pi-daddy 0.27.4 → 0.32.0

package/src/work-ledger-projection.ts

@@ -1,262 +0,0 @@
-import { parseWorkLedgerText } from "./work-ledger.ts";
-import { canonicalWorkJson, freezeWork, workDigest, workResultKey as key, sortWorkResults as unique,
-  mergeWorkProblems, mergeWorkConflicts } from "./work-ledger-json.ts";
-import type { EventRef, RevisionRef, WorkFrozen, WorkIngestion, WorkLedgerEvent, WorkProjectionContext,
-  WorkClaimResult, WorkObligationResult, WorkProblem, WorkConflict, WorkCoverage, WorkCoverageItem,
-  WorkReference, WorkAcceptanceEvent, WorkAvailability } from "./work-ledger-types.ts";
-import type { resolveWorkSnapshotText } from "./work-ledger-snapshot.ts";
-import type { foldWorkOccurrences } from "./work-ledger-occurrences.ts";
-
-type IndexedEvent = WorkFrozen<WorkLedgerEvent>;
-
-/**
- * Internal first-pass evidence index, NOT the public WorkProjection result.
- * No selector, graph resolution, runtime counts or authority decisions are inferred here.
- * Keep every candidate plus the exact conflicting event references: later reachability must
- * inspect all alternatives, including nonselected associations and redelivered revision bodies.
- */
-interface WorkReplayIndex {
-  readonly ingestion: WorkFrozen<WorkIngestion>;
-  /** One body per validated (eventId,digest); includes quarantined evidence. */
-  readonly candidates: readonly IndexedEvent[];
-  /** Every alternative of every ID with multiple digests; not a chosen winner or receipt conflict. */
-  readonly conflictingEvents: ReadonlyArray<WorkFrozen<EventRef>>;
-  /** Exact revision bodies appearing in those conflicts, independent of delivery ID/timestamp. */
-  readonly quarantinedRevisions: ReadonlyArray<WorkFrozen<RevisionRef>>;
-  /** Central, frozen source index. Body keys point to IDs, not duplicated Cartesian candidate lists. */
-  readonly conflictSources: {
-    readonly bodies: Readonly<Record<string, readonly string[]>>;
-    readonly events: Readonly<Record<string, readonly WorkFrozen<EventRef>[]>>;
-  };
-  /** Clean delivery identities only; these are evidence, never proof of acceptance or a current head. */
-  readonly effectiveEvents: readonly IndexedEvent[];
-}
-
-const revisionIdentity = ({ kind, id, revision, digest }: WorkFrozen<RevisionRef>) => key(["revision", kind, id, revision, digest]);
-/** The ONLY nested identity definition. Claims deliberately have no nested quarantine identity. */
-function nestedIdentity(event: IndexedEvent): string | null {
-  switch (event.event) {
-    case "work_revision": return revisionIdentity(event.payload.revision);
-    case "work_snapshot": return key(["snapshot", event.payload.snapshot.snapshotId, event.payload.snapshot.digest]);
-    case "work_occurrence": return key(["occurrence", event.payload]);
-    case "work_acceptance": return null;
-  }
-}
-type Sources = Pick<WorkReplayIndex, "conflictSources">;
-function sourceIds(index: Sources, event: IndexedEvent | WorkFrozen<EventRef>): readonly string[] {
-  const nested = "event" in event ? nestedIdentity(event) : null;
-  return [...(index.conflictSources.events[key(event.eventId)] ? [event.eventId] : []),
-    ...(nested === null ? [] : index.conflictSources.bodies[nested] ?? [])];
-}
-/** @internal Only index-derived validated events/references. Raw alternatives remain diagnostic input. */
-export function workEventConflictSources(index: Sources, event: IndexedEvent | WorkFrozen<EventRef>): WorkFrozen<EventRef>[] {
-  return unique(unique(sourceIds(index, event)).flatMap(id => index.conflictSources.events[key(id)]));
-}
-/** @internal Exact revision references need not have a clean delivery to be quarantined. */
-export function workRevisionConflictSources(index: Sources, ref: WorkFrozen<RevisionRef>): readonly WorkFrozen<EventRef>[] {
-  return unique((index.conflictSources.bodies[revisionIdentity(ref)] ?? []).flatMap(id => index.conflictSources.events[key(id)]));
-}
-
-function sorted<T>(values: Iterable<T>): T[] {
-  // Canonicalize individual rows, not the aggregate. A valid 10,000-record input can have
-  // more than 256 candidates/conflicts; the per-wire-array bound must not truncate replay.
-  return [...values].map(value => ({ value, key: canonicalWorkJson(value) }))
-    .sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0)
-    .map(entry => entry.value);
-}
-
-/**
- * @internal Strict text -> complete delivery grouping -> quarantine -> effective evidence.
- * Deliberately not re-exported by work-ledger.ts: this is not an unchecked public projector.
- * Raw serialized/archival byte hashes play no role in semantic delivery identity.
- */
-export function indexWorkLedgerText(text: string): WorkReplayIndex {
-  const ingestion = parseWorkLedgerText(text);
-  const groups = new Map<string, Map<string, IndexedEvent>>();
-  for (const event of ingestion.events) {
-    let group = groups.get(event.eventId);
-    if (!group) { group = new Map(); groups.set(event.eventId, group); }
-    if (!group.has(event.digest)) {
-      // Equal canonical digests can arrive with different property insertion orders. Normalize
-      // the validated body so even serialized index output does not choose an arrival's key order.
-      // Parse ONLY our own canonical emission, never raw input. Strict ingestion already checked
-      // duplicates, domains and digests. JCS can expand exact exponent tokens beyond the delivered
-      // text size, so applying the raw-line byte bound again here would reject valid evidence.
-      const normalized = JSON.parse(canonicalWorkJson(event)) as WorkLedgerEvent;
-      group.set(event.digest, freezeWork(normalized));
-    }
-  }
-
-  const conflictingEvents: EventRef[] = [];
-  const quarantined = new Map<string, RevisionRef>(); // Retained diagnostic view, not a second quarantine policy.
-  const bodies = new Map<string, Set<string>>(), eventGroups = new Map<string, EventRef[]>();
-  for (const [eventId, group] of groups) {
-    if (group.size < 2) continue;
-    eventGroups.set(key(eventId), sorted([...group.values()].map(event => ({ eventId, digest: event.digest }))));
-    for (const event of group.values()) {
-      conflictingEvents.push({ eventId, digest: event.digest });
-      const identity = nestedIdentity(event);
-      if (identity !== null) {
-        const ids = bodies.get(identity) ?? new Set<string>();
-        ids.add(eventId); bodies.set(identity, ids);
-      }
-      if (event.event === "work_revision") {
-        const { kind, id, revision, digest } = event.payload.revision;
-        // Ingestion verified that this digest covers the entire revision, including kind/ID/scope.
-        // Quarantine exact bodies, not every fork or successor sharing a stable entity ID.
-        quarantined.set(digest, { kind, id, revision, digest });
-      }
-    }
-  }
-
-  const candidates = sorted([...groups.values()].flatMap(group => [...group.values()]));
-  const byKey = <T>(map: Map<string, T>) => [...map].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-  const conflictSources = { bodies: Object.fromEntries(byKey(bodies).map(([identity, ids]) => [identity, [...ids].sort()])),
-    events: Object.fromEntries(byKey(eventGroups)) };
-  // All existing nested identities use the same source index before any effective evidence is exposed.
-  const effectiveEvents = ingestion.complete ? candidates.filter(event => !sourceIds({ conflictSources }, event).length) : [];
-  return freezeWork({
-    ingestion, candidates, conflictingEvents: sorted(conflictingEvents), conflictSources,
-    quarantinedRevisions: sorted(quarantined.values()), effectiveEvents,
-  });
-}
-
-type Problem = WorkFrozen<WorkProblem>;
-type Claim = WorkFrozen<WorkAcceptanceEvent>;
-const eventRef = (event: IndexedEvent): EventRef => ({ eventId: event.eventId, digest: event.digest });
-const eventReference = (event: IndexedEvent): WorkFrozen<WorkReference> => ({ type: "event", ref: eventRef(event) });
-const isConflict = (p: Problem) => p.code.endsWith("CONFLICT");
-function coverage(items: readonly WorkFrozen<WorkCoverageItem>[]): WorkFrozen<WorkCoverage> {
-  const state = (["conflicted", "unavailable", "unknown"] as const).find(s => items.some(item => item.state === s));
-  return { state: state ?? (items.length ? "available" : "unknown"), items: unique(items) };
-}
-
-/** @internal Global receipt identity diagnostics exist even without a resolved work selector. */
-export function indexWorkReceipts(authority: WorkFrozen<WorkProjectionContext>["authority"]) {
-  type Decision = NonNullable<WorkFrozen<WorkProjectionContext>["authority"]>["decisions"][number];
-  const receipts = new Map<string, Map<string, Decision>>();
-  const conflicts: WorkFrozen<WorkConflict>[] = [];
-  for (const d of authority?.decisions ?? []) {
-    const group = receipts.get(d.receiptId) ?? new Map<string, Decision>();
-    // Complete decision + enclosing authority snapshot; diagnostic identity, NOT authentication.
-    group.set(workDigest({ authoritySnapshot: authority!.snapshot, ...d }), d); receipts.set(d.receiptId, group);
-  }
-  for (const [id, group] of receipts) if (group.size > 1) {
-    conflicts.push({ kind: "receipt", id, digests: unique(group.keys()), affectedObligations: [] });
-  }
-  return { receipts, conflicts: unique(conflicts) };
-}
-
-/** @internal Conditional binding proof, not authentication. Only the separately supplied, validated
- * host authority is a TCB input. No wire label, event, receipt-shaped payload or environment is trust. */
-export function projectWorkAcceptance(index: WorkReplayIndex, structure: ReturnType<typeof resolveWorkSnapshotText>,
-  authority: WorkFrozen<WorkProjectionContext>["authority"], runtime: ReturnType<typeof foldWorkOccurrences>) {
-  const snapshot = structure.snapshot!;
-  const claims: WorkFrozen<WorkClaimResult>[] = [], obligations: WorkFrozen<WorkObligationResult>[] = [];
-  const problems: Problem[] = [...structure.problems];
-  const conflicts: WorkFrozen<WorkConflict>[] = [...structure.conflicts, ...runtime.conflicts];
-  const eventConflicts = new Set(index.conflictingEvents.map(e => e.eventId));
-  const events = new Map(index.candidates.map(e => [key(eventRef(e)), e]));
-  const receiptIndex = indexWorkReceipts(authority), { receipts } = receiptIndex;
-  conflicts.push(...receiptIndex.conflicts);
-  const decisions = [...receipts.values()].filter(g => g.size === 1).flatMap(g => [...g.values()]);
-  function available(kind: "artifact" | "evidence", id: string, digest: string): WorkFrozen<WorkCoverageItem> {
-    const values = unique((authority?.availability ?? []).filter(row => row.kind === kind && row.id === id && row.digest === digest).map(row => row.available));
-    const state: WorkAvailability = values.length > 1 ? "conflicted" : values.length === 0 ? "unknown" : values[0] ? "available" : "unavailable";
-    return { kind, identity: { id, digest }, state };
-  }
-  const allClaims = index.candidates.filter((e): e is Claim => e.event === "work_acceptance");
-  function sourceProblems(ref: WorkFrozen<EventRef>, affected: readonly WorkFrozen<RevisionRef>[]): Problem[] {
-    const result: Problem[] = [];
-    const found = events.get(key(ref));
-    for (const event of workEventConflictSources(index, found ?? ref)) {
-      result.push({ code: "EVENT_CONFLICT", reference: { type: "event", ref: event }, affectedObligations: affected });
-    }
-    if (!found) result.push({ code: "REFERENCE_MISSING", reference: { type: "event", ref }, affectedObligations: affected });
-    for (const p of runtime.eventProblems.get(key(ref)) ?? []) result.push({ ...p, affectedObligations: affected });
-    return mergeWorkProblems(result);
-  }
-  for (const row of structure.obligations) {
-    const binding = row.binding, affected = [binding.obligation];
-    const problem = (code: WorkProblem["code"], reference: WorkFrozen<WorkReference> | null): Problem => ({ code, reference, affectedObligations: affected });
-    const inventoryProblem = problem("ARTIFACT_UNSELECTED", { type: "revision", ref: binding.obligation });
-    const blockers: Problem[] = [...row.problems, ...(binding.artifact === null ? [inventoryProblem] : [])];
-    const selectedClaims = allClaims.filter(e => e.payload.binding.scope.id === snapshot.scope.id && e.payload.binding.obligation.id === binding.obligation.id);
-    const applicable = (claim: Claim) => {
-      const b = claim.payload.binding;
-      return key(b.snapshot) === key(structure.selectedSnapshot) && key(b.scope) === key(snapshot.scope) &&
-        key(b.intent) === key(binding.intent) && key(b.obligation) === key(binding.obligation) &&
-        key(b.artifact) === key(binding.artifact) && key(b.policy) === key(binding.policy);
-    };
-    const current = selectedClaims.filter(applicable);
-    const currentRefs = new Set(current.map(e => key(eventRef(e))));
-    for (const e of current) if (eventConflicts.has(e.eventId)) {
-      blockers.push(...index.conflictingEvents.filter(ref => ref.eventId === e.eventId).map(ref => problem("EVENT_CONFLICT", { type: "event", ref })));
-    }
-    for (const [id, group] of receipts) if (group.size > 1 && [...group.values()].some(d => currentRefs.has(key(d.claim)))) {
-      conflicts.push({ kind: "receipt", id, digests: unique(group.keys()), affectedObligations: affected });
-      blockers.push(problem("RECEIPT_CONFLICT", { type: "authority", ref: authority!.snapshot }));
-    }
-    const artifactItems = row.artifact ? [available("artifact", row.artifact.id, row.artifact.contentDigest)] : [];
-    const artifactCoverage: WorkFrozen<WorkCoverage> = binding.artifact === null ? { state: "unselected", items: [] } : coverage(artifactItems);
-    const evidenceCoverage = coverage(unique(current.flatMap(e => e.payload.binding.evidence.map(ref => available("evidence", ref.id, ref.digest)))));
-    function coverageProblems(items: readonly WorkFrozen<WorkCoverageItem>[]): Problem[] {
-      return items.filter(item => item.state !== "available").map(item => problem(
-        item.state === "conflicted" ? "AVAILABILITY_CONFLICT" : item.state === "unavailable" ? "BYTES_UNAVAILABLE" : "AVAILABILITY_MISSING",
-        { type: item.kind === "artifact" ? "artifact-bytes" : "evidence-bytes", ref: item.identity },
-      ));
-    }
-    const rowClaims: WorkFrozen<WorkClaimResult>[] = [];
-    const trustedDecisions = new Set<string>();
-    for (const claim of selectedClaims) {
-      if (eventConflicts.has(claim.eventId)) continue; // No first/last winner row, even for a favorable exact alternative.
-      if (!applicable(claim)) {
-        rowClaims.push({ claim: eventRef(claim), obligation: claim.payload.binding.obligation, applicability: "superseded",
-          matchedReceiptIds: [], problems: [problem("SUPERSEDED_BINDING", eventReference(claim))] });
-        continue;
-      }
-      const b = claim.payload.binding;
-      const local: Problem[] = [];
-      const bytesMatch = row.artifact !== null && b.artifactDigest === row.artifact.contentDigest;
-      if (row.artifact && !bytesMatch) local.push(problem("ARTIFACT_DIGEST_MISMATCH", { type: "artifact-bytes", ref: { id: row.artifact.id, digest: b.artifactDigest } }));
-      if (!row.artifact && binding.artifact) local.push(problem("REFERENCE_MISSING", { type: "revision", ref: binding.artifact }));
-      const matching = decisions.filter(d => bytesMatch && key(d.claim) === key(eventRef(claim)) &&
-        d.authorityId === claim.payload.authorityId && key(d.binding) === key(b));
-      for (const d of matching) trustedDecisions.add(d.decision);
-      if (!authority) local.push(problem("AUTHORITY_MISSING", null));
-      else if (!matching.length) local.push(problem(decisions.some(d => d.claim.eventId === claim.eventId) ? "RECEIPT_MISMATCH" : "RECEIPT_MISSING", eventReference(claim)));
-      const support = b.evidence.flatMap(ref => ref.event ? sourceProblems(ref.event, affected) : []);
-      const availabilityProblems = coverageProblems([...artifactItems, ...b.evidence.map(ref => available("evidence", ref.id, ref.digest))]);
-      local.push(...support, ...availabilityProblems);
-      // Only EXACT matching current trusted decisions root global support conflicts. Missing trust,
-      // wrong bytes and superseded/mismatched receipts cannot turn an unsupported sibling into a veto.
-      if (matching.length) blockers.push(...support.filter(isConflict), ...availabilityProblems.filter(isConflict));
-      const rejection = matching.some(d => d.decision === "reject");
-      rowClaims.push({ claim: eventRef(claim), obligation: b.obligation,
-        applicability: rejection ? "unaccepted" : matching.some(d => d.decision === "accept") && local.length === 0 ? "accepted-under-supplied-authority" : "unresolved",
-        matchedReceiptIds: unique(matching.map(d => d.receiptId)),
-        problems: rejection ? [problem("TRUSTED_REJECTION", eventReference(claim))] : mergeWorkProblems(local),
-      });
-    }
-    if (trustedDecisions.size > 1) blockers.push(problem("DECISION_CONFLICT", { type: "revision", ref: binding.obligation }));
-    const blocked = mergeWorkProblems(blockers);
-    for (const p of blocked) if (p.code === "EVENT_CONFLICT" && p.reference?.type === "event") {
-      const id = p.reference.ref.eventId;
-      conflicts.push({ kind: "event", id, digests: index.conflictingEvents.filter(e => e.eventId === id).map(e => e.digest), affectedObligations: affected });
-    }
-    const finalClaims = rowClaims.map(c => blocked.length && c.applicability !== "superseded" ? { ...c, applicability: "unresolved" as const, problems: blocked } : c);
-    const accepted = finalClaims.some(c => c.applicability === "accepted-under-supplied-authority");
-    const rejected = finalClaims.some(c => c.applicability === "unaccepted");
-    const unresolved = finalClaims.filter(c => c.applicability === "unresolved");
-    const acceptance = blocked.length ? "unresolved" : accepted ? "accepted-under-supplied-authority" : rejected ? "unaccepted" : unresolved.length ? "unresolved" : "unaccepted";
-    const obligationProblems = blocked.length ? blocked : accepted ? [] : rejected ?
-      finalClaims.filter(c => c.applicability === "unaccepted").flatMap(c => c.problems) : unresolved.length ? unresolved.flatMap(c => c.problems) :
-        [problem("NO_CLAIM", { type: "revision", ref: binding.obligation })];
-    obligations.push({ binding, acceptance, artifactCoverage, evidenceCoverage, claims: unique(finalClaims.map(c => c.claim)), problems: mergeWorkProblems(obligationProblems) });
-    claims.push(...finalClaims); problems.push(...obligationProblems, ...finalClaims.flatMap(c => c.problems));
-  }
-  return { obligations: unique(obligations), claims: unique(claims), supersededClaims: claims.filter(c => c.applicability === "superseded").length,
-    conflicts: mergeWorkConflicts(conflicts), problems: mergeWorkProblems([...problems, ...runtime.problems]),
-    progress: { accepted: obligations.filter(o => o.acceptance === "accepted-under-supplied-authority").length, total: obligations.length },
-  };
-}

package/src/work-ledger-snapshot.ts

@@ -1,246 +0,0 @@
-import { indexWorkLedgerText, workEventConflictSources, workRevisionConflictSources } from "./work-ledger-projection.ts";
-import { canonicalWorkJson, copyWorkJson, freezeWork } from "./work-ledger-json.ts";
-import { validateWorkSelection } from "./work-ledger-validation.ts";
-import {
-  WorkInputError, type EventRef, type Identity, type ObligationBinding, type RevisionRef,
-  type WorkConflict, type WorkDiagnostic, type WorkFrozen, type WorkProblem, type WorkReference,
-  type WorkResolutionCode, type WorkRevision, type WorkSnapshot,
-} from "./work-ledger-types.ts";
-
-type Ref = WorkFrozen<RevisionRef>;
-type Revision = WorkFrozen<WorkRevision>;
-type Problem = WorkFrozen<WorkProblem>;
-/** Internal shape of WorkProjectionContext.selectedSnapshot, not an authority context. */
-interface Selection { snapshot: Identity; event: EventRef }
-/** Internal structural result only. Never a substitute for WorkProjection/acceptance/runtime. */
-interface SnapshotResolution {
-  readonly scopeState: "unselected" | "valid" | "unresolved" | "invalid";
-  readonly selectedSnapshot: WorkFrozen<Identity> | null;
-  readonly snapshot: WorkFrozen<WorkSnapshot> | null;
-  readonly scope: Revision | null;
-  readonly revisions: readonly Revision[];
-  readonly obligations: ReadonlyArray<{
-    readonly binding: WorkFrozen<ObligationBinding>;
-    readonly revision: Revision;
-    readonly artifact: Revision | null;
-    readonly problems: readonly Problem[];
-  }>;
-  readonly problems: readonly Problem[];
-  readonly conflicts: ReadonlyArray<WorkFrozen<WorkConflict>>;
-  readonly errors: ReadonlyArray<WorkFrozen<WorkDiagnostic>>;
-}
-const key = canonicalWorkJson;
-const entity = (ref: Ref): string => `${ref.kind}:${ref.id}`;
-const reference = (ref: Ref): WorkFrozen<WorkReference> => ({ type: "revision", ref });
-function unique<T>(values: readonly T[]): T[] {
-  const rows = new Map(values.map(value => [key(value), value]));
-  return [...rows].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, value]) => value);
-}
-function diagnosticKey(row: Problem | WorkFrozen<WorkConflict>): string {
-  // Internally built output collections may exceed the wire array bound (e.g. 300 conflicting
-  // deliveries). Only their validated scalar/reference constituents use the wire canonicalizer.
-  const affected = key(row.affectedObligations);
-  return "code" in row
-    ? `{"affectedObligations":${affected},"code":${JSON.stringify(row.code)},"reference":${key(row.reference)}}`
-    : `{"affectedObligations":${affected},"digests":${JSON.stringify(row.digests)},"id":${JSON.stringify(row.id)},"kind":${JSON.stringify(row.kind)}}`;
-}
-function sortedDiagnostics<T extends Problem | WorkFrozen<WorkConflict>>(rows: T[]): T[] {
-  return rows.map(value => ({ value, key: diagnosticKey(value) }))
-    .sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).map(row => row.value);
-}
-
-/** @internal Real builder/text/index/selector path. No unchecked parsed-object projection entry. */
-export function resolveWorkSnapshotText(text: string, requested: WorkFrozen<Selection> | null = null): SnapshotResolution {
-  const index = indexWorkLedgerText(text);
-  const errors: WorkFrozen<WorkDiagnostic>[] = [...index.ingestion.errors];
-  let selection: WorkFrozen<Selection> | null = null;
-  try {
-    const copied = copyWorkJson(requested);
-    validateWorkSelection(copied);
-    selection = copied as unknown as WorkFrozen<Selection> | null;
-  } catch (error) {
-    if (!(error instanceof WorkInputError)) throw error;
-    errors.push({ line: null, code: "WORK_CONTEXT_INVALID" });
-  }
-  const problems = new Map<string, Problem>();
-  const conflicts = new Map<string, { digests: string[]; affected: Ref[] }>();
-  for (const ref of index.conflictingEvents) {
-    const row = conflicts.get(ref.eventId) ?? { digests: [], affected: [] };
-    row.digests.push(ref.digest); conflicts.set(ref.eventId, row);
-  }
-  function problem(code: WorkResolutionCode, ref: WorkFrozen<WorkReference> | null, affected: readonly Ref[] = []) {
-    const id = `${code}:${key(ref)}`;
-    const old = problems.get(id);
-    problems.set(id, { code, reference: ref, affectedObligations: unique([...(old?.affectedObligations ?? []), ...affected]) });
-  }
-  function conflict(id: string, affected: readonly Ref[]) {
-    const row = conflicts.get(id);
-    if (!row) return;
-    row.affected = unique([...row.affected, ...affected]);
-    for (const digest of row.digests) problem("EVENT_CONFLICT", { type: "event", ref: { eventId: id, digest } }, affected);
-  }
-  function reports() {
-    return {
-      problems: sortedDiagnostics([...problems.values()]),
-      conflicts: sortedDiagnostics([...conflicts].map(([id, row]) => ({
-        kind: "event" as const, id, digests: [...row.digests].sort(), affectedObligations: unique(row.affected),
-      }))), errors,
-    };
-  }
-  function empty(scopeState: SnapshotResolution["scopeState"]): SnapshotResolution {
-    return freezeWork({ scopeState, selectedSnapshot: selection?.snapshot ?? null,
-      snapshot: null, scope: null, revisions: [], obligations: [], ...reports() });
-  }
-  if (errors.length) { problem("INPUT_INCOMPLETE", null); return empty("unresolved"); }
-  if (!selection) { problem("NO_SELECTION", null); return empty("unselected"); }
-
-  // Exact event AND nested snapshot identity: never elect a head from candidate order or time.
-  const nominated = index.candidates.find(event => event.eventId === selection!.event.eventId && event.digest === selection!.event.digest);
-  const exactSnapshot = nominated?.event === "work_snapshot" &&
-    nominated.payload.snapshot.snapshotId === selection.snapshot.id && nominated.payload.snapshot.digest === selection.snapshot.digest
-    ? nominated.payload.snapshot : null;
-  // A nominated inventory is diagnostic evidence only until ALL conflicting source IDs have been
-  // checked. Nested identity, not delivery ID/time, connects an alias to the selected closure.
-  const affected = exactSnapshot?.revisions.filter(ref => ref.kind === "obligation") ?? [];
-  const snapshotSources = workEventConflictSources(index, exactSnapshot ? nominated! : selection.event);
-  for (const source of snapshotSources) conflict(source.eventId, affected);
-  // An empty selected inventory is still quarantined: affected.length is not a validity test.
-  if (snapshotSources.length) return empty("unresolved");
-  if (!nominated) { problem("REFERENCE_MISSING", { type: "event", ref: selection.event }); return empty("unresolved"); }
-  if (!exactSnapshot) {
-    problem("SCOPE_INVALID", { type: "snapshot", ref: selection.snapshot }); return empty("invalid");
-  }
-  const snapshot = exactSnapshot;
-  const selected = new Map<string, Ref>();
-  let invalid = false, missing = false;
-  function reject(code: WorkResolutionCode, ref: Ref, affected: readonly Ref[] = []) {
-    invalid = true; problem(code, reference(ref), affected);
-  }
-  for (const ref of [snapshot.scope, ...snapshot.revisions]) {
-    if (selected.has(entity(ref))) reject("REVISION_INVALID", ref);
-    selected.set(entity(ref), ref); // Diagnostic lookup only if invalid; no rows will be exposed.
-  }
-  const obligationRefs = snapshot.revisions.filter(ref => ref.kind === "obligation");
-  const allAffected = unique(obligationRefs);
-  const records = new Map<string, Revision>();
-  const quarantineSources = new Map<string, readonly WorkFrozen<EventRef>[]>();
-  for (const event of index.candidates) if (event.event === "work_revision") {
-    const r = event.payload.revision;
-    const ref = { kind: r.kind, id: r.id, revision: r.revision, digest: r.digest };
-    if (!records.has(key(ref))) {
-      const sources = workRevisionConflictSources(index, ref);
-      if (sources.length) quarantineSources.set(key(ref), sources);
-    }
-    records.set(key(ref), r);
-  }
-  const isSelected = (ref: Ref) => key(selected.get(entity(ref)) ?? null) === key(ref);
-  function lookup(ref: Ref, affected: readonly Ref[], localArtifact = false): Revision | null {
-    // A scope revision's ID is its scopeId by the validated wire contract. This contradiction
-    // is already known from the reference; absent bytes must not downgrade it to a mere gap.
-    if (ref.kind === "scope" && ref.id !== snapshot.scope.id) reject("SCOPE_INVALID", ref, affected);
-    const sources = quarantineSources.get(key(ref));
-    if (sources) {
-      for (const source of sources) conflict(source.eventId, affected);
-      if (!localArtifact) missing = true;
-      return null;
-    }
-    const r = records.get(key(ref));
-    if (!r) {
-      problem("REFERENCE_MISSING", reference(ref), affected);
-      if (!localArtifact) missing = true;
-      return null;
-    }
-    if (r.scopeId !== snapshot.scope.id) reject("REVISION_INVALID", ref, affected);
-    return r;
-  }
-
-  function walk(root: Ref, affected: readonly Ref[], localArtifact = false) {
-    // Iterative traversal: the wire depth bound does not impose a limit on revision history length.
-    type Frame = { ref: Ref; current: boolean; exit?: boolean; local?: boolean };
-    const stack: Frame[] = [{ ref: root, current: true, local: localArtifact }];
-    const done = new Set<string>(), active = new Set<string>();
-    while (stack.length) {
-      const frame = stack.pop()!, id = `${frame.current}:${key(frame.ref)}`;
-      if (frame.exit) { active.delete(id); done.add(id); continue; }
-      if (active.has(id)) { reject("CYCLE", frame.ref, affected); continue; }
-      if (done.has(id)) continue;
-      if (frame.current && selected.has(entity(frame.ref)) && !isSelected(frame.ref)) reject("REVISION_INVALID", frame.ref, affected);
-      if (frame.current && frame.ref.kind === "scope" && key(frame.ref) !== key(snapshot.scope)) reject("SCOPE_INVALID", frame.ref, affected);
-      const r = lookup(frame.ref, affected, frame.local);
-      if (!r) continue;
-      active.add(id); stack.push({ ...frame, exit: true });
-      if (r.predecessor) {
-        const prior = lookup(r.predecessor, affected);
-        if (prior && (prior.kind !== r.kind || prior.id !== r.id || prior.scopeId !== r.scopeId || prior.revision + 1 !== r.revision)) {
-          reject("REVISION_INVALID", frame.ref, affected);
-        }
-        stack.push({ ref: r.predecessor, current: false });
-      }
-      if (r.parent) {
-        if (entity(r.parent) === entity(frame.ref)) reject("CYCLE", frame.ref, affected);
-        stack.push({ ref: r.parent, current: frame.current });
-      }
-      if (r.policy) {
-        if (frame.current && !isSelected(r.policy)) reject("REVISION_INVALID", r.policy, affected);
-        stack.push({ ref: r.policy, current: frame.current });
-      }
-      for (const dep of r.dependencies) {
-        if (entity(dep) === entity(frame.ref)) reject("CYCLE", frame.ref, affected);
-        if (frame.current && !isSelected(dep)) reject("DEPENDENCY_INVALID", dep, affected);
-        stack.push({ ref: dep, current: frame.current });
-      }
-    }
-  }
-  // Structural roots must be checked even when no obligation names them. Then walk each obligation
-  // independently to accumulate exact affected-obligation reachability, including shared ancestors.
-  walk(snapshot.scope, allAffected);
-  for (const ref of snapshot.revisions) {
-    const affected = ref.kind === "obligation" ? [ref] : snapshot.bindings.filter(binding =>
-      [binding.intent, binding.policy, binding.artifact].some(value => value && key(value) === key(ref)),
-    ).map(binding => binding.obligation).filter(isSelected);
-    walk(ref, affected, ref.kind === "artifact");
-  }
-  function ancestor(obligation: Ref, intent: Ref): boolean | null {
-    const seen = new Set<string>();
-    let cursor: Ref | null = obligation;
-    while (cursor) {
-      const id = key(cursor);
-      if (seen.has(id) || quarantineSources.has(id)) return null;
-      seen.add(id);
-      const r = records.get(id);
-      if (!r) return null;
-      cursor = r.parent;
-      if (cursor && key(cursor) === key(intent)) return true;
-    }
-    return false;
-  }
-  for (const ref of obligationRefs) {
-    if (snapshot.bindings.filter(binding => key(binding.obligation) === key(ref)).length !== 1) reject("SCOPE_INVALID", ref, [ref]);
-  }
-  for (const binding of snapshot.bindings) {
-    const affected = isSelected(binding.obligation) ? [binding.obligation] : [];
-    if (!isSelected(binding.obligation)) reject("SCOPE_INVALID", binding.obligation);
-    if (!isSelected(binding.intent)) reject("SCOPE_INVALID", binding.intent, affected);
-    if (!isSelected(binding.policy)) reject("REVISION_INVALID", binding.policy, affected);
-    const r = lookup(binding.obligation, affected);
-    if (r && key(r.policy) !== key(binding.policy)) reject("REVISION_INVALID", binding.policy, affected);
-    if (r && ancestor(binding.obligation, binding.intent) === false) reject("SCOPE_INVALID", binding.intent, affected);
-    if (binding.artifact && !isSelected(binding.artifact)) reject("ARTIFACT_UNSELECTED", binding.artifact, affected);
-  }
-  if (invalid) return empty("invalid");
-  if (missing) return empty("unresolved");
-  const diagnostics = reports();
-  return freezeWork({
-    scopeState: "valid", selectedSnapshot: selection.snapshot, snapshot,
-    scope: records.get(key(snapshot.scope))!,
-    revisions: unique(snapshot.revisions.flatMap(ref => {
-      const r = quarantineSources.has(key(ref)) ? undefined : records.get(key(ref));
-      return r ? [r] : [];
-    })),
-    obligations: snapshot.bindings.map(binding => ({
-      binding, revision: records.get(key(binding.obligation))!,
-      artifact: binding.artifact && !quarantineSources.has(key(binding.artifact)) ? records.get(key(binding.artifact)) ?? null : null,
-      problems: diagnostics.problems.filter(p => p.affectedObligations.some(ref => key(ref) === key(binding.obligation))),
-    })), ...diagnostics,
-  });
-}