName, targetFieldCode, suffix, evidence, input.draft[index], input.published[index], checks);
-    });
-    const add = (id, ok, detail) => checks.push({ id, status: ok ? "validated" : "blocked", detail });
-    add("designer-direct-url", evidence.designerDirectUrl.startsWith(`/admin/#/apps/model/${TICKET10_TEST_APPLICATION_CODE}/${evidence.targetSchemaCode}/`), `designer direct URL ${evidence.designerDirectUrl} stays inspectable.`);
-    const form = input.form;
-    add("form-consistency-observation", true, form.observed
-        ? `form readback observes published=${String(form.published)} existDraft=${String(form.existDraft)} after the field publish; model, field, and form are not one transaction, so any form consistency lag is recorded as this explicit partial state rather than assumed cascade consistency.`
-        : "form readback is unavailable; recorded as an explicit partial state (model, field, and form are not one transaction) instead of assumed cascade consistency.");
-    const blocked = checks.find((check) => check.status === "blocked");
-    return blocked ? { status: "blocked", reason: `Ticket 10 behavior validation failed: ${blocked.detail}`, checks } : { status: "validated", checks };
-}
-/** Execution boundary: named test environment, route-bound package steps, active approvals, no replay of terminal or uncertain packages. */
-export function assertTicket10ExecutionBoundary(input) {
-    if (input.environmentName !== "test")
-        throw new Error("Ticket 10 execution is restricted to the named test environment; production and staging are rejected.");
-    const { projection } = input;
-    const routeStepPrefix = input.route === TICKET10_FIELD_PUBLISH_ROUTE ? "field-publish:" : "cleanup:published-field:";
-    const expectedSteps = input.route === TICKET10_FIELD_PUBLISH_ROUTE ? 1 : TICKET09_FIELD_FAMILY.length;
-    if (input.steps.length !== expectedSteps || input.steps.some((step) => !step.id.startsWith(routeStepPrefix)))
-        throw new Error(`Ticket 10 execution boundary rejected package ${input.packageId}: its steps are not the ${expectedSteps} ${routeStepPrefix} operation(s) bound to the ${input.route} route.`);
-    if (projection.status === "approved" && projection.approvals.plan === "approved" && projection.approvals.environment === "approved")
-        return;
-    if (projection.status === "completed")
-        throw new Error(`Ticket 10 package ${input.packageId} is already terminal completed; replay is rejected.`);
-    if (projection.status === "uncertain")
-        throw new Error(`Ticket 10 package ${input.packageId} is uncertain; reconcile by authoritative readback before any replay.`);
-    if (projection.status === "in_progress")
-        throw new Error(`Ticket 10 package ${input.packageId} is already running; concurrent execution is rejected.`);
-    const pending = [...projection.blockers];
-    if (projection.approvals.plan !== "approved")
-        pending.push("Delivery Plan Approval is required before package execution.");
-    if (projection.approvals.environment !== "approved")
-        pending.push("Environment Change Approval is required before mutation.");
-    throw new Error(`Ticket 10 execution boundary rejected package ${input.packageId}: status is ${projection.status} (blocked); ${[...new Set(pending)].join("; ")}.`);
-}
-/** Executes the approved one-step model-scoped field-publish package through the single OMC Host write transport, then validates two-state behavior. */
-export async function executeTicket10FieldPublishPackage(input) {
-    assertTicket10TestFieldPublishEnvironment(input.settings);
-    if (typeof input.transport.serializedServerFieldPublish !== "function")
-        throw new Error("Ticket 10 execution requires the OMC Host serialized field-publish transport; bypass transports are rejected.");
-    const projection = input.ledger.project(input.prepared.package.packageId);
-    assertTicket10ExecutionBoundary({ projection, environmentName: input.settings.environmentName, packageId: input.prepared.package.packageId, route: TICKET10_FIELD_PUBLISH_ROUTE, steps: input.prepared.package.steps });
-    if (input.environmentApproval.packageId !== input.prepared.package.packageId || input.environmentApproval.packageHash !== input.prepared.package.packageHash)
-        throw new Error("Ticket 10 Environment Change Approval does not match the prepared package.");
-    const evidence = input.prepared.evidence;
-    for (const member of TICKET09_FIELD_FAMILY) {
-        const draftProbe = await input.readFieldEvidence(member.propertyTypeName, "false");
-        if (draftProbe.classification !== "present" || draftProbe.field?.published === true)
-            throw new Error(`Ticket 10 execution requires the draft ${member.propertyTypeName} family field to be present and unpublished; ${input.prepared.package.steps[0].target} diverges from the approved handoff.`);
-        const publishedProbe = await input.readFieldEvidence(member.propertyTypeName, "true");
-        if (publishedProbe.classification !== "absent" || publishedProbe.reason !== "exact-absence")
-            throw new Error(`Ticket 10 execution requires exact published-state absence for the ${member.propertyTypeName} family field; ${input.prepared.package.steps[0].target} is already published or blocked.`);
-    }
-    const result = await runNativeConfigurationPackage({
-        package: input.prepared.package,
-        gate: {
-            mode: "approved",
-            planApproval: { status: "approved", approvalHash: input.prepared.planApproval.approvalHash },
-            environmentApproval: { status: "approved", packageHash: input.environmentApproval.packageHash },
-            lease: { owner: "configuration-agent", environment: TICKET10_TEST_ENVIRONMENT_NAME },
-            baselineFingerprint: input.prepared.package.binding.baselineFingerprint,
-            snapshots: input.prepared.package.snapshotManifest,
-            package: input.prepared.package,
-        },
-        operations: input.prepared.operations,
-        ledger: input.ledger,
-        planApproval: input.prepared.planApproval,
-        transport: input.transport,
-        credentials: input.credentials,
-        authoritativeOrigin: input.authoritativeOrigin,
-        testApplicationCode: TICKET10_TEST_APPLICATION_CODE,
-    }, input.signal);
-    const mutationExecuted = result.steps.some((step) => step.status === "committed" || step.status === "uncertain");
-    const blockers = [...result.blockers];
-    let status = ticket10ExecutionStatus(result.status);
-    let nextAction = result.nextAction;
-    let behavior;
-    const partialStates = [];
-    if (result.status === "completed") {
-        const form = await ticket10FormObservation(input.readFormState);
-        const draft = await Promise.all(TICKET09_FIELD_FAMILY.map((member) => input.readFieldEvidence(member.propertyTypeName, "false")));
-        const published = await Promise.all(TICKET09_FIELD_FAMILY.map((member) => input.readFieldEvidence(member.propertyTypeName, "true")));
-        behavior = validateTicket10FieldPublishBehavior({ evidence, draft, published, form });
-        if (!form.observed)
-            partialStates.push("form-readback-unavailable: the default form state could not be observed after the model-scoped family field publish; model, field, and form are not one transaction, so this is recorded as an explicit partial state rather than assumed cascade consistency.");
-        else if (form.published !== true)
-            partialStates.push(`form-consistency-lag: the default form still reads published=false existDraft=${String(form.existDraft)} after the model-scoped family field publish; form draft/publish is an independent action and the lag is recorded as an explicit partial state.`);
-        if (behavior.status !== "validated") {
-            status = "blocked";
-            blockers.push(behavior.reason ?? "Ticket 10 behavior validation failed.");
-            nextAction = "reconcile-behavior-retain-and-report-resource";
-        }
-    }
-    return { reportType: "omc.ticket10.test-field-publish-execution", schemaVersion: 1, packageId: result.packageId, packageHash: result.packageHash, route: TICKET10_FIELD_PUBLISH_ROUTE, testRunId: evidence.testRunId, targetSchemaCode: evidence.targetSchemaCode, targetFieldCodes: evidence.targetFieldCodes, status, mutationExecuted, steps: result.steps, blockers, nextAction, ...(behavior ? { behavior } : {}), ...(partialStates.length ? { partialStates } : {}) };
-}
-async function ticket10FormObservation(readFormState) {
-    if (!readFormState)
-        return { observed: false, published: null, existDraft: null };
-    try {
-        const form = await readFormState();
-        return { observed: true, published: form.published === true, existDraft: form.existDraft === true };
-    }
-    catch {
-        return { observed: false, published: null, existDraft: null };
-    }
-}
-/**
- * Executes the separately approved owned published-field cleanup: the owned
- * field is the force_delete probe, disambiguated by authoritative two-state
- * readback. A deterministic rejection adopts the stated model-cascade variant
- * (stop, retain, no retry); uncertainty stops, retains, and reports.
- */
-export async function executeTicket10FieldCleanupPackage(input) {
-    assertTicket10TestFieldPublishEnvironment(input.settings);
-    if (typeof input.transport.publishedFieldForceDelete !== "function")
-        throw new Error("Ticket 10 field cleanup requires the OMC Host published-field force-delete transport; bypass transports are rejected.");
-    const projection = input.ledger.project(input.prepared.package.packageId);
-    assertTicket10ExecutionBoundary({ projection, environmentName: input.settings.environmentName, packageId: input.prepared.package.packageId, route: TICKET10_FIELD_CLEANUP_ROUTE, steps: input.prepared.package.steps });
-    if (input.environmentApproval.packageId !== input.prepared.package.packageId || input.environmentApproval.packageHash !== input.prepared.package.packageHash)
-        throw new Error("Ticket 10 field cleanup Environment Change Approval does not match the prepared package.");
-    const evidence = input.evidence;
-    const probeMemberName = TICKET09_FIELD_FAMILY[0].propertyTypeName;
-    const draftProbe = await input.readFieldEvidence(probeMemberName, "false");
-    const publishedProbe = await input.readFieldEvidence(probeMemberName, "true");
-    if (draftProbe.classification === "absent" && publishedProbe.classification === "absent") {
-        return { reportType: "omc.ticket10.test-field-publish-execution", schemaVersion: 1, packageId: input.prepared.package.packageId, packageHash: input.prepared.package.packageHash, route: TICKET10_FIELD_CLEANUP_ROUTE, testRunId: evidence.testRunId, targetSchemaCode: evidence.targetSchemaCode, targetFieldCodes: evidence.targetFieldCodes, status: "blocked", mutationExecuted: false, steps: projection.steps, blockers: ["Ticket 10 field cleanup targets are already absent in both readback states; nothing owned remains to delete and no unbounded deletion is attempted."], nextAction: "accept", absenceReadback: [publishedProbe] };
-    }
-    const result = await runNativeConfigurationPackage({
-        package: input.prepared.package,
-        gate: {
-            mode: "approved",
-            planApproval: { status: "approved", approvalHash: input.prepared.planApproval.approvalHash },
-            environmentApproval: { status: "approved", packageHash: input.environmentApproval.packageHash },
-            lease: { owner: "configuration-agent", environment: TICKET10_TEST_ENVIRONMENT_NAME },
-            baselineFingerprint: input.prepared.package.binding.baselineFingerprint,
-            snapshots: input.prepared.package.snapshotManifest,
-            package: input.prepared.package,
-        },
-        operations: input.prepared.operations,
-        ledger: input.ledger,
-        planApproval: input.prepared.planApproval,
-        transport: input.transport,
-        credentials: input.credentials,
-        authoritativeOrigin: input.authoritativeOrigin,
-        testApplicationCode: TICKET10_TEST_APPLICATION_CODE,
-    }, input.signal);
-    const mutationExecuted = result.steps.some((step) => step.status === "committed" || step.status === "uncertain");
-    const blockers = [...result.blockers];
-    let status = ticket10ExecutionStatus(result.status);
-    let nextAction = result.nextAction;
-    let absenceReadback;
-    let draftAbsenceReadback;
-    let cleanupVariant;
-    if (result.status === "completed") {
-        cleanupVariant = "published-field-force-delete";
-        draftAbsenceReadback = await Promise.all(TICKET09_FIELD_FAMILY.map((member) => input.readFieldEvidence(member.propertyTypeName, "false")));
-        absenceReadback = await Promise.all(TICKET09_FIELD_FAMILY.map((member) => input.readFieldEvidence(member.propertyTypeName, "true")));
-        if (draftAbsenceReadback.some((readback) => readback.classification !== "absent" || readback.reason !== "exact-absence") || absenceReadback.some((readback) => readback.classification !== "absent" || readback.reason !== "exact-absence")) {
-            status = "uncertain";
-            blockers.push("Ticket 10 post-cleanup two-state exact absence readback did not confirm absence for every family field; the fixture fields are retained and reported.");
-            nextAction = "reconcile";
-        }
-    }
-    else if (result.status === "uncertain") {
-        // Disambiguate by authoritative two-state readback: a deterministic
-        // rejection (fields still present in both states, no mutation) adopts the
-        // stated model-cascade variant; anything else stays uncertain.
-        const draftStates = await Promise.all(TICKET09_FIELD_FAMILY.map((member) => input.readFieldEvidence(member.propertyTypeName, "false").catch(() => undefined)));
-        const publishedStates = await Promise.all(TICKET09_FIELD_FAMILY.map((member) => input.readFieldEvidence(member.propertyTypeName, "true").catch(() => undefined)));
-        const allPresent = draftStates.every((draft) => draft?.classification === "present") && publishedStates.every((published) => published?.classification === "present" && published.field?.published === true);
-        if (allPresent) {
-            cleanupVariant = "model-cascade-plus-field-absence-confirmation";
-            status = "blocked";
-            nextAction = "model-cascade-cleanup";
-            blockers.push("Ticket 10 published-field force_delete was rejected by the server and the family fields remain present in both readback states; the stated cleanup contract for this rung applies: stop the field-level deletes (no retry), run the separately approved model physical delete cascade, then confirm per-field two-state absence.");
-            return { reportType: "omc.ticket10.test-field-publish-execution", schemaVersion: 1, packageId: result.packageId, packageHash: result.packageHash, route: TICKET10_FIELD_CLEANUP_ROUTE, testRunId: evidence.testRunId, targetSchemaCode: evidence.targetSchemaCode, targetFieldCodes: evidence.targetFieldCodes, status, mutationExecuted: false, steps: result.steps, blockers, nextAction, cleanupVariant };
-        }
-        blockers.push("Ticket 10 published-field force_delete outcome is uncertain; the fixture family fields are retained and reported with their exact resource identities and no retry is attempted.");
-    }
-    return { reportType: "omc.ticket10.test-field-publish-execution", schemaVersion: 1, packageId: result.packageId, packageHash: result.packageHash, route: TICKET10_FIELD_CLEANUP_ROUTE, testRunId: evidence.testRunId, targetSchemaCode: evidence.targetSchemaCode, targetFieldCodes: evidence.targetFieldCodes, status, mutationExecuted, steps: result.steps, blockers, nextAction, ...(absenceReadback ? { absenceReadback } : {}), ...(draftAbsenceReadback ? { draftAbsenceReadback } : {}), ...(cleanupVariant ? { cleanupVariant } : {}) };
-}
-/** Closes the stated model-cascade cleanup variant: after the model physical delete, every family field must be absent in BOTH readback states. */
-export function confirmTicket10FieldCascadeAbsence(input) {
-    const evidence = validateTicket10Evidence(input.evidence);
-    evidence.targetFieldCodes.forEach((targetFieldCode, fieldIndex) => {
-        for (const [label, readbacks] of [["draft", input.draft], ["published", input.published]]) {
-            const readback = readbacks[fieldIndex];
-            if (readback.classification !== "absent" || readback.reason !== "exact-absence" || readback.query.schemaCode !== evidence.targetSchemaCode || readback.query.propertyCode !== targetFieldCode)
-                throw new Error(`Ticket 10 model-cascade cleanup contract is not closed: the ${label} (isPublish=${label === "draft" ? "false" : "true"}) readback does not confirm exact absence for the family field ${targetFieldCode} after the model physical delete.`);
-        }
-    });
-}
-function ticket10ExecutionStatus(status) {
-    if (status === "completed" || status === "uncertain" || status === "partial")
-        return status;
-    return "blocked";
-}
-function requireTicket10Approval(approval, route, capabilityId) {
-    const value = approval;
-    if (value.route !== route || value.capabilityId !== capabilityId || value.environmentName !== "test" || value.applicationCode !== "test" || value.targets?.length !== 1 || !value.folderId || !value.folderName || !value.testRunId || !value.targetSchemaCode || !Array.isArray(value.targetFieldCodes) || value.targetFieldCodes.length !== TICKET09_FIELD_FAMILY.length || value.targetFieldCodes.some((code) => !isTicket09TargetField(code)) || new Set(value.targetFieldCodes).size !== TICKET09_FIELD_FAMILY.length)
-        throw new Error(`Ticket 10 approval frame is not bound to the exact ${route} route, family targets, folder, and testRunId.`);
-    return value;
-}
-function requirePersistedApprovedPlan(ledger, approval) {
-    if (approval.status !== "approved")
-        throw new Error("Ticket 10 package preparation requires the approved exact Ticket 10 Delivery Plan Approval.");
-    const persisted = ledger.findPlanApproval(approval.approvalId);
-    if (!persisted || persisted.status !== "approved" || persisted.approvalHash !== approval.approvalHash)
-        throw new Error("Ticket 10 package preparation requires the exact authoritative approved Delivery Plan Approval.");
-    return persisted;
-}
-function assertTicket10BindingMatchesEvidence(binding, evidence) {
-    const expected = {
-        deliveryId: ticket10DeliveryId(evidence.testRunId),
-        environment: TICKET10_TEST_ENVIRONMENT_NAME,
-        baselineFingerprint: evidence.baselineFingerprint,
-        environmentFingerprint: evidence.environmentFingerprint,
-        discoveryFingerprint: evidence.discoveryFingerprint,
-        ...(evidence.evidenceArtifactId ? { evidenceArtifactId: evidence.evidenceArtifactId } : {}),
-    };
-    if (stable(binding) !== stable(expected))
-        throw new Error("Ticket 10 plan approval binding is outside the evidence baseline, environment, discovery, or delivery binding.");
-}
-function validateTicket10Evidence(evidence) {
-    if (!evidence || evidence.route !== TICKET10_FIELD_PUBLISH_ROUTE || evidence.capabilityId !== TICKET10_FIELD_PUBLISH_CAPABILITY_ID)
-        throw new Error("Ticket 10 evidence is not the host-owned field publish route.");
-    if (evidence.environmentName !== "test" || evidence.applicationCode !== "test")
-        throw new Error("Ticket 10 evidence is outside the named test environment and dedicated test application.");
-    if (!isTicket08TargetSchema(evidence.targetSchemaCode))
-        throw new Error("Ticket 10 evidence fixture model is not the host-owned Ticket 08 schema.");
-    if (!Array.isArray(evidence.targetFieldCodes) || evidence.targetFieldCodes.length !== TICKET09_FIELD_FAMILY.length || evidence.targetFieldCodes.some((code) => !isTicket09TargetField(code)) || new Set(evidence.targetFieldCodes).size !== TICKET09_FIELD_FAMILY.length)
-        throw new Error("Ticket 10 evidence family field codes are not the distinct host-owned Ticket 09 field codes (one per active family member).");
-    if ([evidence.environmentFingerprint, evidence.baselineFingerprint, evidence.discoveryFingerprint].some((value) => !SHA256.test(value)))
-        throw new Error("Ticket 10 evidence fingerprints are not canonical.");
-    if (evidence.modelPresence.classification !== "present" || evidence.modelPresence.query.schemaCode !== evidence.targetSchemaCode)
-        throw new Error("Ticket 10 evidence does not carry the authoritative fixture model presence handoff.");
-    evidence.targetFieldCodes.forEach((fieldCode, index) => {
-        const draftPresence = evidence.draftPresence[index];
-        const publishedAbsence = evidence.publishedAbsence[index];
-        if (draftPresence?.classification !== "present" || draftPresence.query.schemaCode !== evidence.targetSchemaCode || draftPresence.query.propertyCode !== fieldCode)
-            throw new Error("Ticket 10 evidence does not carry exact authenticated draft family field presence.");
-        if (publishedAbsence?.classification !== "absent" || publishedAbsence.reason !== "exact-absence" || publishedAbsence.query.schemaCode !== evidence.targetSchemaCode || publishedAbsence.query.propertyCode !== fieldCode)
-            throw new Error("Ticket 10 evidence does not carry exact authenticated published-state family field absence.");
-    });
-    if (!evidence.folder.id || !evidence.folder.name)
-        throw new Error("Ticket 10 evidence folder binding is missing.");
-    return evidence;
-}
-function assertDigest(value, label) {
-    if (typeof value !== "string" || !SHA256.test(value) || !/[1-9a-f]/i.test(value))
-        throw new Error(`Ticket 10 ${label} is invalid.`);
-}
-function digest(value) { return createHash("sha256").update(stable(value)).digest("hex"); }
-function stable(value) { return JSON.stringify(sort(value)); }
-function sort(value) { if (Array.isArray(value))
-    return value.map(sort); if (value && typeof value === "object")
-    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sort(item)])); return value; }
-//# sourceMappingURL=ticket10-test-field-publish.js.map