pi-daddy 0.22.0 → 0.23.0

package/src/work-ledger-json.ts

@@ -0,0 +1,228 @@
+import { createHash } from "node:crypto";
+import { WorkInputError, type WorkFrozen, type WorkProblem, type WorkConflict } from "./work-ledger-types.ts";
+
+export const WORK_EVENT_BYTES = 64 * 1024;
+export const WORK_TEXT_BYTES = 16 * 1024 * 1024;
+export const WORK_RECORDS = 10_000;
+const MAX_DEPTH = 16;
+const MAX_ARRAY = 256;
+export type WorkJson = null | boolean | number | string | WorkJson[] | { [key: string]: WorkJson };
+const invalid = (): never => { throw new WorkInputError("WORK_SCHEMA_INVALID"); };
+const limit = (): never => { throw new WorkInputError("WORK_LIMIT_EXCEEDED"); };
+
+function unicode(value: string): string {
+  // RFC 8785 refuses lone UTF-16 surrogates, including ones decoded from escapes.
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code >= 0xd800 && code <= 0xdbff) {
+      const next = value.charCodeAt(++i);
+      if (!(next >= 0xdc00 && next <= 0xdfff)) invalid();
+    } else if (code >= 0xdc00 && code <= 0xdfff) invalid();
+  }
+  return value;
+}
+
+/** Inspect descriptors rather than serializing: no getters/toJSON or lossy JSON coercion. */
+export function ownWorkFields(value: unknown): Record<string, PropertyDescriptor> {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) invalid();
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) invalid();
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  for (const key of Reflect.ownKeys(descriptors)) {
+    if (typeof key !== "string") return invalid();
+    const descriptor = descriptors[key];
+    if (!Object.hasOwn(descriptor, "value") || !descriptor.enumerable) invalid();
+    unicode(key);
+  }
+  return descriptors;
+}
+
+/** Detach only the approved JSON value profile, before any serialization or validation use. */
+export function copyWorkJson(value: unknown): WorkJson {
+  const ancestors = new Set<object>();
+  function copy(v: unknown, depth: number): WorkJson {
+    if (v === null || typeof v === "boolean") return v;
+    if (typeof v === "string") return unicode(v);
+    if (typeof v === "number") return Number.isSafeInteger(v) ? v : invalid();
+    if (typeof v !== "object") return invalid();
+    if (depth > MAX_DEPTH) limit();
+    if (ancestors.has(v)) invalid();
+    ancestors.add(v);
+    let result: WorkJson;
+    if (Array.isArray(v)) {
+      if (Object.getPrototypeOf(v) !== Array.prototype) invalid();
+      if (v.length > MAX_ARRAY) limit();
+      const fields = Object.getOwnPropertyDescriptors(v);
+      if (Reflect.ownKeys(fields).length !== v.length + 1) invalid();
+      result = [];
+      for (let i = 0; i < v.length; i++) {
+        const d = fields[String(i)];
+        if (!d || !Object.hasOwn(d, "value") || !d.enumerable) invalid();
+        result.push(copy(d.value, depth + 1));
+      }
+    } else {
+      const fields = ownWorkFields(v);
+      result = {};
+      for (const key of Object.keys(fields)) {
+        Object.defineProperty(result, key, { value: copy(fields[key].value, depth + 1), enumerable: true, writable: true, configurable: true });
+      }
+    }
+    ancestors.delete(v);
+    return result;
+  }
+  return copy(value, 1);
+}
+
+/** Exact decimal arithmetic BEFORE Number conversion, without unbounded exponent allocation. */
+function integerToken(token: string): number {
+  const match = /^(-?)(\d+)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(token)!;
+  let digits = (match[2] + (match[3] ?? "")).replace(/^0+/, "");
+  if (!digits) return 0;
+  let shift = BigInt(match[4] ?? "0") - BigInt((match[3] ?? "").length);
+  const trailing = /0*$/.exec(digits)![0].length;
+  digits = digits.slice(0, digits.length - trailing);
+  shift += BigInt(trailing);
+  if (shift < 0n || BigInt(digits.length) + shift > 16n) invalid();
+  const exact = BigInt(digits) * (10n ** shift);
+  if (exact > BigInt(Number.MAX_SAFE_INTEGER)) invalid();
+  return Number(match[1] === "-" ? -exact : exact);
+}
+
+type JsonNode =
+  | { type: "literal"; value: null | boolean | string }
+  | { type: "number"; token: string }
+  | { type: "array"; items: JsonNode[] }
+  | { type: "object"; entries: Array<[string, JsonNode]> };
+
+function checkMembers(node: JsonNode): void {
+  if (node.type === "object") {
+    const names = new Set<string>();
+    for (const [key, child] of node.entries) {
+      if (names.has(key)) throw new WorkInputError("WORK_DUPLICATE_MEMBER");
+      names.add(key);
+      checkMembers(child);
+    }
+  } else if (node.type === "array") node.items.forEach(checkMembers);
+}
+function materialize(node: JsonNode): WorkJson {
+  if (node.type === "number") return integerToken(node.token);
+  if (node.type === "literal") return typeof node.value === "string" ? unicode(node.value) : node.value;
+  if (node.type === "array") return node.items.map(materialize);
+  return Object.fromEntries(node.entries.map(([key, child]) => [unicode(key), materialize(child)]));
+}
+
+/** Bounded syntax tree: syntax, decoded duplicates, then exact numeric/string profile. */
+export function parseWorkJson(text: string): WorkJson {
+  if (typeof text !== "string") invalid();
+  if (Buffer.byteLength(text, "utf8") > WORK_EVENT_BYTES) limit();
+  let at = 0;
+  const syntax = (): never => { throw new WorkInputError("WORK_JSON_INVALID"); };
+  const whitespace = () => { while (at < text.length && /[ \t\r\n]/.test(text[at])) at++; };
+  function string(): string {
+    const start = at++;
+    while (at < text.length) {
+      const char = text[at++];
+      if (char === '"') {
+        // JSON.parse is used ONLY for one lexically delimited string token, never an object.
+        return JSON.parse(text.slice(start, at)) as string;
+      }
+      if (char.charCodeAt(0) < 0x20) syntax();
+      if (char === "\\") {
+        const escape = text[at++];
+        if (escape === "u") {
+          if (!/^[0-9a-fA-F]{4}$/.test(text.slice(at, at + 4))) syntax();
+          at += 4;
+        } else if (!escape || !'"\\/bfnrt'.includes(escape)) syntax();
+      }
+    }
+    return syntax();
+  }
+  function value(depth: number): JsonNode {
+    whitespace();
+    const char = text[at];
+    if (char === '"') return { type: "literal", value: string() };
+    if (char === "{" || char === "[") {
+      if (depth > MAX_DEPTH) limit();
+      at++;
+      whitespace();
+      const object = char === "{";
+      const end = object ? "}" : "]";
+      const entries: Array<[string, JsonNode]> = [];
+      const items: JsonNode[] = [];
+      if (text[at] !== end) for (;;) {
+        whitespace();
+        let key = "";
+        if (object) {
+          if (text[at] !== '"') syntax();
+          key = string();
+          whitespace();
+          if (text[at++] !== ":") syntax();
+        } else if (items.length >= MAX_ARRAY) limit();
+        const child = value(depth + 1);
+        if (object) entries.push([key, child]); else items.push(child);
+        whitespace();
+        if (text[at] === end) break;
+        if (text[at++] !== ",") syntax();
+      }
+      at++;
+      return object ? { type: "object", entries } : { type: "array", items };
+    }
+    for (const [token, literal] of [["null", null], ["true", true], ["false", false]] as const) {
+      if (text.startsWith(token, at)) { at += token.length; return { type: "literal", value: literal }; }
+    }
+    const token = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(text.slice(at));
+    if (!token) return syntax();
+    at += token[0].length;
+    return { type: "number", token: token[0] };
+  }
+  const result = value(1);
+  whitespace();
+  if (at !== text.length) syntax();
+  checkMembers(result);
+  return materialize(result);
+}
+
+function emit(value: WorkJson): string {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(emit).join(",")}]`;
+  // Emit keys directly: reconstructing a JS object would reorder numeric-looking keys.
+  return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${emit(value[key])}`).join(",")}}`;
+}
+
+/** RFC 8785 emission restricted to our validated JSON profile; not an archival-byte identity. */
+export function canonicalWorkJson(value: unknown): string { return emit(copyWorkJson(value)); }
+export function workDigest(value: unknown): string {
+  return createHash("sha256").update(canonicalWorkJson(value), "utf8").digest("hex");
+}
+/** @internal ONLY validated constituents / internally constructed plain results. Output collections
+ * are not wire records: they may contain >256 claims, problems, labels, or conflict alternatives.
+ * Never use this emitter in place of copyWorkJson/strict ingestion at an input boundary. */
+export function workResultKey<T>(value: T): string { return emit(value as unknown as WorkJson); }
+export function sortWorkResults<T>(values: Iterable<T>): T[] {
+  const rows = new Map([...values].map(value => [workResultKey(value), value]));
+  return [...rows].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, value]) => value);
+}
+export function mergeWorkProblems(values: readonly WorkFrozen<WorkProblem>[]): WorkFrozen<WorkProblem>[] {
+  const rows = new Map<string, WorkFrozen<WorkProblem>>();
+  for (const row of values) {
+    const id = workResultKey([row.code, row.reference]), prior = rows.get(id);
+    rows.set(id, { ...row, affectedObligations: sortWorkResults([...(prior?.affectedObligations ?? []), ...row.affectedObligations]) });
+  }
+  return sortWorkResults(rows.values());
+}
+export function mergeWorkConflicts(values: readonly WorkFrozen<WorkConflict>[]): WorkFrozen<WorkConflict>[] {
+  const rows = new Map<string, WorkFrozen<WorkConflict>>();
+  for (const row of values) {
+    const id = workResultKey([row.kind, row.id]), prior = rows.get(id);
+    rows.set(id, { ...row, digests: sortWorkResults([...(prior?.digests ?? []), ...row.digests]),
+      affectedObligations: sortWorkResults([...(prior?.affectedObligations ?? []), ...row.affectedObligations]) });
+  }
+  return sortWorkResults(rows.values());
+}
+export function freezeWork<T>(value: T): WorkFrozen<T> {
+  if (value !== null && typeof value === "object") {
+    for (const child of Object.values(value)) freezeWork(child);
+    Object.freeze(value);
+  }
+  return value as WorkFrozen<T>;
+}

package/src/work-ledger-occurrences.ts

@@ -0,0 +1,99 @@
+import { workResultKey as key, sortWorkResults as sorted, mergeWorkProblems } from "./work-ledger-json.ts";
+import { workEventConflictSources, type indexWorkLedgerText } from "./work-ledger-projection.ts";
+import type {
+  WorkFrozen, WorkSnapshot, WorkOccurrenceEvent, WorkOccurrencePayload, WorkAttempt,
+  WorkAttemptBinding, WorkRuntime, WorkProblem, WorkConflict,
+} from "./work-ledger-types.ts";
+
+type Occurrence = WorkFrozen<WorkOccurrenceEvent>;
+type Problem = WorkFrozen<WorkProblem>;
+const eventRef = (e: Occurrence) => ({ eventId: e.eventId, digest: e.digest });
+const emptyLabels = (): WorkOccurrencePayload["labels"] => ({ sessionId: null, branchLeafId: null,
+  toolCallId: null, taskId: null, workspaceId: null, definitionDigest: null, configurationDigest: null, modelId: null, effortId: null });
+
+/** @internal One governed execution identity, many explicit work associations. No acceptance inferred. */
+export function foldWorkOccurrences(index: ReturnType<typeof indexWorkLedgerText>, snapshot: WorkFrozen<WorkSnapshot>) {
+  const groups = new Map<string, Occurrence[]>();
+  const effectiveRefs = new Set(index.effectiveEvents.map(e => key({ eventId: e.eventId, digest: e.digest })));
+  for (const event of index.candidates) if (event.event === "work_occurrence") {
+    const group = groups.get(event.payload.executionId) ?? [];
+    group.push(event); groups.set(event.payload.executionId, group);
+  }
+  const effective = new Map([...groups].map(([id, group]) => [id, group.filter(e => effectiveRefs.has(key(eventRef(e))))]));
+  const selectedObligations = new Set(snapshot.bindings.map(b => key(b.obligation)));
+  const selectedJoin = (e: Occurrence) => key(e.payload.scope) === key(snapshot.scope) && selectedObligations.has(key(e.payload.obligation));
+  const attempts: WorkFrozen<WorkAttempt>[] = [], occurrences: WorkFrozen<WorkRuntime>["occurrences"][number][] = [];
+  const allProblems: Problem[] = [], conflicts: WorkFrozen<WorkConflict>[] = [];
+  const eventProblems = new Map<string, readonly Problem[]>();
+  for (const [executionId, candidates] of groups) {
+    const clean = effective.get(executionId)!;
+    const bindings = new Map<string, WorkFrozen<WorkAttemptBinding>>();
+    for (const event of clean.filter(selectedJoin)) {
+      const p = event.payload, id = key([p.scope, p.obligation]), prior = bindings.get(id);
+      bindings.set(id, { scope: p.scope, obligation: p.obligation,
+        variantIds: sorted([...(prior?.variantIds ?? []), ...(p.variantId ? [p.variantId] : [])]),
+        artifacts: sorted([...(prior?.artifacts ?? []), ...(p.artifact ? [p.artifact] : [])]),
+      });
+    }
+    const affected = sorted([...bindings.values()].map(b => b.obligation));
+    const problems: Problem[] = [];
+    const problem = (code: WorkProblem["code"], id = executionId) => problems.push({ code, reference: { type: "execution", id }, affectedObligations: affected });
+    const badSources = sorted(candidates.flatMap(e => workEventConflictSources(index, e)));
+    for (const ref of badSources) problems.push({ code: "EVENT_CONFLICT", reference: { type: "event", ref }, affectedObligations: affected });
+    if (bindings.size) for (const id of sorted(badSources.map(ref => ref.eventId))) {
+      conflicts.push({ kind: "event", id, digests: index.conflictingEvents.filter(ref => ref.eventId === id).map(ref => ref.digest), affectedObligations: affected });
+    }
+    const parents = sorted(clean.map(e => e.payload.parentExecutionId));
+    const children = sorted(clean.flatMap(e => e.payload.childId ? [e.payload.childId] : []));
+    const identityConflict = parents.length > 1 || children.length > 1;
+    if (identityConflict) problem("OCCURRENCE_CONFLICT");
+    let parentExecutionId = parents.length === 1 ? parents[0] : null;
+    let childId = children.length === 1 ? children[0] : null;
+    const observed = clean.filter(e => e.payload.provenance === "observed");
+    const declaredLabels = sorted(clean.filter(e => e.payload.provenance === "declared").map(e => e.payload.labels));
+    const observedLabels = sorted(observed.map(e => e.payload.labels));
+    const effectiveLabels = emptyLabels();
+    for (const label of Object.keys(effectiveLabels) as Array<keyof WorkOccurrencePayload["labels"]>) {
+      const values = sorted(observed.flatMap(e => e.payload.labels[label] === null ? [] : [e.payload.labels[label]!]));
+      if (values.length > 1) problem("OBSERVATION_CONFLICT");
+      else effectiveLabels[label] = values[0] ?? null;
+    }
+    const states = new Set(observed.map(e => e.payload.state));
+    const terminalConflict = states.has("completed") && states.has("failed");
+    if (terminalConflict) problem("OBSERVATION_CONFLICT");
+    let state: WorkAttempt["state"] = terminalConflict ? "conflicted" : states.has("completed") ? "completed" :
+      states.has("failed") ? "failed" : states.has("running") ? "running" : states.has("starting") ? "starting" : "unknown";
+    if (identityConflict || badSources.length) {
+      state = "conflicted"; parentExecutionId = null; childId = null;
+      Object.assign(effectiveLabels, emptyLabels());
+    } else {
+      const seen = new Set([executionId]);
+      let parent = parentExecutionId;
+      while (parent !== null) {
+        if (seen.has(parent)) { problem("PARENT_CYCLE", parent); break; }
+        seen.add(parent);
+        const bodies = effective.get(parent);
+        if (!bodies?.length) { problem("PARENT_MISSING", parent); break; }
+        const alternatives = sorted(bodies.map(e => e.payload.parentExecutionId));
+        if (alternatives.length !== 1) { problem("OCCURRENCE_CONFLICT", parent); break; }
+        parent = alternatives[0];
+      }
+      if (effectiveLabels.branchLeafId === null) problem("BRANCH_UNKNOWN");
+    }
+    const rowProblems = mergeWorkProblems(problems);
+    // Support closure can name an occurrence even when its association is not selected. Keep its
+    // global identity diagnostics available internally; only selected joins become public attempts.
+    for (const candidate of candidates) eventProblems.set(key(eventRef(candidate)), rowProblems);
+    if (!bindings.size) continue;
+    allProblems.push(...rowProblems);
+    occurrences.push(...candidates.map(e => ({ event: eventRef(e), payload: e.payload })));
+    attempts.push({ executionId, bindings: sorted(bindings.values()), parentExecutionId, childId, declaredLabels,
+      observedLabels, effectiveLabels, state, resolution: rowProblems.length ? "unresolved" : "resolved", problems: rowProblems });
+  }
+  const runtime: WorkFrozen<WorkRuntime> = { attempts: sorted(attempts), occurrences: sorted(occurrences), counts: {
+    attempts: attempts.length,
+    variants: new Set(attempts.flatMap(a => a.bindings.flatMap(b => b.variantIds))).size,
+    observedCompletedAttempts: attempts.filter(a => a.resolution === "resolved" && a.state === "completed").length,
+  } };
+  return { runtime, problems: mergeWorkProblems(allProblems), conflicts, eventProblems };
+}

package/src/work-ledger-projection.ts

@@ -0,0 +1,262 @@
+import { parseWorkLedgerText } from "./work-ledger.ts";
+import { canonicalWorkJson, freezeWork, workDigest, workResultKey as key, sortWorkResults as unique,
+  mergeWorkProblems, mergeWorkConflicts } from "./work-ledger-json.ts";
+import type { EventRef, RevisionRef, WorkFrozen, WorkIngestion, WorkLedgerEvent, WorkProjectionContext,
+  WorkClaimResult, WorkObligationResult, WorkProblem, WorkConflict, WorkCoverage, WorkCoverageItem,
+  WorkReference, WorkAcceptanceEvent, WorkAvailability } from "./work-ledger-types.ts";
+import type { resolveWorkSnapshotText } from "./work-ledger-snapshot.ts";
+import type { foldWorkOccurrences } from "./work-ledger-occurrences.ts";
+
+type IndexedEvent = WorkFrozen<WorkLedgerEvent>;
+
+/**
+ * Internal first-pass evidence index, NOT the public WorkProjection result.
+ * No selector, graph resolution, runtime counts or authority decisions are inferred here.
+ * Keep every candidate plus the exact conflicting event references: later reachability must
+ * inspect all alternatives, including nonselected associations and redelivered revision bodies.
+ */
+interface WorkReplayIndex {
+  readonly ingestion: WorkFrozen<WorkIngestion>;
+  /** One body per validated (eventId,digest); includes quarantined evidence. */
+  readonly candidates: readonly IndexedEvent[];
+  /** Every alternative of every ID with multiple digests; not a chosen winner or receipt conflict. */
+  readonly conflictingEvents: ReadonlyArray<WorkFrozen<EventRef>>;
+  /** Exact revision bodies appearing in those conflicts, independent of delivery ID/timestamp. */
+  readonly quarantinedRevisions: ReadonlyArray<WorkFrozen<RevisionRef>>;
+  /** Central, frozen source index. Body keys point to IDs, not duplicated Cartesian candidate lists. */
+  readonly conflictSources: {
+    readonly bodies: Readonly<Record<string, readonly string[]>>;
+    readonly events: Readonly<Record<string, readonly WorkFrozen<EventRef>[]>>;
+  };
+  /** Clean delivery identities only; these are evidence, never proof of acceptance or a current head. */
+  readonly effectiveEvents: readonly IndexedEvent[];
+}
+
+const revisionIdentity = ({ kind, id, revision, digest }: WorkFrozen<RevisionRef>) => key(["revision", kind, id, revision, digest]);
+/** The ONLY nested identity definition. Claims deliberately have no nested quarantine identity. */
+function nestedIdentity(event: IndexedEvent): string | null {
+  switch (event.event) {
+    case "work_revision": return revisionIdentity(event.payload.revision);
+    case "work_snapshot": return key(["snapshot", event.payload.snapshot.snapshotId, event.payload.snapshot.digest]);
+    case "work_occurrence": return key(["occurrence", event.payload]);
+    case "work_acceptance": return null;
+  }
+}
+type Sources = Pick<WorkReplayIndex, "conflictSources">;
+function sourceIds(index: Sources, event: IndexedEvent | WorkFrozen<EventRef>): readonly string[] {
+  const nested = "event" in event ? nestedIdentity(event) : null;
+  return [...(index.conflictSources.events[key(event.eventId)] ? [event.eventId] : []),
+    ...(nested === null ? [] : index.conflictSources.bodies[nested] ?? [])];
+}
+/** @internal Only index-derived validated events/references. Raw alternatives remain diagnostic input. */
+export function workEventConflictSources(index: Sources, event: IndexedEvent | WorkFrozen<EventRef>): WorkFrozen<EventRef>[] {
+  return unique(unique(sourceIds(index, event)).flatMap(id => index.conflictSources.events[key(id)]));
+}
+/** @internal Exact revision references need not have a clean delivery to be quarantined. */
+export function workRevisionConflictSources(index: Sources, ref: WorkFrozen<RevisionRef>): readonly WorkFrozen<EventRef>[] {
+  return unique((index.conflictSources.bodies[revisionIdentity(ref)] ?? []).flatMap(id => index.conflictSources.events[key(id)]));
+}
+
+function sorted<T>(values: Iterable<T>): T[] {
+  // Canonicalize individual rows, not the aggregate. A valid 10,000-record input can have
+  // more than 256 candidates/conflicts; the per-wire-array bound must not truncate replay.
+  return [...values].map(value => ({ value, key: canonicalWorkJson(value) }))
+    .sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0)
+    .map(entry => entry.value);
+}
+
+/**
+ * @internal Strict text -> complete delivery grouping -> quarantine -> effective evidence.
+ * Deliberately not re-exported by work-ledger.ts: this is not an unchecked public projector.
+ * Raw serialized/archival byte hashes play no role in semantic delivery identity.
+ */
+export function indexWorkLedgerText(text: string): WorkReplayIndex {
+  const ingestion = parseWorkLedgerText(text);
+  const groups = new Map<string, Map<string, IndexedEvent>>();
+  for (const event of ingestion.events) {
+    let group = groups.get(event.eventId);
+    if (!group) { group = new Map(); groups.set(event.eventId, group); }
+    if (!group.has(event.digest)) {
+      // Equal canonical digests can arrive with different property insertion orders. Normalize
+      // the validated body so even serialized index output does not choose an arrival's key order.
+      // Parse ONLY our own canonical emission, never raw input. Strict ingestion already checked
+      // duplicates, domains and digests. JCS can expand exact exponent tokens beyond the delivered
+      // text size, so applying the raw-line byte bound again here would reject valid evidence.
+      const normalized = JSON.parse(canonicalWorkJson(event)) as WorkLedgerEvent;
+      group.set(event.digest, freezeWork(normalized));
+    }
+  }
+
+  const conflictingEvents: EventRef[] = [];
+  const quarantined = new Map<string, RevisionRef>(); // Retained diagnostic view, not a second quarantine policy.
+  const bodies = new Map<string, Set<string>>(), eventGroups = new Map<string, EventRef[]>();
+  for (const [eventId, group] of groups) {
+    if (group.size < 2) continue;
+    eventGroups.set(key(eventId), sorted([...group.values()].map(event => ({ eventId, digest: event.digest }))));
+    for (const event of group.values()) {
+      conflictingEvents.push({ eventId, digest: event.digest });
+      const identity = nestedIdentity(event);
+      if (identity !== null) {
+        const ids = bodies.get(identity) ?? new Set<string>();
+        ids.add(eventId); bodies.set(identity, ids);
+      }
+      if (event.event === "work_revision") {
+        const { kind, id, revision, digest } = event.payload.revision;
+        // Ingestion verified that this digest covers the entire revision, including kind/ID/scope.
+        // Quarantine exact bodies, not every fork or successor sharing a stable entity ID.
+        quarantined.set(digest, { kind, id, revision, digest });
+      }
+    }
+  }
+
+  const candidates = sorted([...groups.values()].flatMap(group => [...group.values()]));
+  const byKey = <T>(map: Map<string, T>) => [...map].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  const conflictSources = { bodies: Object.fromEntries(byKey(bodies).map(([identity, ids]) => [identity, [...ids].sort()])),
+    events: Object.fromEntries(byKey(eventGroups)) };
+  // All existing nested identities use the same source index before any effective evidence is exposed.
+  const effectiveEvents = ingestion.complete ? candidates.filter(event => !sourceIds({ conflictSources }, event).length) : [];
+  return freezeWork({
+    ingestion, candidates, conflictingEvents: sorted(conflictingEvents), conflictSources,
+    quarantinedRevisions: sorted(quarantined.values()), effectiveEvents,
+  });
+}
+
+type Problem = WorkFrozen<WorkProblem>;
+type Claim = WorkFrozen<WorkAcceptanceEvent>;
+const eventRef = (event: IndexedEvent): EventRef => ({ eventId: event.eventId, digest: event.digest });
+const eventReference = (event: IndexedEvent): WorkFrozen<WorkReference> => ({ type: "event", ref: eventRef(event) });
+const isConflict = (p: Problem) => p.code.endsWith("CONFLICT");
+function coverage(items: readonly WorkFrozen<WorkCoverageItem>[]): WorkFrozen<WorkCoverage> {
+  const state = (["conflicted", "unavailable", "unknown"] as const).find(s => items.some(item => item.state === s));
+  return { state: state ?? (items.length ? "available" : "unknown"), items: unique(items) };
+}
+
+/** @internal Global receipt identity diagnostics exist even without a resolved work selector. */
+export function indexWorkReceipts(authority: WorkFrozen<WorkProjectionContext>["authority"]) {
+  type Decision = NonNullable<WorkFrozen<WorkProjectionContext>["authority"]>["decisions"][number];
+  const receipts = new Map<string, Map<string, Decision>>();
+  const conflicts: WorkFrozen<WorkConflict>[] = [];
+  for (const d of authority?.decisions ?? []) {
+    const group = receipts.get(d.receiptId) ?? new Map<string, Decision>();
+    // Complete decision + enclosing authority snapshot; diagnostic identity, NOT authentication.
+    group.set(workDigest({ authoritySnapshot: authority!.snapshot, ...d }), d); receipts.set(d.receiptId, group);
+  }
+  for (const [id, group] of receipts) if (group.size > 1) {
+    conflicts.push({ kind: "receipt", id, digests: unique(group.keys()), affectedObligations: [] });
+  }
+  return { receipts, conflicts: unique(conflicts) };
+}
+
+/** @internal Conditional binding proof, not authentication. Only the separately supplied, validated
+ * host authority is a TCB input. No wire label, event, receipt-shaped payload or environment is trust. */
+export function projectWorkAcceptance(index: WorkReplayIndex, structure: ReturnType<typeof resolveWorkSnapshotText>,
+  authority: WorkFrozen<WorkProjectionContext>["authority"], runtime: ReturnType<typeof foldWorkOccurrences>) {
+  const snapshot = structure.snapshot!;
+  const claims: WorkFrozen<WorkClaimResult>[] = [], obligations: WorkFrozen<WorkObligationResult>[] = [];
+  const problems: Problem[] = [...structure.problems];
+  const conflicts: WorkFrozen<WorkConflict>[] = [...structure.conflicts, ...runtime.conflicts];
+  const eventConflicts = new Set(index.conflictingEvents.map(e => e.eventId));
+  const events = new Map(index.candidates.map(e => [key(eventRef(e)), e]));
+  const receiptIndex = indexWorkReceipts(authority), { receipts } = receiptIndex;
+  conflicts.push(...receiptIndex.conflicts);
+  const decisions = [...receipts.values()].filter(g => g.size === 1).flatMap(g => [...g.values()]);
+  function available(kind: "artifact" | "evidence", id: string, digest: string): WorkFrozen<WorkCoverageItem> {
+    const values = unique((authority?.availability ?? []).filter(row => row.kind === kind && row.id === id && row.digest === digest).map(row => row.available));
+    const state: WorkAvailability = values.length > 1 ? "conflicted" : values.length === 0 ? "unknown" : values[0] ? "available" : "unavailable";
+    return { kind, identity: { id, digest }, state };
+  }
+  const allClaims = index.candidates.filter((e): e is Claim => e.event === "work_acceptance");
+  function sourceProblems(ref: WorkFrozen<EventRef>, affected: readonly WorkFrozen<RevisionRef>[]): Problem[] {
+    const result: Problem[] = [];
+    const found = events.get(key(ref));
+    for (const event of workEventConflictSources(index, found ?? ref)) {
+      result.push({ code: "EVENT_CONFLICT", reference: { type: "event", ref: event }, affectedObligations: affected });
+    }
+    if (!found) result.push({ code: "REFERENCE_MISSING", reference: { type: "event", ref }, affectedObligations: affected });
+    for (const p of runtime.eventProblems.get(key(ref)) ?? []) result.push({ ...p, affectedObligations: affected });
+    return mergeWorkProblems(result);
+  }
+  for (const row of structure.obligations) {
+    const binding = row.binding, affected = [binding.obligation];
+    const problem = (code: WorkProblem["code"], reference: WorkFrozen<WorkReference> | null): Problem => ({ code, reference, affectedObligations: affected });
+    const inventoryProblem = problem("ARTIFACT_UNSELECTED", { type: "revision", ref: binding.obligation });
+    const blockers: Problem[] = [...row.problems, ...(binding.artifact === null ? [inventoryProblem] : [])];
+    const selectedClaims = allClaims.filter(e => e.payload.binding.scope.id === snapshot.scope.id && e.payload.binding.obligation.id === binding.obligation.id);
+    const applicable = (claim: Claim) => {
+      const b = claim.payload.binding;
+      return key(b.snapshot) === key(structure.selectedSnapshot) && key(b.scope) === key(snapshot.scope) &&
+        key(b.intent) === key(binding.intent) && key(b.obligation) === key(binding.obligation) &&
+        key(b.artifact) === key(binding.artifact) && key(b.policy) === key(binding.policy);
+    };
+    const current = selectedClaims.filter(applicable);
+    const currentRefs = new Set(current.map(e => key(eventRef(e))));
+    for (const e of current) if (eventConflicts.has(e.eventId)) {
+      blockers.push(...index.conflictingEvents.filter(ref => ref.eventId === e.eventId).map(ref => problem("EVENT_CONFLICT", { type: "event", ref })));
+    }
+    for (const [id, group] of receipts) if (group.size > 1 && [...group.values()].some(d => currentRefs.has(key(d.claim)))) {
+      conflicts.push({ kind: "receipt", id, digests: unique(group.keys()), affectedObligations: affected });
+      blockers.push(problem("RECEIPT_CONFLICT", { type: "authority", ref: authority!.snapshot }));
+    }
+    const artifactItems = row.artifact ? [available("artifact", row.artifact.id, row.artifact.contentDigest)] : [];
+    const artifactCoverage: WorkFrozen<WorkCoverage> = binding.artifact === null ? { state: "unselected", items: [] } : coverage(artifactItems);
+    const evidenceCoverage = coverage(unique(current.flatMap(e => e.payload.binding.evidence.map(ref => available("evidence", ref.id, ref.digest)))));
+    function coverageProblems(items: readonly WorkFrozen<WorkCoverageItem>[]): Problem[] {
+      return items.filter(item => item.state !== "available").map(item => problem(
+        item.state === "conflicted" ? "AVAILABILITY_CONFLICT" : item.state === "unavailable" ? "BYTES_UNAVAILABLE" : "AVAILABILITY_MISSING",
+        { type: item.kind === "artifact" ? "artifact-bytes" : "evidence-bytes", ref: item.identity },
+      ));
+    }
+    const rowClaims: WorkFrozen<WorkClaimResult>[] = [];
+    const trustedDecisions = new Set<string>();
+    for (const claim of selectedClaims) {
+      if (eventConflicts.has(claim.eventId)) continue; // No first/last winner row, even for a favorable exact alternative.
+      if (!applicable(claim)) {
+        rowClaims.push({ claim: eventRef(claim), obligation: claim.payload.binding.obligation, applicability: "superseded",
+          matchedReceiptIds: [], problems: [problem("SUPERSEDED_BINDING", eventReference(claim))] });
+        continue;
+      }
+      const b = claim.payload.binding;
+      const local: Problem[] = [];
+      const bytesMatch = row.artifact !== null && b.artifactDigest === row.artifact.contentDigest;
+      if (row.artifact && !bytesMatch) local.push(problem("ARTIFACT_DIGEST_MISMATCH", { type: "artifact-bytes", ref: { id: row.artifact.id, digest: b.artifactDigest } }));
+      if (!row.artifact && binding.artifact) local.push(problem("REFERENCE_MISSING", { type: "revision", ref: binding.artifact }));
+      const matching = decisions.filter(d => bytesMatch && key(d.claim) === key(eventRef(claim)) &&
+        d.authorityId === claim.payload.authorityId && key(d.binding) === key(b));
+      for (const d of matching) trustedDecisions.add(d.decision);
+      if (!authority) local.push(problem("AUTHORITY_MISSING", null));
+      else if (!matching.length) local.push(problem(decisions.some(d => d.claim.eventId === claim.eventId) ? "RECEIPT_MISMATCH" : "RECEIPT_MISSING", eventReference(claim)));
+      const support = b.evidence.flatMap(ref => ref.event ? sourceProblems(ref.event, affected) : []);
+      const availabilityProblems = coverageProblems([...artifactItems, ...b.evidence.map(ref => available("evidence", ref.id, ref.digest))]);
+      local.push(...support, ...availabilityProblems);
+      // Only EXACT matching current trusted decisions root global support conflicts. Missing trust,
+      // wrong bytes and superseded/mismatched receipts cannot turn an unsupported sibling into a veto.
+      if (matching.length) blockers.push(...support.filter(isConflict), ...availabilityProblems.filter(isConflict));
+      const rejection = matching.some(d => d.decision === "reject");
+      rowClaims.push({ claim: eventRef(claim), obligation: b.obligation,
+        applicability: rejection ? "unaccepted" : matching.some(d => d.decision === "accept") && local.length === 0 ? "accepted-under-supplied-authority" : "unresolved",
+        matchedReceiptIds: unique(matching.map(d => d.receiptId)),
+        problems: rejection ? [problem("TRUSTED_REJECTION", eventReference(claim))] : mergeWorkProblems(local),
+      });
+    }
+    if (trustedDecisions.size > 1) blockers.push(problem("DECISION_CONFLICT", { type: "revision", ref: binding.obligation }));
+    const blocked = mergeWorkProblems(blockers);
+    for (const p of blocked) if (p.code === "EVENT_CONFLICT" && p.reference?.type === "event") {
+      const id = p.reference.ref.eventId;
+      conflicts.push({ kind: "event", id, digests: index.conflictingEvents.filter(e => e.eventId === id).map(e => e.digest), affectedObligations: affected });
+    }
+    const finalClaims = rowClaims.map(c => blocked.length && c.applicability !== "superseded" ? { ...c, applicability: "unresolved" as const, problems: blocked } : c);
+    const accepted = finalClaims.some(c => c.applicability === "accepted-under-supplied-authority");
+    const rejected = finalClaims.some(c => c.applicability === "unaccepted");
+    const unresolved = finalClaims.filter(c => c.applicability === "unresolved");
+    const acceptance = blocked.length ? "unresolved" : accepted ? "accepted-under-supplied-authority" : rejected ? "unaccepted" : unresolved.length ? "unresolved" : "unaccepted";
+    const obligationProblems = blocked.length ? blocked : accepted ? [] : rejected ?
+      finalClaims.filter(c => c.applicability === "unaccepted").flatMap(c => c.problems) : unresolved.length ? unresolved.flatMap(c => c.problems) :
+        [problem("NO_CLAIM", { type: "revision", ref: binding.obligation })];
+    obligations.push({ binding, acceptance, artifactCoverage, evidenceCoverage, claims: unique(finalClaims.map(c => c.claim)), problems: mergeWorkProblems(obligationProblems) });
+    claims.push(...finalClaims); problems.push(...obligationProblems, ...finalClaims.flatMap(c => c.problems));
+  }
+  return { obligations: unique(obligations), claims: unique(claims), supersededClaims: claims.filter(c => c.applicability === "superseded").length,
+    conflicts: mergeWorkConflicts(conflicts), problems: mergeWorkProblems([...problems, ...runtime.problems]),
+    progress: { accepted: obligations.filter(o => o.acceptance === "accepted-under-supplied-authority").length, total: obligations.length },
+  };
+}