pi-mega-compact 0.20.8 → 0.20.10

package/dist/vector-cortex/heal/rebuild.js

@@ -0,0 +1,136 @@
+/**
+ * vector-cortex/heal/rebuild.ts — VC6C generation rebuild + atomic pointer switch.
+ *
+ * Executes what `controller.ts` planned: materialize a NEW generation, verify its
+ * root digest, and only then flip the live pointer.
+ *
+ * COPY, VERIFY, SWITCH — in that order, always.
+ *
+ *   1. COPY. The rebuild writes into `plan.generation` (always `current + 1`),
+ *      never into the live generation. The thing currently being served is never
+ *      the thing being modified, so a crash mid-rebuild leaves a complete old
+ *      generation and a partial new one — never a torn live one.
+ *   2. VERIFY. The new generation's root digest must equal the digest the plan
+ *      pinned. This is the ONLY gate on the pointer.
+ *   3. SWITCH. `switchPointer` moves the pointer iff verification passed.
+ *
+ * A FAILED VERIFICATION DELETES NO EVIDENCE. On mismatch we keep the old pointer
+ * AND leave the new generation on disk. That is deliberate: the corrupt
+ * generation is the only artifact that can explain WHY the rebuild was wrong, and
+ * a self-healing system that tidies up its failures is a system that cannot be
+ * debugged. Cleanup is a separate, explicit operator action.
+ *
+ * CRASH SAFETY IS A CONSEQUENCE OF THE ORDER, NOT AN EXTRA STEP. The pointer is
+ * the single atomic commit point. Kill the process after step 1 or 2 and the old
+ * pointer is still live, so the next start serves the prior generation and simply
+ * re-plans — the orphaned generation is inert. This is what
+ * `rebuild-chaos.test.ts` pins.
+ *
+ * THE TRIAD (independent algorithms, per TRIAD_RESILIENCE).
+ *   A — TARGETED: rebuild only `plan.range`, reusing the prior generation for
+ *       everything outside it. Cheap; needs a healthy prior generation.
+ *   B — FULL DETERMINISTIC: re-derive the whole subsystem from the byte ledger,
+ *       reusing NOTHING. Independent of A: it shares no index, no prior
+ *       generation, and no incremental state, so a bug or corruption that breaks
+ *       A cannot break B the same way.
+ *   C — DISABLE DERIVED STATE: no rebuild at all. Mode C is a real outcome, not
+ *       an error path, and it MUST state its loss of old semantic context — the
+ *       subsystem serves nothing rather than serving something wrong.
+ *
+ * PURE. `node:crypto` only — no storage, no console, no clock, no network
+ * (PREVENT-PI-004 / PREVENT-011). Callers own persistence; this module owns the
+ * decision and the digest arithmetic, which is what makes it fixture-testable.
+ */
+import { createHash } from "node:crypto";
+/** Root digest of a generation's bytes: SHA-256, bare lowercase hex. */
+export function rootDigest(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+ * Materialize + verify one generation.
+ *
+ * Hashes the rebuilt bytes and compares to the pinned root digest. A mismatch
+ * returns `HEAL_REPAIR_DIGEST_MISMATCH` and — critically — the caller must NOT
+ * switch the pointer; `switchPointer` enforces that structurally by requiring the
+ * verified flag.
+ *
+ * An EMPTY rebuild is a failure, not an empty success: a generation with no bytes
+ * would hash to the digest of nothing, and if a plan ever pinned that digest an
+ * empty rebuild would "verify" and the pointer would flip to nothing at all. It
+ * is reported as `HEAL_REBUILD_FAILED` because the rebuild produced no artifact.
+ */
+export function rebuildGeneration(input, mode = "A") {
+    if (input.sourceBytes.length === 0) {
+        return {
+            ok: false,
+            code: "HEAL_REBUILD_FAILED",
+            generation: input.generation,
+            mode,
+        };
+    }
+    const digest = rootDigest(input.sourceBytes);
+    if (digest !== input.expectedDigest) {
+        // Evidence retained: the caller keeps the generation on disk for inspection.
+        return {
+            ok: false,
+            code: "HEAL_REPAIR_DIGEST_MISMATCH",
+            generation: input.generation,
+            mode,
+        };
+    }
+    return { ok: true, generation: input.generation, digest, mode };
+}
+/**
+ * The atomic commit point: flip the live pointer iff the new generation verified.
+ *
+ * `verified` is a required argument rather than something re-derived here, so a
+ * caller cannot switch the pointer without having gone through
+ * `rebuildGeneration` — "switch without verifying" is not expressible.
+ *
+ * A non-monotonic switch is also refused: the new generation must be strictly
+ * greater than the current one. Replaying a stale plan after a restart would
+ * otherwise roll the pointer BACKWARDS onto an older generation, silently
+ * un-healing the subsystem.
+ */
+export function switchPointer(currentGen, newGen, verified) {
+    if (!verified)
+        return { switched: false, generation: currentGen };
+    if (newGen <= currentGen)
+        return { switched: false, generation: currentGen };
+    return { switched: true, generation: newGen };
+}
+/**
+ * Apply the triad arm for a rebuild.
+ *
+ * A and B run the same verification (a digest is a digest) but are reached by
+ * INDEPENDENT production paths: A reuses the prior generation and rebuilds only
+ * the planned range, while B re-derives everything from the byte ledger sharing
+ * no index or incremental state with A. C performs no rebuild at all and states
+ * its loss.
+ */
+export function applyTriad(mode, input) {
+    if (mode === "C") {
+        // Derived state disabled: no rebuild, and the loss of old semantic context
+        // is DISCLOSED rather than papered over with a stale or partial generation.
+        return {
+            ok: false,
+            code: "HEAL_REBUILD_FAILED",
+            generation: input.generation,
+            mode: "C",
+            semanticLossStated: true,
+        };
+    }
+    return rebuildGeneration(input, mode);
+}
+/**
+ * Convenience: rebuild then switch, returning both halves.
+ *
+ * The pointer moves only on a verified rebuild, so a failed verification yields
+ * `switched:false` with the ORIGINAL generation still live and the new (corrupt)
+ * generation left intact on disk for inspection.
+ */
+export function rebuildAndSwitch(input, currentGen, mode = "A") {
+    const result = applyTriad(mode, input);
+    const pointer = switchPointer(currentGen, input.generation, result.ok);
+    return { result, pointer };
+}

package/dist/vector-cortex/heal/repair-emit.js

@@ -0,0 +1,83 @@
+/**
+ * vector-cortex/heal/repair-emit.ts — VC6C event reporter seam.
+ *
+ * Mirrors `./restore-emit.ts`: a thin `safe()` wrapper around an optional
+ * injected `emit`, and the three event names the sprint spec requires verbatim:
+ *   - `vector_cortex_repair_planned`         — a gap was detected, rebuild queued.
+ *   - `vector_cortex_repair_pointer_switched`— a verified generation went live.
+ *   - `vector_cortex_repair_backoff`         — suppressed (rate limit) or failed.
+ *
+ * FLAG SEMANTICS. `detectGaps` / `planRebuild` / `rebuildGeneration` /
+ * `switchPointer` are PURE arithmetic and run REGARDLESS of `MEGACOMPACT_VC6C`.
+ * The flag gates ONLY this reporting + dashboard seam: with the flag off we still
+ * detect gaps, still verify digests, and still refuse unverified pointer
+ * switches — we just do not announce it under the VC6C event namespace. That is
+ * what makes flag-off byte-identical to VC6B: the computation is never skipped,
+ * only the emission.
+ *
+ * PAYLOAD DISCIPLINE. These events carry the SUBSYSTEM NAME, generation numbers,
+ * timings, and codes — never rebuilt bytes, never a root digest of user content,
+ * never a seq range's contents. The subsystem name is an operator-facing
+ * identifier ("topology"), not user data. A repair event is exactly the place
+ * where an unguarded `payload` field would leak a rebuilt transcript into a log.
+ *
+ * No console, no storage, no network (PREVENT-PI-004 / PREVENT-011). Every line
+ * is a structured JSON event with `ts` + `event`.
+ */
+import { VC6C_ENABLED } from "../../config/vector-cortex.js";
+/** Run `fn` only when an emit exists; a reporting failure is never fatal. */
+function safe(emit, fn) {
+    if (emit === undefined)
+        return;
+    try {
+        fn(emit);
+    }
+    catch {
+        // Non-fatal: a reporting failure must never break the agent loop.
+    }
+}
+/** The event names VC6C emits, exported for the dashboard seam and tests. */
+export const REPAIR_EVENT_NAMES = [
+    "vector_cortex_repair_planned",
+    "vector_cortex_repair_pointer_switched",
+    "vector_cortex_repair_backoff",
+];
+/** Report a planned rebuild: which subsystem, which generation, what delay. */
+export function reportRepairPlanned(emit, payload) {
+    if (!VC6C_ENABLED())
+        return;
+    safe(emit, (e) => e("vector_cortex_repair_planned", {
+        ts: undefined,
+        event: "vector_cortex_repair_planned",
+        subsystem: payload.subsystem,
+        generation: payload.generation,
+        backoffMs: payload.backoffMs,
+        gapSize: payload.gapSize,
+    }));
+}
+/** Report the atomic commit: a verified generation became live. */
+export function reportRepairPointerSwitched(emit, payload) {
+    if (!VC6C_ENABLED())
+        return;
+    safe(emit, (e) => e("vector_cortex_repair_pointer_switched", {
+        ts: undefined,
+        event: "vector_cortex_repair_pointer_switched",
+        subsystem: payload.subsystem,
+        fromGeneration: payload.fromGeneration,
+        toGeneration: payload.toGeneration,
+        mode: payload.mode,
+    }));
+}
+/** Report a suppressed or failed rebuild now waiting out its backoff. */
+export function reportRepairBackoff(emit, payload) {
+    if (!VC6C_ENABLED())
+        return;
+    safe(emit, (e) => e("vector_cortex_repair_backoff", {
+        ts: undefined,
+        event: "vector_cortex_repair_backoff",
+        subsystem: payload.subsystem,
+        code: payload.code,
+        backoffMs: payload.backoffMs,
+        attempt: payload.attempt,
+    }));
+}

package/dist/vector-cortex/heal/repair-types.js

@@ -0,0 +1,74 @@
+/**
+ * vector-cortex/heal/repair-types.ts — VC6C self-healing derived controller.
+ *
+ * VC6B answered "when a node's bytes are gone, WHERE do they come from?". VC6C
+ * answers the question one level up: when a DERIVED subsystem (topology, shards,
+ * closure) has fallen BEHIND the durable authority, how do we notice, and how do
+ * we catch it up without ever risking the authority itself?
+ *
+ * THE AUTHORITY IS READ-ONLY, ALWAYS. The controller compares each derived
+ * source's high-water to the durable authority high-water and plans work. It has
+ * no write path to the authority — not a guarded one, not an admin one. Derived
+ * state is disposable and can always be rebuilt from the byte ledger; the
+ * authority is not, so the repair path is deliberately one-directional. This is
+ * why `RepairState` carries `authorityHighWater` as a plain readonly field and
+ * why no function in `controller.ts` returns anything that could be applied to it.
+ *
+ * NEVER READ PAST THE AUTHORITY (TRIAD_RESILIENCE §frontier). A derived builder
+ * may not read beyond the durable CONTIGUOUS authority high-water. During an
+ * authority outage that high-water FREEZES even though the spool keeps accepting
+ * frames — so a derived subsystem that is "behind" a frozen frontier is CORRECT,
+ * not broken, and planning a rebuild against the spool tail would materialize
+ * frames that are not yet durable. `detectGaps` therefore treats
+ * `authorityFrozen` as a hard stop (`HEAL_REPAIR_AUTHORITY_FROZEN`) rather than
+ * as a large gap to chase. After the drain, catch-up resumes from the OLD
+ * high-water; it never jumps to the tail.
+ *
+ * REBUILD IS COPY-THEN-SWITCH, NEVER IN-PLACE. `rebuild.ts` materializes a NEW
+ * generation, verifies its root digest, and only then flips the pointer. A failed
+ * verification keeps the old pointer and DELETES NO EVIDENCE: the corrupt
+ * generation stays on disk to be inspected. An in-place repair would, by
+ * construction, destroy the only copy of the thing that was about to be proven
+ * wrong.
+ *
+ * RATE LIMIT + BACKOFF ARE THE BLAST RADIUS. A subsystem that fails to rebuild
+ * will fail again, usually instantly, so an unbounded retry loop turns one broken
+ * shard into a CPU-saturating rebuild storm. One rebuild per subsystem per 5
+ * minutes bounds the steady state, and the deterministic exponential backoff
+ * (30s * 2^attempt, capped at 15 min, ±10% jitter derived from the SUBSYSTEM
+ * DIGEST rather than `Math.random`) bounds the failure state while keeping the
+ * schedule reproducible in a fixture.
+ *
+ * Pure types + registered conformance IDs: no storage, no console, no clock, no
+ * network (PREVENT-PI-004 / PREVENT-011).
+ */
+/**
+ * One rebuild per subsystem per 5 minutes. Bounds a rebuild storm: a subsystem
+ * that fails will fail again immediately, and without this an unhealthy tier
+ * would saturate the box re-materializing the same broken generation.
+ */
+export const REPAIR_RATE_LIMIT_MS = 5 * 60_000;
+/**
+ * Exponential backoff base/cap, matching the breaker's retry rule
+ * (TRIAD_RESILIENCE): `30s * 2^attempt`, capped at 15 minutes.
+ */
+export const REPAIR_BACKOFF_BASE_MS = 30_000;
+export const REPAIR_BACKOFF_CAP_MS = 15 * 60_000;
+/**
+ * ±10% deterministic jitter. Derived from the SUBSYSTEM DIGEST, not a PRNG, so
+ * two subsystems desynchronize (no thundering herd) while any single subsystem's
+ * schedule stays reproducible in a fixture.
+ */
+export const REPAIR_BACKOFF_JITTER = 0.1;
+/**
+ * Registered VC6C conformance ID range (HEAL-031..045), continuing VC6B's
+ * HEAL-016..030. The acceptance test reads these rows from the v2 manifest and
+ * asserts each returns its manifest `ok`/`code`.
+ */
+export const REPAIR_IDS = Array.from({ length: 15 }, (_v, i) => `HEAL-${String(i + 31).padStart(3, "0")}`);
+/** Named VC6C conformance assertions (the sprint's headline rows). */
+export const REPAIR_NAMED_IDS = [
+    "HEAL-GAP-001",
+    "HEAL-RATE-002",
+    "HEAL-SWITCH-003",
+];

package/dist/vector-cortex/heal/restore-emit.js

@@ -0,0 +1,70 @@
+/**
+ * vector-cortex/heal/restore-emit.ts — VC6B event reporter seam.
+ *
+ * Mirrors `./emit.ts`: a thin `safe()` wrapper around an optional injected
+ * `emit` (unit tests pass `undefined` and stay pure), and the two event names the
+ * sprint spec requires verbatim:
+ *   - `vector_cortex_source_restored`         — a restore batch completed.
+ *   - `vector_cortex_restore_digest_rejected` — a source failed its digest check.
+ *
+ * FLAG SEMANTICS. `restoreSources` / `verifyRestored` are PURE arithmetic and run
+ * REGARDLESS of `MEGACOMPACT_VC6B`. The flag gates ONLY this reporting +
+ * dashboard seam: with the flag off we still restore and still verify, we just do
+ * not announce it under the VC6B event namespace. That is what makes flag-off
+ * byte-identical to VC6A — the computation is never skipped, only the emission.
+ *
+ * PAYLOAD DISCIPLINE. These events carry COUNTS and MODES only — never restored
+ * bytes, never node text, never a digest of user content. The exact ledger is not
+ * diagnostic data (SECURITY_PRIVACY), and a restoration event is exactly the
+ * place where an unguarded `payload` field would leak the entire transcript into
+ * a log file.
+ *
+ * No console, no storage, no network (PREVENT-PI-004 / PREVENT-011). Every line
+ * is a structured JSON event with `ts` + `event`.
+ */
+import { VC6B_ENABLED } from "../../config/vector-cortex.js";
+/** Run `fn` only when an emit exists; a reporting failure is never fatal. */
+function safe(emit, fn) {
+    if (emit === undefined)
+        return;
+    try {
+        fn(emit);
+    }
+    catch {
+        // Non-fatal: a reporting failure must never break the agent loop.
+    }
+}
+/** The event names VC6B emits, exported for the dashboard seam and tests. */
+export const RESTORE_EVENT_NAMES = [
+    "vector_cortex_source_restored",
+    "vector_cortex_restore_digest_rejected",
+];
+/**
+ * Report a completed restoration. Counts and mode only — enough to see whether
+ * the shard index is serving reads (mode A) or every span is falling through to
+ * a ledger scan (mode B), without disclosing what was restored.
+ */
+export function reportSourceRestored(emit, payload) {
+    if (!VC6B_ENABLED())
+        return;
+    safe(emit, (e) => e("vector_cortex_source_restored", {
+        ts: undefined,
+        event: "vector_cortex_source_restored",
+        sessionId: payload.sessionId,
+        restoredCount: payload.restoredCount,
+        missingCount: payload.missingCount,
+        mode: payload.mode,
+    }));
+}
+/** Report a rejected source (digest/limit/range). Suppressed under flag-off. */
+export function reportRestoreDigestRejected(emit, payload) {
+    if (!VC6B_ENABLED())
+        return;
+    safe(emit, (e) => e("vector_cortex_restore_digest_rejected", {
+        ts: undefined,
+        event: "vector_cortex_restore_digest_rejected",
+        sessionId: payload.sessionId,
+        code: payload.code,
+        mode: payload.mode,
+    }));
+}

package/dist/vector-cortex/heal/restore-readers.js

@@ -0,0 +1,114 @@
+/**
+ * vector-cortex/heal/restore-readers.ts — the two EXACT source readers (VC6B).
+ *
+ * Split out of `restore.ts` so the orchestrator stays a short, readable policy
+ * file and each reader can be reasoned about on its own (PRACTICES: split at the
+ * 300-line soft limit, delegate-shell + impl).
+ *
+ * Both readers share one discipline: they return bytes ONLY after recomputing
+ * SHA-256 over the bytes they actually hold and comparing it to the digest the
+ * REQUEST pinned. Neither reader trusts the digest recorded alongside its own
+ * source — an `ExactShardV1.digest` is metadata that lives in the same file as
+ * the bytes, so a swapped file carries a matching (wrong) pair. Only the
+ * caller-supplied digest is authoritative, and only a fresh hash of the fetched
+ * bytes can be checked against it.
+ *
+ * Pure/deterministic/local: `node:crypto` only (a Node built-in, not a network
+ * call), no storage, no console (PREVENT-PI-004 / PREVENT-011).
+ */
+import { createHash } from "node:crypto";
+/**
+ * SHA-256 over bytes as LOWERCASE HEX with NO `sha256:` prefix — the
+ * `ExactShardV1.digest` / `ReconstructionSpan.digest` / `RestoreSpanRequest`
+ * convention. `EventV2.bytesDigest` prefixes this same value with `sha256:`.
+ */
+export function sha256Hex(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+ * Strip the `sha256:` prefix from an `EventV2.bytesDigest` so it can be compared
+ * against a bare hex digest. A value that does not carry the prefix is returned
+ * unchanged rather than mangled — the comparison then simply fails, which is the
+ * correct outcome for a malformed record.
+ */
+export function bareHex(digest) {
+    return digest.startsWith("sha256:") ? digest.slice("sha256:".length) : digest;
+}
+/**
+ * Structural range equality. All five components must match: two spans over the
+ * same seq window but different byte offsets are DIFFERENT spans (a re-encoded
+ * or re-offset stream is not the stream that was requested).
+ */
+export function rangeEquals(a, b) {
+    return (a.sessionId === b.sessionId &&
+        a.seqStart === b.seqStart &&
+        a.seqEnd === b.seqEnd &&
+        a.byteStart === b.byteStart &&
+        a.byteEnd === b.byteEnd);
+}
+/**
+ * Mode A — indexed exact-shard read.
+ *
+ * Selection is by RANGE identity plus the shard's own recorded digest, which
+ * narrows the candidate set the way a real index lookup would. The accepted
+ * candidate is then re-hashed from its `originalBytes`: this second check is
+ * what catches a shard whose bytes were swapped AFTER the index lookup resolved
+ * (the sprint's unique failure injection). A candidate that matches by range but
+ * fails either digest check reports `digest-mismatch` — it does NOT silently fall
+ * through to the ledger, because a corrupt exact shard is a fact worth surfacing.
+ */
+export function readExactShard(shards, range, digest) {
+    const byRange = shards.filter((s) => rangeEquals(s.range, range));
+    if (byRange.length === 0)
+        return { kind: "absent" };
+    const candidate = byRange.find((s) => s.digest === digest);
+    if (candidate === undefined)
+        return { kind: "digest-mismatch" };
+    // Defense in depth: the shard's recorded digest is metadata, the bytes are the
+    // authority. Re-hash what we actually hold.
+    const bytes = candidate.originalBytes;
+    if (sha256Hex(bytes) !== digest)
+        return { kind: "digest-mismatch" };
+    return { kind: "bytes", bytes };
+}
+/**
+ * Mode B — ledger range scan.
+ *
+ * An INDEPENDENT path from mode A: no shard index is consulted. The occurrence
+ * records covering `[seqStart..seqEnd]` are selected, sorted ascending by seq
+ * (the caller's array order is untrusted — a scan that concatenated records in
+ * arrival order would produce plausible-looking but wrong bytes), each record's
+ * own `bytesDigest` is verified, and the concatenation is hashed against the
+ * span digest.
+ *
+ * Both checks matter. Per-record verification localizes corruption to a single
+ * occurrence; the span-level hash catches a scan that is individually valid but
+ * collectively wrong — a missing record in the middle of the range, or a range
+ * that covers different content than the requester believed.
+ */
+export function readLedgerSpan(events, range, digest) {
+    const covering = events
+        .filter((e) => e.sessionId === range.sessionId &&
+        e.seq >= range.seqStart &&
+        e.seq <= range.seqEnd)
+        .sort((a, b) => (a.seq < b.seq ? -1 : a.seq > b.seq ? 1 : 0));
+    if (covering.length === 0)
+        return { kind: "absent" };
+    // Per-record byte authority (VC1A): a record whose own digest disagrees with
+    // its bytes is corrupt, and a corrupt record can never contribute to a restore.
+    for (const e of covering) {
+        if (sha256Hex(e.originalBytes) !== bareHex(e.bytesDigest)) {
+            return { kind: "digest-mismatch" };
+        }
+    }
+    const total = covering.reduce((sum, e) => sum + e.originalBytes.length, 0);
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const e of covering) {
+        bytes.set(e.originalBytes, offset);
+        offset += e.originalBytes.length;
+    }
+    if (sha256Hex(bytes) !== digest)
+        return { kind: "digest-mismatch" };
+    return { kind: "bytes", bytes };
+}

package/dist/vector-cortex/heal/restore-types.js

@@ -0,0 +1,66 @@
+/**
+ * vector-cortex/heal/restore-types.ts — VC6B exact source restoration contract.
+ *
+ * VC6A optimized WHICH EDGES the closure plan walks. VC6B answers the next
+ * question: when the plan needs a node whose bytes are no longer in the live
+ * window, WHERE do those bytes come from? The answer is deliberately narrow —
+ * an EXACT source, or nothing.
+ *
+ * THE CARDINAL RULE. Restored bytes are ONLY ever read from an exact source:
+ *   1. an `ExactShardV1` whose range and digest both match the request, or
+ *   2. a scan of the `EventV2` occurrence ledger over the requested seq range.
+ * Bytes are NEVER inferred from an embedding, a semantic shard, a RAPTOR
+ * summary, or any other derived/lossy representation. A semantic tier can tell
+ * you what a span was ABOUT; it cannot tell you what the span WAS. Attempting to
+ * "restore" from a derived source would silently fabricate transcript history,
+ * so VC6B has no code path that can do it: `RestoreReader` exposes exactly the
+ * two exact sources and nothing else.
+ *
+ * THE VERIFICATION RULE. Every restored span must hash to the SHA-256 digest the
+ * REQUEST pinned, checked immediately before insertion. A source that matches by
+ * range but not by hash is rejected (`HEAL_RESTORE_DIGEST_MISMATCH`) — never
+ * "close enough". This is what makes a swapped shard file, a truncated read, or a
+ * corrupted ledger record fail loudly instead of poisoning the reconstruction.
+ *
+ * DIGEST PINNING (three fields exist; do not confuse them).
+ *   - `ReconstructionSpan.digest` and `ExactShardV1.digest` are SHA-256 in
+ *     LOWERCASE HEX with NO prefix.
+ *   - `EventV2.bytesDigest` is `sha256:<hex>`, WITH the prefix.
+ * `RestoreSpanRequest.digest` works at SPAN level and uses the FORMER: bare
+ * lowercase hex, matching `ExactShardV1.digest` / `ReconstructionSpan.digest`.
+ * The prefixed `EventV2.bytesDigest` is used ONLY for per-event verification
+ * inside the ledger-scan path and is never the request-level digest. Mixing the
+ * two would make every ledger restoration fail (or, worse, make a prefix-stripped
+ * comparison accidentally succeed against the wrong granularity).
+ *
+ * BOUNDS. A restore request is attacker-shaped input: it names spans and byte
+ * ranges. `RESTORE_LIMIT_SPANS` / `RESTORE_LIMIT_BYTES` bound it BEFORE any
+ * reader is consulted, so an oversized request cannot be used to make the
+ * restorer walk the whole ledger (HEAL-LIMIT-002).
+ *
+ * Pure types + registered conformance IDs: no storage, no console, no network
+ * (PREVENT-PI-004 / PREVENT-011).
+ */
+/**
+ * Maximum spans in one request. A request naming more spans than this is
+ * rejected outright — the bound exists so a single call cannot be turned into an
+ * unbounded traversal of the ledger.
+ */
+export const RESTORE_LIMIT_SPANS = 64;
+/**
+ * Maximum aggregate requested bytes (4 MiB), summed from the REQUEST's ranges
+ * (`byteEnd - byteStart`) so the bound is enforceable without reading anything.
+ */
+export const RESTORE_LIMIT_BYTES = 4 * 1024 * 1024;
+/**
+ * Registered VC6B conformance ID range (HEAL-016..030), continuing VC6A's
+ * HEAL-001..015. The acceptance test reads these rows from the v2 manifest and
+ * asserts each returns its manifest `ok`/`code`.
+ */
+export const RESTORE_IDS = Array.from({ length: 15 }, (_v, i) => `HEAL-${String(i + 16).padStart(3, "0")}`);
+/** Named VC6B conformance assertions (the sprint's headline rows). */
+export const RESTORE_NAMED_IDS = [
+    "HEAL-SPAN-001",
+    "HEAL-LIMIT-002",
+    "HEAL-DIGEST-003",
+];