wowbagger 0.1.0-alpha.13 → 0.1.0-alpha.17

package/src/claim-journal.js

@@ -2,6 +2,7 @@ import { constants } from 'node:fs';
 import { lstat, mkdir, open, readFile, stat } from 'node:fs/promises';
 import path from 'node:path';
 import { validateClaimRequest } from './claim-request.js';
+import { isCalendarDate } from './validate.js';
 
 import { advanceClockFloor, claimAcquire, claimRelease, claimRenew } from './claim-operations.js';
 import { emptyClaimState } from './claim-store.js';
@@ -19,7 +20,11 @@ const JOURNAL_ENTRY_TYPES = new Set([
   'publish-finalization',
   'publish-intent',
   'revision-adoption',
+  'number-repair-intent',
+  'number-repair-final',
 ]);
+// Every command the legacy mutation fence journals.
+const LEGACY_MUTATION_COMMANDS = new Set(['patch-v1', 'transition-v1', 'create-v1']);
 // The reconciliation log is a tracked derived artifact. Entry types that every
 // invocation appends, including refusals and read-only verification, stay out
 // of it so a mutation that changes nothing leaves the working tree unchanged.
@@ -177,6 +182,9 @@ async function readJournalEntries(journalPath, namespace = null) {
   const lines = source.split('\n').filter(Boolean);
   if (lines.length > MAX_JOURNAL_ENTRIES) throw journalCapacityExceeded();
   const entries = lines.map((line) => JSON.parse(line));
+  const createAttempts = new Map();
+  const repairIntents = new Map();
+  const repairFinals = new Set();
   for (let index = 0; index < entries.length; index += 1) {
     if (!Number.isSafeInteger(entries[index]?.seq) || entries[index].seq !== index + 1) {
       throw journalInvalid('non-contiguous-sequence');
@@ -187,6 +195,12 @@ async function readJournalEntries(journalPath, namespace = null) {
     if (!validJournalEntry(entries[index], namespace)) {
       throw journalInvalid('invalid-entry');
     }
+    if (!validCreateResolution(entries[index], createAttempts)) {
+      throw journalInvalid('invalid-entry');
+    }
+    if (!validRepairResolution(entries[index], repairIntents, repairFinals)) {
+      throw journalInvalid('invalid-entry');
+    }
   }
   return entries;
 }
@@ -282,8 +296,10 @@ function validJournalEntry(entry, namespace) {
       && typeof entry.ledger_namespace === 'string'
       && (namespace === null || entry.ledger_namespace === namespace)
       && typeof entry.item_id === 'string'
-      && ['patch-v1', 'transition-v1'].includes(entry.command)
-      && typeof entry.expected_revision === 'string'
+      && LEGACY_MUTATION_COMMANDS.has(entry.command)
+      && (entry.command === 'create-v1'
+        ? entry.expected_revision === null
+        : typeof entry.expected_revision === 'string')
       && typeof entry.candidate_revision === 'string'
       && (!Object.hasOwn(entry, 'item_path') || typeof entry.item_path === 'string')
       && (!Object.hasOwn(entry, 'writer_worktree_id')
@@ -295,7 +311,7 @@ function validJournalEntry(entry, namespace) {
       && typeof entry.ledger_namespace === 'string'
       && (namespace === null || entry.ledger_namespace === namespace)
       && typeof entry.item_id === 'string'
-      && ['patch-v1', 'transition-v1'].includes(entry.command)
+      && LEGACY_MUTATION_COMMANDS.has(entry.command)
       && typeof entry.committed_revision === 'string'
       && (!Object.hasOwn(entry, 'item_path') || typeof entry.item_path === 'string')
       && (!Object.hasOwn(entry, 'writer_worktree_id')
@@ -303,11 +319,19 @@ function validJournalEntry(entry, namespace) {
       && typeof entry.observed_at === 'string';
   }
   if (entry.type === 'legacy-mutation-abort') {
+    // A create abort names no predecessor revision, so the absence of one is
+    // its evidence. Patch and transition aborts keep their exact legacy shape
+    // and never carry a command.
+    const validAbortRevision = (
+      !Object.hasOwn(entry, 'command') && typeof entry.observed_revision === 'string'
+    ) || (
+      entry.command === 'create-v1' && entry.observed_revision === null
+    );
     return typeof entry.attempt_id === 'string'
       && typeof entry.ledger_namespace === 'string'
       && (namespace === null || entry.ledger_namespace === namespace)
       && typeof entry.item_id === 'string'
-      && typeof entry.observed_revision === 'string'
+      && validAbortRevision
       && typeof entry.observed_at === 'string';
   }
   if (entry.type === 'revision-adoption') {
@@ -322,6 +346,12 @@ function validJournalEntry(entry, namespace) {
       && typeof entry.git_commit === 'string'
       && (!Object.hasOwn(entry, 'item_path') || typeof entry.item_path === 'string');
   }
+  if (entry.type === 'number-repair-intent') {
+    return validRepairIntent(entry, namespace);
+  }
+  if (entry.type === 'number-repair-final') {
+    return validRepairFinal(entry, namespace);
+  }
   if (entry.type === 'publish-intent') {
     return typeof entry.operation_id === 'string'
       && typeof entry.operation_digest === 'string'
@@ -351,6 +381,97 @@ function validJournalEntry(entry, namespace) {
     && typeof entry.git_commit === 'string';
 }
 
+const REPAIR_ID = /^nr_\d{8}_\d{4}$/;
+const REPAIR_ITEM_ID = /^wb_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const REPAIR_REVISION = /^sha256:[0-9a-f]{64}$/;
+const REPAIR_STAGING_ID = /^[A-Za-z0-9_-]{1,80}$/;
+
+function validRepairIntent(entry, namespace) {
+  return REPAIR_ID.test(entry.repair_id)
+    && typeof entry.ledger_namespace === 'string'
+    && (namespace === null || entry.ledger_namespace === namespace)
+    && REPAIR_REVISION.test(entry.ledger_snapshot_revision)
+    && isCalendarDate(entry.date)
+    && REPAIR_STAGING_ID.test(entry.staging_id)
+    && validRepairItems(entry.items, { includeExpected: true });
+}
+
+function validRepairFinal(entry, namespace) {
+  return REPAIR_ID.test(entry.repair_id)
+    && typeof entry.ledger_namespace === 'string'
+    && (namespace === null || entry.ledger_namespace === namespace)
+    && REPAIR_STAGING_ID.test(entry.staging_id)
+    && typeof entry.observed_at === 'string'
+    && validRepairItems(entry.items, { includeCommitted: true });
+}
+
+function validRepairItems(items, options) {
+  if (!Array.isArray(items) || items.length === 0) return false;
+  const seen = new Set();
+  for (const item of items) {
+    if (!isRecord(item)
+      || !REPAIR_ITEM_ID.test(item.item_id)
+      || seen.has(item.item_id)
+      || typeof item.item_path !== 'string'
+      || !REPAIR_REVISION.test(item.candidate_revision)) {
+      return false;
+    }
+    if (options.includeExpected
+      && (!REPAIR_REVISION.test(item.expected_revision)
+        || !Number.isSafeInteger(item.expected_number)
+        || item.expected_number < 1
+        || !Number.isSafeInteger(item.replacement_number)
+        || item.replacement_number < 1)) {
+      return false;
+    }
+    if (options.includeCommitted && !REPAIR_REVISION.test(item.committed_revision)) return false;
+    seen.add(item.item_id);
+  }
+  return true;
+}
+
+function validRepairResolution(entry, intents, finals) {
+  if (entry.type === 'number-repair-intent') {
+    if (intents.has(entry.repair_id)) return false;
+    intents.set(entry.repair_id, entry);
+    return true;
+  }
+  if (entry.type !== 'number-repair-final') return true;
+  const intent = intents.get(entry.repair_id);
+  if (!intent || finals.has(entry.repair_id) || intent.staging_id !== entry.staging_id) return false;
+  const expected = new Map(intent.items.map((item) => [item.item_id, item.candidate_revision]));
+  if (entry.items.length !== expected.size) return false;
+  for (const item of entry.items) {
+    if (expected.get(item.item_id) !== item.candidate_revision) return false;
+  }
+  finals.add(entry.repair_id);
+  return true;
+}
+
+// A journal-fenced create is only meaningful as a pair: the terminal that ends
+// an attempt must name the intent that opened it, so a standalone create
+// terminal names no authorized attempt and fails closed. Patch and transition
+// entries remain valid standing alone, so only create-v1 attempts are tracked.
+function validCreateResolution(entry, attempts) {
+  if (entry.command !== 'create-v1') return true;
+  if (entry.type === 'legacy-mutation-intent') {
+    attempts.set(entry.attempt_id, entry);
+    return true;
+  }
+  if (entry.type !== 'legacy-mutation' && entry.type !== 'legacy-mutation-abort') return true;
+  const intent = attempts.get(entry.attempt_id);
+  if (intent === undefined || intent.item_id !== entry.item_id) return false;
+  // A committed create publishes exactly the revision its intent proposed; an
+  // aborted one publishes none.
+  if (entry.type === 'legacy-mutation' && intent.candidate_revision !== entry.committed_revision) {
+    return false;
+  }
+  // One attempt resolves once, so the intent is consumed here and a repeated
+  // resolution finds no open attempt to end.
+  attempts.delete(entry.attempt_id);
+  return true;
+}
+
 function isRecord(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value);
 }

package/src/claim-publication.js

@@ -18,6 +18,12 @@ import { loadLedger, parseLedgerItemSource } from './ledger.js';
 import { MAX_ITEM_SOURCE_BYTES } from './limits.js';
 import { findRevisionOwner, readGitHeadLedger, readGitTreeFile } from './git-reconciliation.js';
 import { publishClaimedCandidate, revisionFor } from './mutation.js';
+import {
+  blocksTarget,
+  classifyReconciliation,
+  normalizeRevision,
+  requiresOwnerEvidence,
+} from './reconciliation-classifier.js';
 import { validateLedger } from './validate.js';
 import {
   assertUniqueWorktreeIdentity,
@@ -403,6 +409,14 @@ export async function reconcileClaimJournal({
   ));
   const entries = [...replayed.entries];
   const findings = [];
+  // What each finding refuses is the coordinator's own judgement, never a
+  // published member, so the scope rules on the write as the finding is
+  // recorded and never becomes a member something has to strip back out.
+  let unsafe = false;
+  const addFinding = (scope, finding) => {
+    unsafe ||= blocksTarget(scope, finding.item_id, targetItemId);
+    findings.push(finding);
+  };
   const observedAt = advanceClockFloor(replayed.state, physicalNow);
   try {
     entries.push(await appendClaimEntry(journalPath, {
@@ -451,6 +465,10 @@ export async function reconcileClaimJournal({
         attempt_id: intent.attempt_id,
         ledger_namespace: namespace,
         item_id: intent.item_id,
+        // A create abort names no predecessor revision, so its terminal must
+        // say which command aborted; patch and transition aborts keep their
+        // exact legacy shape and never carry a command.
+        ...(intent.command === 'create-v1' ? { command: intent.command } : {}),
         observed_revision: actualRevision,
         observed_at: observedAt,
       }));
@@ -459,7 +477,7 @@ export async function reconcileClaimJournal({
         ?? intent.item_path
         ?? null;
       const pathLabel = expectedPath ?? `item ${intent.item_id}`;
-      findings.push({
+      addFinding('global', {
         code: 'legacy-mutation-outcome-unknown',
         item_id: intent.item_id,
         attempt_id: intent.attempt_id,
@@ -541,7 +559,8 @@ export async function reconcileClaimJournal({
       outcome,
     }));
     const unknownPath = itemPathRelativeToLedger(ledgerDirectory, item?.file);
-    findings.push({
+    // A resolved intent is news, not a barrier: it refuses nothing.
+    addFinding(outcome.stdout.state === 'unknown' ? 'global' : 'none', {
       code: outcome.stdout.state === 'unknown'
         ? 'publication-outcome-unknown'
         : 'pending-intent-resolved',
@@ -606,7 +625,12 @@ export async function reconcileClaimJournal({
     const expectedRevision = authorizedRevisionOf(latestAuthorized);
     const authorizedRevisions = new Set(authorized.map(authorizedRevisionOf));
     for (const intent of entries) {
-      if (intent.type === 'legacy-mutation-intent' && intent.item_id === itemId) {
+      // A create names no predecessor revision, so its `null` is the absence of
+      // one, never a ruling that absent bytes are authorized. Reading it as a
+      // revision would make an uncommitted create look finalized in Git.
+      if (intent.type === 'legacy-mutation-intent'
+        && intent.item_id === itemId
+        && intent.expected_revision !== null) {
         authorizedRevisions.add(intent.expected_revision);
       }
     }
@@ -631,7 +655,7 @@ export async function reconcileClaimJournal({
     );
     if (activeMismatch?.earlier) {
       const pathLabel = expectedPath ?? `item ${itemId}`;
-      findings.push({
+      addFinding('global', {
         code: 'stale-write-detected',
         item_id: itemId,
         actual_revision: actualRevision,
@@ -650,13 +674,10 @@ export async function reconcileClaimJournal({
       });
       continue;
     }
-    // Who the journal says wrote the authorized revision, judged against who
-    // is asking. An entry from before writer identity existed, or a caller
-    // that cannot name itself, leaves the writer unknown.
-    const recordedWriter = latestAuthorized.writer_worktree_id ?? null;
-    const expectedWriter = recordedWriter === null || currentWorktreeId === null
-      ? 'unknown'
-      : recordedWriter === currentWorktreeId ? 'current' : 'other';
+    const expectedWriter = expectedWriterOf(
+      latestAuthorized.writer_worktree_id ?? null,
+      currentWorktreeId,
+    );
     const diagnosis = await reconciliationDiagnosis({
       ledgerDirectory,
       actualRevision,
@@ -665,15 +686,14 @@ export async function reconcileClaimJournal({
       expectedRevision,
       headRevision,
       expectedWriter,
-      workingTreeChanged,
     });
-    findings.push({
+    addFinding(diagnosis.scope, {
       code: 'stale-write-detected',
       item_id: itemId,
       actual_revision: workingTreeChanged ? actualRevision : headRevision,
       expected_revision: expectedRevision,
       observed_surface: workingTreeChanged ? 'working-tree' : 'git-head',
-      ...diagnosis,
+      ...diagnosis.finding,
       ...(record?.active ? {
         active_fence: {
           ledger_namespace: namespace,
@@ -706,7 +726,7 @@ export async function reconcileClaimJournal({
       ?? expected.item_path
       ?? null;
     const pathLabel = expectedPath ?? `item ${record.item_id}`;
-    findings.push({
+    addFinding('global', {
       code: earlier ? 'stale-write-detected' : 'revision-regression',
       item_id: record.item_id,
       actual_revision: actualRevision,
@@ -730,9 +750,6 @@ export async function reconcileClaimJournal({
     });
   }
 
-  const unsafe = findings.some((finding) => (
-    finding.code !== 'pending-intent-resolved' && blocksTarget(finding, targetItemId)
-  ));
   const logPath = claimReconcileLogPath(path.resolve(ledgerDirectory), namespace);
   let logExists = true;
   try {
@@ -757,6 +774,11 @@ export async function reconcileClaimJournal({
     findings,
     gitHead,
     headItems,
+    // Every coordinated item the journal knows and this working ledger does not
+    // hold. An item's number is immutable, so a caller that allocates the next
+    // one needs to know when an allocation exists that it cannot read; a stale
+    // revision of an item that is present hides no number.
+    missingCoordinatedItems: [...coordinatedItems].filter((itemId) => !items.has(itemId)),
     // The snapshot reconciliation judged. Reconciliation writes only the
     // journal, the claim state, and the ledger's `.wowbagger` reconcile log,
     // none of which a complete ledger load reads, so these are still the bytes
@@ -793,15 +815,6 @@ function itemPathRelativeToLedger(ledgerDirectory, file) {
   return path.relative(path.resolve(ledgerDirectory), file).split(path.sep).join('/');
 }
 
-// A mutation names the item it targets. Another item's unresolved publication
-// waits on a synchronization this mutation does not touch, so it reports as a
-// finding without refusing the write. A caller that names no target, such as
-// the `claim-verify` command, keeps every finding blocking.
-function blocksTarget(finding, targetItemId) {
-  if (targetItemId === null || finding.item_id === targetItemId) return true;
-  return finding.reason !== 'worktree-synchronization-required';
-}
-
 // Ownership is evidence, never a guess: an unreadable history or a missing
 // expected path leaves the revision unattributed instead of naming a ref.
 async function revisionOwnerEvidence(ledgerDirectory, expectedPath, expectedRevision) {
@@ -813,18 +826,76 @@ async function revisionOwnerEvidence(ledgerDirectory, expectedPath, expectedRevi
   }
 }
 
-// One owner, one shape: only an active named worktree reaches this finding, and
-// the remediation names the same ref and commit the finding does.
-function namedOwnerFinding(owner, expectedPath) {
-  return {
-    reason: 'worktree-synchronization-required',
-    ...(expectedPath ? { expected_path: expectedPath } : {}),
-    owner_ref: owner.ref,
-    owner_commit: owner.commit,
-    remediation: `WAIT for owner ${owner.ref} to publish ${owner.commit}, then synchronize this worktree and run claim-verify.`,
-  };
+// The classifier decides which topology this is; the sentences stay here.
+// Member order is part of the published finding, so each remedy builds its own
+// shape rather than sharing a base object.
+function topologyFinding(decision, expectedPath, expectedRevision) {
+  const pathLabel = expectedPath ?? 'the item path';
+  const at = expectedPath ? { expected_path: expectedPath } : {};
+  switch (decision.remediation) {
+    case 'commit-in-git':
+      return {
+        reason: decision.reason,
+        ...at,
+        remediation: `Commit ${pathLabel} in Git, then run claim-verify.`,
+      };
+    case 'wait-for-named-owner':
+      return {
+        reason: decision.reason,
+        ...at,
+        owner_ref: decision.owner.ref,
+        owner_commit: decision.owner.commit,
+        remediation: `WAIT for owner ${decision.owner.ref} to publish ${decision.owner.commit}, then synchronize this worktree and run claim-verify.`,
+      };
+    case 'establish-ownership':
+      return {
+        reason: decision.reason,
+        ...at,
+        owner_unavailable: true,
+        remediation: `Ownership of ${pathLabel} revision ${expectedRevision} cannot be established from reachable refs; inspect reachable or dangling commits, restore or explicitly adopt reviewed bytes, then run claim-verify.`,
+      };
+    // Reachable but unowned: the revision is in Git already, so the only honest
+    // instruction is to go read it. Naming an owner to wait for would be a wait
+    // with no end, which is what item #178 found in the field.
+    case 'inspect-reachable-history':
+      return {
+        reason: decision.reason,
+        ...at,
+        owner_unavailable: true,
+        remediation: `Revision ${expectedRevision} of ${pathLabel} is reachable in Git, but no active named worktree owner is established; inspect the reachable history, restore or explicitly adopt reviewed bytes, then run claim-verify.`,
+      };
+    case 'await-owner-commit':
+      return {
+        reason: decision.reason,
+        ...at,
+        owner_unavailable: true,
+        remediation: `Ownership of ${pathLabel} revision ${expectedRevision} is not yet reachable; wait for the owning worktree to commit, then synchronize this worktree and run claim-verify.`,
+      };
+    // Two remedies, both named, in the order that makes the cost obvious. The
+    // field report behind item #113 read the single restore sentence as the
+    // only way out and discarded reviewed, merged work to obey it.
+    case 'restore-or-adopt':
+      return {
+        reason: decision.reason,
+        ...at,
+        remediation: `Restore the authorized revision at ${pathLabel}, then run claim-verify; that discards the edit. Or adopt the committed revision of ${pathLabel} with claim-adopt, then run claim-verify; that keeps the edit.`,
+      };
+    default:
+      throw new Error(`The reconciliation topology named no remedy: ${decision.remediation}.`);
+  }
+}
+
+// Who the journal says wrote the authorized revision, judged against who is
+// asking. An entry from before writer identity existed, or a caller that
+// cannot name itself, leaves the writer unknown.
+function expectedWriterOf(recordedWriter, currentWorktreeId) {
+  if (recordedWriter === null || currentWorktreeId === null) return 'unknown';
+  return recordedWriter === currentWorktreeId ? 'current' : 'other';
 }
 
+// Evidence in, scope and public finding out: the classifier rules on the
+// topology, and this gathers exactly the evidence it rules on, then renders
+// the sentence it prescribes.
 async function reconciliationDiagnosis({
   ledgerDirectory,
   actualRevision,
@@ -833,64 +904,22 @@ async function reconciliationDiagnosis({
   expectedRevision,
   headRevision,
   expectedWriter,
-  workingTreeChanged,
 }) {
-  const pathLabel = expectedPath ?? 'the item path';
-  // Two remedies, both named, in the order that makes the cost obvious. The
-  // field report behind item #113 read the single restore sentence as the only
-  // way out and discarded reviewed, merged work to obey it.
-  const unauthorizedRevision = {
-    reason: 'unauthorized-revision',
-    ...(expectedPath ? { expected_path: expectedPath } : {}),
-    remediation: `Restore the authorized revision at ${pathLabel}, then run claim-verify; that discards the edit. Or adopt the committed revision of ${pathLabel} with claim-adopt, then run claim-verify; that keeps the edit.`,
+  const revisions = {
+    workingTree: normalizeRevision(actualRevision, expectedRevision, authorizedRevisions),
+    head: normalizeRevision(headRevision, expectedRevision, authorizedRevisions),
+  };
+  const decision = classifyReconciliation({
+    ...revisions,
+    expectedOwner: requiresOwnerEvidence(revisions)
+      ? await revisionOwnerEvidence(ledgerDirectory, expectedPath, expectedRevision)
+      : null,
+    expectedWriter,
+  });
+  return {
+    scope: decision.scope,
+    finding: topologyFinding(decision, expectedPath, expectedRevision),
   };
-  const hasOutOfProtocolLocalState = (
-    (actualRevision !== null && !authorizedRevisions.has(actualRevision))
-    || (headRevision !== null && !authorizedRevisions.has(headRevision))
-    || (actualRevision === null && headRevision !== null)
-  );
-  if (hasOutOfProtocolLocalState) return unauthorizedRevision;
-  let expectedOwner = null;
-  if (headRevision !== null && actualRevision === headRevision
-    && headRevision !== expectedRevision) {
-    expectedOwner = await revisionOwnerEvidence(ledgerDirectory, expectedPath, expectedRevision);
-    if (expectedOwner.kind === 'named-sibling') return namedOwnerFinding(expectedOwner, expectedPath);
-  }
-  if (!workingTreeChanged && headRevision !== expectedRevision) {
-    return {
-      reason: 'git-finalization-required',
-      ...(expectedPath ? { expected_path: expectedPath } : {}),
-      remediation: `Commit ${pathLabel} in Git, then run claim-verify.`,
-    };
-  }
-  if (actualRevision === null && headRevision !== expectedRevision) {
-    const owner = await revisionOwnerEvidence(ledgerDirectory, expectedPath, expectedRevision);
-    if (owner.kind === 'named-sibling') return namedOwnerFinding(owner, expectedPath);
-    return {
-      reason: 'worktree-synchronization-required',
-      ...(expectedPath ? { expected_path: expectedPath } : {}),
-      owner_unavailable: true,
-      remediation: `Ownership of ${pathLabel} revision ${expectedRevision} cannot be established from reachable refs; inspect reachable or dangling commits, restore or explicitly adopt reviewed bytes, then run claim-verify.`,
-    };
-  }
-  if (authorizedRevisions.has(actualRevision)) {
-    expectedOwner ??= await revisionOwnerEvidence(ledgerDirectory, expectedPath, expectedRevision);
-    if (expectedOwner.kind === 'named-sibling') return namedOwnerFinding(expectedOwner, expectedPath);
-    // Advice to wait for an owning worktree needs an owner that could still
-    // appear. When the journal names this worktree as the writer of the
-    // expected revision and no active worktree carries it, the successor exists
-    // nowhere but in the journal: there is nothing to synchronize from, and the
-    // local bytes are simply unauthorized.
-    if (expectedWriter !== 'current' && expectedOwner.kind !== 'current') {
-      return {
-        reason: 'worktree-synchronization-required',
-        ...(expectedPath ? { expected_path: expectedPath } : {}),
-        owner_unavailable: true,
-        remediation: `Ownership of ${pathLabel} revision ${expectedRevision} is not yet reachable; wait for the owning worktree to commit, then synchronize this worktree and run claim-verify.`,
-      };
-    }
-  }
-  return unauthorizedRevision;
 }
 
 function activePublicationMismatch(entries, record, actualRevision, observedAt) {

package/src/claim-request.js

@@ -4,6 +4,7 @@
 // requestSchemaError encodes for the reference model — production code must not
 // depend on test code, so the rules are duplicated here rather than imported.
 import { pointer } from './request.js';
+import { validateLedgerRepairRequest } from './ledger-repair.js';
 
 const NAMESPACE_ID = /^wbns_[a-f0-9]{32}$/;
 const ITEM_ID = /^wb_[0-9A-HJKMNP-TV-Z]{26}$/;
@@ -24,7 +25,15 @@ const REQUIRED_MEMBERS = {
 // Returns an array of {path, code, message} issues (empty when the request is valid).
 // The request must already be JSON-parsed and deep-normalized (plain objects/arrays,
 // JsonNumber unwrapped) — this module only checks shape, not JSON syntax.
+//
+// `number-repair` is a ledger-repair request, not a work-claim one. It is
+// answered here because the claim journal validates every entry it replays
+// through this seam, so a repair request the journal accepts must be the exact
+// request the command accepts. Its members are the repair domain's own.
 export function validateClaimRequest(operation, request) {
+  if (operation === 'number-repair') {
+    return validateLedgerRepairRequest(request);
+  }
   const required = REQUIRED_MEMBERS[operation];
   if (!isPlainObject(request)) {
     return [problem([], 'invalid-type', `The ${operation} request must be a JSON object.`)];