wowbagger 0.1.0-alpha.14 → 0.1.0-alpha.17

package/CHANGELOG.md

@@ -7,6 +7,55 @@ consolidation. The first tagged release inherits this file.
 
 ## Unreleased
 
+## 0.1.0-alpha.17 - 2026-08-30
+
+- **Breaking:** raise the supported Node.js floor from 20 to 24. Node 20 and
+  Node 22 no longer satisfy `engines.node`; Node 26 remains outside the
+  supported matrix because of the separate Vitest incompatibility reported by
+  Lee.
+
+The alpha.14 hard cutover remains the baseline: `claim-store-unavailable`
+answers **The durable claim store is unavailable.** with
+`claim-store-unreadable`; upgrade every writer before the first alpha.14 create.
+There is no automatic migration or mixed-version grace period. There is no
+batch mutation, the create-then-commit loop remains supported, item #186 owns
+batch design, and item #182 owns existing duplicate numbers. The fence adds no
+new Git roster or history traversal and costs two extra fsync'd journal appends
+within the 65,536-entry limit.
+
+
+## 0.1.0-alpha.16 - 2026-08-30
+
+- Added `version-drift --json` to detect stale installed skill pins, core
+  contract versions, and package provenance before ledger mutation.
+
+The alpha.14 hard cutover remains the baseline: `claim-store-unavailable`
+answers **The durable claim store is unavailable.** with
+`claim-store-unreadable`; upgrade every writer before the first alpha.14
+create. There is no automatic migration or mixed-version grace period. There is
+no batch mutation, the create-then-commit loop remains supported, item #186 owns
+batch design, and item #182 owns existing duplicate numbers. The fence adds no
+new Git roster or history traversal and costs two extra fsync'd journal appends
+within the 65,536-entry limit.
+
+## 0.1.0-alpha.15 - 2026-08-30
+
+- **Duplicate-number recovery now has a separate `ledger-repair` contract
+  version 1.** Use the read-only `number-repair-proposal` command to review a
+  complete mapping, then apply it with `number-repair`. The repair path requires
+  duplicate-number errors to be the complete validation failure, preserves ULID
+  identities and relation values, uses the shared namespace fence, records
+  durable intent/final entries, and supports bounded auto-commit recovery.
+
+The alpha.14 hard cutover remains the baseline: `claim-store-unavailable`
+answers **The durable claim store is unavailable.** with
+`claim-store-unreadable`; upgrade every writer before the first alpha.14
+create. There is no automatic migration or mixed-version grace period. There is
+no batch mutation, the create-then-commit loop remains supported, item #186 owns
+batch design, and item #182 owns existing duplicate numbers.
+The fence adds no new Git roster or history traversal and costs two extra
+fsync'd journal appends within the 65,536-entry limit.
+
 ## 0.1.0-alpha.14 - 2026-08-29
 
 ### Changed

package/README.md

@@ -30,8 +30,8 @@ agent to use those guarantees instead of hand-editing your Markdown.
 
 **Start here:** [install the core and set up a ledger](#start-here).
 
-> **Status: alpha, published, and self-hosted.** `0.1.0-alpha.14` is on npm under
-> the `next` tag and on this repository's `v0.1.0-alpha.14` tag. It is the
+> **Status: alpha, published, and self-hosted.** `0.1.0-alpha.17` is on npm under
+> the `next` tag and on this repository's `v0.1.0-alpha.17` tag. It is the
 > version this repository runs its own backlog on. The API is not frozen and the
 > version will move before a stable release.
 >
@@ -77,7 +77,7 @@ Wowbagger is the core authority for a Git-native work ledger. Use it instead
 of editing ledger Markdown by hand.
 
 ```sh
-wowbagger --version                 # require 0.1.0-alpha.14
+wowbagger --version                 # require 0.1.0-alpha.17
 wowbagger capabilities --json       # require contract_version: 5
 wowbagger validate --ledger ledger --json
 wowbagger ready --ledger ledger --as-of YYYY-MM-DD --json
@@ -103,10 +103,10 @@ cooperating writers; they are not exclusive locks.
 Install the core CLI, then verify it. The core requires Node.js 20 or later:
 
 ```sh
-npm install -g wowbagger@0.1.0-alpha.14   # exact plugin-matched release
+npm install -g wowbagger@0.1.0-alpha.17   # exact plugin-matched release
 # or, from this release's Git tag:
-# npm install -g github:lstutzman/wowbagger#v0.1.0-alpha.14
-wowbagger --version         # 0.1.0-alpha.14
+# npm install -g github:lstutzman/wowbagger#v0.1.0-alpha.17
+wowbagger --version         # 0.1.0-alpha.17
 wowbagger capabilities --json              # must report contract_version: 5
 ```
 
@@ -325,7 +325,7 @@ two supported install routes:
   registry requires a `latest` tag), so a bare install resolves to the same
   bytes.
 - **git tag** —
-  `npm install -g github:lstutzman/wowbagger#v0.1.0-alpha.14` installs this
+  `npm install -g github:lstutzman/wowbagger#v0.1.0-alpha.17` installs this
   release. Installing at a ref installs the core and every adapter that ref
   carries.
 
@@ -397,7 +397,7 @@ Upgrade the pieces you installed:
 
 ```sh
 npm install -g wowbagger@next                  # public npm registry
-npm install -g github:lstutzman/wowbagger#v0.1.0-alpha.14  # immutable Git release
+npm install -g github:lstutzman/wowbagger#v0.1.0-alpha.17  # immutable Git release
 git pull && npm ci                            # or: a direct checkout
 ```
 
@@ -445,6 +445,16 @@ core, these are the changes most likely to touch you:
   `create` and refuses a caller-supplied one; `patch` refuses it because it is
   immutable identity. Keep a legacy identifier in a declared extension member or
   in the item body.
+
+- **Repair duplicate numbers through `ledger-repair` version 1.** Generate a
+  read-only proposal with `number-repair-proposal`, review every
+  `expected_revision` and `replacement_number`, then apply the complete mapping
+  with `number-repair`. The command preserves ULID identities and relations and
+  does not change core contract version 5.
+
+- **Run `version-drift --json` before mutation.** It compares the installed
+  skill pin, required core contract, and running core, and names the stale
+  package, plugin cache, or linked checkout with remediation.
 - **Delete your local ULID generator.** `wowbagger mint-id --json` prints a
   canonical ID; `--date YYYY-MM-DD` selects the creation date the ID must
   encode.
@@ -1171,18 +1181,20 @@ the finding as a ledger item rather than leaving it in a transcript.
 
 ### The verification gate
 
-Four commands. All four must pass, and the test commands run on **both** the
-current Node runtime and Node 20:
+Four commands. All four must pass, and the test commands run on **Node 24.20.0**:
 
 ```sh
-TMPDIR=/tmp node --test test/*.test.js
-TMPDIR=/tmp /opt/homebrew/opt/node@20/bin/node --test test/*.test.js
-TMPDIR=/tmp node spec/run-adapter-implementation.js
-node bin/wowbagger.js validate --ledger ledger --json
+TMPDIR=/tmp /opt/homebrew/opt/node@24/bin/node --test test/*.test.js
+TMPDIR=/tmp /opt/homebrew/opt/node@24/bin/node --pending-deprecation --throw-deprecation --test test/*.test.js
+TMPDIR=/tmp /opt/homebrew/opt/node@24/bin/node spec/run-adapter-implementation.js
+TMPDIR=/tmp /opt/homebrew/opt/node@24/bin/node bin/wowbagger.js validate --ledger ledger --json
 ```
 
 `TMPDIR=/tmp` is not optional: the default macOS temporary path makes the claim
-lock socket path too long. Substitute your own Node 20 binary path.
+lock socket path too long. Use an explicit Node 24.20.0 binary path.
+
+The supported runtime matrix is Node 24.20.0. Node 26 remains excluded until
+the separate Vitest incompatibility reported by Lee is resolved.
 
 `npm test`, `npm audit --omit=dev`, and `git diff --check` are useful alongside
 it; they are not a substitute for the four commands above.

package/docs/host-contract.md

@@ -26,10 +26,13 @@ shell: an absolute Node executable, the absolute `wowbagger.js` the package
 installed, an argument array, and `shell: false`. Neither path is discovered by
 searching a global npm directory, and neither is a platform command shim.
 
-Wowbagger requires Node.js 20 or later. The package declares that floor in
+Wowbagger requires Node.js 24 or later. The package declares that floor in
 `engines.node`, and the launch seam exports it as `MINIMUM_NODE_MAJOR` for a
 host that resolves its own runtime instead of reusing the one it is running on.
 
+The supported release matrix is Node 24.20.0. Node 26 is excluded until the
+separate Vitest incompatibility reported by Lee is resolved.
+
 ~~~js
 import { resolveCoreLaunch } from 'wowbagger';
 
@@ -258,6 +261,9 @@ not a fetch URL.
 | `bare-ready-result.json` | bare result | a `ready` success |
 | `ledger-mutation-refusal.json` | ledger-mutation 1 | the legacy-write fence refusals |
 | `report-config-v1.json` | report config 1 | `<ledger>/.wowbagger/report.json` at version 1 |
+| `ledger-repair-request.json` | ledger-repair 1 | the strict `number-repair` request |
+| `ledger-repair-proposal.json` | ledger-repair 1 | the read-only `number-repair-proposal` result |
+| `ledger-repair-response.json` | ledger-repair 1 | every `number-repair-proposal` and `number-repair` response |
 | `report-config-v2.json` | report config 2 | the same file at version 2, which names views |
 
 Every schema fixes its root members exactly and pins the version of its own

package/docs/mutation-contract.md

@@ -376,6 +376,7 @@ answer in two domains.
 | work-claim | `work-claim` | 1, the legacy envelope marker | `result.operations.work_claim.api_version` of `claim capabilities --json` |
 | ledger-publication | `ledger-publication` | 1, the legacy envelope marker | the same work-claim `api_version` |
 | ledger-mutation | `ledger-mutation` | 1, the legacy envelope marker | the same work-claim `api_version` |
+| ledger-repair | `ledger-repair` | 1 | `contract_version` of `number-repair-proposal` or `number-repair` |
 | bare result | absent, and no `ok` member either | none | none |
 
 The rule has three steps:
@@ -401,6 +402,7 @@ legacy claim-envelope marker, and a consumer must never compare it with the core
 | `inspect` | core | core |
 | `list` | core | core |
 | `mint-id` | core | core |
+| `version-drift` | core | core |
 | `report` | core | core |
 | `create` | core | core, or ledger-mutation when the claim fence refuses |
 | `transition` | core | core, or ledger-mutation when the claim fence refuses |
@@ -415,7 +417,8 @@ legacy claim-envelope marker, and a consumer must never compare it with the core
 | `claim-sync` | work-claim | work-claim |
 | `claim-adopt` | work-claim | work-claim |
 | `mutation-finalize` | work-claim | work-claim |
-| `claim verify` | ledger-publication, `command: "read"` | ledger-publication |
+| `number-repair-proposal` | ledger-repair | ledger-repair |
+| `number-repair` | ledger-repair | ledger-repair |
 | `publish-claimed` | ledger-publication | ledger-publication |
 
 **Exact root members**
@@ -1600,10 +1603,16 @@ A create has no authorized predecessor, so Git `HEAD` is the only surface that
 can carry its authorized bytes, and an uncommitted create raises the global
 `git-finalization-required` barrier for every later mutation. Commit each
 created item before the next mutating command. This release adds no batch
-mutation; the supported bulk pattern is the create-then-commit loop, and item
-#186 owns safe batch design. A ledger that already carries duplicate numbers is
-item #182's recovery work: it fails validation and refuses every mutation
-before allocation, and nothing here renumbers it.
+mutation; the supported bulk pattern remains the create-then-commit loop.
+A ledger that already carries duplicate numbers is item #182 recovery work and
+is repaired through the separate `ledger-repair` contract, not through core
+version 5 mutation. Run
+`number-repair-proposal --ledger <dir> --json`, review the complete mapping, then
+run `number-repair --ledger <dir> --input <repair.json> --json`. The repair
+command operates only when duplicate-number errors are the complete validation
+failure, preserves ULID identities and relation values, and publishes all
+affected items under the shared namespace fence. Arbitrary hand edits remain
+unsupported because they can damage IDs, paths, or references.
 
 **What this guarantees, and what it does not.** The fence closes the reported
 PropertyCompass2 collision: cooperating alpha.14 worktrees of one clone that

package/docs/work-claim-contract.md

@@ -477,16 +477,14 @@ intent and one committed terminal, so with no other activity the
 ceiling. Capacity is checked before publication and fails closed. Journal
 compaction is not part of this change.
 
-**A ledger that already carries duplicate numbers is item #182's recovery
-work, not this fix's.** Such a ledger fails validation and refuses every
-mutation before allocation, and item #182 owns the fenced repair. #181 prevents
-new collisions in every valid ledger; it neither renumbers damaged items nor
-makes an invalid ledger worse. Editing `number` in the item source by hand,
-committing it, and then running `claim-adopt` is **not a supported
-workaround**: one field deployment did exactly that as an emergency
-intervention during an outage, and it bypasses the number-collision and
-reference checks every mutation performs, so it can leave dangling
-`depends_on`, `related`, and parent references that nothing reports.
+A ledger that already carries duplicate numbers is item #182 recovery work and
+is repaired through the separate `ledger-repair` contract, not through claim
+operations. Run `number-repair-proposal --ledger <dir> --json`, review the
+complete mapping, then run `number-repair --ledger <dir> --input <repair.json>
+--json`. The repair command runs only when duplicate-number errors are the
+complete validation failure, preserves ULID identities and relation values, and
+publishes all affected items under the shared namespace fence. Arbitrary hand
+edits remain unsupported because they can damage IDs, paths, or references.
 
 **What alpha.14 guarantees, and what it does not.** Alpha.14 closes the
 reported PropertyCompass2 collision: cooperating alpha.14 worktrees of one

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wowbagger",
-  "version": "0.1.0-alpha.14",
+  "version": "0.1.0-alpha.17",
   "description": "Git-native work ledger for coding agents: deterministic ready queues, guarded CAS mutations, claims and fencing, and self-contained HTML reports.",
   "type": "module",
   "license": "MIT",
@@ -30,7 +30,7 @@
     "cli"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "bin": {
     "wowbagger": "bin/wowbagger.js"

package/schemas/core-envelope.json

@@ -25,7 +25,8 @@
             "inspect",
             "list",
             "mint-id",
-            "report"
+            "report",
+            "version-drift"
           ]
         },
         "contract_version": {
@@ -55,8 +56,8 @@
             "capabilities",
             "inspect",
             "list",
-            "mint-id",
-            "report"
+            "report",
+            "version-drift"
           ]
         },
         "contract_version": {

package/schemas/index.json

@@ -92,6 +92,24 @@
       "version": 1,
       "summary": "Legacy-write fence refusals in the ledger-mutation namespace."
     },
+    {
+      "file": "ledger-repair-proposal.json",
+      "domain": "ledger-repair",
+      "version": 1,
+      "summary": "The read-only duplicate-number repair proposal result."
+    },
+    {
+      "file": "ledger-repair-request.json",
+      "domain": "ledger-repair",
+      "version": 1,
+      "summary": "The strict number-repair request, covering the complete duplicate set."
+    },
+    {
+      "file": "ledger-repair-response.json",
+      "domain": "ledger-repair",
+      "version": 1,
+      "summary": "Every ledger-repair response: the proposal and apply envelopes at repair version 1."
+    },
     {
       "file": "report-config-v1.json",
       "domain": "report-config",

package/schemas/ledger-repair-proposal.json

@@ -0,0 +1,170 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/lstutzman/wowbagger/schemas/ledger-repair-proposal.json",
+  "title": "number-repair-proposal result, ledger-repair version 1",
+  "description": "The `result` member of a successful `number-repair-proposal` response. The proposal is read-only: it reads the raw items of a ledger whose complete error set is duplicate numbers and computes the mapping that would repair it, writing nothing. The caller confirms or replaces `suggested_changes` and submits them as a `number-repair` request, which validates every witness again under the repair lock.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "ledger_snapshot_revision",
+    "duplicate_groups",
+    "items",
+    "suggested_changes",
+    "preserved_items",
+    "validation_errors"
+  ],
+  "properties": {
+    "ledger_snapshot_revision": {
+      "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/revision",
+      "description": "The digest over the complete relevant source bytes this proposal was computed from. A repair request replays it so a changed ledger is a conflict rather than a surprise."
+    },
+    "duplicate_groups": {
+      "type": "array",
+      "minItems": 1,
+      "description": "One entry per duplicated number, naming every item that carries it. A repair request must resolve every group.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "number",
+          "item_ids"
+        ],
+        "properties": {
+          "number": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "item_ids": {
+            "type": "array",
+            "minItems": 2,
+            "uniqueItems": true,
+            "items": {
+              "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/itemId"
+            }
+          }
+        }
+      }
+    },
+    "items": {
+      "type": "array",
+      "minItems": 1,
+      "description": "Every item in a duplicate group, with the configured path and exact source revision a repair request witnesses.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "item_id",
+          "path",
+          "revision",
+          "number"
+        ],
+        "properties": {
+          "item_id": {
+            "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/itemId"
+          },
+          "path": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The item's configured path, relative to the ledger directory."
+          },
+          "revision": {
+            "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/revision"
+          },
+          "number": {
+            "type": "integer",
+            "minimum": 1
+          }
+        }
+      }
+    },
+    "suggested_changes": {
+      "type": "array",
+      "minItems": 1,
+      "description": "The computed mapping, in the exact shape of the `changes` member of a number-repair request. Each group keeps the number on its lexicographically smallest ULID and moves the rest above the current maximum number.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "item_id",
+          "expected_revision",
+          "expected_number",
+          "replacement_number"
+        ],
+        "properties": {
+          "item_id": {
+            "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/itemId"
+          },
+          "expected_revision": {
+            "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/revision"
+          },
+          "expected_number": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "replacement_number": {
+            "type": "integer",
+            "minimum": 1
+          }
+        }
+      }
+    },
+    "preserved_items": {
+      "type": "array",
+      "minItems": 1,
+      "description": "Item IDs the proposal keeps at their current number.",
+      "uniqueItems": true,
+      "items": {
+        "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/itemId"
+      }
+    },
+    "references": {
+      "type": "array",
+      "description": "The affected items' relations, exactly as the source carries them. Relations are ULIDs, so a number repair preserves them; they are reported so a caller can confirm that nothing identity-bearing is being rewritten.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "item_id",
+          "depends_on",
+          "related",
+          "parent"
+        ],
+        "properties": {
+          "item_id": {
+            "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/itemId"
+          },
+          "depends_on": {
+            "type": "array",
+            "items": {
+              "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/itemId"
+            }
+          },
+          "related": {
+            "type": "array",
+            "items": {
+              "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/itemId"
+            }
+          },
+          "parent": {
+            "oneOf": [
+              {
+                "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/itemId"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        }
+      }
+    },
+    "validation_errors": {
+      "type": "array",
+      "minItems": 1,
+      "description": "The complete current validation errors. A proposal is produced only when every one of them is a duplicate-number error; any other error returns ledger-repair-not-applicable instead.",
+      "items": {
+        "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/validationError"
+      }
+    }
+  }
+}

package/schemas/ledger-repair-request.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/lstutzman/wowbagger/schemas/ledger-repair-request.json",
+  "title": "number-repair request, ledger-repair version 1",
+  "description": "The strict JSON request `number-repair` reads from stdin or a host-created request file. One request covers the complete duplicate set: a partial mapping is refused, because moving one group cannot produce a valid complete ledger while another group remains. Each change carries the witnesses the apply path compares under the repair lock. `ledger-repair` is its own contract version, separate from the core contract version and the work-claim contract version.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "repair_id",
+    "ledger_snapshot_revision",
+    "date",
+    "changes"
+  ],
+  "properties": {
+    "repair_id": {
+      "type": "string",
+      "pattern": "^nr_[0-9]{8}_[0-9]{4}$",
+      "description": "The bounded recovery key: `nr_`, the repair date, and a four-digit sequence within that date. An interrupted apply is resumed by this ID rather than retried blindly."
+    },
+    "ledger_snapshot_revision": {
+      "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/revision",
+      "description": "The complete-snapshot witness the proposal was computed against. A changed snapshot is a conflict, never a repair applied to bytes the caller never read."
+    },
+    "date": {
+      "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/isoDate"
+    },
+    "changes": {
+      "type": "array",
+      "minItems": 1,
+      "description": "One entry per moved item. No `item_id` repeats, because an item moves once, and no `replacement_number` repeats, because two items cannot land on one number. An empty list is an invalid request rather than a no-op.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "item_id",
+          "expected_revision",
+          "expected_number",
+          "replacement_number"
+        ],
+        "properties": {
+          "item_id": {
+            "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/itemId"
+          },
+          "expected_revision": {
+            "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/revision"
+          },
+          "expected_number": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "The number the item carries now, compared as an integer. It is a witness, not a label."
+          },
+          "replacement_number": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "The number the item is moved to. The apply path refuses a collision with any item that is not being moved."
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/ledger-repair-response.json

@@ -0,0 +1,90 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/lstutzman/wowbagger/schemas/ledger-repair-response.json",
+  "title": "ledger-repair responses, contract version 1",
+  "description": "Every `number-repair-proposal` and `number-repair` --json response. The root carries a `namespace` member: dispatch on `namespace` before reading any version field. `contract_version` is the repair domain's own version 1 — the core contract version and the work-claim contract version are separate and unchanged by it. A future change to the request or the repaired source shape requires a new repair contract version rather than a silent reinterpretation of version 1.",
+  "type": "object",
+  "oneOf": [
+    {
+      "title": "repair success",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "ok",
+        "namespace",
+        "command",
+        "contract_version",
+        "state",
+        "result"
+      ],
+      "properties": {
+        "ok": {
+          "const": true
+        },
+        "namespace": {
+          "const": "ledger-repair"
+        },
+        "command": {
+          "enum": [
+            "number-repair-proposal",
+            "number-repair"
+          ]
+        },
+        "contract_version": {
+          "const": 1
+        },
+        "state": {
+          "enum": [
+            "unchanged",
+            "committed"
+          ],
+          "description": "A proposal changes nothing, so it is always `unchanged`. An applied repair is `committed`."
+        },
+        "result": {
+          "type": "object",
+          "description": "The proposal result is the ledger-repair-proposal schema. The apply result names the repair ID, the snapshot it was applied against, the changed items, and the Git commit when one was established."
+        }
+      }
+    },
+    {
+      "title": "repair refusal",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "ok",
+        "namespace",
+        "command",
+        "contract_version",
+        "state",
+        "error"
+      ],
+      "properties": {
+        "ok": {
+          "const": false
+        },
+        "namespace": {
+          "const": "ledger-repair"
+        },
+        "command": {
+          "enum": [
+            "number-repair-proposal",
+            "number-repair"
+          ]
+        },
+        "contract_version": {
+          "const": 1
+        },
+        "state": {
+          "enum": [
+            "unchanged",
+            "unknown"
+          ],
+          "description": "`unchanged` states that no ledger byte was written. `unknown` is reserved for an outcome this core could not resolve; it never accompanies a refusal raised before any write was attempted."
+        },
+        "error": {
+          "$ref": "https://github.com/lstutzman/wowbagger/schemas/common.json#/$defs/error"
+        }
+      }
+    }
+  ]
+}