things-api 0.19.3 → 0.20.0

package/dist/write/operations.d.ts

@@ -541,6 +541,51 @@ export interface RepeatRuleParams {
      */
     next?: IsoDate;
 }
+/**
+ * `reschedule-repeat` params — the full {@link RepeatRuleParams} vocabulary with
+ * `frequency` + `interval` OPTIONAL, because the verb now has TWO spellings:
+ *
+ *  - **Restate the rule** (both present): the Repeat dialog is driven, exactly as
+ *    before — the ui vector, `dangerouslyDriveGui`, the whole rule rewritten.
+ *  - **RE-ANCHOR** (`{ uuid, next }` alone, both absent): move the series' next
+ *    occurrence to a date without restating its rule. One background `open` on
+ *    the URL scheme, tier 0, no GUI-drive acknowledgement — the path REANCH1
+ *    measured (docs/lab/reanch1-url-reanchor.md) and REANCH2 re-verified. It is
+ *    guarded hard: Things ≥ 3.23, a strictly-future date, a fixed non-paused
+ *    single-weekday rule, and a route matching the row type.
+ *
+ * The two are exclusive by construction — a re-anchor carries `next` and NOTHING
+ * else, so any other rule field means the dialog spelling and `frequency` +
+ * `interval` are required with it (enforced by `assertRescheduleRule`).
+ */
+export interface RescheduleRepeatParams extends Omit<RepeatRuleParams, "frequency" | "interval"> {
+    /** The recurrence unit — required UNLESS this is a bare re-anchor. */
+    frequency?: RepeatFrequency;
+    /** "every N units", 1–99 — required UNLESS this is a bare re-anchor. */
+    interval?: number;
+}
+/**
+ * The bare RE-ANCHOR spelling of {@link RescheduleRepeatParams}: a target uuid and
+ * the date its series' next occurrence moves to, nothing else.
+ */
+export interface RepeatReanchorParams {
+    uuid: string;
+    next: IsoDate;
+}
+/**
+ * Is this reschedule the bare re-anchor (URL-drivable) rather than a rule
+ * restatement (GUI-bound)? The discriminator is `frequency`: validation
+ * (`assertRescheduleRule`) refuses every other rule field alongside its absence,
+ * so an params bag without a frequency IS `{ uuid, next }`.
+ */
+export declare function isRepeatReanchor(params: RescheduleRepeatParams): params is RepeatReanchorParams & RescheduleRepeatParams;
+/**
+ * Does THIS call drive the GUI? Every {@link UI_DRIVE_OPS} member does, except a
+ * `reschedule-repeat` in its bare re-anchor spelling, which compiles to one URL
+ * dispatch and therefore carries no GUI-drive gate (H-UI-DRIVE). Keyed on the
+ * params, so the scare gate rides the SPELLING rather than the verb.
+ */
+export declare function drivesGuiForParams(op: OperationKind, params: Record<string, unknown>): boolean;
 /**
  * The calendar-anchor subset of the Repeat-dialog rule vocabulary the
  * add-repeating composites carry on their PROMOTE leg (frequency/interval plus
@@ -617,7 +662,8 @@ export interface ProjectAddRepeatingParams extends AddRepeatingRuleFields {
  * landing on the seed — this deadlines every occurrence AND keeps the seed
  * deadline-free so the app does not SRCFATE-preserve it into a double-booked
  * future instance (DBLSPAWN1). It therefore requires a concrete `when` on or
- * before it (after-completion series keep the seed's one-off deadline instead).
+ * before it. An AFTER-COMPLETION series is deadlined the same way: the offset is
+ * measured from each occurrence's own start, which such a series has (CNCAC2).
  * `startDaysEarlier` is the SAME deadline geometry named from the other end (the
  * per-occurrence lead directly, deadline derived as `when + N`); the two are
  * over-determined together and must AGREE (`deadline − when == startDaysEarlier`).
@@ -631,7 +677,8 @@ export interface TodoAddRepeatingParams extends AddRepeatingRuleFields {
     /**
      * The FIRST occurrence's due date — mapped to the RULE (derive start-days-earlier =
      * deadline − when), so every occurrence is deadlined and the seed carries none.
-     * Needs a concrete `when` on or before it; not applicable to after-completion.
+     * Needs a concrete `when` on or before it. Applies to an after-completion series
+     * too — the offset is measured from each occurrence's start, not from a calendar.
      */
     deadline?: IsoDate;
     /**
@@ -639,8 +686,7 @@ export interface TodoAddRepeatingParams extends AddRepeatingRuleFields {
      * before its own deadline (integer ≥ 0), the deadline derived as `when + N`.
      * Where a concrete `deadline` names the first due date, this names the
      * per-occurrence lead directly. Needs a concrete `when`; when BOTH are given they
-     * must AGREE (`deadline − when == startDaysEarlier`) or the call is refused. Not
-     * applicable to after-completion (no calendar start to count back from).
+     * must AGREE (`deadline − when == startDaysEarlier`) or the call is refused.
      */
     startDaysEarlier?: number;
     tags?: string[];
@@ -718,12 +764,12 @@ export interface OperationParamsMap {
     "project.dissolve-heading": UuidParams;
     "todo.clear-dated-reminder": UuidParams;
     "todo.make-repeating": RepeatRuleParams;
-    "todo.reschedule-repeat": RepeatRuleParams;
+    "todo.reschedule-repeat": RescheduleRepeatParams;
     "todo.pause-repeat": UuidParams;
     "todo.resume-repeat": UuidParams;
     "todo.create-next-copy": UuidParams;
     "todo.convert-to-project": UuidParams;
-    "project.reschedule-repeat": RepeatRuleParams;
+    "project.reschedule-repeat": RescheduleRepeatParams;
     "project.pause-repeat": UuidParams;
     "project.resume-repeat": UuidParams;
     "area.reorder": AreaReorderParams;

package/dist/write/operations.js

@@ -154,4 +154,26 @@ export const WEEKDAYS = [
     "friday",
     "saturday",
 ];
+/**
+ * Is this reschedule the bare re-anchor (URL-drivable) rather than a rule
+ * restatement (GUI-bound)? The discriminator is `frequency`: validation
+ * (`assertRescheduleRule`) refuses every other rule field alongside its absence,
+ * so an params bag without a frequency IS `{ uuid, next }`.
+ */
+export function isRepeatReanchor(params) {
+    return params.frequency === undefined && params.next !== undefined;
+}
+/**
+ * Does THIS call drive the GUI? Every {@link UI_DRIVE_OPS} member does, except a
+ * `reschedule-repeat` in its bare re-anchor spelling, which compiles to one URL
+ * dispatch and therefore carries no GUI-drive gate (H-UI-DRIVE). Keyed on the
+ * params, so the scare gate rides the SPELLING rather than the verb.
+ */
+export function drivesGuiForParams(op, params) {
+    if (!isUiDriveOp(op))
+        return false;
+    if (op !== "todo.reschedule-repeat" && op !== "project.reschedule-repeat")
+        return true;
+    return !isRepeatReanchor(params);
+}
 //# sourceMappingURL=operations.js.map

package/dist/write/operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/write/operations.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,UAAU;IACV,aAAa;IACb,eAAe;IACf,aAAa;IACb,aAAa;IACb,WAAW;IACX,eAAe;IACf,wBAAwB;IACxB,0BAA0B;IAC1B,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,UAAU;IACV,aAAa;IACb,SAAS;IACT,YAAY;IACZ,aAAa;IACb,SAAS;IACT,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;IACrB,wBAAwB;IACxB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;IACzB,sBAAsB;IACtB,iCAAiC;IACjC,0BAA0B;IAC1B,2BAA2B;IAC3B,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,yBAAyB;IACzB,2BAA2B;IAC3B,sBAAsB;IACtB,uBAAuB;IACvB,cAAc;IACd,wBAAwB;IACxB,uBAAuB;IACvB,oBAAoB;IACpB,YAAY;IACZ,eAAe;IACf,SAAS;CACD,CAAC;AAIX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B;IACpD,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,oBAAoB;IACpB,sEAAsE;IACtE,6EAA6E;IAC7E,+EAA+E;IAC/E,0EAA0E;IAC1E,6DAA6D;IAC7D,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,2BAA2B;IAC3B,sBAAsB;IACtB,uBAAuB;IACvB,cAAc;IACd,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,iEAAiE;IACjE,wBAAwB;IACxB,2EAA2E;IAC3E,4EAA4E;IAC5E,+EAA+E;IAC/E,kEAAkE;IAClE,iCAAiC;IACjC,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,gBAAgB;IAChB,0BAA0B;IAC1B,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,+EAA+E;IAC/E,uEAAuE;IACvE,4DAA4D;IAC5D,sBAAsB;CACd,CAAC;AAEX,MAAM,UAAU,WAAW,CAAC,EAAiB;IAC3C,OAAO,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAA6B;IACnD,qBAAqB;IACrB,wBAAwB;IACxB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;IACzB,sBAAsB;IACtB,iCAAiC;IACjC,0BAA0B;CAClB,CAAC;AAEX,MAAM,UAAU,WAAW,CAAC,EAAiB;IAC3C,OAAO,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B;IAC1D,wBAAwB;IACxB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;IACzB,0BAA0B;CAClB,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,EAAiB;IACjD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC;AAyhBD,MAAM,CAAC,MAAM,QAAQ,GAAuB;IAC1C,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,UAAU;IACV,QAAQ;IACR,UAAU;CACF,CAAC"}
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/write/operations.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,UAAU;IACV,aAAa;IACb,eAAe;IACf,aAAa;IACb,aAAa;IACb,WAAW;IACX,eAAe;IACf,wBAAwB;IACxB,0BAA0B;IAC1B,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,UAAU;IACV,aAAa;IACb,SAAS;IACT,YAAY;IACZ,aAAa;IACb,SAAS;IACT,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;IACrB,wBAAwB;IACxB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;IACzB,sBAAsB;IACtB,iCAAiC;IACjC,0BAA0B;IAC1B,2BAA2B;IAC3B,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,yBAAyB;IACzB,2BAA2B;IAC3B,sBAAsB;IACtB,uBAAuB;IACvB,cAAc;IACd,wBAAwB;IACxB,uBAAuB;IACvB,oBAAoB;IACpB,YAAY;IACZ,eAAe;IACf,SAAS;CACD,CAAC;AAIX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B;IACpD,qBAAqB;IACrB,wBAAwB;IACxB,mBAAmB;IACnB,oBAAoB;IACpB,sEAAsE;IACtE,6EAA6E;IAC7E,+EAA+E;IAC/E,0EAA0E;IAC1E,6DAA6D;IAC7D,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,2BAA2B;IAC3B,sBAAsB;IACtB,uBAAuB;IACvB,cAAc;IACd,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,iEAAiE;IACjE,wBAAwB;IACxB,2EAA2E;IAC3E,4EAA4E;IAC5E,+EAA+E;IAC/E,kEAAkE;IAClE,iCAAiC;IACjC,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,gBAAgB;IAChB,0BAA0B;IAC1B,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,+EAA+E;IAC/E,uEAAuE;IACvE,4DAA4D;IAC5D,sBAAsB;CACd,CAAC;AAEX,MAAM,UAAU,WAAW,CAAC,EAAiB;IAC3C,OAAO,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAA6B;IACnD,qBAAqB;IACrB,wBAAwB;IACxB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;IACzB,sBAAsB;IACtB,iCAAiC;IACjC,0BAA0B;CAClB,CAAC;AAEX,MAAM,UAAU,WAAW,CAAC,EAAiB;IAC3C,OAAO,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B;IAC1D,wBAAwB;IACxB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;IACzB,0BAA0B;CAClB,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,EAAiB;IACjD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC;AAyhBD,MAAM,CAAC,MAAM,QAAQ,GAAuB;IAC1C,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,UAAU;IACV,QAAQ;IACR,UAAU;CACF,CAAC;AAqHX;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA8B;IAE9B,OAAO,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAiB,EAAE,MAA+B;IACnF,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,EAAE,KAAK,wBAAwB,IAAI,EAAE,KAAK,2BAA2B;QAAE,OAAO,IAAI,CAAC;IACvF,OAAO,CAAC,gBAAgB,CAAC,MAA2C,CAAC,CAAC;AACxE,CAAC"}

package/dist/write/opid.d.ts

@@ -25,10 +25,34 @@
  *    operation asserts a whole-database singleton, or nothing was recorded — the
  *    resubmission is REFUSED with a pointer at the item, never guessed.
  *
- * Every other result class (blocked, unsupported, intent, the other
- * verify-failed reasons) is not a match: a blocked/unsupported attempt changed
- * nothing, a mismatch/silent-noop landed something the caller must look at
- * first, and an intent marker means the attempt may still be in flight.
+ * Every other FINAL result class (blocked, unsupported, the other verify-failed
+ * reasons) is not a match: a blocked/unsupported attempt changed nothing, and a
+ * mismatch/silent-noop landed something the caller must look at first.
+ *
+ * The third class is an UNSUPERSEDED INTENT — a keyed write that recorded its
+ * start and has written no final record yet (#639). That is not a fourth match
+ * rule but a different question, and it is answered by asking whether the
+ * process that wrote it is still alive:
+ *
+ *  - HOLDER ALIVE — the original is still running. The resubmission is REFUSED
+ *    (`blocked:in-flight`) and pointed at `things op-result <key>`. This is the
+ *    refusal that closes the race the pre-lock lookback used to leave open: a
+ *    retry fired while the original is mid-drive used to see no record, queue
+ *    behind the mutation lock, and execute the whole verb a second time once the
+ *    original released it.
+ *  - HOLDER GONE — the writer died between touching the app and recording an
+ *    outcome, which is the SAME ambiguity a `verify-failed:timeout` leaves, so it
+ *    takes the same answer: the intent's own recorded assertion is the presence
+ *    oracle, re-evaluated against current state. An intent that recorded no
+ *    usable oracle refuses honestly rather than guessing.
+ *
+ * DOUBLE-CHECKED LOCKING. Every caller consults this gate TWICE: once before
+ * taking the mutation lock (the cheap fast path — most resubmissions are settled
+ * by then and never touch the lock) and again immediately after acquiring it,
+ * before the first mutating leg. The second check is the load-bearing one: a
+ * retry that passed the first check while the original was still running, then
+ * waited out the lock, finds the original's record on the way back in and
+ * replays instead of re-executing.
  */
 import type { AuditRecord } from "../audit/schema.ts";
 import { type MutationResult, type WriteDeps, type WriteOptions } from "./pipeline.ts";
@@ -42,7 +66,12 @@ export declare const OP_ID_RE: RegExp;
  */
 export declare const OPID_LOOKBACK_RECORDS = 1000;
 export declare const OPID_LOOKBACK_MS: number;
-/** The disclosure a reconciled replay carries — see {@link reconcileTimedOut}. */
+/**
+ * The disclosure a reconciled replay carries — see {@link reconcileAmbiguous}.
+ * Deliberately worded for BOTH ambiguous origins (a confirmation that timed out,
+ * and a writer that died before recording an outcome): the caller's situation
+ * and next move are identical either way, and the record itself says which.
+ */
 export declare const RECONCILED_NOTE: string;
 /**
  * The recent-history lookback for an opId: the most recent MATCHABLE record
@@ -51,6 +80,26 @@ export declare const RECONCILED_NOTE: string;
  * blocked records are naturally excluded.
  */
 export declare function findOpIdRecord(records: AuditRecord[], opId: string, now: Date): AuditRecord | undefined;
+/**
+ * The UNSUPERSEDED intent for a key, if there is one: an `intent` record whose
+ * ATTEMPT never recorded an outcome.
+ *
+ * Supersession pairs an intent to its own final by `ts`, which is the schema's
+ * documented sibling invariant — both records of one attempt derive from the
+ * same `startedAt`, so they carry the same timestamp (`audit/schema.ts`). It is
+ * deliberately NOT "the last record wins": `readAuditRecords` RE-SORTS the trail
+ * by `ts`, so file order does not survive the read, and a composite's intent
+ * (written when it takes the lock) briefly carried a later `ts` than its own
+ * summary (stamped when the verb began) — which sorted the intent last and left
+ * every finished promote looking permanently in flight. Measured in TORPH1
+ * cell B; the fix is this pairing plus stamping a composite's intent with the
+ * verb's own `startedAt`.
+ *
+ * Pairing also handles the RE-DISPATCH shape by construction: a key retried
+ * after an ambiguous failure records intent+final for the first attempt and a
+ * fresh intent for the second, and only the second is unpaired.
+ */
+export declare function findPendingIntent(records: AuditRecord[], opId: string, now: Date): AuditRecord | undefined;
 /**
  * Can the recorded assertion decide, after the fact, whether the timed-out
  * change landed? Usable means the assertion is keyed to a SUBJECT the attempt
@@ -69,9 +118,15 @@ export type PresenceOracle = {
 export declare function presenceOracle(spec: DeltaSpec | undefined): PresenceOracle;
 /**
  * The lookback as a DISPATCH DECISION over an already-read trail: the replay
- * result when this key was already applied, a refusal when it matched an
- * unsettleable attempt, or null when the write must run. Shared by the batch
- * line path and {@link replayIfApplied}.
+ * result when this key was already applied, a refusal when it is still running
+ * or matched an unsettleable attempt, or null when the write must run. Shared by
+ * the batch line path and {@link replayIfApplied}.
+ *
+ * An unsuperseded intent is consulted FIRST, because it describes the key's
+ * present, while any matchable final describes its past. (Both can exist: a key
+ * whose first attempt timed out and is now being re-driven has an old timeout
+ * final AND a live intent. Acting on the final there would replay a change the
+ * running attempt has not finished making.)
  */
 export declare function resolveOpId(deps: WriteDeps, records: AuditRecord[], opId: string, now: Date): MutationResult | null;
 /**
@@ -82,6 +137,12 @@ export declare function resolveOpId(deps: WriteDeps, records: AuditRecord[], opI
  * flip-dance, and the promote-via-clone verbs; they never reach `run`, so
  * without this the key would be recorded and never honored).
  *
+ * Called TWICE per keyed write, and the second call is the one that matters —
+ * see the module header on double-checked locking. Both calls re-read the trail:
+ * the whole point of the post-acquire check is that the trail changed while this
+ * process was waiting for the lock, so a cached read would answer the stale
+ * question all over again.
+ *
  * Three conditions fail-open (run the write) rather than fail-closed: no key, a
  * dry run (it mints and records nothing, so there is nothing to deduplicate
  * against), or no trail to read.

package/dist/write/opid.js

@@ -1,3 +1,5 @@
+import { instanceAlive } from "../process-instance.js";
+import { attach, disclose, disclosuresOf } from "./disclosures.js";
 import { replayResultFromRecord, } from "./pipeline.js";
 import { readAuditRecords } from "./undo.js";
 import { createDbReader, evaluateDelta } from "./verify/delta.js";
@@ -10,10 +12,15 @@ export const OP_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
  */
 export const OPID_LOOKBACK_RECORDS = 1000;
 export const OPID_LOOKBACK_MS = 7 * 24 * 60 * 60 * 1000;
-/** The disclosure a reconciled replay carries — see {@link reconcileTimedOut}. */
-export const RECONCILED_NOTE = "an earlier submission with this idempotency key did not finish confirming; the change was " +
-    "found already in place, so nothing ran again. It cannot be reversed with `things undo` — the " +
-    "earlier attempt never recorded a completed change to reverse";
+/**
+ * The disclosure a reconciled replay carries — see {@link reconcileAmbiguous}.
+ * Deliberately worded for BOTH ambiguous origins (a confirmation that timed out,
+ * and a writer that died before recording an outcome): the caller's situation
+ * and next move are identical either way, and the record itself says which.
+ */
+export const RECONCILED_NOTE = "an earlier submission with this idempotency key never recorded a completed change; the change " +
+    "was found already in place, so nothing ran again. It cannot be reversed with `things undo` — " +
+    "there is no completed-change record to reverse";
 /** Result classes an `opId` match acts on (see the module header). */
 function matchable(result) {
     return result === "ok" || result === "verify-failed:timeout";
@@ -37,6 +44,37 @@ export function findOpIdRecord(records, opId, now) {
     }
     return match;
 }
+/**
+ * The UNSUPERSEDED intent for a key, if there is one: an `intent` record whose
+ * ATTEMPT never recorded an outcome.
+ *
+ * Supersession pairs an intent to its own final by `ts`, which is the schema's
+ * documented sibling invariant — both records of one attempt derive from the
+ * same `startedAt`, so they carry the same timestamp (`audit/schema.ts`). It is
+ * deliberately NOT "the last record wins": `readAuditRecords` RE-SORTS the trail
+ * by `ts`, so file order does not survive the read, and a composite's intent
+ * (written when it takes the lock) briefly carried a later `ts` than its own
+ * summary (stamped when the verb began) — which sorted the intent last and left
+ * every finished promote looking permanently in flight. Measured in TORPH1
+ * cell B; the fix is this pairing plus stamping a composite's intent with the
+ * verb's own `startedAt`.
+ *
+ * Pairing also handles the RE-DISPATCH shape by construction: a key retried
+ * after an ambiguous failure records intent+final for the first attempt and a
+ * fresh intent for the second, and only the second is unpaired.
+ */
+export function findPendingIntent(records, opId, now) {
+    const cutoff = now.getTime() - OPID_LOOKBACK_MS;
+    const window = records.slice(-OPID_LOOKBACK_RECORDS);
+    const inWindow = (r) => r.opId === opId && new Date(r.ts).getTime() >= cutoff;
+    const settled = new Set();
+    for (const r of window) {
+        if (inWindow(r) && r.result !== "intent")
+            settled.add(r.ts); // that attempt finished
+    }
+    // The newest unpaired intent (there is at most one in practice).
+    return window.findLast((r) => inWindow(r) && r.result === "intent" && !settled.has(r.ts));
+}
 export function presenceOracle(spec) {
     if (spec === undefined) {
         return {
@@ -94,30 +132,62 @@ export function presenceOracle(spec) {
 /** The refusal: the key matched an unconfirmed attempt nothing here can settle. */
 function unreconcilable(record, why) {
     const target = record.uuid === null ? "the item" : record.uuid;
+    // An intent's writer DIED; a timeout's writer finished and could not confirm.
+    // Both leave the same ambiguity, and the caller acts on it the same way, but
+    // saying which one happened is what makes the trace worth looking at.
+    const how = record.result === "intent"
+        ? `started a change and its process ended without recording an outcome`
+        : `never confirmed its change`;
     return {
         kind: "blocked",
         op: record.op,
         reason: "reconcile",
-        detail: `an earlier submission with this idempotency key (${record.ts}) never confirmed its ` +
-            `change, and ${why} — so whether that change took effect cannot be settled from here`,
+        detail: `an earlier submission with this idempotency key (${record.ts}) ${how}, and ${why} — so ` +
+            "whether that change took effect cannot be settled from here",
         remediation: `check ${target} in Things (\`things op-result ${record.opId ?? "<key>"}\` reports what the ` +
             "earlier attempt recorded); once you know whether the change is there, leave it alone or " +
             "re-run with a NEW --op-id",
     };
 }
 /**
- * Reconcile a resubmission against a TIMED-OUT original: re-read current state
- * through the attempt's own recorded assertion and decide.
+ * The refusal: this key is STILL RUNNING somewhere. Returned instead of letting
+ * the resubmission queue behind the mutation lock, because waiting there is how
+ * the double happened — the waiter wakes up after the original finishes and, on
+ * the pre-lock answer it is still carrying, executes the verb again.
+ *
+ * Refusing costs the caller one poll. It is also the only answer that is true
+ * for the whole class: nothing here can know whether the running original will
+ * succeed, so nothing here should act on a guess about it.
+ */
+function stillInFlight(record, holderPid) {
+    return {
+        kind: "blocked",
+        op: record.op,
+        reason: "in-flight",
+        detail: `an earlier submission with this idempotency key is STILL RUNNING (started ${record.ts}, ` +
+            `pid ${holderPid}) — it has not recorded an outcome yet, so nothing was run again here`,
+        remediation: `poll \`things op-result ${record.opId ?? "<key>"}\` until it reports a final outcome, then ` +
+            "act on that; do not resubmit while it is running (a GUI-driven change takes seconds, and " +
+            "longer on a large or syncing database)",
+    };
+}
+/**
+ * Reconcile a resubmission against an AMBIGUOUS original — one that touched the
+ * app and never recorded whether the change landed. Two records reach here: a
+ * `verify-failed:timeout` final (the attempt finished and could not confirm) and
+ * an orphaned `intent` (the attempt's process died mid-flight, #639). The
+ * ambiguity is identical, so the answer is: re-read current state through the
+ * attempt's own recorded assertion and decide.
  *
  *  - satisfied  → the change is there: replay it as already-applied, disclosing
- *    that a timeout was reconciled. The replay carries NO undo token — the trail
- *    holds no completed-change record for undo to reverse — and takes its uuid
- *    from the re-read, which is how a create whose uuid was never discovered
- *    (recorded `uuid: null`) still answers with the row it made.
+ *    the reconciliation. The replay carries NO undo token — the trail holds no
+ *    completed-change record for undo to reverse — and takes its uuid from the
+ *    re-read, which is how a create whose uuid was never discovered (recorded
+ *    `uuid: null`) still answers with the row it made.
  *  - not satisfied → the change is absent: return null so the write runs.
  *  - no usable oracle → refuse (never a guess).
  */
-function reconcileTimedOut(deps, record) {
+function reconcileAmbiguous(deps, record) {
     const oracle = presenceOracle(record.expected);
     if (!oracle.usable)
         return unreconcilable(record, oracle.why);
@@ -132,25 +202,45 @@ function reconcileTimedOut(deps, record) {
     if (replay.kind !== "ok")
         return replay; // replayResultFromRecord always builds an ok
     const { undoToken: _noToken, ...rest } = replay;
-    return {
+    const bag = disclosuresOf(replay);
+    disclose(bag, "reconciled-replay", RECONCILED_NOTE);
+    return attach({
         ...rest,
         uuid: evaluation.discoveredUuid ?? record.uuid,
         observed: evaluation.observed,
         ...(evaluation.repeating !== undefined && { repeating: evaluation.repeating }),
-        warnings: [...(replay.warnings ?? []), RECONCILED_NOTE],
-    };
+    }, bag);
 }
 /**
  * The lookback as a DISPATCH DECISION over an already-read trail: the replay
- * result when this key was already applied, a refusal when it matched an
- * unsettleable attempt, or null when the write must run. Shared by the batch
- * line path and {@link replayIfApplied}.
+ * result when this key was already applied, a refusal when it is still running
+ * or matched an unsettleable attempt, or null when the write must run. Shared by
+ * the batch line path and {@link replayIfApplied}.
+ *
+ * An unsuperseded intent is consulted FIRST, because it describes the key's
+ * present, while any matchable final describes its past. (Both can exist: a key
+ * whose first attempt timed out and is now being re-driven has an old timeout
+ * final AND a live intent. Acting on the final there would replay a change the
+ * running attempt has not finished making.)
  */
 export function resolveOpId(deps, records, opId, now) {
+    const pending = findPendingIntent(records, opId, now);
+    if (pending !== undefined) {
+        const holder = pending.holder;
+        // No holder recorded (an M3 intent from before write-ahead intents, or a
+        // path that writes one unkeyed): liveness is unknowable, and the safe
+        // unknowable answer is the one that never doubles — treat it as running.
+        if (holder === undefined || instanceAlive(holder)) {
+            return stillInFlight(pending, holder?.pid ?? -1);
+        }
+        // The holder is gone and no outcome was ever recorded: same ambiguity as a
+        // timeout, same oracle-driven answer.
+        return reconcileAmbiguous(deps, pending);
+    }
     const match = findOpIdRecord(records, opId, now);
     if (match === undefined)
         return null;
-    return match.result === "ok" ? replayResultFromRecord(match) : reconcileTimedOut(deps, match);
+    return match.result === "ok" ? replayResultFromRecord(match) : reconcileAmbiguous(deps, match);
 }
 /**
  * The dispatch decision for a SINGLE invocation, reading the trail itself. The
@@ -160,6 +250,12 @@ export function resolveOpId(deps, records, opId, now) {
  * flip-dance, and the promote-via-clone verbs; they never reach `run`, so
  * without this the key would be recorded and never honored).
  *
+ * Called TWICE per keyed write, and the second call is the one that matters —
+ * see the module header on double-checked locking. Both calls re-read the trail:
+ * the whole point of the post-acquire check is that the trail changed while this
+ * process was waiting for the lock, so a cached read would answer the stale
+ * question all over again.
+ *
  * Three conditions fail-open (run the write) rather than fail-closed: no key, a
  * dry run (it mints and records nothing, so there is nothing to deduplicate
  * against), or no trail to read.

package/dist/write/opid.js.map

@@ -1 +1 @@
-{"version":3,"file":"opid.js","sourceRoot":"","sources":["../../src/write/opid.ts"],"names":[],"mappings":"AAkCA,OAAO,EACL,sBAAsB,GAIvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAkB,MAAM,mBAAmB,CAAC;AAElF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAC1B,4FAA4F;IAC5F,+FAA+F;IAC/F,8DAA8D,CAAC;AAEjE,sEAAsE;AACtE,SAAS,SAAS,CAAC,MAA6B;IAC9C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,uBAAuB,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAsB,EACtB,IAAY,EACZ,GAAS;IAET,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACrD,IAAI,KAA8B,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtD,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM;YAAE,SAAS;QAChD,KAAK,GAAG,CAAC,CAAC,CAAC,4DAA4D;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAaD,MAAM,UAAU,cAAc,CAAC,IAA2B;IACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,wDAAwD;SAC9D,CAAC;IACJ,CAAC;IACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;gBAClB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,qDAAqD,EAAE,CAAC;QACpF,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;gBAClB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,qDAAqD,EAAE,CAAC;QACpF,KAAK,QAAQ;YACX,sEAAsE;YACtE,uEAAuE;YACvE,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC;gBAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;gBAClB,CAAC,CAAC;oBACE,MAAM,EAAE,KAAK;oBACb,GAAG,EACD,kFAAkF;wBAClF,+BAA+B;iBAClC,CAAC;QACR,KAAK,gBAAgB,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC7B,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;gBAClB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,uDAAuD,EAAE,CAAC;QACtF,KAAK,eAAe;YAClB,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,GAAG,EACD,mFAAmF;oBACnF,yDAAyD;aAC5D,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,GAAG,EACD,sFAAsF;oBACtF,+BAA+B;aAClC,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,MAAmB,EAAE,GAAW;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/D,OAAO;QACL,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,MAAM,CAAC,EAAmB;QAC9B,MAAM,EAAE,WAAW;QACnB,MAAM,EACJ,oDAAoD,MAAM,CAAC,EAAE,wBAAwB;YACrF,eAAe,GAAG,mEAAmE;QACvF,WAAW,EACT,SAAS,MAAM,kCAAkC,MAAM,CAAC,IAAI,IAAI,OAAO,sBAAsB;YAC7F,0FAA0F;YAC1F,2BAA2B;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,IAAe,EAAE,MAAmB;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAqB,CAAC;IAC1C,MAAM,UAAU,GAAG,aAAa,CAC9B,IAAI,EACJ,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC;IAC9D,0EAA0E;IAC1E,6EAA6E;IAC7E,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAC7B,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,6CAA6C;IACtF,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAChD,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,UAAU,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI;QAC9C,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;QAC9E,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,IAAe,EACf,OAAsB,EACtB,IAAY,EACZ,GAAS;IAET,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,OAAqB;IACpE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,WAAW,CAChB,IAAI,EACJ,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,EACnC,OAAO,CAAC,IAAI,EACZ,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"opid.js","sourceRoot":"","sources":["../../src/write/opid.ts"],"names":[],"mappings":"AAyDA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEnE,OAAO,EACL,sBAAsB,GAIvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAkB,MAAM,mBAAmB,CAAC;AAElF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,gGAAgG;IAChG,+FAA+F;IAC/F,gDAAgD,CAAC;AAEnD,sEAAsE;AACtE,SAAS,SAAS,CAAC,MAA6B;IAC9C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,uBAAuB,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAsB,EACtB,IAAY,EACZ,GAAS;IAET,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACrD,IAAI,KAA8B,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtD,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM;YAAE,SAAS;QAChD,KAAK,GAAG,CAAC,CAAC,CAAC,4DAA4D;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,IAAY,EACZ,GAAS;IAET,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,CAAC,CAAc,EAAW,EAAE,CAC3C,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB;IACvF,CAAC;IACD,iEAAiE;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAaD,MAAM,UAAU,cAAc,CAAC,IAA2B;IACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,wDAAwD;SAC9D,CAAC;IACJ,CAAC;IACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC;gBACrC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;gBAClB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,qDAAqD,EAAE,CAAC;QACpF,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;gBAClB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,qDAAqD,EAAE,CAAC;QACpF,KAAK,QAAQ;YACX,sEAAsE;YACtE,uEAAuE;YACvE,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC;gBAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;gBAClB,CAAC,CAAC;oBACE,MAAM,EAAE,KAAK;oBACb,GAAG,EACD,kFAAkF;wBAClF,+BAA+B;iBAClC,CAAC;QACR,KAAK,gBAAgB,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC7B,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;gBAClB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,uDAAuD,EAAE,CAAC;QACtF,KAAK,eAAe;YAClB,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,GAAG,EACD,mFAAmF;oBACnF,yDAAyD;aAC5D,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,GAAG,EACD,sFAAsF;oBACtF,+BAA+B;aAClC,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,MAAmB,EAAE,GAAW;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/D,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,GAAG,GACP,MAAM,CAAC,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,qEAAqE;QACvE,CAAC,CAAC,4BAA4B,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,MAAM,CAAC,EAAmB;QAC9B,MAAM,EAAE,WAAW;QACnB,MAAM,EACJ,oDAAoD,MAAM,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ;YACzF,6DAA6D;QAC/D,WAAW,EACT,SAAS,MAAM,kCAAkC,MAAM,CAAC,IAAI,IAAI,OAAO,sBAAsB;YAC7F,0FAA0F;YAC1F,2BAA2B;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,MAAmB,EAAE,SAAiB;IAC3D,OAAO;QACL,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,MAAM,CAAC,EAAmB;QAC9B,MAAM,EAAE,WAAW;QACnB,MAAM,EACJ,6EAA6E,MAAM,CAAC,EAAE,IAAI;YAC1F,OAAO,SAAS,uEAAuE;QACzF,WAAW,EACT,2BAA2B,MAAM,CAAC,IAAI,IAAI,OAAO,4CAA4C;YAC7F,2FAA2F;YAC3F,wCAAwC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,kBAAkB,CAAC,IAAe,EAAE,MAAmB;IAC9D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAqB,CAAC;IAC1C,MAAM,UAAU,GAAG,aAAa,CAC9B,IAAI,EACJ,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC;IAC9D,0EAA0E;IAC1E,6EAA6E;IAC7E,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAC7B,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,6CAA6C;IACtF,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAChD,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC;IACpD,OAAO,MAAM,CACX;QACE,GAAG,IAAI;QACP,IAAI,EAAE,UAAU,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI;QAC9C,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;KAC/E,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,IAAe,EACf,OAAsB,EACtB,IAAY,EACZ,GAAS;IAET,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,OAAO,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,2EAA2E;QAC3E,sCAAsC;QACtC,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,OAAqB;IACpE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,WAAW,CAChB,IAAI,EACJ,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,EACnC,OAAO,CAAC,IAAI,EACZ,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAC3B,CAAC;AACJ,CAAC"}

package/dist/write/param-schema.js

@@ -523,6 +523,18 @@ const REPEAT_RULE = {
     startDaysEarlier: opt(int(0, 366, "a whole number of days ≥ 0")),
     next: opt(isoDate()),
 };
+/**
+ * reschedule-repeat: the same vocabulary with `frequency` + `interval` OPTIONAL,
+ * because the verb has two spellings — restate the rule (both required), or move
+ * the next occurrence with `next` alone (the series RE-ANCHOR). Which one this is,
+ * and that a re-anchor carries nothing else, is settled by `assertRescheduleRule`
+ * — the schema's job is only to let the second shape through the type gate.
+ */
+const RESCHEDULE_RULE = {
+    ...REPEAT_RULE,
+    frequency: opt(enumOf(["daily", "weekly", "monthly", "yearly"])),
+    interval: opt(int(1, 99, "a whole number 1–99")),
+};
 const SET_DATES = {
     uuid: str("an item uuid"),
     completedAt: opt(timestamp()),
@@ -685,12 +697,12 @@ export const PARAM_SCHEMAS = {
     "project.dissolve-heading": { uuid: str("a heading uuid") },
     "todo.clear-dated-reminder": UUID_ONLY,
     "todo.make-repeating": REPEAT_RULE,
-    "todo.reschedule-repeat": REPEAT_RULE,
+    "todo.reschedule-repeat": RESCHEDULE_RULE,
     "todo.pause-repeat": UUID_ONLY,
     "todo.resume-repeat": UUID_ONLY,
     "todo.create-next-copy": UUID_ONLY,
     "todo.convert-to-project": UUID_ONLY,
-    "project.reschedule-repeat": REPEAT_RULE,
+    "project.reschedule-repeat": RESCHEDULE_RULE,
     "project.pause-repeat": { uuid: str("a project uuid or unique title") },
     "project.resume-repeat": { uuid: str("a project uuid or unique title") },
     "area.reorder": {