slidemind 0.3.20 → 0.4.0

package/src/lib/edit-state.mjs

@@ -0,0 +1,1244 @@
+// The two edit-safeguard sidecars on disk: `state/edit-operations.json` (what
+// this run is allowed to change) and `state/slide-preservation.json` (what the
+// slide must still contain afterwards). The SHAPES live in
+// `edit-operations.mjs` / `slide-preservation.mjs` — pure, mirrored into the
+// add-in, and the only judges of validity. This module is the CLI's I/O half:
+// read, validate, refuse, write atomically, and migrate a deck that predates
+// both records.
+//
+// Three rules the implementation exists to keep:
+//
+//   • A RECORD WE CANNOT READ IS NEVER REWRITTEN. Corrupt JSON, a schema from a
+//     future build, or a record that fails its own validator all raise a coded
+//     error and leave the bytes exactly as they were found. Downgrading state
+//     is how obligations silently disappear.
+//   • IDENTITY IS RESOLVED, NEVER INFERRED. `--slides 2,7` is an INPUT
+//     grammar; what gets persisted is the slide's durable GUID
+//     (src/lib/slide-guids.mjs), minted and saved when a slide has none yet.
+//     Nothing here stores a slide number.
+//   • MIGRATION READS THE SOURCE IN FRONT OF IT. A slide that has been edited
+//     since `transcribe` stamped it is seeded from its CURRENT source, never
+//     from the concept spec it no longer resembles, and its evidence is
+//     `unknown` — which is not `passed`.
+
+import { createHash, randomUUID } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+import { statePath } from "./deck-paths.mjs";
+import { readRevision, slideFileOrder, writeStateJson } from "./revision.mjs";
+import { loadSlideGuids, saveSlideGuids, slideGuidEntry, reconcileSlideGuids } from "./slide-guids.mjs";
+import { conversionProvenance, loadConversions } from "./conversions.mjs";
+import { mintSlideGuid } from "../pptx/tags.mjs";
+import {
+  EDIT_OPERATIONS_FILE,
+  EDIT_OPERATION_VERSION,
+  OPERATION_KINDS,
+  operationSlideKeys,
+  validateEditOperation,
+  validateEditOperationsFile,
+} from "./edit-operations.mjs";
+import {
+  SLIDE_PRESERVATION_FILE,
+  SLIDE_PRESERVATION_VERSION,
+  amendForOperation,
+  validatePreservationUpdate,
+  validateSlidePreservationFile,
+} from "./slide-preservation.mjs";
+import { PROPERTY_SCOPES } from "./edit-operations.mjs";
+import { isDurableId } from "./durable-ids.mjs";
+import { bindSplitIds, readSlideElements } from "./preservation-verdict.mjs";
+import { inlineComponents } from "./inline-components.mjs";
+import { cleanText, readSpec } from "../builders/concept-spec.mjs";
+
+const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+
+/**
+ * What a SEEDED requirement protects, by where the obligation came from.
+ *
+ * Existence is protected unconditionally — an empty `properties` list still
+ * means "this element must still be there". Beyond that, only what the evidence
+ * at hand actually establishes, because a scope nobody can justify is a block
+ * on an edit the user is entitled to make:
+ *
+ *   concept        the spec IS the approved content: its text is the business
+ *                  fact, its image/icon the asset that was chosen, its fill the
+ *                  design decision. GEOMETRY IS NOT PROTECTED — settling moves
+ *                  elements by design, and the repair budget (phase 6) is what
+ *                  governs that, not a permanent obligation.
+ *   converted      an import is a fidelity claim about somebody else's slide:
+ *                  its raw borders, spacing and typography are precisely the
+ *                  thing being preserved (E02), so the full set applies. The
+ *                  CLI never snaps or settles converted source, so nothing
+ *                  legitimate trips over it.
+ *   legacy-current hand-owned or pre-record source. The bytes prove an element
+ *                  is there and which asset it points at; they prove nothing
+ *                  about which of its properties were deliberate, so nothing
+ *                  deeper is claimed. Stated as a limitation rather than
+ *                  guessed at in either direction.
+ */
+export const PROTECTED_BY_ORIGIN = {
+  concept: ["text", "fill", "media", "chart", "native"],
+  converted: ["text", "geom", "fill", "line", "media", "chart", "native"],
+  "legacy-current": ["media", "native"],
+};
+
+// Candidate scopes ∩ what this origin may claim, in the vocabulary's own order
+// so two seeds of the same slide are byte-comparable.
+const protect = (candidates, origin) => {
+  const allowed = new Set(PROTECTED_BY_ORIGIN[origin] ?? PROTECTED_BY_ORIGIN["legacy-current"]);
+  const wanted = new Set(candidates);
+  return PROPERTY_SCOPES.filter((scope) => allowed.has(scope) && wanted.has(scope));
+};
+
+/** Operations that still hold their slides. Anything else has let go. */
+export const OPEN_OPERATION_STATUSES = ["prepared", "validated"];
+
+/** The kinds `revision begin --operation` accepts: `create` is a build's inference, never a session's claim. */
+export const SESSION_OPERATION_KINDS = OPERATION_KINDS.filter((k) => k !== "create");
+
+const EMPTY_OPERATIONS = { version: EDIT_OPERATION_VERSION, operations: [] };
+const EMPTY_PRESERVATION = { version: SLIDE_PRESERVATION_VERSION, slides: {} };
+
+const stateError = (code, message, extra = {}) =>
+  Object.assign(new Error(message), { code, ...extra });
+
+const errorLines = (errors) =>
+  errors.slice(0, 8).map((e) => `  ${e.path}: ${e.message}`).join("\n") +
+  (errors.length > 8 ? `\n  … and ${errors.length - 8} more` : "");
+
+// ---------------------------------------------------------------------------
+// read / write
+// ---------------------------------------------------------------------------
+
+function readDoc(workspaceDir, name, validate, empty) {
+  const file = statePath(workspaceDir, name);
+  let raw;
+  try {
+    raw = fs.readFileSync(file, "utf8");
+  } catch (err) {
+    if (err?.code === "ENOENT") return structuredClone(empty);
+    throw stateError("state_unreadable", `state/${name} cannot be read (${err.message}); nothing was changed.`);
+  }
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch (err) {
+    throw stateError(
+      "state_invalid",
+      `state/${name} is not readable JSON (${err.message}). The file was left untouched — ` +
+        `repair or remove it before editing this deck.`,
+    );
+  }
+  const { ok, errors } = validate(doc);
+  if (ok) return doc;
+  // A version this build does not know is its own outcome: the record may be
+  // perfectly valid for a newer slidemind, so it is preserved and named.
+  const future = errors.find((e) => e.code === "unsupported_version");
+  if (future) {
+    throw stateError("unsupported_version", `state/${name}: ${future.message} The file was left untouched.`, {
+      file,
+    });
+  }
+  throw stateError(
+    "state_invalid",
+    `state/${name} does not match the record contract, so it was left untouched:\n${errorLines(errors)}`,
+    { errors },
+  );
+}
+
+/** `{ version, operations[] }` — an absent file reads as empty, never as an error. */
+export function readEditOperations(workspaceDir) {
+  return readDoc(workspaceDir, EDIT_OPERATIONS_FILE, (d) => validateEditOperationsFile(d), EMPTY_OPERATIONS);
+}
+
+/** `{ version, slides{} }` — same. */
+export function readSlidePreservation(workspaceDir) {
+  return readDoc(workspaceDir, SLIDE_PRESERVATION_FILE, (d) => validateSlidePreservationFile(d), EMPTY_PRESERVATION);
+}
+
+/** Validate, then write-then-rename. An invalid document never reaches disk. */
+export function writeEditOperations(workspaceDir, doc) {
+  const { ok, errors } = validateEditOperationsFile(doc);
+  if (!ok) {
+    throw stateError("state_invalid", `refusing to write state/${EDIT_OPERATIONS_FILE}:\n${errorLines(errors)}`, {
+      errors,
+    });
+  }
+  writeStateJson(workspaceDir, EDIT_OPERATIONS_FILE, doc);
+  return doc;
+}
+
+/**
+ * Write the preservation file. The transition rule runs FIRST: `next` may not
+ * have dropped an obligation `previous` held unless it supersedes it inside
+ * `operation`'s scope. A rejected write leaves the previous bytes in place.
+ */
+export function writeSlidePreservation(workspaceDir, next, { operation = null } = {}) {
+  const previous = readSlidePreservation(workspaceDir);
+  const { ok, errors } = validatePreservationUpdate(previous, next, { operation });
+  if (!ok) {
+    throw stateError("state_invalid", `refusing to write state/${SLIDE_PRESERVATION_FILE}:\n${errorLines(errors)}`, {
+      errors,
+    });
+  }
+  writeStateJson(workspaceDir, SLIDE_PRESERVATION_FILE, next);
+  return next;
+}
+
+// ---------------------------------------------------------------------------
+// operations
+// ---------------------------------------------------------------------------
+
+export function readOperation(workspaceDir, operationId) {
+  return readEditOperations(workspaceDir).operations.find((o) => o.operationId === operationId) ?? null;
+}
+
+/** The operations that still hold slides — what a lease check compares against. */
+export function openOperations(workspaceDir) {
+  return readEditOperations(workspaceDir).operations.filter((o) => OPEN_OPERATION_STATUSES.includes(o.status));
+}
+
+/**
+ * Persist one operation, upserting by `operationId`.
+ *
+ * The LEASE: a slide is scoped by at most one open operation. A second, different
+ * operation naming the same slide is refused rather than layered on top — two
+ * live scopes on one slide means neither one describes what may change.
+ */
+export function recordOperation(workspaceDir, operation) {
+  const { ok, errors } = validateEditOperation(operation);
+  if (!ok) {
+    throw stateError("operation_invalid", `this operation record is not valid:\n${errorLines(errors)}`, { errors });
+  }
+  const doc = readEditOperations(workspaceDir);
+  const mine = new Set(operationSlideKeys(operation));
+  for (const other of doc.operations) {
+    if (other.operationId === operation.operationId) continue;
+    if (!OPEN_OPERATION_STATUSES.includes(other.status)) continue;
+    const clash = operationSlideKeys(other).filter((k) => mine.has(k));
+    if (clash.length > 0) {
+      throw stateError(
+        "operation_conflict",
+        `slide ${clash[0]} is already scoped by operation ${other.operationId} (${other.kind}, ${other.status}). ` +
+          `Finish that edit session (\`slidemind revision finish <deck>\`) before opening a second scope on it.`,
+        { operationId: other.operationId, slideKeys: clash },
+      );
+    }
+  }
+  writeEditOperations(workspaceDir, {
+    version: EDIT_OPERATION_VERSION,
+    operations: [...doc.operations.filter((o) => o.operationId !== operation.operationId), operation],
+  });
+  return operation;
+}
+
+/** Move every open operation to `status` — what the end of an edit session means. */
+export function closeOpenOperations(workspaceDir, { status = "aborted" } = {}) {
+  const doc = readEditOperations(workspaceDir);
+  const closed = [];
+  const operations = doc.operations.map((o) => {
+    if (!OPEN_OPERATION_STATUSES.includes(o.status)) return o;
+    closed.push(o.operationId);
+    return { ...o, status };
+  });
+  if (closed.length > 0) writeEditOperations(workspaceDir, { version: EDIT_OPERATION_VERSION, operations });
+  return closed;
+}
+
+/** sha256 of a slide's bytes as they are on disk right now, or null when it is gone. */
+export function sourceHash(workspaceDir, jsxPath) {
+  try {
+    return sha256(fs.readFileSync(path.join(workspaceDir, jsxPath)));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Compare-and-swap: every target's source must still be the bytes the operation
+ * was prepared against. A candidate built from source that has since moved is
+ * not this operation's candidate, whatever its ledger says.
+ */
+export function assertOperationFresh(workspaceDir, operation) {
+  for (const target of operation?.targets ?? []) {
+    if (!target?.baseSourceHash) continue;
+    const current = sourceHash(workspaceDir, target.jsxPath);
+    if (current === null) {
+      throw stateError(
+        "source_missing",
+        `${target.jsxPath} is gone, but operation ${operation.operationId} was prepared against it.`,
+        { slideKey: target.slideKey, jsxPath: target.jsxPath },
+      );
+    }
+    if (current !== target.baseSourceHash) {
+      throw stateError(
+        "source_moved",
+        `${target.jsxPath} changed since operation ${operation.operationId} was prepared ` +
+          `(${target.baseSourceHash.slice(0, 12)} → ${current.slice(0, 12)}). ` +
+          `Re-open the scope (\`slidemind revision begin\`) against the current source.`,
+        { slideKey: target.slideKey, jsxPath: target.jsxPath, expected: target.baseSourceHash, actual: current },
+      );
+    }
+  }
+  return true;
+}
+
+// ---------------------------------------------------------------------------
+// resolving a selection to durable identity
+// ---------------------------------------------------------------------------
+
+/**
+ * "2,7" / "2-4" / "all" / "03-market.jsx" / "03-market" → the raw selectors.
+ * Position is an input grammar only: {@link resolveSlideTargets} turns each one
+ * into a slide GUID before anything is written down.
+ */
+export function parseSlideSelection(raw) {
+  if (raw == null || raw === "" || raw === "all") return null;
+  const out = [];
+  for (const chunk of String(raw).split(",")) {
+    const token = chunk.trim();
+    if (!token) continue;
+    const range = /^(\d+)\s*-\s*(\d+)$/.exec(token);
+    if (range) {
+      const [from, to] = [Number(range[1]), Number(range[2])];
+      if (from < 1 || to < from) throw stateError("bad_selection", `'${token}' is not a slide range`);
+      for (let n = from; n <= to; n++) out.push(n);
+      continue;
+    }
+    if (/^\d+$/.test(token)) {
+      const n = Number(token);
+      if (n < 1) throw stateError("bad_selection", `'${token}' is not a 1-based slide number`);
+      out.push(n);
+      continue;
+    }
+    out.push(token);
+  }
+  return out.length > 0 ? out : null;
+}
+
+/**
+ * Every slide file in play order with its DURABLE key. A slide with no GUID yet
+ * (a deck that has never rendered) gets one minted and persisted here, because
+ * an operation that named a position would be worthless the moment the deck is
+ * reordered.
+ *
+ * `selection` is the output of {@link parseSlideSelection}; null means all.
+ */
+export function resolveSlideTargets(workspaceDir, { selection = null } = {}) {
+  const known = loadSlideGuids(workspaceDir);
+  const guids = reconcileSlideGuids(workspaceDir);
+  const order = slideFileOrder(workspaceDir);
+  const fresh = {};
+  const all = order.map((file, i) => {
+    const jsxPath = `slides/${file}`;
+    let slideKey = guids[jsxPath] ?? null;
+    if (!slideKey) {
+      // `reconcileSlideGuids` tracks .jsx only, so it drops a reused native
+      // slide's entry every time it runs. `known` is the sidecar as it was
+      // before that, which is where a native's identity survives — and it is
+      // re-persisted below so the next command resolves the same key.
+      slideKey = known[jsxPath] ?? null;
+      if (!slideKey) slideKey = mintSlideGuid();
+      try {
+        fresh[jsxPath] = slideGuidEntry(slideKey, fs.readFileSync(path.join(workspaceDir, jsxPath)));
+      } catch {
+        fresh[jsxPath] = slideKey;
+      }
+    }
+    return { number: i + 1, file, jsxPath, slideKey, sourceHash: sourceHash(workspaceDir, jsxPath) };
+  });
+  if (Object.keys(fresh).length > 0) saveSlideGuids(workspaceDir, fresh);
+  if (!selection) return all;
+
+  const byNumber = new Map(all.map((t) => [t.number, t]));
+  const byName = new Map();
+  for (const t of all) {
+    byName.set(t.file, t);
+    byName.set(t.file.replace(/\.(jsx|pptx)$/i, ""), t);
+    byName.set(t.slideKey, t);
+  }
+  const picked = new Map();
+  for (const selector of selection) {
+    const hit = typeof selector === "number" ? byNumber.get(selector) : byName.get(selector);
+    if (!hit) {
+      throw stateError(
+        "bad_selection",
+        `--slides: this deck has no slide '${selector}' (it has ${all.length}: ${all.map((t) => t.file).join(", ") || "none"})`,
+      );
+    }
+    picked.set(hit.slideKey, hit);
+  }
+  return [...picked.values()].sort((a, b) => a.number - b.number);
+}
+
+// ---------------------------------------------------------------------------
+// legacy migration
+// ---------------------------------------------------------------------------
+
+// `state/transcribed.json`, written by `slidemind transcribe` (src/cli/transcribe.mjs):
+// slide file name → sha256 of the utf8 source it wrote. Read directly rather
+// than through that module, which is a command (its helpers exit the process).
+// `state/transcribed-delivery.json`, written beside it: per file, the ids that
+// write left out (`dropped`) and the line id each connector went under.
+function readTranscribeStamps(workspaceDir, name = "transcribed.json") {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(statePath(workspaceDir, name), "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+// ponytail: tag scan by regex, not a JSX parse. Slide source has no `>` inside
+// an attribute expression (`style={{…}}`, `data={{…}}`, numeric props), so the
+// bound holds for everything the transcriber and the converter emit. A real
+// parser belongs with the repair validator (phase 6), which needs one anyway.
+const TAG_RE = /<[A-Za-z][^>]*>/g;
+// `(?<![-\w])` and not `\b`: `\bid=` also matches the tail of
+// `data-sm-source-id=`, which would hand a converted element its source id
+// under the wrong attribute name. A braced value counts only as a string or
+// number literal: `id={id}` names a helper's parameter, not a value.
+const attr = (tag, name) => {
+  const m = new RegExp(`(?<![-\\w])${name}="([^"]*)"`).exec(tag);
+  if (m) return m[1];
+  const braced = new RegExp(`(?<![-\\w])${name}=\\{\\s*(?:"([^"]*)"|'([^']*)'|\\x60([^\\x60$]*)\\x60|(\\d+))\\s*\\}`).exec(tag);
+  return braced ? (braced[1] ?? braced[2] ?? braced[3] ?? braced[4]) : null;
+};
+/** `<div id={id} …>`: a helper's template, given a real id at each call site. */
+const isTemplateTag = (tag) => attr(tag, "id") == null && /(?<![-\w])id=\{/.test(tag);
+
+/** How much of an element's text a requirement keeps, to quote in a refusal. */
+const EXCERPT_CHARS = 32;
+const excerptOf = (text) => (text.length > EXCERPT_CHARS ? `${text.slice(0, EXCERPT_CHARS - 1)}…` : text);
+
+/**
+ * The obligations readable from the source in front of us: one requirement per
+ * element that carries a durable id, connectors bound to their endpoints, and
+ * the native-object placeholders an import left behind.
+ *
+ * For a CONVERTED slide the ids are the converter's own shape ids
+ * (`data-sm-source-id`), never a concept's — an import has no concept. What
+ * each requirement protects comes from {@link PROTECTED_BY_ORIGIN}; an image
+ * also records the asset it points at (`mediaRef`), which is what makes a
+ * substitution detectable at the same element count (E11).
+ */
+export function scanSourceRequirements(jsx, { packagePart = null, origin = "legacy-current" } = {}) {
+  const requirements = [];
+  const limitations = [];
+  const ids = new Set();
+  const sourceIds = new Set();
+  const connectors = [];
+  let unidentified = 0;
+  const read = readSlideElements(jsx);
+
+  // A set component's members are scanned where they are drawn, by their
+  // literal part ids (inline-components.mjs).
+  const inlined = inlineComponents(String(jsx ?? ""));
+  for (const u of inlined.unreadable) {
+    limitations.push(`<${u.component}> on line ${u.line} is spread from an object, so its members cannot be required back`);
+  }
+  for (const tag of inlined.src.match(TAG_RE) ?? []) {
+    if (/^<\//.test(tag) || isTemplateTag(tag)) continue;
+    const srcId = attr(tag, "data-sm-source-id");
+    const elementId = attr(tag, "id") ?? (srcId ? String(srcId) : null);
+    const isConnector = /\bdata-connector\b/.test(tag);
+    const isNative = /\bdata-sm-native-object\b/.test(tag);
+    const isImage = /^<img\b/i.test(tag);
+
+    if (isConnector) {
+      // A connector is identified by what it joins, so an unlabelled one is not
+      // ambiguous the way an unlabelled box is: its id is derived below, after
+      // both endpoints have been resolved against the slide.
+      connectors.push({ elementId, from: attr(tag, "data-from"), to: attr(tag, "data-to") });
+      if (elementId) ids.add(elementId);
+      if (srcId) sourceIds.add(String(srcId));
+      continue;
+    }
+    if (!elementId) {
+      // A layout wrapper carries no identity and owes nothing; a content element
+      // without one cannot be required back. Counted, never guessed at.
+      if (isNative || isImage || /\bx=|\bleft:/.test(tag)) unidentified += 1;
+      continue;
+    }
+    if (srcId) sourceIds.add(String(srcId));
+    ids.add(elementId);
+
+    if (isNative) {
+      const rel = packagePart ? [{ role: "package-part", target: packagePart }] : [];
+      if (rel.length === 0) {
+        limitations.push(
+          `${elementId} is a preserved native object whose source package is not in this deck; ` +
+            `its dependency closure cannot be required back`,
+        );
+        requirements.push({
+          requirementId: `req-element-${elementId}`,
+          elementId,
+          kind: "element",
+          // Still a native object: content, never decoration a redesign may drop.
+          properties: protect(["geom", "native"], origin),
+        });
+        continue;
+      }
+      const slot = attr(tag, "data-sm-native-object");
+      requirements.push({
+        requirementId: `req-native-object-${elementId}`,
+        elementId,
+        kind: "native-object",
+        properties: protect(["native"], origin),
+        relationships: slot != null ? [...rel, { role: "native-slot", target: String(slot) }] : rel,
+      });
+      continue;
+    }
+    // What each element class can even have: an image has bytes, a chart has
+    // data, an ordinary box has styling — and text or a picture fill only
+    // where it actually carries one. A shape with no content owes none, which
+    // is what lets a redesign restyle it away (`declaredFor`,
+    // preservation-verdict.mjs). The origin then decides which of those it is
+    // entitled to claim.
+    const isChart = /^<Chart\b/.test(tag);
+    const text = read.byId.get(elementId)?.text ?? "";
+    const candidates = isImage
+      ? ["media", "geom"]
+      : isChart
+        ? ["chart", "geom"]
+        : ["geom", "fill", "line", ...(text ? ["text"] : []), ...(/\burl\(/.test(tag) ? ["media"] : [])];
+    const properties = protect(candidates, origin);
+    const mediaRef = isImage ? attr(tag, "src") : null;
+    requirements.push({
+      requirementId: `req-element-${elementId}`,
+      elementId,
+      kind: "element",
+      properties,
+      ...(mediaRef ? { mediaRef } : {}),
+      ...(properties.includes("text") ? { excerpt: excerptOf(text) } : {}),
+    });
+  }
+
+  // A connector's endpoints are the whole obligation (E11: same element count,
+  // different endpoint). The emitted anchor may be prefixed — resolve it against
+  // the ids actually on this slide, and say so when it resolves to nothing.
+  const resolveEnd = (ref) => {
+    const bare = String(ref ?? "").replace(/^#/, "");
+    if (!bare) return null;
+    if (ids.has(bare)) return bare;
+    const suffix = /^sm-(.+)$/.exec(bare)?.[1];
+    if (suffix && (ids.has(suffix) || sourceIds.has(suffix))) return suffix;
+    return bare;
+  };
+  const usedConnectorIds = new Set(ids);
+  for (const c of connectors) {
+    const start = resolveEnd(c.from);
+    const end = resolveEnd(c.to);
+    if (!start || !end) {
+      // Without both ends there is no obligation to state and no identity to
+      // derive — the only honest outcome is to say so.
+      unidentified += 1;
+      limitations.push(`a connector names no endpoints in the source; it cannot be required back`);
+      continue;
+    }
+    // Derived, not invented: a connector the source did not name is identified
+    // by the pair it joins, and two connectors on the same pair are numbered in
+    // source order — the order both clients read the slide in.
+    let elementId = c.elementId;
+    if (!elementId) {
+      elementId = `conn-${start}-${end}`;
+      for (let n = 2; usedConnectorIds.has(elementId); n++) elementId = `conn-${start}-${end}-${n}`;
+    }
+    usedConnectorIds.add(elementId);
+    if (!ids.has(start) && !sourceIds.has(start)) {
+      limitations.push(`connector ${elementId} starts at '${start}', which is not an element of this slide`);
+    }
+    if (!ids.has(end) && !sourceIds.has(end)) {
+      limitations.push(`connector ${elementId} ends at '${end}', which is not an element of this slide`);
+    }
+    requirements.push({
+      requirementId: `req-connection-${elementId}`,
+      elementId,
+      kind: "connection",
+      // A connector's obligation IS its endpoints; the route is style, and only
+      // an import claims that much.
+      properties: protect(["geom", "line"], origin),
+      relationships: [
+        { role: "start", target: start },
+        { role: "end", target: end },
+      ],
+    });
+  }
+
+  if (unidentified > 0) {
+    limitations.push(
+      `${unidentified} element(s) in the current source carry no durable id, so their preservation cannot be required`,
+    );
+  }
+  return { requirements, limitations };
+}
+
+/**
+ * The obligations a TRANSCRIBED slide carries, taken from its concept spec's
+ * element ids (`state/concept-specs/concept-slide-NN.json`) rather than from
+ * the JSX those ids were written into. The spec is the approved content: it
+ * knows which text is a business fact, which asset was chosen and which element
+ * is a chart — none of which the emitted source states about itself.
+ *
+ * Connector ids are derived exactly as {@link scanSourceRequirements} derives
+ * them (`conn-<from>-<to>`), so a slide seeded from its spec and one re-read
+ * from its source name the same obligations.
+ */
+export function specRequirements(spec, { origin = "concept" } = {}) {
+  const requirements = [];
+  const limitations = [];
+  const ids = new Set();
+  let unidentified = 0;
+
+  for (const e of spec?.elements ?? []) {
+    if (!isDurableId(e?.id)) {
+      unidentified += 1;
+      continue;
+    }
+    ids.add(e.id);
+    // A bound original delegates byte and framing verification to the
+    // image-intent validator; all this record keeps is the canonical use id.
+    if (isDurableId(e.image?.assetUseId)) {
+      requirements.push({
+        requirementId: `req-image-use-${e.id}`,
+        elementId: e.id,
+        kind: "image-use",
+        useId: e.image.assetUseId,
+        properties: protect(["media"], origin),
+      });
+      continue;
+    }
+    const candidates = [];
+    if (cleanText(e.text) != null) candidates.push("text");
+    if (e.fillToken || e.fillHex || (e.fill && e.fill !== "none")) candidates.push("fill");
+    if (e.image || e.icon) candidates.push("media");
+    if (e.chart) candidates.push("chart");
+    requirements.push({
+      requirementId: `req-element-${e.id}`,
+      elementId: e.id,
+      kind: "element",
+      properties: protect(candidates, origin),
+    });
+  }
+
+  const used = new Set(ids);
+  for (const c of spec?.connectors ?? []) {
+    // A free line (an end at a point) is drawn geometry, not a relationship.
+    if (c?.fromPoint || c?.toPoint) continue;
+    const start = String(c?.from ?? "");
+    const end = String(c?.to ?? "");
+    if (!isDurableId(start) || !isDurableId(end)) {
+      limitations.push("a connector in the concept spec names no endpoints; it cannot be required back");
+      continue;
+    }
+    let elementId = `conn-${start}-${end}`;
+    for (let n = 2; used.has(elementId); n++) elementId = `conn-${start}-${end}-${n}`;
+    used.add(elementId);
+    if (!ids.has(start)) limitations.push(`connector ${elementId} starts at '${start}', which the spec does not list`);
+    if (!ids.has(end)) limitations.push(`connector ${elementId} ends at '${end}', which the spec does not list`);
+    requirements.push({
+      requirementId: `req-connection-${elementId}`,
+      elementId,
+      kind: "connection",
+      properties: protect(["geom", "line"], origin),
+      relationships: [
+        { role: "start", target: start },
+        { role: "end", target: end },
+      ],
+    });
+  }
+  if (unidentified > 0) {
+    limitations.push(`${unidentified} concept element(s) carry no id, so their preservation cannot be required`);
+  }
+  return { requirements, limitations };
+}
+
+// Concept obligations bound to what `transcribe` DELIVERED — LOCKSTEP with the
+// add-in's `bindDelivered` (transcription-state.ts). A spec is read only while
+// its source is byte for byte transcribe's output, so an obligation that output
+// cannot answer for fails our own gate on a slide nobody touched. `delivery` is
+// transcribe's own record of that write: a split line or a mark's dots is
+// `<id>-N` (`bindSplitIds`); a connector not glued as the concept says (a
+// loop's arc, an end whose ink stops short) is owed as the line it was written
+// under (`connectorLines`); an id it deliberately left out (`dropped`) is
+// released. Anything else the output lacks stays owed: a silent loss is a
+// transcriber defect and must read as one.
+function bindDelivered(seeded, jsx, { dropped = [], connectorLines = [] } = {}) {
+  const present = readSlideElements(jsx).byId;
+  const pairOf = (r) => ["start", "end"].map((role) => r.relationships?.find((x) => x.role === role)?.target).join(" -> ");
+  const bound = bindSplitIds(seeded.requirements, jsx);
+  // A delivered connector answers for one obligation, never for an element id.
+  const claimed = new Set(bound.filter((r) => r.kind !== "connection").map((r) => r.elementId));
+  const limitations = [...seeded.limitations];
+  const requirements = [];
+  for (const req of bound) {
+    const ends = req.kind === "connection" ? pairOf(req) : null;
+    const written = ends ? connectorLines.filter((l) => `${l.from} -> ${l.to}` === ends).map((l) => l.id) : [];
+    const glued = ends && [...present].find(([id, e]) => !claimed.has(id) && pairOf(e) === ends)?.[0];
+    const line = ends && !glued && written.find((id) => present.has(id) && !claimed.has(id));
+    if (glued || line) {
+      claimed.add(glued || line);
+      if (glued) requirements.push({ ...req, requirementId: `req-connection-${glued}`, elementId: glued });
+      else {
+        requirements.push({ requirementId: `req-element-${line}`, elementId: line, kind: "element", properties: req.properties });
+        limitations.push(`${ends} is drawn as ${line} without both ends glued: the line is owed, the relation cannot be required back`);
+      }
+    } else if ((ends || !present.has(req.elementId)) && [req.elementId, ...written].some((id) => dropped.includes(id))) {
+      limitations.push(`${req.elementId} was left out by transcribe (see its notes), so it cannot be required back`);
+    } else {
+      requirements.push(req);
+    }
+  }
+  return { requirements, limitations };
+}
+
+// A slide file's number is its NN- prefix — the same rule `transcribe` uses to
+// pair `concept-slide-NN.json` with `NN-name.jsx`. Falls back to play order for
+// a deck that never used the prefix.
+function slideNumberFor(target) {
+  const prefixed = /^(\d+)[-_.]/.exec(target.file);
+  return prefixed ? Number(prefixed[1]) : target.number;
+}
+
+function seedEntry(workspaceDir, target, { stamps, delivery, conversions, baseRevision }) {
+  let bytes;
+  try {
+    bytes = fs.readFileSync(path.join(workspaceDir, target.jsxPath));
+  } catch {
+    return null;
+  }
+  const baseline = { sourceHash: sha256(bytes), revision: baseRevision ?? null };
+  const limitations = [];
+  // `loadConversions` cannot say "a record was here and I could not read it" —
+  // a map has no encoding for that, so a corrupt record reaches it as absence.
+  // Read the third state directly: seeding `legacy-current` for a slide that
+  // IS an import would hand it the WEAKER protected set (media/native instead
+  // of the full raw-fidelity set), and an import is precisely the case where
+  // the raw values are the content. The record file existing is evidence about
+  // what the slide IS; failing to parse it says nothing about that, only about
+  // the details — so origin stays `converted` and the details become a stated
+  // limitation.
+  const provenance = conversionProvenance(workspaceDir, target.file);
+  const conversionUnreadable = provenance === undefined;
+  const conversion = conversions[target.file] ?? (conversionUnreadable ? {} : null);
+  const isJsx = target.file.toLowerCase().endsWith(".jsx");
+  const stem = target.file.replace(/\.(jsx|pptx)$/i, "");
+  const packagePart = fs.existsSync(path.join(workspaceDir, "conversions", `${stem}.slide.pptx`))
+    ? `conversions/${stem}.slide.pptx`
+    : null;
+
+  // WHERE THE OBLIGATIONS COME FROM decides both the origin and the reader.
+  // An import is read through the converter's shape ids, a machine-owned
+  // transcription through its concept spec, and everything else through the
+  // source as it stands — which is the one rule with teeth here: source that a
+  // person has edited since it was stamped is NOT a concept's to promise.
+  let origin;
+  let seeded = null;
+  const machineOwned = Boolean(stamps[target.file]) && stamps[target.file] === sha256(bytes.toString("utf8"));
+  if (conversion) {
+    origin = "converted";
+    if (conversionUnreadable) {
+      // The natives its `preserved[]` would have named cannot be enumerated, so
+      // any native without a placeholder in the source is unrecoverable here.
+      limitations.push(
+        `conversions/${stem}.json is on disk and could not be read: this slide is treated as an import ` +
+          `(its raw values are protected), but its preserved natives could not be enumerated — repair or ` +
+          `re-adopt the record before relying on native preservation`,
+      );
+    } else if (!conversion.conversionEvidence) {
+      limitations.push("imported without render evidence; what the conversion produced was never verified here");
+    }
+  } else if (!isJsx) {
+    origin = "legacy-current";
+    limitations.push("native .pptx slide: its contents are not modelled locally, only its bytes are");
+  } else if (machineOwned) {
+    const spec = readSpec(workspaceDir, slideNumberFor(target));
+    if (spec) {
+      origin = "concept";
+      seeded = bindDelivered(specRequirements(spec, { origin }), bytes.toString("utf8"), delivery[target.file]);
+    } else {
+      origin = "legacy-current";
+      limitations.push(
+        "transcribed, but its concept spec is no longer on disk; these obligations come from the current source",
+      );
+    }
+  } else {
+    origin = "legacy-current";
+    if (stamps[target.file]) {
+      limitations.push(
+        "edited since `transcribe` stamped it: these obligations come from the CURRENT source, " +
+          "not from the concept spec it was generated from",
+      );
+    }
+  }
+
+  const scan =
+    seeded ??
+    (isJsx
+      ? scanSourceRequirements(bytes.toString("utf8"), { packagePart, origin })
+      : { requirements: [], limitations: [] });
+  const active = [...scan.requirements];
+  limitations.push(...scan.limitations);
+
+  // A converted slide whose source carries fewer identities than the original
+  // had shapes lost something in conversion; that is a stated gap, not a pass.
+  const sourceShapes = conversion?.sourceBaseline?.projection?.shapes?.length ?? null;
+  if (sourceShapes != null && active.length > 0 && sourceShapes > active.length) {
+    limitations.push(
+      `the source slide had ${sourceShapes} shape(s) but only ${active.length} carry an identity here; ` +
+        `the rest cannot be required back`,
+    );
+  }
+
+  // Natives the import preserved but the source carries no placeholder for:
+  // the package is the obligation, whatever the jsx shows.
+  const placeheld = new Set(active.filter((r) => r.kind === "native-object").map((r) => r.elementId));
+  (conversion?.preserved ?? []).forEach((p, i) => {
+    const elementId = String(p?.sourceId ?? `native-${i}`).replace(/\s+/g, "-");
+    if (placeheld.has(elementId) || active.some((r) => r.kind === "native-object" && r.relationships?.some((rel) => rel.role === "native-slot" && rel.target === String(i)))) {
+      return;
+    }
+    if (!packagePart) {
+      limitations.push(`preserved native '${elementId}' has no source package in this deck; it cannot be required back`);
+      return;
+    }
+    active.push({
+      requirementId: `req-native-object-${elementId}`,
+      elementId,
+      kind: "native-object",
+      properties: protect(["native"], origin),
+      relationships: [
+        { role: "package-part", target: packagePart },
+        { role: "native-slot", target: String(i) },
+      ],
+    });
+  });
+
+  return {
+    version: SLIDE_PRESERVATION_VERSION,
+    slideKey: target.slideKey,
+    origin,
+    // Migration captures obligations, never verdicts. `unknown` is what makes a
+    // final replacement refusable instead of quietly assumed good.
+    evidence: "unknown",
+    baseline,
+    active,
+    superseded: [],
+    limitations,
+    migratedAt: new Date().toISOString(),
+  };
+}
+
+/**
+ * Seed preservation records for every slide that has none, from the evidence
+ * actually on disk. Additive and resumable: an existing entry is never touched,
+ * so a run interrupted halfway continues where it stopped, and a deck that has
+ * already migrated is a no-op.
+ *
+ * Refuses (and writes nothing) when the record on disk is corrupt or carries a
+ * schema this build does not read.
+ */
+export function migrateEditState(workspaceDir, { selection = null } = {}) {
+  const previous = readSlidePreservation(workspaceDir);
+  const targets = resolveSlideTargets(workspaceDir, { selection });
+  const stamps = readTranscribeStamps(workspaceDir);
+  const delivery = readTranscribeStamps(workspaceDir, "transcribed-delivery.json");
+  const conversions = loadConversions(workspaceDir, { includeSource: false });
+  const baseRevision = readRevision(workspaceDir)?.base?.sha256 ?? null;
+
+  const slides = { ...previous.slides };
+  const seeded = [];
+  const skipped = [];
+  for (const target of targets) {
+    if (slides[target.slideKey]) continue;
+    const entry = seedEntry(workspaceDir, target, { stamps, delivery, conversions, baseRevision });
+    if (!entry) {
+      skipped.push({ slideKey: target.slideKey, jsxPath: target.jsxPath, reason: "unreadable" });
+      continue;
+    }
+    slides[target.slideKey] = entry;
+    seeded.push({
+      slideKey: target.slideKey,
+      jsxPath: target.jsxPath,
+      origin: entry.origin,
+      requirements: entry.active.length,
+      limitations: entry.limitations,
+    });
+  }
+  if (seeded.length > 0) {
+    writeSlidePreservation(workspaceDir, { version: SLIDE_PRESERVATION_VERSION, slides });
+  }
+  return { seeded, skipped, migrated: seeded.length > 0, slideCount: Object.keys(slides).length };
+}
+
+// ---------------------------------------------------------------------------
+// scoped amendments — the only legal way a requirement set changes
+// ---------------------------------------------------------------------------
+
+/**
+ * What this operation PERMITS on a slide: `elementId → Set(property scope)`,
+ * plus `removed` for the elements it was asked to delete.
+ *
+ * Permissions live on the operation, obligations on the preservation record.
+ * Keeping them apart is deliberate: an `update` never narrows a requirement (it
+ * would never widen back), so the verdict reads both and the record stays the
+ * statement of what is owed.
+ */
+export function permittedChanges(operation, slideKey) {
+  const out = new Map();
+  const target = (operation?.targets ?? []).find((t) => t?.slideKey === slideKey);
+  for (const change of target?.changes ?? []) {
+    if (!isDurableId(change?.elementId)) continue;
+    const entry = out.get(change.elementId) ?? { action: change.action, properties: new Set() };
+    entry.action = change.action;
+    for (const scope of change.properties ?? []) entry.properties.add(scope);
+    out.set(change.elementId, entry);
+  }
+  return out;
+}
+
+/**
+ * Apply an operation's declared changes to the preservation record.
+ *
+ * This is the ONLY door through which an obligation ends. It is request-scoped
+ * in three ways at once: the supersession names the operation that authorized
+ * it and the base source it was authorized against; the write goes through
+ * `validatePreservationUpdate(previous, next, { operation })`, which refuses any
+ * drop this operation did not name and any slide it does not target; and the
+ * operation must still be fresh, so a scope declared against source that has
+ * since moved cannot retire anything.
+ *
+ * Three actions, three outcomes:
+ *   remove  supersede every requirement on that element — the intentional
+ *           deletion, distinguishable from the accidental one precisely because
+ *           it was asked for in advance (E09 vs E10).
+ *   add     a REQUESTED ADDITION becomes a required output in its own right.
+ *           Absence of old content is not the only failure mode: an addition
+ *           the user asked for and did not get fails too.
+ *   update  nothing here. See {@link permittedChanges}.
+ *
+ * Unaffected requirements are carried through untouched, and there is no
+ * encoding for "reset this slide" — a blanket clear is unrepresentable because
+ * every drop has to be named element by element.
+ */
+export function applyRequirementAmendment(workspaceDir, operation) {
+  assertOperationFresh(workspaceDir, operation);
+  const doc = readSlidePreservation(workspaceDir);
+  const slides = { ...doc.slides };
+  const amended = { added: [], superseded: [], slides: [] };
+  const at = new Date().toISOString();
+
+  for (const target of operation?.targets ?? []) {
+    const changes = (target.changes ?? []).filter((c) => isDurableId(c?.elementId));
+    if (changes.length === 0) continue;
+    const entry = slides[target.slideKey];
+    if (!entry) {
+      throw stateError(
+        "no_preservation_record",
+        `${target.jsxPath} has no preservation record, so there is nothing to amend. ` +
+          `Open the scope with \`slidemind revision begin\`, which captures one first.`,
+        { slideKey: target.slideKey },
+      );
+    }
+    const next = amendForOperation(entry, target, operation, { at });
+    for (const requirementId of next.superseded) amended.superseded.push({ slideKey: target.slideKey, requirementId });
+    for (const requirementId of next.added) amended.added.push({ slideKey: target.slideKey, requirementId });
+    slides[target.slideKey] = next.entry;
+    amended.slides.push(target.slideKey);
+  }
+
+  if (amended.slides.length > 0) {
+    writeSlidePreservation(workspaceDir, { version: SLIDE_PRESERVATION_VERSION, slides }, { operation });
+  }
+  return amended;
+}
+
+// ---------------------------------------------------------------------------
+// checking a requirement set against evidence
+// ---------------------------------------------------------------------------
+
+/**
+ * The slide's obligations-facing evidence, read from its SOURCE: which element
+ * identities are present, what each connector is bound to, and which asset each
+ * image points at.
+ *
+ * Source evidence proves identity and relationships exactly; it cannot prove
+ * that a protected text, fill or geometry is unchanged — that needs the
+ * normalized render IR. {@link checkRequirements} therefore reports those
+ * scopes as UNVERIFIED rather than passing them, which is the whole reason the
+ * two are separate values.
+ */
+export function requirementEvidenceFromSource(jsx, options = {}) {
+  const { requirements } = scanSourceRequirements(jsx, options);
+  const ids = new Set();
+  const relationships = new Map();
+  const media = new Map();
+  for (const req of requirements) {
+    ids.add(req.elementId);
+    if (req.relationships?.length) relationships.set(req.elementId, req.relationships);
+    if (req.mediaRef) media.set(req.elementId, req.mediaRef);
+  }
+  return { ids, relationships, media };
+}
+
+/**
+ * Which of a slide's active requirements the evidence says are met, unmet, or
+ * simply not answerable.
+ *
+ * `operation` is the permission side: an element it was asked to remove is not
+ * reported missing, and a property scope it was allowed to change is not
+ * reported unverified.
+ */
+export function checkRequirements(entry, evidence, { operation = null } = {}) {
+  const violations = [];
+  const unverified = [];
+  const permitted = operation ? permittedChanges(operation, entry?.slideKey) : new Map();
+  // Only these two are decidable from source; everything else needs the render.
+  const PROVABLE = new Set(["media"]);
+
+  for (const req of entry?.active ?? []) {
+    const allowed = permitted.get(req.elementId) ?? null;
+    if (!evidence.ids.has(req.elementId)) {
+      // An element the operation was asked to remove should have been
+      // superseded by the amendment; if it still stands, it is still owed.
+      violations.push({
+        requirementId: req.requirementId,
+        elementId: req.elementId,
+        code: allowed?.action === "remove" ? "removed_without_amendment" : "missing",
+        detail:
+          allowed?.action === "remove"
+            ? `${req.elementId} was removed, but its requirement was never superseded by this operation`
+            : `${req.elementId} is required on this slide and is not in the evidence`,
+      });
+      continue;
+    }
+    for (const rel of req.relationships ?? []) {
+      // A package part is evidence about the .pptx, not about the source.
+      if (rel.role !== "start" && rel.role !== "end") continue;
+      const actual = (evidence.relationships.get(req.elementId) ?? []).find((r) => r.role === rel.role);
+      if (!actual) {
+        violations.push({
+          requirementId: req.requirementId,
+          elementId: req.elementId,
+          code: "relationship_missing",
+          detail: `${req.elementId} no longer records its ${rel.role} endpoint`,
+        });
+      } else if (actual.target !== rel.target) {
+        violations.push({
+          requirementId: req.requirementId,
+          elementId: req.elementId,
+          code: "relationship_changed",
+          detail: `${req.elementId}'s ${rel.role} was ${rel.target}, now ${actual.target}`,
+        });
+      }
+    }
+    if (req.mediaRef && !allowed?.properties.has("media")) {
+      const actual = evidence.media.get(req.elementId) ?? null;
+      if (actual !== req.mediaRef) {
+        violations.push({
+          requirementId: req.requirementId,
+          elementId: req.elementId,
+          code: "media_changed",
+          detail: `${req.elementId} pointed at ${req.mediaRef}, now ${actual ?? "nothing"}`,
+        });
+      }
+    }
+    const open = (req.properties ?? []).filter(
+      (scope) => !PROVABLE.has(scope) && !allowed?.properties.has(scope),
+    );
+    const mediaUnprovable = (req.properties ?? []).includes("media") && !req.mediaRef && !allowed?.properties.has("media");
+    if (mediaUnprovable) open.push("media");
+    if (req.kind === "native-object" || req.kind === "image-use") open.push(req.kind);
+    if (open.length > 0) {
+      unverified.push({ requirementId: req.requirementId, elementId: req.elementId, properties: [...new Set(open)] });
+    }
+  }
+  return { ok: violations.length === 0, violations, unverified };
+}
+
+/**
+ * The verdict a check earns: a violation is `failed`, an unanswerable
+ * obligation is `unknown`, and only a check that answered everything is
+ * `passed`. Missing evidence never becomes a pass.
+ */
+export function evidenceStatus(result) {
+  if (!result || result.violations.length > 0) return "failed";
+  return result.unverified.length > 0 ? "unknown" : "passed";
+}
+
+// ---------------------------------------------------------------------------
+// redesign — a replacement, not an addition
+// ---------------------------------------------------------------------------
+
+/**
+ * Whether an explicit redesign actually REPLACED what it was pointed at.
+ *
+ * A redesign is authorized by the user's request, so nothing here asks again
+ * (guide section 1: "A user who already asked for redesign has authorized that
+ * transition; no redundant approval prompt"). What it does check is the one
+ * thing a restyle gets wrong in practice — E18 — which is producing a second
+ * slide next to the original instead of replacing it, and then carrying neither
+ * the original's required content nor its native objects across.
+ *
+ * Four questions, each answerable from what is already on disk:
+ *
+ *   • does every target still exist under its OWN slideKey? A redesign that
+ *     minted a new identity has lost the thing it was asked to change.
+ *   • did a slide appear that nobody has a scope for? The operation records the
+ *     deck's slide identities as they stood when it was prepared; a slide
+ *     outside that set, and outside any `create`, is the duplicate E18 is
+ *     about. A slide merely LACKING a preservation record proves nothing — a
+ *     legacy or partially migrated deck is full of those — so it is never the
+ *     test, and an operation that recorded no such set reports the question as
+ *     unanswerable rather than answering it.
+ *   • did the required content survive? Delegated to {@link checkRequirements},
+ *     so "carried forward" means the same thing here as everywhere else.
+ *   • are the native objects still backed? A native's obligation is its source
+ *     package dependency closure — which survives a change of placement, and
+ *     does not survive the package being dropped.
+ *
+ * Reports; never writes. The caller decides whether a violation blocks —
+ * `unverified` names what could not be decided and is never a violation.
+ */
+export function checkRedesignTransition(workspaceDir, operation) {
+  const violations = [];
+  const unverified = [];
+  const { slides } = readSlidePreservation(workspaceDir);
+  const targets = resolveSlideTargets(workspaceDir);
+  const byKey = new Map(targets.map((t) => [t.slideKey, t]));
+
+  for (const target of operation?.targets ?? []) {
+    const current = byKey.get(target.slideKey);
+    if (!current) {
+      violations.push({
+        code: "target_missing",
+        slideKey: target.slideKey,
+        detail:
+          `${target.jsxPath} was redesigned away rather than redesigned: no slide in this deck carries ` +
+          `${target.slideKey} any more. A redesign replaces the slide it was pointed at, under its own identity.`,
+      });
+      continue;
+    }
+    const entry = slides[target.slideKey];
+    if (!entry) {
+      violations.push({
+        code: "no_preservation_record",
+        slideKey: target.slideKey,
+        detail: `${current.jsxPath} has no preservation record, so nothing can be said to have carried forward`,
+      });
+      continue;
+    }
+
+    let jsx = "";
+    try {
+      jsx = fs.readFileSync(path.join(workspaceDir, current.jsxPath), "utf8");
+    } catch {
+      /* read failure surfaces below as every requirement missing */
+    }
+    const stem = current.file.replace(/\.(jsx|pptx)$/i, "");
+    const packagePart = fs.existsSync(path.join(workspaceDir, "conversions", `${stem}.slide.pptx`))
+      ? `conversions/${stem}.slide.pptx`
+      : null;
+    const result = checkRequirements(entry, requirementEvidenceFromSource(jsx, { packagePart, origin: entry.origin }), {
+      operation,
+    });
+    for (const v of result.violations) {
+      violations.push({ code: `carry_forward_${v.code}`, slideKey: target.slideKey, requirementId: v.requirementId, detail: v.detail });
+    }
+
+    // A native object's placement may change; its package may not go missing.
+    for (const req of entry.active) {
+      if (req.kind !== "native-object") continue;
+      for (const rel of req.relationships ?? []) {
+        if (rel.role !== "package-part") continue;
+        if (fs.existsSync(path.join(workspaceDir, rel.target))) continue;
+        violations.push({
+          code: "native_package_missing",
+          slideKey: target.slideKey,
+          requirementId: req.requirementId,
+          detail:
+            `${req.elementId} is a preserved native object and ${rel.target} is gone; ` +
+            `its dependency closure has to survive a redesign, wherever the object ends up on the slide`,
+        });
+      }
+    }
+  }
+
+  // THE DUPLICATE. The question is "did this slide appear since the scope
+  // opened?" — never "does this slide have a preservation record?". A deck can
+  // legitimately hold slides with no record at all (a legacy deck, a partial
+  // migration, an adopt from a file an older CLI baked, where
+  // `restorePreservationFromTags` only restores what carried a payload), and
+  // convicting those would report an innocent slide as E18. Absence of a record
+  // is not evidence either way.
+  //
+  // The evidence is `preparedSlideKeys`: the deck's slide identities as they
+  // stood when the operation was recorded. A slide in that set was there
+  // before, whatever its record says; one outside it appeared afterwards and
+  // belongs to a `create` operation or to nothing.
+  const prepared = Array.isArray(operation?.preparedSlideKeys)
+    ? new Set(operation.preparedSlideKeys.filter(isDurableId))
+    : null;
+  if (!prepared) {
+    // An operation recorded without that set — another client's, or one built
+    // by hand — cannot answer the question. Say so; do not guess in either
+    // direction.
+    unverified.push({
+      code: "insertion_unverifiable",
+      detail:
+        `operation ${operation?.operationId ?? "(unnamed)"} did not record the deck's slides as they stood when ` +
+        `it was prepared, so a slide added since cannot be told from one that was always there`,
+    });
+  } else {
+    const created = new Set(
+      openOperations(workspaceDir)
+        .filter((o) => o.kind === "create")
+        .flatMap((o) => operationSlideKeys(o)),
+    );
+    for (const target of targets) {
+      if (prepared.has(target.slideKey) || created.has(target.slideKey)) continue;
+      violations.push({
+        code: "duplicate_insertion",
+        slideKey: target.slideKey,
+        detail:
+          `${target.jsxPath} appeared after this redesign was scoped and belongs to no operation. A redesign ` +
+          `replaces its target in place; a genuinely new slide is its own \`create\`.`,
+      });
+    }
+  }
+
+  return { ok: violations.length === 0, violations, unverified };
+}
+
+/** The open redesign operations governing this deck. */
+export function openRedesigns(workspaceDir) {
+  return openOperations(workspaceDir).filter((o) => o.kind === "redesign");
+}
+
+/**
+ * Why a FINAL replacement cannot go ahead for these slides yet: no record at
+ * all, or a record whose evidence is anything but `passed`. Reading and
+ * drafting stay open — the caller reports the limitation; only delivery refuses.
+ */
+export function finalEvidenceBlockers(workspaceDir, slideKeys) {
+  const { slides } = readSlidePreservation(workspaceDir);
+  const blockers = [];
+  for (const slideKey of slideKeys ?? []) {
+    const entry = slides[slideKey];
+    if (!entry) {
+      blockers.push({ slideKey, code: "no_record", reason: "no preservation record; run an edit scope to capture one" });
+      continue;
+    }
+    if (entry.evidence !== "passed") {
+      blockers.push({
+        slideKey,
+        code: `evidence_${entry.evidence}`,
+        reason:
+          `preservation evidence is '${entry.evidence}'` +
+          (entry.limitations?.length ? ` — ${entry.limitations.join("; ")}` : ""),
+      });
+    }
+  }
+  return blockers;
+}