diff --git a/decisions/D-004-PACKET.md b/decisions/D-004-PACKET.md
index 8923e11f0d..3254c95151 100644
--- a/decisions/D-004-PACKET.md
+++ b/decisions/D-004-PACKET.md
@@ -1,6 +1,8 @@
 # D-004 final executable preregistration
 
-Schema/stage remains **`D004-MANIFEST-1` / `PREREGISTERED`**; the direct H1–H6 repairs are not a new C stage. D-004 remains **OPEN** and **not frozen**. The package is now **freezable**, meaning eligible for later commit, independent producer review, external capture, and freeze—not that any evidence, adoption, register/ADR update, or mechanism decision is claimed.
+Schema/stage remains **`D004-MANIFEST-1` / `PREREGISTERED`**; the direct H1–H6 repairs are not a new C stage. D-004 remains **OPEN** and **not frozen**. The package is only a candidate for rereview: it becomes freezable after that rereview, meaning eligible for later commit, independent producer review, external capture, and freeze—not that any evidence, adoption, register/ADR update, or mechanism decision is claimed.
+
+**Bounded pre-freeze v1 correction.** Independent review of commits `a69eaad` and `fbe4b23` authorized in-place pure-contract correction before any freeze or retained evidence existed. Manifest digests `1d8d4da297eca59e359c2559b77ffac661be5fad966106d5b647c31a329154db` and now `f689d7cf90c74b76ff1b5d4aeaa8926ab1d216996a1cc0ea2af075c146cb6dd3`, every O derived from either, and all corresponding producer pins are explicitly invalid development-only material and must reject. The latter lacked independently recomputable package/tree/commit/runtime/bundle provenance and is superseded by this High 4 and pure-schema Highs 1/2 repair. Cases, families, recovery axes, assertions, O contract, evidence DAG, gates, and adoption rule are unchanged; only provenance/freeze declarations and required schemas change. No freeze, evidence, role bundle, or live capture is created here. Fresh role bundles and external live capture are required after rereview; only then is the corrected package freezable.
 
 ## C1 relation retained
 
@@ -61,7 +63,15 @@ The frozen CPython 3.11 stdlib allowlist is manifest-declared. Exact repository
 
 Independence revalidates each identity against the byte maps embedded in its own supplied bundle before comparison—there is no separate decoy map. Roles, roots, sources, semantic dependency bytes, and commits must differ. Source/dependency path or byte overlap and cross-producer/validator imports reject. Cross-overlap is restricted to identical packet/manifest lock bytes; identical canonical literals are permitted only when independently transcribed inside disjoint source files, not as shared files.
 
-Future `D004-FREEZE-1` is a closed canonical record binding packet/manifest hashes and lengths, executor/checker source and identity hashes and lengths, and exact externally captured package commit, tree, and timestamp token. Validation recomputes every binding from exact bytes, complete producer bundles, and a separate closed package-capture input; the freeze cannot self-declare capture facts. The current manifest freeze remains null and `frozen:false`.
+Future `D004-FREEZE-1` has exactly these fields in declared inventory: `schema, packet, manifest, executor_source, checker_source, executor_identity, checker_identity, executor_bundle, checker_bundle, runtime_test_capture, commit, tree, timestamp_token`. Packet/manifest, source closures, identities, both Git bundles, and runtime capture are typed artifact identities with exact SHA-256 and byte length.
+
+The capture-tool handoff is closed `D004-PACKAGE-CAPTURE-2`: `schema`; derived `commit`, `tree`, and `timestamp_token`; `commit_payload` as exact lowercase hex plus byte length and SHA-256; `full_tree` as the complete recursively flattened, path-sorted leaf inventory where every entry is exactly `{path,mode:"100644",type:"blob",blob_oid,content}` and content uses that same strict raw encoding; `selected_required` as exact ordered `{path,content}` entries; raw encoded executor/checker Git bundle bytes plus their recomputed artifact identities; and closed `D004-RUNTIME-TEST-CAPTURE-2`. The selected path list is exactly packet, manifest, validator/test, executor producer/test, checker producer/test, and capture tool/test. Every package capture requires the supplied commit to equal current `HEAD` and the global staged, unstaged, and untracked status to be empty; ignored files remain explicitly out of scope because neither the committed tree nor archive contains them. There is no uncontrolled capture switch.
+
+Pure validation strictly decodes bytes; recomputes every blob OID, recursive Git root tree, commit SHA-1 from payload and tree, and token from the unique committer header; requires selected entries equal their full-tree bytes; requires exact packet/manifest lock bytes in both role bundles; and requires each role source/dependency map equal its selected package production paths/bytes. It also parses each raw Git bundle header and PACK stream using only the Python standard library, checks the pack checksum, inflates objects, resolves OFS/REF deltas, recomputes object identities, requires the sole advertised ref to be the exact role ref at the exact logical zero-parent commit, and requires the packed object set and bytes to equal the independently reconstructed commit/tree/blob closure with no omissions or extras. Header decoys, payload corruption, wrong commit/ref/closure, arbitrary raw replacement even with a recomputed artifact, and bundle-byte/artifact swaps reject. External capture remains responsible for creating and live-Git-verifying the bundle; pure validation independently proves the retained raw bundle's deterministic logical binding without subprocess or live Git.
+
+Runtime capture fixes literal `CPython` `3.11.14`, generic interpreter artifact identity, isolated bootstrap artifact identity, package commit/tree, three ordered test paths, expected/executed 45, and exit 0. Production capture has no caller-controlled runner, exporter, or probe seam: it invokes the fixed archive export and subprocess paths. The probe requires reported `sys.executable`, after resolution, to equal the explicit executable whose bytes are hashed. The exact normalized command is `CPYTHON -I -S -c <bootstrap_sha256> <EXPORT_ROOT> decisions.test_d004_manifest future.d004_executor.test_producer future.d004_checker.test_producer`; `<EXPORT_ROOT>` is a normalization token, not a caller path. Tested closure is recomputed over all ten selected required path identities and exact bytes, not accepted as a caller artifact.
+
+`timestamp_token` has exact grammar `GIT_COMMITTER_TIMESTAMP:<decimal-seconds>:<+/-HHMM>` with valid timezone (`00:00` through `14:00`, minutes below 60, and no offset beyond `±14:00`). It identifies the captured commit’s exact unique committer-timestamp header only; it is **not trusted time, freshness, or notarization**. This validator remains pure/read-only and performs no subprocess or live Git inspection. The current freeze remains absent and `frozen:false`.
 
 ## Final H6 V/E and binary verdict
 
@@ -73,6 +83,6 @@ The ordered DAG now includes FREEZE, binds packet/manifest and both producer sou
 
 ## Current status and future sequence
 
-Direct Highs **H1–H6 are repaired**. This preregistration remains `OPEN` and `frozen:false`; no producer implementations, capture, freeze, V, E, evidence run, or adoption currently exists. `freezable:true` means only that after independent review the package may be committed and later frozen—it is not a freeze or adoption claim.
+Direct Highs **H1–H6 are repaired**. This preregistration remains `OPEN` and `frozen:false`; no capture, freeze, V, E, retained evidence run, role bundle, or adoption currently exists. The corrected package is freezable only after rereview; manifest `freezable:true` is a future eligibility gate, not a current freeze or adoption claim.
 
-Future sequence: **independent review → commit packet+manifest together → independently implement executor/checker → review implementations → externally capture committed package and producer facts → create detached freeze → execute evidence separately → validate exact V/E**. Synthetic tests are in-memory, clearly non-retained, and do not perform any of those governance steps.
+Future sequence: **rereview corrected packet+manifest → commit them together → independently review executor/checker → externally capture the exact committed package, runtime test record, timestamp token, and fresh role bundles → create detached freeze → execute evidence separately → validate exact V/E**. Synthetic tests are in-memory, clearly non-retained, and do not perform any governance step or substitute for live capture.
diff --git a/decisions/d004-crash-manifest-v1.json b/decisions/d004-crash-manifest-v1.json
index 6882cc7e14..14496f5803 100644
--- a/decisions/d004-crash-manifest-v1.json
+++ b/decisions/d004-crash-manifest-v1.json
@@ -1 +1 @@
-{"artifact_kind":"PREREGISTRATION_ONLY","assertions":[{"equality":"EXACT_VALUE_AND_SHA256","expected_count":73,"id":"A01-HISTORY","operator":"HISTORY_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_cases","source_refs":["cases","predecessors","branches"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":46,"id":"A02-TRANSITIONS","operator":"TRANSITIONS_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_durable_steps","source_refs":["cases","operations","durable_cuts"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":73,"id":"A03-CLASSIFICATION","operator":"CLASSIFICATION_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_history_cells","source_refs":["durable_images","compatible_completions"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":7,"id":"A04-UNKNOWN-IFF","operator":"UNKNOWN_EQUIVALENCE_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"unknown_cells","source_refs":["dispatch","completion_sets","no_redispatch"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":2,"id":"A05-QUERY-REINVOKE","operator":"QUERY_REINVOKE_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"C03","source_refs":["authorize","query","reinvoke"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":10,"id":"A06-F1-F5","operator":"F1_F5_INVARIANTS_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"C01:C10","source_refs":["F1","F2","F3","F4","F5"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":4,"id":"A07-PROMOTION","operator":"PROMOTION_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"C11:C14","source_refs":["F6","B1-13","B1-14"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":1971,"id":"A08-RECOVERIES","operator":"RECOVERY_COLLECTION_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_recovery_observations","source_refs":["F8","history_cells","axes"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":1971,"id":"A09-METAMORPHIC","operator":"RECOVERY_METAMORPHIC_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_recovery_observations","source_refs":["stale_replay","cycles","crash","outage"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":56,"id":"A10-CAUSAL-GUARDS","operator":"CAUSAL_GUARDS_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_steps","source_refs":["predecessors","branches","event_guards"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":2044,"id":"A11-SCHEMA-CELLS","operator":"SCHEMA_CONFORMANCE_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_derived_values","source_refs":["schemas","history_cells","recovery_results"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":7,"id":"A12-COVERAGE","operator":"COVERAGE_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"coverage","source_refs":["families","cases","steps","cells","unknown","recoveries","assertions"]}],"cases":[{"family":"F1","id":{"tag":"CaseId","value":"C01"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-deny-mal"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C01-G01"},"id":{"tag":"StepId","value":"C01-01"},"kind":"DURABLE","operation":{"actor":{"tag":"ActorId","value":"actor-deny"},"attempt":{"tag":"AttemptId","value":"att-deny-mal"},"authority":false,"commitment":{"tag":"CommitmentId","value":"commit-deny"},"kind":"DENIAL","outcome":null,"reason":"MALFORMED","request":{"tag":"RequestId","value":"req-deny-mal"},"semantic_digest_after":{"tag":"OpaqueToken","value":"semantic-empty"},"semantic_digest_before":{"tag":"OpaqueToken","value":"semantic-empty"}},"predecessors":[]}],"template":"MALFORMED_DENIAL"},{"family":"F1","id":{"tag":"CaseId","value":"C02"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-deny-auth"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C02-G01"},"id":{"tag":"StepId","value":"C02-01"},"kind":"LOGICAL_COMMIT","operation":{"actor":{"tag":"ActorId","value":"actor-deny"},"attempt":{"tag":"AttemptId","value":"att-deny-auth"},"authority":false,"commitment":{"tag":"CommitmentId","value":"commit-deny"},"kind":"DENIAL","outcome":{"attempt":{"tag":"AttemptId","value":"att-deny-auth"},"authority":false,"id":{"tag":"OutcomeId","value":"out-deny-auth"},"request":{"tag":"RequestId","value":"req-deny-auth"},"status":"DENIED"},"reason":"AUTHORITY","request":{"tag":"RequestId","value":"req-deny-auth"},"semantic_digest_after":{"tag":"OpaqueToken","value":"semantic-empty"},"semantic_digest_before":{"tag":"OpaqueToken","value":"semantic-empty"}},"predecessors":[]}],"template":"AUTHORITY_DENIAL"},{"family":"F2","id":{"tag":"CaseId","value":"C03"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-auth"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C03-G01"},"id":{"tag":"StepId","value":"C03-01"},"kind":"LOGICAL_COMMIT","operation":{"activation_id":{"tag":"ActivationId","value":"activation-1"},"actor":{"tag":"ActorId","value":"actor-auth"},"attempt":{"tag":"AttemptId","value":"att-auth"},"audience":{"tag":"AudienceId","value":"audience-1"},"commitment":{"tag":"CommitmentId","value":"commit-auth"},"current_grant":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-expiry"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-auth"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-auth"},"owner":{"tag":"ActorId","value":"actor-auth"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-auth"}},"generation":{"tag":"GenerationId","value":"gen-old"},"grant_id":{"tag":"GrantId","value":"grant-auth"},"invocation_nonce":{"tag":"NonceId","value":"nonce-auth"},"kind":"AUTHORIZE","now":{"tag":"InstantId","value":"now-1"},"outcome":{"attempt":{"tag":"AttemptId","value":"att-auth"},"authority":true,"id":{"tag":"OutcomeId","value":"out-auth"},"request":{"tag":"RequestId","value":"req-auth"},"status":"ALLOW"},"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-auth"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"actor-auth"}},"replay_key":[{"tag":"ActivationId","value":"activation-1"},{"tag":"NonceId","value":"nonce-auth"}],"request":{"tag":"RequestId","value":"req-auth"},"right":{"tag":"RightId","value":"right-1"},"selection_id":{"tag":"SelectionId","value":"selection-1"},"status":"ALLOW","target":{"tag":"TargetId","value":"target-1"},"world":{"tag":"WorldId","value":"world-1"}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"QUERY","group":null,"id":{"tag":"StepId","value":"C03-02"},"kind":"ENV_EVENT","operation":{"attempt":{"tag":"AttemptId","value":"att-auth"},"kind":"QUERY_OUTCOME","outcome":{"tag":"OutcomeId","value":"out-auth"},"request":{"tag":"RequestId","value":"req-auth"},"result":"ALLOW"},"predecessors":[{"tag":"StepId","value":"C03-01"}]},{"branch":"ALWAYS","event_kind":"REINVOKE","group":null,"id":{"tag":"StepId","value":"C03-03"},"kind":"ENV_EVENT","operation":{"activation_id":{"tag":"ActivationId","value":"activation-1"},"actor":{"tag":"ActorId","value":"actor-auth"},"attempt":{"tag":"AttemptId","value":"att-auth"},"audience":{"tag":"AudienceId","value":"audience-1"},"commitment":{"tag":"CommitmentId","value":"commit-auth"},"current_grant":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-expiry"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-auth"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-auth"},"owner":{"tag":"ActorId","value":"actor-auth"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-auth"}},"generation":{"tag":"GenerationId","value":"gen-old"},"grant_id":{"tag":"GrantId","value":"grant-auth"},"invocation_nonce":{"tag":"NonceId","value":"nonce-auth"},"kind":"REINVOKE","now":{"tag":"InstantId","value":"now-1"},"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-auth"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"actor-auth"}},"request":{"tag":"RequestId","value":"req-auth"},"result":"DENY_REPLAY","right":{"tag":"RightId","value":"right-1"},"selection_id":{"tag":"SelectionId","value":"selection-1"},"target":{"tag":"TargetId","value":"target-1"},"world":{"tag":"WorldId","value":"world-1"}},"predecessors":[{"tag":"StepId","value":"C03-01"}]}],"template":"AUTHORIZE_QUERY_REINVOKE"},{"family":"F3","id":{"tag":"CaseId","value":"C04"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-parent"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"sender"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}}],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-move"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C04-G01"},"id":{"tag":"StepId","value":"C04-01"},"kind":"LOGICAL_COMMIT","operation":{"audience":{"tag":"AudienceId","value":"audience-1"},"claim":{"tag":"ClaimId","value":"claim-move"},"current_epoch":{"tag":"EpochId","value":"epoch-1"},"fresh_grant":{"tag":"GrantId","value":"grant-successor"},"issuer":{"tag":"ActorId","value":"issuer"},"kind":"TRANSFER_MOVE","lineage_nonce":[{"tag":"LineageId","value":"lineage-1"},{"tag":"NonceId","value":"nonce-move"}],"mode":"MOVE","nonce":{"tag":"NonceId","value":"nonce-move"},"outcome":{"attempt":{"tag":"AttemptId","value":"att-move"},"authority":true,"id":{"tag":"OutcomeId","value":"out-move"},"request":{"tag":"RequestId","value":"req-move"},"status":"MOVED"},"parent":{"tag":"GrantId","value":"grant-parent"},"parent_after":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-parent"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"sender"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"MOVED","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}},"parent_before":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-parent"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"sender"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}},"recipient":{"tag":"ActorId","value":"recipient"},"sender":{"tag":"ActorId","value":"sender"},"successor":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-successor"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"recipient"},"parents":[{"tag":"GrantId","value":"grant-parent"}],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}},"validation":{"constraint_dimensions":[{"tag":"OpaqueToken","value":"constraint-audience"},{"tag":"OpaqueToken","value":"constraint-depth"},{"tag":"OpaqueToken","value":"constraint-expiry"}],"current_epoch":{"tag":"EpochId","value":"epoch-1"},"delegate":true,"expiry_bound":{"tag":"InstantId","value":"expiry-1"},"freshness_identities":[{"tag":"OpaqueToken","value":"fresh-claim"},{"tag":"OpaqueToken","value":"fresh-grant"},{"tag":"OpaqueToken","value":"fresh-nonce"}],"id":{"tag":"ValidationId","value":"d003-validation-1"},"live":true,"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"sender"}},"rights":[{"tag":"RightId","value":"right-1"}],"state_authority":{"tag":"AuthorityId","value":"d003-state-authority"},"target":{"tag":"TargetId","value":"target-1"},"unrevoked":true,"verdict":"D003_VALIDATED"}},"predecessors":[]}],"template":"TRANSFER_MOVE"},{"family":"F3","id":{"tag":"CaseId","value":"C05"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-parent"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"sender"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}}],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-wrong-audience"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C05-G01"},"id":{"tag":"StepId","value":"C05-01"},"kind":"LOGICAL_COMMIT","operation":{"actor":{"tag":"ActorId","value":"actor-deny"},"attempt":{"tag":"AttemptId","value":"att-wrong-audience"},"authority":false,"commitment":{"tag":"CommitmentId","value":"commit-deny"},"kind":"DENIAL","outcome":{"attempt":{"tag":"AttemptId","value":"att-wrong-audience"},"authority":false,"id":{"tag":"OutcomeId","value":"out-wrong-audience"},"request":{"tag":"RequestId","value":"req-wrong-audience"},"status":"DENIED"},"reason":"AUTHORITY","request":{"tag":"RequestId","value":"req-wrong-audience"},"semantic_digest_after":{"tag":"OpaqueToken","value":"semantic-empty"},"semantic_digest_before":{"tag":"OpaqueToken","value":"semantic-empty"}},"predecessors":[]}],"template":"WRONG_AUDIENCE"},{"family":"F4","id":{"tag":"CaseId","value":"C06"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-revision"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C06-G01"},"id":{"tag":"StepId","value":"C06-01"},"kind":"DURABLE","operation":{"kind":"MATERIALIZE_REVISION","revision":{"actor":{"tag":"ActorId","value":"actor-rev"},"authoritative":false,"causal_inputs":[{"tag":"OpaqueToken","value":"causal-rev"}],"commitment":{"tag":"CommitmentId","value":"commit-rev"},"id":{"tag":"RevisionId","value":"revision-1"},"payload":{"tag":"OpaqueToken","value":"payload-rev"},"predecessor":null}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C06-G02"},"id":{"tag":"StepId","value":"C06-02"},"kind":"LOGICAL_COMMIT","operation":{"binding":{"proposed_delta":{"tag":"OpaqueToken","value":"proposed-world-delta"},"revision":{"tag":"RevisionId","value":"revision-1"},"world":{"tag":"WorldId","value":"world-1"},"writer_verdict":{"tag":"VerdictId","value":"writer-verdict"}},"kind":"PUBLISH_WORLD","outcome":{"attempt":{"tag":"AttemptId","value":"att-revision"},"authority":false,"id":{"tag":"OutcomeId","value":"out-revision"},"request":{"tag":"RequestId","value":"req-revision"},"status":"PUBLISHED"}},"predecessors":[{"tag":"StepId","value":"C06-01"}]}],"template":"REVISION_PUBLISH"},{"family":"F5","id":{"tag":"CaseId","value":"C07"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-revoke"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C07-G01"},"id":{"tag":"StepId","value":"C07-01"},"kind":"LOGICAL_COMMIT","operation":{"fact":{"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"FactId","value":"revocation-1"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"}},"grant":{"tag":"GrantId","value":"grant-parent"},"kind":"REVOKE","outcome":{"attempt":{"tag":"AttemptId","value":"att-revoke"},"authority":false,"id":{"tag":"OutcomeId","value":"out-revoke"},"request":{"tag":"RequestId","value":"req-revoke"},"status":"REVOKED"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"},"validation":{"constraint_dimensions":[{"tag":"OpaqueToken","value":"constraint-audience"},{"tag":"OpaqueToken","value":"constraint-depth"},{"tag":"OpaqueToken","value":"constraint-expiry"}],"current_epoch":{"tag":"EpochId","value":"epoch-1"},"delegate":true,"expiry_bound":{"tag":"InstantId","value":"expiry-1"},"freshness_identities":[{"tag":"OpaqueToken","value":"fresh-claim"},{"tag":"OpaqueToken","value":"fresh-grant"},{"tag":"OpaqueToken","value":"fresh-nonce"}],"id":{"tag":"ValidationId","value":"d003-validation-1"},"live":true,"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"revoker"}},"rights":[{"tag":"RightId","value":"right-1"}],"state_authority":{"tag":"AuthorityId","value":"d003-state-authority"},"target":{"tag":"TargetId","value":"target-1"},"unrevoked":true,"verdict":"D003_VALIDATED"}},"predecessors":[]}],"template":"REVOKE_FIRST"},{"family":"F5","id":{"tag":"CaseId","value":"C08"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[{"attempt":{"tag":"AttemptId","value":"att-revoke"},"authority":false,"id":{"tag":"OutcomeId","value":"out-revoke"},"request":{"tag":"RequestId","value":"req-revoke"},"status":"REVOKED"}],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[{"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"FactId","value":"revocation-1"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"}}],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-revoke-repeat"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C08-G01"},"id":{"tag":"StepId","value":"C08-01"},"kind":"LOGICAL_COMMIT","operation":{"fact":{"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"FactId","value":"revocation-1"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"}},"grant":{"tag":"GrantId","value":"grant-parent"},"kind":"REVOKE","outcome":{"attempt":{"tag":"AttemptId","value":"att-revoke"},"authority":false,"id":{"tag":"OutcomeId","value":"out-revoke"},"request":{"tag":"RequestId","value":"req-revoke"},"status":"REVOKED"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"},"validation":{"constraint_dimensions":[{"tag":"OpaqueToken","value":"constraint-audience"},{"tag":"OpaqueToken","value":"constraint-depth"},{"tag":"OpaqueToken","value":"constraint-expiry"}],"current_epoch":{"tag":"EpochId","value":"epoch-1"},"delegate":true,"expiry_bound":{"tag":"InstantId","value":"expiry-1"},"freshness_identities":[{"tag":"OpaqueToken","value":"fresh-claim"},{"tag":"OpaqueToken","value":"fresh-grant"},{"tag":"OpaqueToken","value":"fresh-nonce"}],"id":{"tag":"ValidationId","value":"d003-validation-1"},"live":true,"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"revoker"}},"rights":[{"tag":"RightId","value":"right-1"}],"state_authority":{"tag":"AuthorityId","value":"d003-state-authority"},"target":{"tag":"TargetId","value":"target-1"},"unrevoked":true,"verdict":"D003_VALIDATED"}},"predecessors":[]}],"template":"REVOKE_IDEMPOTENT"},{"family":"F5","id":{"tag":"CaseId","value":"C09"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-account"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C09-G01"},"id":{"tag":"StepId","value":"C09-01"},"kind":"LOGICAL_COMMIT","operation":{"kind":"ACCOUNT","occurrence":{"actor":{"tag":"ActorId","value":"actor-account"},"commitment":{"tag":"CommitmentId","value":"commit-account"},"id":{"tag":"FactId","value":"account-1"},"token":{"tag":"OpaqueToken","value":"account-token"},"world":{"tag":"WorldId","value":"world-1"}},"outcome":{"attempt":{"tag":"AttemptId","value":"att-account"},"authority":false,"id":{"tag":"OutcomeId","value":"out-account"},"request":{"tag":"RequestId","value":"req-account"},"status":"RECORDED"}},"predecessors":[]}],"template":"ACCOUNTING_OCCURRENCE"},{"family":"F5","id":{"tag":"CaseId","value":"C10"},"initial_state":{"accounting":[{"actor":{"tag":"ActorId","value":"actor-account"},"commitment":{"tag":"CommitmentId","value":"commit-account"},"id":{"tag":"FactId","value":"account-1"},"token":{"tag":"OpaqueToken","value":"account-token"},"world":{"tag":"WorldId","value":"world-1"}}],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[[{"tag":"ActivationId","value":"activation-1"},{"tag":"NonceId","value":"nonce-auth"}]],"revisions":[],"revocations":[{"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"FactId","value":"revocation-1"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"}}],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-restart"},"steps":[{"branch":"ALWAYS","event_kind":"DISCARD","group":null,"id":{"tag":"StepId","value":"C10-01"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C10-G02"},"id":{"tag":"StepId","value":"C10-02"},"kind":"DURABLE","operation":{"kind":"RESTART"},"predecessors":[{"tag":"StepId","value":"C10-01"}]}],"template":"DISCARD_RESTART"},{"family":"F6","id":{"tag":"CaseId","value":"C11"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-promo-success"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G01"},"id":{"tag":"StepId","value":"C11-01"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"REQUESTED","transition":{"tag":"TransitionId","value":"promo-success-requested"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G02"},"id":{"tag":"StepId","value":"C11-02"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"VALIDATED","transition":{"tag":"TransitionId","value":"promo-success-validated"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-01"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G03"},"id":{"tag":"StepId","value":"C11-03"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"ROOT_PREPARED","transition":{"tag":"TransitionId","value":"promo-success-root_prepared"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-02"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G04"},"id":{"tag":"StepId","value":"C11-04"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"ROOT_COMMITTED","transition":{"tag":"TransitionId","value":"promo-success-root_committed"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-03"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G05"},"id":{"tag":"StepId","value":"C11-05"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"BOOT_SELECTED","transition":{"tag":"TransitionId","value":"promo-success-boot_selected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-04"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G06"},"id":{"tag":"StepId","value":"C11-06"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"HEALTH_ACCEPTED","transition":{"tag":"TransitionId","value":"promo-success-health_accepted"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-05"}]}],"template":"PROMOTION_SUCCESS"},{"family":"F6","id":{"tag":"CaseId","value":"C12"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-promo-preboot"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G01"},"id":{"tag":"StepId","value":"C12-01"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"REQUESTED","transition":{"tag":"TransitionId","value":"promo-preboot-requested"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G02"},"id":{"tag":"StepId","value":"C12-02"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"VALIDATED","transition":{"tag":"TransitionId","value":"promo-preboot-validated"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-01"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G03"},"id":{"tag":"StepId","value":"C12-03"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"ROOT_PREPARED","transition":{"tag":"TransitionId","value":"promo-preboot-root_prepared"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-02"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G04"},"id":{"tag":"StepId","value":"C12-04"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"ROOT_COMMITTED","transition":{"tag":"TransitionId","value":"promo-preboot-root_committed"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-03"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G05"},"id":{"tag":"StepId","value":"C12-05"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"ROLLBACK_INTENT","transition":{"tag":"TransitionId","value":"promo-preboot-rollback_intent"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-04"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G06"},"id":{"tag":"StepId","value":"C12-06"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"ROOT_ROLLED_BACK","transition":{"tag":"TransitionId","value":"promo-preboot-root_rolled_back"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-05"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G07"},"id":{"tag":"StepId","value":"C12-07"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"PRIOR_BOOT_RESELECTED","transition":{"tag":"TransitionId","value":"promo-preboot-prior_boot_reselected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-06"}]}],"template":"ROLLBACK_PREBOOT"},{"family":"F6","id":{"tag":"CaseId","value":"C13"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G01"},"id":{"tag":"StepId","value":"C13-01"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"REQUESTED","transition":{"tag":"TransitionId","value":"promo-watchdog-requested"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G02"},"id":{"tag":"StepId","value":"C13-02"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"VALIDATED","transition":{"tag":"TransitionId","value":"promo-watchdog-validated"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-01"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G03"},"id":{"tag":"StepId","value":"C13-03"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"ROOT_PREPARED","transition":{"tag":"TransitionId","value":"promo-watchdog-root_prepared"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-02"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G04"},"id":{"tag":"StepId","value":"C13-04"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"ROOT_COMMITTED","transition":{"tag":"TransitionId","value":"promo-watchdog-root_committed"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-03"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G05"},"id":{"tag":"StepId","value":"C13-05"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"BOOT_SELECTED","transition":{"tag":"TransitionId","value":"promo-watchdog-boot_selected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-04"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G06"},"id":{"tag":"StepId","value":"C13-06"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"ROLLBACK_INTENT","transition":{"tag":"TransitionId","value":"promo-watchdog-rollback_intent"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-05"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G07"},"id":{"tag":"StepId","value":"C13-07"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"ROOT_ROLLED_BACK","transition":{"tag":"TransitionId","value":"promo-watchdog-root_rolled_back"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-06"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G08"},"id":{"tag":"StepId","value":"C13-08"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"PRIOR_BOOT_RESELECTED","transition":{"tag":"TransitionId","value":"promo-watchdog-prior_boot_reselected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-07"}]}],"template":"ROLLBACK_WATCHDOG"},{"family":"F6","id":{"tag":"CaseId","value":"C14"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G01"},"id":{"tag":"StepId","value":"C14-01"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"REQUESTED","transition":{"tag":"TransitionId","value":"promo-posthealth-requested"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G02"},"id":{"tag":"StepId","value":"C14-02"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"VALIDATED","transition":{"tag":"TransitionId","value":"promo-posthealth-validated"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-01"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G03"},"id":{"tag":"StepId","value":"C14-03"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"ROOT_PREPARED","transition":{"tag":"TransitionId","value":"promo-posthealth-root_prepared"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-02"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G04"},"id":{"tag":"StepId","value":"C14-04"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"ROOT_COMMITTED","transition":{"tag":"TransitionId","value":"promo-posthealth-root_committed"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-03"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G05"},"id":{"tag":"StepId","value":"C14-05"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"BOOT_SELECTED","transition":{"tag":"TransitionId","value":"promo-posthealth-boot_selected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-04"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G06"},"id":{"tag":"StepId","value":"C14-06"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"ROLLBACK_INTENT","transition":{"tag":"TransitionId","value":"promo-posthealth-rollback_intent"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-05"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G07"},"id":{"tag":"StepId","value":"C14-07"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"ROOT_ROLLED_BACK","transition":{"tag":"TransitionId","value":"promo-posthealth-root_rolled_back"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-06"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G08"},"id":{"tag":"StepId","value":"C14-08"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"PRIOR_BOOT_RESELECTED","transition":{"tag":"TransitionId","value":"promo-posthealth-prior_boot_reselected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-07"}]}],"template":"ROLLBACK_POSTHEALTH"},{"family":"F7","id":{"tag":"CaseId","value":"C15"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-effect-amb"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C15-G01"},"id":{"tag":"StepId","value":"C15-01"},"kind":"LOGICAL_COMMIT","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-amb"},"request":{"tag":"RequestId","value":"req-effect-amb"},"status":"AUTHORIZED"},"kind":"EFFECT"},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C15-G02"},"id":{"tag":"StepId","value":"C15-02"},"kind":"DURABLE","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-amb"},"request":{"tag":"RequestId","value":"req-effect-amb"},"status":"DISPATCHING"},"kind":"EFFECT"},"predecessors":[{"tag":"StepId","value":"C15-01"}]},{"branch":"ALWAYS","event_kind":"DISPATCH","group":null,"id":{"tag":"StepId","value":"C15-03"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C15-02"}]},{"branch":"NOT_OCCURRED","event_kind":"NOT_OCCURRED","group":null,"id":{"tag":"StepId","value":"C15-04"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C15-03"}]},{"branch":"OCCURRED","event_kind":"OCCURRED","group":null,"id":{"tag":"StepId","value":"C15-05"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C15-03"}]}],"template":"EFFECT_AMBIGUITY"},{"family":"F7","id":{"tag":"CaseId","value":"C16"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-effect-ack"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C16-G01"},"id":{"tag":"StepId","value":"C16-01"},"kind":"LOGICAL_COMMIT","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-ack"},"request":{"tag":"RequestId","value":"req-effect-ack"},"status":"AUTHORIZED"},"kind":"EFFECT"},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C16-G02"},"id":{"tag":"StepId","value":"C16-02"},"kind":"DURABLE","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-ack"},"request":{"tag":"RequestId","value":"req-effect-ack"},"status":"DISPATCHING"},"kind":"EFFECT"},"predecessors":[{"tag":"StepId","value":"C16-01"}]},{"branch":"ALWAYS","event_kind":"DISPATCH","group":null,"id":{"tag":"StepId","value":"C16-03"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C16-02"}]},{"branch":"NOT_OCCURRED","event_kind":"NOT_OCCURRED","group":null,"id":{"tag":"StepId","value":"C16-04"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C16-03"}]},{"branch":"OCCURRED","event_kind":"OCCURRED","group":null,"id":{"tag":"StepId","value":"C16-05"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C16-03"}]},{"branch":"OCCURRED","event_kind":"ACK_RECEIPT","group":null,"id":{"tag":"StepId","value":"C16-06"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C16-05"}]},{"branch":"OCCURRED","event_kind":"NONE","group":{"tag":"GroupId","value":"C16-G07"},"id":{"tag":"StepId","value":"C16-07"},"kind":"ACK_WRITE","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-ack"},"request":{"tag":"RequestId","value":"req-effect-ack"},"status":"ACKNOWLEDGED"},"kind":"EFFECT"},"predecessors":[{"tag":"StepId","value":"C16-06"}]},{"branch":"OCCURRED","event_kind":"NONE","group":{"tag":"GroupId","value":"C16-G08"},"id":{"tag":"StepId","value":"C16-08"},"kind":"LOGICAL_COMMIT","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-ack"},"request":{"tag":"RequestId","value":"req-effect-ack"},"status":"SETTLED"},"kind":"EFFECT"},"predecessors":[{"tag":"StepId","value":"C16-07"}]}],"template":"EFFECT_ACK_SETTLEMENT"}],"coverage":{"assertion_count":12,"case_count":16,"family_count":8,"history_cell_count":73,"recovery_observation_count":1971,"step_count":56,"unknown_cell_count":7},"decision":{"freezable":true,"frozen":false,"id":"D-004","status":"OPEN"},"evidence_dag":{"edges":[{"from":"PACKET","to":"FREEZE"},{"from":"MANIFEST","to":"FREEZE"},{"from":"EXECUTOR_SOURCE","to":"FREEZE"},{"from":"CHECKER_SOURCE","to":"FREEZE"},{"from":"PACKET","to":"EXECUTOR_SOURCE"},{"from":"MANIFEST","to":"EXECUTOR_SOURCE"},{"from":"PACKET","to":"CHECKER_SOURCE"},{"from":"MANIFEST","to":"CHECKER_SOURCE"},{"from":"MANIFEST","to":"O1"},{"from":"PACKET","to":"O1"},{"from":"EXECUTOR_SOURCE","to":"O1"},{"from":"EXECUTOR_SOURCE","to":"I1"},{"from":"MANIFEST","to":"O2"},{"from":"PACKET","to":"O2"},{"from":"CHECKER_SOURCE","to":"O2"},{"from":"CHECKER_SOURCE","to":"I2"},{"from":"FREEZE","to":"V"},{"from":"O1","to":"V"},{"from":"O2","to":"V"},{"from":"I1","to":"V"},{"from":"I2","to":"V"},{"from":"V","to":"E"}],"nodes":[{"id":"PACKET","type":"LOCK"},{"id":"MANIFEST","type":"LOCK"},{"id":"FREEZE","type":"FREEZE_RECORD"},{"id":"EXECUTOR_SOURCE","type":"IDENTITY_INPUT"},{"id":"CHECKER_SOURCE","type":"IDENTITY_INPUT"},{"id":"O1","type":"SEMANTIC_OUTPUT"},{"id":"I1","type":"PRODUCER_IDENTITY"},{"id":"O2","type":"SEMANTIC_OUTPUT"},{"id":"I2","type":"PRODUCER_IDENTITY"},{"id":"V","type":"FINAL_VERIFIER"},{"id":"E","type":"EVIDENCE_REPORT"}]},"families":[{"case_count":2,"id":"F1"},{"case_count":1,"id":"F2"},{"case_count":2,"id":"F3"},{"case_count":1,"id":"F4"},{"case_count":4,"id":"F5"},{"case_count":4,"id":"F6"},{"case_count":2,"id":"F7"},{"case_count":0,"id":"F8"}],"gates":{"C1":"COMPLETE","C2":"COMPLETE","C3":"COMPLETE_PREREGISTRATION_ONLY","current":"OPEN","direct_highs":{"H1":"REPAIRED","H2":"REPAIRED","H3":"REPAIRED","H4":"REPAIRED","H5":"REPAIRED","H6":"REPAIRED"},"future_adopt_if":"VALID_EXTERNAL_FREEZE_AND_V_AND_E","mechanism_ranking":false,"otherwise":"OPEN"},"independence":{"checker_source_root":"future/d004_checker","distinct_sources_commits_roles":true,"executor_source_root":"future/d004_executor","forbidden_imports":["other_producer","d004_manifest","generated_expected","transition_recovery_helpers","assertion_evaluator","O_fixture"],"shared_only":["packet_bytes","manifest_bytes","independently_transcribed_canonical_constants"],"validator_is_producer":false},"o_contract":{"manifest_identity_fields":["kind","sha256","byte_length"],"packet_identity_fields":["kind","sha256","byte_length"],"packet_kind":"PACKET","producer_identity_inside_o":false,"raw_bytes_agreement":"EXACT_CANONICAL_BYTES","schema":"D004-O-1"},"provenance_contract":{"clean_capture":"SUPPLIED_CLOSED_GIT_FACTS_NOT_LIVE_INSPECTION","content_hash":"sha256","current_freeze_record":null,"dependency_roots":["role_source_root","future/d004_common"],"file_modes":{"executable":"FORBIDDEN","regular":"100644","symlink":"FORBIDDEN","tree":"40000"},"freeze_record_fields":["schema","packet_sha256","manifest_sha256","executor_identity_sha256","checker_identity_sha256","commit","tree","frozen_at"],"git_blob_rule":"SHA1(blob SP decimal-length NUL bytes)","git_commit_rule":"STRICT_TREE_PARENTS_AUTHOR_COMMITTER_MESSAGE","git_object_format":"sha1","git_tree_rule":"RECURSIVE_CANONICAL_RAW_NAME_BYTES_DIRECTORY_SUFFIX_SLASH","invalidation":["packet","manifest","schema","semantics","cases","assertions","source","dependency","lock","identity"],"mandatory_locks":["decisions/D-004-PACKET.md","decisions/d004-crash-manifest-v1.json"],"producer_schema":"D004-PRODUCER-IDENTITY-2","python":{"implementation":"CPython","stdlib_allowlist":["ast","collections","dataclasses","hashlib","itertools","json","pathlib","re","sys","typing","unicodedata"],"version":"3.11"},"source_roots":{"CHECKER":"future/d004_checker","EXECUTOR":"future/d004_executor"},"tracked_closure":"EXACT_SOURCE_DEPENDENCY_LOCK_UNION"},"recovery_axes":{"crashes":["NONE","BEFORE_EACH_COMMIT","AFTER_EACH_COMMIT"],"modes":["OBSERVE","STALE_REPLAY","RECOVERY_CYCLES"],"outages":["NONE","MODEL","NETWORK"]},"schema":"D004-MANIFEST-1","schemas":{"AccountingOccurrence":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"token","schema":{"kind":"ref","name":"Id"}},{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},"Case":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"family","schema":{"kind":"enum","values":["F1","F2","F3","F4","F5","F6","F7"]}},{"name":"template","schema":{"kind":"primitive","name":"string"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"initial_state","schema":{"kind":"ref","name":"State"}},{"name":"steps","schema":{"items":{"kind":"ref","name":"Step"},"kind":"array"}}],"kind":"record"},"D003Validation":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"verdict","schema":{"kind":"literal","value":"D003_VALIDATED"}},{"name":"presentation","schema":{"kind":"ref","name":"GrantPresentation"}},{"name":"state_authority","schema":{"kind":"ref","name":"Id"}},{"name":"current_epoch","schema":{"kind":"ref","name":"Id"}},{"name":"unrevoked","schema":{"kind":"literal","value":true}},{"name":"live","schema":{"kind":"literal","value":true}},{"name":"delegate","schema":{"kind":"literal","value":true}},{"name":"target","schema":{"kind":"ref","name":"Id"}},{"name":"rights","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"constraint_dimensions","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"expiry_bound","schema":{"kind":"ref","name":"Id"}},{"name":"freshness_identities","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}}],"kind":"record"},"DurableImage":{"fields":[{"name":"state","schema":{"kind":"ref","name":"State"}},{"name":"durable_events","schema":{"items":{"kind":"ref","name":"Id"},"kind":"array"}}],"kind":"record"},"Effect":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"status","schema":{"kind":"enum","values":["AUTHORIZED","DISPATCHING","ACKNOWLEDGED","SETTLED"]}}],"kind":"record"},"Grant":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"issuer","schema":{"kind":"ref","name":"Id"}},{"name":"epoch","schema":{"kind":"ref","name":"Id"}},{"name":"target","schema":{"kind":"ref","name":"Id"}},{"name":"rights","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"constraints","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"parents","schema":{"items":{"kind":"ref","name":"Id"},"kind":"array"}},{"name":"lineage","schema":{"kind":"ref","name":"Id"}},{"name":"owner","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}},{"name":"witness","schema":{"kind":"ref","name":"Id"}},{"name":"status","schema":{"kind":"enum","values":["LIVE","MOVED"]}}],"kind":"record"},"GrantPresentation":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"grant","schema":{"kind":"ref","name":"Id"}},{"name":"authenticity_ref","schema":{"kind":"ref","name":"Id"}},{"name":"presenter","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},"HistoryCell":{"fields":[{"name":"key","schema":{"items":[{"kind":"ref","name":"Id"},{"items":{"kind":"ref","name":"Id"},"kind":"array"}],"kind":"tuple"}},{"name":"case","schema":{"kind":"ref","name":"Id"}},{"name":"included_steps","schema":{"items":{"kind":"ref","name":"Id"},"kind":"array"}},{"name":"image","schema":{"kind":"ref","name":"DurableImage"}},{"name":"event_mark","schema":{"kind":"enum","values":["UNRESOLVED","NOT_OCCURRED","OCCURRED"]}},{"name":"classification","schema":{"kind":"enum","values":["NOT_COMMITTED","COMMITTED","UNKNOWN_EXTERNAL"]}},{"name":"action","schema":{"kind":"enum","values":["RETRY_SAFE","NO_RETRY_QUERY_RESULT","RECONCILE_ONLY"]}}],"kind":"record"},"Id":{"fields":[{"name":"tag","schema":{"kind":"enum","values":["ActivationId","ActorId","AttemptId","AudienceId","AuthorityId","CaseId","ClaimId","CommitmentId","EffectId","EpochId","FactId","GenerationId","GrantId","GroupId","InstantId","LineageId","NonceId","OpaqueToken","OutcomeId","PresentationId","ReasonId","RequestId","RevisionId","RightId","RootId","SelectionId","SlotId","StepId","TargetId","TransitionId","ValidationId","VerdictId","WitnessId","WorldId"]}},{"name":"value","schema":{"kind":"primitive","name":"string"}}],"kind":"record"},"Operation":{"kind":"union","variants":[{"fields":[{"name":"kind","schema":{"kind":"literal","value":"DENIAL"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"reason","schema":{"kind":"enum","values":["MALFORMED","AUTHORITY"]}},{"name":"semantic_digest_before","schema":{"kind":"ref","name":"Id"}},{"name":"semantic_digest_after","schema":{"kind":"ref","name":"Id"}},{"name":"authority","schema":{"kind":"literal","value":false}},{"name":"outcome","schema":{"kind":"union","variants":[{"kind":"ref","name":"Outcome"},{"kind":"primitive","name":"null"}]}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"AUTHORIZE"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"activation_id","schema":{"kind":"ref","name":"Id"}},{"name":"selection_id","schema":{"kind":"ref","name":"Id"}},{"name":"grant_id","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"generation","schema":{"kind":"ref","name":"Id"}},{"name":"target","schema":{"kind":"ref","name":"Id"}},{"name":"right","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}},{"name":"now","schema":{"kind":"ref","name":"Id"}},{"name":"invocation_nonce","schema":{"kind":"ref","name":"Id"}},{"name":"presentation","schema":{"kind":"ref","name":"GrantPresentation"}},{"name":"current_grant","schema":{"kind":"ref","name":"Grant"}},{"name":"status","schema":{"kind":"literal","value":"ALLOW"}},{"name":"replay_key","schema":{"items":[{"kind":"ref","name":"Id"},{"kind":"ref","name":"Id"}],"kind":"tuple"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"QUERY_OUTCOME"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"result","schema":{"kind":"literal","value":"ALLOW"}},{"name":"outcome","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"REINVOKE"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"activation_id","schema":{"kind":"ref","name":"Id"}},{"name":"selection_id","schema":{"kind":"ref","name":"Id"}},{"name":"grant_id","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"generation","schema":{"kind":"ref","name":"Id"}},{"name":"target","schema":{"kind":"ref","name":"Id"}},{"name":"right","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}},{"name":"now","schema":{"kind":"ref","name":"Id"}},{"name":"invocation_nonce","schema":{"kind":"ref","name":"Id"}},{"name":"presentation","schema":{"kind":"ref","name":"GrantPresentation"}},{"name":"current_grant","schema":{"kind":"ref","name":"Grant"}},{"name":"result","schema":{"kind":"literal","value":"DENY_REPLAY"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"TRANSFER_MOVE"}},{"name":"parent","schema":{"kind":"ref","name":"Id"}},{"name":"sender","schema":{"kind":"ref","name":"Id"}},{"name":"recipient","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}},{"name":"mode","schema":{"kind":"literal","value":"MOVE"}},{"name":"nonce","schema":{"kind":"ref","name":"Id"}},{"name":"fresh_grant","schema":{"kind":"ref","name":"Id"}},{"name":"claim","schema":{"kind":"ref","name":"Id"}},{"name":"validation","schema":{"kind":"ref","name":"D003Validation"}},{"name":"issuer","schema":{"kind":"ref","name":"Id"}},{"name":"current_epoch","schema":{"kind":"ref","name":"Id"}},{"name":"parent_before","schema":{"kind":"ref","name":"Grant"}},{"name":"parent_after","schema":{"kind":"ref","name":"Grant"}},{"name":"successor","schema":{"kind":"ref","name":"Grant"}},{"name":"lineage_nonce","schema":{"items":[{"kind":"ref","name":"Id"},{"kind":"ref","name":"Id"}],"kind":"tuple"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"MATERIALIZE_REVISION"}},{"name":"revision","schema":{"kind":"ref","name":"Revision"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"PUBLISH_WORLD"}},{"name":"binding","schema":{"kind":"ref","name":"WorldBinding"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"REVOKE"}},{"name":"grant","schema":{"kind":"ref","name":"Id"}},{"name":"revoker","schema":{"kind":"ref","name":"Id"}},{"name":"reason","schema":{"kind":"ref","name":"Id"}},{"name":"validation","schema":{"kind":"ref","name":"D003Validation"}},{"name":"fact","schema":{"kind":"ref","name":"RevocationFact"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"ACCOUNT"}},{"name":"occurrence","schema":{"kind":"ref","name":"AccountingOccurrence"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"PROMOTION"}},{"name":"promotion","schema":{"kind":"ref","name":"Promotion"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"EFFECT"}},{"name":"effect","schema":{"kind":"ref","name":"Effect"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"UNCERTAINTY"}},{"name":"uncertainty","schema":{"kind":"ref","name":"Uncertainty"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"NOOP"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"RESTART"}}],"kind":"record"}]},"Outcome":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"status","schema":{"kind":"enum","values":["ALLOW","DENIED","MOVED","REVOKED","RECORDED","PUBLISHED","PROMOTED","ROLLED_BACK","SETTLED"]}},{"name":"authority","schema":{"kind":"primitive","name":"bool"}}],"kind":"record"},"Promotion":{"fields":[{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"generation","schema":{"kind":"ref","name":"Id"}},{"name":"parent_generation","schema":{"kind":"ref","name":"Id"}},{"name":"old_root","schema":{"kind":"ref","name":"Id"}},{"name":"candidate_root","schema":{"kind":"ref","name":"Id"}},{"name":"candidate_slot","schema":{"kind":"ref","name":"Id"}},{"name":"prior_slot","schema":{"kind":"ref","name":"Id"}},{"name":"prior_known_good","schema":{"kind":"ref","name":"Id"}},{"name":"prior_status","schema":{"kind":"literal","value":"KNOWN_GOOD"}},{"name":"evidence_verdict","schema":{"kind":"ref","name":"Id"}},{"name":"health_verdict","schema":{"kind":"ref","name":"Id"}},{"name":"recovery_authority","schema":{"kind":"ref","name":"Id"}},{"name":"cause","schema":{"kind":"enum","values":["NONE","PREBOOT_FAILURE","WATCHDOG_RESET","POSTHEALTH_REJECTION"]}},{"name":"stage","schema":{"kind":"enum","values":["REQUESTED","VALIDATED","ROOT_PREPARED","ROOT_COMMITTED","BOOT_SELECTED","HEALTH_ACCEPTED","ROLLBACK_INTENT","ROOT_ROLLED_BACK","PRIOR_BOOT_RESELECTED"]}},{"name":"transition","schema":{"kind":"ref","name":"Id"}},{"name":"outcome","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},"RecoveryContext":{"fields":[{"name":"case","schema":{"kind":"ref","name":"Id"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"image","schema":{"kind":"ref","name":"DurableImage"}},{"name":"classification","schema":{"kind":"enum","values":["NOT_COMMITTED","COMMITTED","UNKNOWN_EXTERNAL"]}},{"name":"action","schema":{"kind":"enum","values":["RETRY_SAFE","NO_RETRY_QUERY_RESULT","RECONCILE_ONLY"]}}],"kind":"record"},"RecoveryInput":{"fields":[{"name":"cell_key","schema":{"items":[{"kind":"ref","name":"Id"},{"items":{"kind":"ref","name":"Id"},"kind":"array"}],"kind":"tuple"}},{"name":"context","schema":{"kind":"ref","name":"RecoveryContext"}},{"name":"mode","schema":{"kind":"enum","values":["OBSERVE","STALE_REPLAY","RECOVERY_CYCLES"]}},{"name":"crash","schema":{"kind":"enum","values":["NONE","BEFORE_EACH_COMMIT","AFTER_EACH_COMMIT"]}},{"name":"outage","schema":{"kind":"enum","values":["NONE","MODEL","NETWORK"]}}],"kind":"record"},"RecoveryResult":{"fields":[{"name":"image","schema":{"kind":"ref","name":"DurableImage"}},{"name":"operations","schema":{"items":{"kind":"ref","name":"Operation"},"kind":"array"}},{"name":"committed_cycles","schema":{"kind":"primitive","name":"string"}},{"name":"stable","schema":{"kind":"primitive","name":"bool"}},{"name":"classification","schema":{"kind":"enum","values":["NOT_COMMITTED","COMMITTED","UNKNOWN_EXTERNAL"]}},{"name":"action","schema":{"kind":"enum","values":["RETRY_SAFE","NO_RETRY_QUERY_RESULT","RECONCILE_ONLY"]}}],"kind":"record"},"Revision":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"predecessor","schema":{"kind":"union","variants":[{"kind":"ref","name":"Id"},{"kind":"primitive","name":"null"}]}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"causal_inputs","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"payload","schema":{"kind":"ref","name":"Id"}},{"name":"authoritative","schema":{"kind":"literal","value":false}}],"kind":"record"},"RevocationFact":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"grant","schema":{"kind":"ref","name":"Id"}},{"name":"revoker","schema":{"kind":"ref","name":"Id"}},{"name":"reason","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},"State":{"fields":[{"name":"canonical_root","schema":{"kind":"ref","name":"Id"}},{"name":"generation","schema":{"kind":"ref","name":"Id"}},{"name":"known_good","schema":{"kind":"ref","name":"Id"}},{"name":"world_bindings","schema":{"items":{"kind":"ref","name":"WorldBinding"},"kind":"array"}},{"name":"replay_keys","schema":{"items":{"items":[{"kind":"ref","name":"Id"},{"kind":"ref","name":"Id"}],"kind":"tuple"},"kind":"set"}},{"name":"outcomes","schema":{"items":{"kind":"ref","name":"Outcome"},"kind":"array"}},{"name":"grants","schema":{"items":{"kind":"ref","name":"Grant"},"kind":"array"}},{"name":"lineage_nonces","schema":{"items":{"items":[{"kind":"ref","name":"Id"},{"kind":"ref","name":"Id"}],"kind":"tuple"},"kind":"set"}},{"name":"claims","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"revisions","schema":{"items":{"kind":"ref","name":"Revision"},"kind":"array"}},{"name":"revocations","schema":{"items":{"kind":"ref","name":"RevocationFact"},"kind":"array"}},{"name":"accounting","schema":{"items":{"kind":"ref","name":"AccountingOccurrence"},"kind":"array"}},{"name":"promotions","schema":{"items":{"kind":"ref","name":"Promotion"},"kind":"array"}},{"name":"effects","schema":{"items":{"kind":"ref","name":"Effect"},"kind":"array"}},{"name":"uncertainties","schema":{"items":{"kind":"ref","name":"Uncertainty"},"kind":"array"}}],"kind":"record"},"Step":{"kind":"union","variants":[{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"kind","schema":{"kind":"enum","values":["DURABLE","LOGICAL_COMMIT","ROOT_SWITCH","ACK_WRITE"]}},{"name":"predecessors","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"branch","schema":{"kind":"enum","values":["ALWAYS","NOT_OCCURRED","OCCURRED"]}},{"name":"group","schema":{"kind":"ref","name":"Id"}},{"name":"event_kind","schema":{"kind":"literal","value":"NONE"}},{"name":"operation","schema":{"kind":"ref","name":"Operation"}}],"kind":"record"},{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"kind","schema":{"kind":"literal","value":"ENV_EVENT"}},{"name":"predecessors","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"branch","schema":{"kind":"enum","values":["ALWAYS","NOT_OCCURRED","OCCURRED"]}},{"name":"group","schema":{"kind":"primitive","name":"null"}},{"name":"event_kind","schema":{"kind":"enum","values":["DISPATCH","NOT_OCCURRED","OCCURRED","ACK_RECEIPT","RESPONSE","QUERY","REINVOKE","DISCARD","RESTART"]}},{"name":"operation","schema":{"kind":"ref","name":"Operation"}}],"kind":"record"}]},"Uncertainty":{"fields":[{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"status","schema":{"kind":"literal","value":"UNKNOWN_EXTERNAL"}},{"name":"redispatch_forbidden","schema":{"kind":"literal","value":true}}],"kind":"record"},"WorldBinding":{"fields":[{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"revision","schema":{"kind":"ref","name":"Id"}},{"name":"writer_verdict","schema":{"kind":"ref","name":"Id"}},{"name":"proposed_delta","schema":{"kind":"ref","name":"Id"}}],"kind":"record"}},"stage":"PREREGISTERED"}
+{"artifact_kind":"PREREGISTRATION_ONLY","assertions":[{"equality":"EXACT_VALUE_AND_SHA256","expected_count":73,"id":"A01-HISTORY","operator":"HISTORY_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_cases","source_refs":["cases","predecessors","branches"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":46,"id":"A02-TRANSITIONS","operator":"TRANSITIONS_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_durable_steps","source_refs":["cases","operations","durable_cuts"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":73,"id":"A03-CLASSIFICATION","operator":"CLASSIFICATION_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_history_cells","source_refs":["durable_images","compatible_completions"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":7,"id":"A04-UNKNOWN-IFF","operator":"UNKNOWN_EQUIVALENCE_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"unknown_cells","source_refs":["dispatch","completion_sets","no_redispatch"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":2,"id":"A05-QUERY-REINVOKE","operator":"QUERY_REINVOKE_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"C03","source_refs":["authorize","query","reinvoke"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":10,"id":"A06-F1-F5","operator":"F1_F5_INVARIANTS_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"C01:C10","source_refs":["F1","F2","F3","F4","F5"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":4,"id":"A07-PROMOTION","operator":"PROMOTION_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"C11:C14","source_refs":["F6","B1-13","B1-14"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":1971,"id":"A08-RECOVERIES","operator":"RECOVERY_COLLECTION_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_recovery_observations","source_refs":["F8","history_cells","axes"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":1971,"id":"A09-METAMORPHIC","operator":"RECOVERY_METAMORPHIC_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_recovery_observations","source_refs":["stale_replay","cycles","crash","outage"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":56,"id":"A10-CAUSAL-GUARDS","operator":"CAUSAL_GUARDS_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_steps","source_refs":["predecessors","branches","event_guards"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":2044,"id":"A11-SCHEMA-CELLS","operator":"SCHEMA_CONFORMANCE_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"all_derived_values","source_refs":["schemas","history_cells","recovery_results"]},{"equality":"EXACT_VALUE_AND_SHA256","expected_count":7,"id":"A12-COVERAGE","operator":"COVERAGE_EXACT","order":"CANONICAL_KEY_ASCENDING","quantifier":"FOR_ALL_ORDERED","selector":"coverage","source_refs":["families","cases","steps","cells","unknown","recoveries","assertions"]}],"cases":[{"family":"F1","id":{"tag":"CaseId","value":"C01"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-deny-mal"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C01-G01"},"id":{"tag":"StepId","value":"C01-01"},"kind":"DURABLE","operation":{"actor":{"tag":"ActorId","value":"actor-deny"},"attempt":{"tag":"AttemptId","value":"att-deny-mal"},"authority":false,"commitment":{"tag":"CommitmentId","value":"commit-deny"},"kind":"DENIAL","outcome":null,"reason":"MALFORMED","request":{"tag":"RequestId","value":"req-deny-mal"},"semantic_digest_after":{"tag":"OpaqueToken","value":"semantic-empty"},"semantic_digest_before":{"tag":"OpaqueToken","value":"semantic-empty"}},"predecessors":[]}],"template":"MALFORMED_DENIAL"},{"family":"F1","id":{"tag":"CaseId","value":"C02"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-deny-auth"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C02-G01"},"id":{"tag":"StepId","value":"C02-01"},"kind":"LOGICAL_COMMIT","operation":{"actor":{"tag":"ActorId","value":"actor-deny"},"attempt":{"tag":"AttemptId","value":"att-deny-auth"},"authority":false,"commitment":{"tag":"CommitmentId","value":"commit-deny"},"kind":"DENIAL","outcome":{"attempt":{"tag":"AttemptId","value":"att-deny-auth"},"authority":false,"id":{"tag":"OutcomeId","value":"out-deny-auth"},"request":{"tag":"RequestId","value":"req-deny-auth"},"status":"DENIED"},"reason":"AUTHORITY","request":{"tag":"RequestId","value":"req-deny-auth"},"semantic_digest_after":{"tag":"OpaqueToken","value":"semantic-empty"},"semantic_digest_before":{"tag":"OpaqueToken","value":"semantic-empty"}},"predecessors":[]}],"template":"AUTHORITY_DENIAL"},{"family":"F2","id":{"tag":"CaseId","value":"C03"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-auth"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C03-G01"},"id":{"tag":"StepId","value":"C03-01"},"kind":"LOGICAL_COMMIT","operation":{"activation_id":{"tag":"ActivationId","value":"activation-1"},"actor":{"tag":"ActorId","value":"actor-auth"},"attempt":{"tag":"AttemptId","value":"att-auth"},"audience":{"tag":"AudienceId","value":"audience-1"},"commitment":{"tag":"CommitmentId","value":"commit-auth"},"current_grant":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-expiry"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-auth"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-auth"},"owner":{"tag":"ActorId","value":"actor-auth"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-auth"}},"generation":{"tag":"GenerationId","value":"gen-old"},"grant_id":{"tag":"GrantId","value":"grant-auth"},"invocation_nonce":{"tag":"NonceId","value":"nonce-auth"},"kind":"AUTHORIZE","now":{"tag":"InstantId","value":"now-1"},"outcome":{"attempt":{"tag":"AttemptId","value":"att-auth"},"authority":true,"id":{"tag":"OutcomeId","value":"out-auth"},"request":{"tag":"RequestId","value":"req-auth"},"status":"ALLOW"},"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-auth"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"actor-auth"}},"replay_key":[{"tag":"ActivationId","value":"activation-1"},{"tag":"NonceId","value":"nonce-auth"}],"request":{"tag":"RequestId","value":"req-auth"},"right":{"tag":"RightId","value":"right-1"},"selection_id":{"tag":"SelectionId","value":"selection-1"},"status":"ALLOW","target":{"tag":"TargetId","value":"target-1"},"world":{"tag":"WorldId","value":"world-1"}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"QUERY","group":null,"id":{"tag":"StepId","value":"C03-02"},"kind":"ENV_EVENT","operation":{"attempt":{"tag":"AttemptId","value":"att-auth"},"kind":"QUERY_OUTCOME","outcome":{"tag":"OutcomeId","value":"out-auth"},"request":{"tag":"RequestId","value":"req-auth"},"result":"ALLOW"},"predecessors":[{"tag":"StepId","value":"C03-01"}]},{"branch":"ALWAYS","event_kind":"REINVOKE","group":null,"id":{"tag":"StepId","value":"C03-03"},"kind":"ENV_EVENT","operation":{"activation_id":{"tag":"ActivationId","value":"activation-1"},"actor":{"tag":"ActorId","value":"actor-auth"},"attempt":{"tag":"AttemptId","value":"att-auth"},"audience":{"tag":"AudienceId","value":"audience-1"},"commitment":{"tag":"CommitmentId","value":"commit-auth"},"current_grant":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-expiry"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-auth"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-auth"},"owner":{"tag":"ActorId","value":"actor-auth"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-auth"}},"generation":{"tag":"GenerationId","value":"gen-old"},"grant_id":{"tag":"GrantId","value":"grant-auth"},"invocation_nonce":{"tag":"NonceId","value":"nonce-auth"},"kind":"REINVOKE","now":{"tag":"InstantId","value":"now-1"},"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-auth"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"actor-auth"}},"request":{"tag":"RequestId","value":"req-auth"},"result":"DENY_REPLAY","right":{"tag":"RightId","value":"right-1"},"selection_id":{"tag":"SelectionId","value":"selection-1"},"target":{"tag":"TargetId","value":"target-1"},"world":{"tag":"WorldId","value":"world-1"}},"predecessors":[{"tag":"StepId","value":"C03-01"}]}],"template":"AUTHORIZE_QUERY_REINVOKE"},{"family":"F3","id":{"tag":"CaseId","value":"C04"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-parent"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"sender"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}}],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-move"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C04-G01"},"id":{"tag":"StepId","value":"C04-01"},"kind":"LOGICAL_COMMIT","operation":{"audience":{"tag":"AudienceId","value":"audience-1"},"claim":{"tag":"ClaimId","value":"claim-move"},"current_epoch":{"tag":"EpochId","value":"epoch-1"},"fresh_grant":{"tag":"GrantId","value":"grant-successor"},"issuer":{"tag":"ActorId","value":"issuer"},"kind":"TRANSFER_MOVE","lineage_nonce":[{"tag":"LineageId","value":"lineage-1"},{"tag":"NonceId","value":"nonce-move"}],"mode":"MOVE","nonce":{"tag":"NonceId","value":"nonce-move"},"outcome":{"attempt":{"tag":"AttemptId","value":"att-move"},"authority":true,"id":{"tag":"OutcomeId","value":"out-move"},"request":{"tag":"RequestId","value":"req-move"},"status":"MOVED"},"parent":{"tag":"GrantId","value":"grant-parent"},"parent_after":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-parent"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"sender"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"MOVED","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}},"parent_before":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-parent"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"sender"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}},"recipient":{"tag":"ActorId","value":"recipient"},"sender":{"tag":"ActorId","value":"sender"},"successor":{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-successor"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"recipient"},"parents":[{"tag":"GrantId","value":"grant-parent"}],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}},"validation":{"constraint_dimensions":[{"tag":"OpaqueToken","value":"constraint-audience"},{"tag":"OpaqueToken","value":"constraint-depth"},{"tag":"OpaqueToken","value":"constraint-expiry"}],"current_epoch":{"tag":"EpochId","value":"epoch-1"},"delegate":true,"expiry_bound":{"tag":"InstantId","value":"expiry-1"},"freshness_identities":[{"tag":"OpaqueToken","value":"fresh-claim"},{"tag":"OpaqueToken","value":"fresh-grant"},{"tag":"OpaqueToken","value":"fresh-nonce"}],"id":{"tag":"ValidationId","value":"d003-validation-1"},"live":true,"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"sender"}},"rights":[{"tag":"RightId","value":"right-1"}],"state_authority":{"tag":"AuthorityId","value":"d003-state-authority"},"target":{"tag":"TargetId","value":"target-1"},"unrevoked":true,"verdict":"D003_VALIDATED"}},"predecessors":[]}],"template":"TRANSFER_MOVE"},{"family":"F3","id":{"tag":"CaseId","value":"C05"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[{"audience":{"tag":"AudienceId","value":"audience-1"},"constraints":[{"tag":"OpaqueToken","value":"constraint-1"}],"epoch":{"tag":"EpochId","value":"epoch-1"},"id":{"tag":"GrantId","value":"grant-parent"},"issuer":{"tag":"ActorId","value":"issuer"},"lineage":{"tag":"LineageId","value":"lineage-1"},"owner":{"tag":"ActorId","value":"sender"},"parents":[],"rights":[{"tag":"RightId","value":"right-1"}],"status":"LIVE","target":{"tag":"TargetId","value":"target-1"},"witness":{"tag":"WitnessId","value":"witness-1"}}],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-wrong-audience"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C05-G01"},"id":{"tag":"StepId","value":"C05-01"},"kind":"LOGICAL_COMMIT","operation":{"actor":{"tag":"ActorId","value":"actor-deny"},"attempt":{"tag":"AttemptId","value":"att-wrong-audience"},"authority":false,"commitment":{"tag":"CommitmentId","value":"commit-deny"},"kind":"DENIAL","outcome":{"attempt":{"tag":"AttemptId","value":"att-wrong-audience"},"authority":false,"id":{"tag":"OutcomeId","value":"out-wrong-audience"},"request":{"tag":"RequestId","value":"req-wrong-audience"},"status":"DENIED"},"reason":"AUTHORITY","request":{"tag":"RequestId","value":"req-wrong-audience"},"semantic_digest_after":{"tag":"OpaqueToken","value":"semantic-empty"},"semantic_digest_before":{"tag":"OpaqueToken","value":"semantic-empty"}},"predecessors":[]}],"template":"WRONG_AUDIENCE"},{"family":"F4","id":{"tag":"CaseId","value":"C06"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-revision"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C06-G01"},"id":{"tag":"StepId","value":"C06-01"},"kind":"DURABLE","operation":{"kind":"MATERIALIZE_REVISION","revision":{"actor":{"tag":"ActorId","value":"actor-rev"},"authoritative":false,"causal_inputs":[{"tag":"OpaqueToken","value":"causal-rev"}],"commitment":{"tag":"CommitmentId","value":"commit-rev"},"id":{"tag":"RevisionId","value":"revision-1"},"payload":{"tag":"OpaqueToken","value":"payload-rev"},"predecessor":null}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C06-G02"},"id":{"tag":"StepId","value":"C06-02"},"kind":"LOGICAL_COMMIT","operation":{"binding":{"proposed_delta":{"tag":"OpaqueToken","value":"proposed-world-delta"},"revision":{"tag":"RevisionId","value":"revision-1"},"world":{"tag":"WorldId","value":"world-1"},"writer_verdict":{"tag":"VerdictId","value":"writer-verdict"}},"kind":"PUBLISH_WORLD","outcome":{"attempt":{"tag":"AttemptId","value":"att-revision"},"authority":false,"id":{"tag":"OutcomeId","value":"out-revision"},"request":{"tag":"RequestId","value":"req-revision"},"status":"PUBLISHED"}},"predecessors":[{"tag":"StepId","value":"C06-01"}]}],"template":"REVISION_PUBLISH"},{"family":"F5","id":{"tag":"CaseId","value":"C07"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-revoke"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C07-G01"},"id":{"tag":"StepId","value":"C07-01"},"kind":"LOGICAL_COMMIT","operation":{"fact":{"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"FactId","value":"revocation-1"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"}},"grant":{"tag":"GrantId","value":"grant-parent"},"kind":"REVOKE","outcome":{"attempt":{"tag":"AttemptId","value":"att-revoke"},"authority":false,"id":{"tag":"OutcomeId","value":"out-revoke"},"request":{"tag":"RequestId","value":"req-revoke"},"status":"REVOKED"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"},"validation":{"constraint_dimensions":[{"tag":"OpaqueToken","value":"constraint-audience"},{"tag":"OpaqueToken","value":"constraint-depth"},{"tag":"OpaqueToken","value":"constraint-expiry"}],"current_epoch":{"tag":"EpochId","value":"epoch-1"},"delegate":true,"expiry_bound":{"tag":"InstantId","value":"expiry-1"},"freshness_identities":[{"tag":"OpaqueToken","value":"fresh-claim"},{"tag":"OpaqueToken","value":"fresh-grant"},{"tag":"OpaqueToken","value":"fresh-nonce"}],"id":{"tag":"ValidationId","value":"d003-validation-1"},"live":true,"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"revoker"}},"rights":[{"tag":"RightId","value":"right-1"}],"state_authority":{"tag":"AuthorityId","value":"d003-state-authority"},"target":{"tag":"TargetId","value":"target-1"},"unrevoked":true,"verdict":"D003_VALIDATED"}},"predecessors":[]}],"template":"REVOKE_FIRST"},{"family":"F5","id":{"tag":"CaseId","value":"C08"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[{"attempt":{"tag":"AttemptId","value":"att-revoke"},"authority":false,"id":{"tag":"OutcomeId","value":"out-revoke"},"request":{"tag":"RequestId","value":"req-revoke"},"status":"REVOKED"}],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[{"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"FactId","value":"revocation-1"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"}}],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-revoke-repeat"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C08-G01"},"id":{"tag":"StepId","value":"C08-01"},"kind":"LOGICAL_COMMIT","operation":{"fact":{"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"FactId","value":"revocation-1"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"}},"grant":{"tag":"GrantId","value":"grant-parent"},"kind":"REVOKE","outcome":{"attempt":{"tag":"AttemptId","value":"att-revoke"},"authority":false,"id":{"tag":"OutcomeId","value":"out-revoke"},"request":{"tag":"RequestId","value":"req-revoke"},"status":"REVOKED"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"},"validation":{"constraint_dimensions":[{"tag":"OpaqueToken","value":"constraint-audience"},{"tag":"OpaqueToken","value":"constraint-depth"},{"tag":"OpaqueToken","value":"constraint-expiry"}],"current_epoch":{"tag":"EpochId","value":"epoch-1"},"delegate":true,"expiry_bound":{"tag":"InstantId","value":"expiry-1"},"freshness_identities":[{"tag":"OpaqueToken","value":"fresh-claim"},{"tag":"OpaqueToken","value":"fresh-grant"},{"tag":"OpaqueToken","value":"fresh-nonce"}],"id":{"tag":"ValidationId","value":"d003-validation-1"},"live":true,"presentation":{"audience":{"tag":"AudienceId","value":"audience-1"},"authenticity_ref":{"tag":"OpaqueToken","value":"authenticity-1"},"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"PresentationId","value":"presentation-1"},"presenter":{"tag":"ActorId","value":"revoker"}},"rights":[{"tag":"RightId","value":"right-1"}],"state_authority":{"tag":"AuthorityId","value":"d003-state-authority"},"target":{"tag":"TargetId","value":"target-1"},"unrevoked":true,"verdict":"D003_VALIDATED"}},"predecessors":[]}],"template":"REVOKE_IDEMPOTENT"},{"family":"F5","id":{"tag":"CaseId","value":"C09"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-account"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C09-G01"},"id":{"tag":"StepId","value":"C09-01"},"kind":"LOGICAL_COMMIT","operation":{"kind":"ACCOUNT","occurrence":{"actor":{"tag":"ActorId","value":"actor-account"},"commitment":{"tag":"CommitmentId","value":"commit-account"},"id":{"tag":"FactId","value":"account-1"},"token":{"tag":"OpaqueToken","value":"account-token"},"world":{"tag":"WorldId","value":"world-1"}},"outcome":{"attempt":{"tag":"AttemptId","value":"att-account"},"authority":false,"id":{"tag":"OutcomeId","value":"out-account"},"request":{"tag":"RequestId","value":"req-account"},"status":"RECORDED"}},"predecessors":[]}],"template":"ACCOUNTING_OCCURRENCE"},{"family":"F5","id":{"tag":"CaseId","value":"C10"},"initial_state":{"accounting":[{"actor":{"tag":"ActorId","value":"actor-account"},"commitment":{"tag":"CommitmentId","value":"commit-account"},"id":{"tag":"FactId","value":"account-1"},"token":{"tag":"OpaqueToken","value":"account-token"},"world":{"tag":"WorldId","value":"world-1"}}],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[[{"tag":"ActivationId","value":"activation-1"},{"tag":"NonceId","value":"nonce-auth"}]],"revisions":[],"revocations":[{"grant":{"tag":"GrantId","value":"grant-parent"},"id":{"tag":"FactId","value":"revocation-1"},"reason":{"tag":"ReasonId","value":"reason-1"},"revoker":{"tag":"ActorId","value":"revoker"}}],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-restart"},"steps":[{"branch":"ALWAYS","event_kind":"DISCARD","group":null,"id":{"tag":"StepId","value":"C10-01"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C10-G02"},"id":{"tag":"StepId","value":"C10-02"},"kind":"DURABLE","operation":{"kind":"RESTART"},"predecessors":[{"tag":"StepId","value":"C10-01"}]}],"template":"DISCARD_RESTART"},{"family":"F6","id":{"tag":"CaseId","value":"C11"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-promo-success"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G01"},"id":{"tag":"StepId","value":"C11-01"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"REQUESTED","transition":{"tag":"TransitionId","value":"promo-success-requested"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G02"},"id":{"tag":"StepId","value":"C11-02"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"VALIDATED","transition":{"tag":"TransitionId","value":"promo-success-validated"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-01"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G03"},"id":{"tag":"StepId","value":"C11-03"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"ROOT_PREPARED","transition":{"tag":"TransitionId","value":"promo-success-root_prepared"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-02"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G04"},"id":{"tag":"StepId","value":"C11-04"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"ROOT_COMMITTED","transition":{"tag":"TransitionId","value":"promo-success-root_committed"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-03"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G05"},"id":{"tag":"StepId","value":"C11-05"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"BOOT_SELECTED","transition":{"tag":"TransitionId","value":"promo-success-boot_selected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-04"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C11-G06"},"id":{"tag":"StepId","value":"C11-06"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-success"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"NONE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-accepted"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-success"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-success"},"stage":"HEALTH_ACCEPTED","transition":{"tag":"TransitionId","value":"promo-success-health_accepted"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C11-05"}]}],"template":"PROMOTION_SUCCESS"},{"family":"F6","id":{"tag":"CaseId","value":"C12"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-promo-preboot"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G01"},"id":{"tag":"StepId","value":"C12-01"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"REQUESTED","transition":{"tag":"TransitionId","value":"promo-preboot-requested"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G02"},"id":{"tag":"StepId","value":"C12-02"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"VALIDATED","transition":{"tag":"TransitionId","value":"promo-preboot-validated"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-01"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G03"},"id":{"tag":"StepId","value":"C12-03"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"ROOT_PREPARED","transition":{"tag":"TransitionId","value":"promo-preboot-root_prepared"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-02"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G04"},"id":{"tag":"StepId","value":"C12-04"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"ROOT_COMMITTED","transition":{"tag":"TransitionId","value":"promo-preboot-root_committed"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-03"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G05"},"id":{"tag":"StepId","value":"C12-05"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"ROLLBACK_INTENT","transition":{"tag":"TransitionId","value":"promo-preboot-rollback_intent"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-04"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G06"},"id":{"tag":"StepId","value":"C12-06"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"ROOT_ROLLED_BACK","transition":{"tag":"TransitionId","value":"promo-preboot-root_rolled_back"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-05"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C12-G07"},"id":{"tag":"StepId","value":"C12-07"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-preboot"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"PREBOOT_FAILURE","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-preboot"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-preboot"},"stage":"PRIOR_BOOT_RESELECTED","transition":{"tag":"TransitionId","value":"promo-preboot-prior_boot_reselected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C12-06"}]}],"template":"ROLLBACK_PREBOOT"},{"family":"F6","id":{"tag":"CaseId","value":"C13"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G01"},"id":{"tag":"StepId","value":"C13-01"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"REQUESTED","transition":{"tag":"TransitionId","value":"promo-watchdog-requested"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G02"},"id":{"tag":"StepId","value":"C13-02"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"VALIDATED","transition":{"tag":"TransitionId","value":"promo-watchdog-validated"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-01"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G03"},"id":{"tag":"StepId","value":"C13-03"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"ROOT_PREPARED","transition":{"tag":"TransitionId","value":"promo-watchdog-root_prepared"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-02"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G04"},"id":{"tag":"StepId","value":"C13-04"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"ROOT_COMMITTED","transition":{"tag":"TransitionId","value":"promo-watchdog-root_committed"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-03"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G05"},"id":{"tag":"StepId","value":"C13-05"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"BOOT_SELECTED","transition":{"tag":"TransitionId","value":"promo-watchdog-boot_selected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-04"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G06"},"id":{"tag":"StepId","value":"C13-06"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"ROLLBACK_INTENT","transition":{"tag":"TransitionId","value":"promo-watchdog-rollback_intent"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-05"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G07"},"id":{"tag":"StepId","value":"C13-07"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"ROOT_ROLLED_BACK","transition":{"tag":"TransitionId","value":"promo-watchdog-root_rolled_back"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-06"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C13-G08"},"id":{"tag":"StepId","value":"C13-08"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-watchdog"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"WATCHDOG_RESET","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-watchdog"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-watchdog"},"stage":"PRIOR_BOOT_RESELECTED","transition":{"tag":"TransitionId","value":"promo-watchdog-prior_boot_reselected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C13-07"}]}],"template":"ROLLBACK_WATCHDOG"},{"family":"F6","id":{"tag":"CaseId","value":"C14"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G01"},"id":{"tag":"StepId","value":"C14-01"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"REQUESTED","transition":{"tag":"TransitionId","value":"promo-posthealth-requested"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G02"},"id":{"tag":"StepId","value":"C14-02"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"VALIDATED","transition":{"tag":"TransitionId","value":"promo-posthealth-validated"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-01"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G03"},"id":{"tag":"StepId","value":"C14-03"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"ROOT_PREPARED","transition":{"tag":"TransitionId","value":"promo-posthealth-root_prepared"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-02"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G04"},"id":{"tag":"StepId","value":"C14-04"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"ROOT_COMMITTED","transition":{"tag":"TransitionId","value":"promo-posthealth-root_committed"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-03"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G05"},"id":{"tag":"StepId","value":"C14-05"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"BOOT_SELECTED","transition":{"tag":"TransitionId","value":"promo-posthealth-boot_selected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-04"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G06"},"id":{"tag":"StepId","value":"C14-06"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"ROLLBACK_INTENT","transition":{"tag":"TransitionId","value":"promo-posthealth-rollback_intent"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-05"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G07"},"id":{"tag":"StepId","value":"C14-07"},"kind":"ROOT_SWITCH","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"ROOT_ROLLED_BACK","transition":{"tag":"TransitionId","value":"promo-posthealth-root_rolled_back"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-06"}]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C14-G08"},"id":{"tag":"StepId","value":"C14-08"},"kind":"DURABLE","operation":{"kind":"PROMOTION","promotion":{"actor":{"tag":"ActorId","value":"actor-promo"},"attempt":{"tag":"AttemptId","value":"att-promo-posthealth"},"candidate_root":{"tag":"RootId","value":"root-new"},"candidate_slot":{"tag":"SlotId","value":"slot-new"},"cause":"POSTHEALTH_REJECTION","commitment":{"tag":"CommitmentId","value":"commit-promo"},"evidence_verdict":{"tag":"VerdictId","value":"evidence-valid"},"generation":{"tag":"GenerationId","value":"gen-new"},"health_verdict":{"tag":"VerdictId","value":"health-rejected"},"old_root":{"tag":"RootId","value":"root-old"},"outcome":{"tag":"OutcomeId","value":"out-promo-posthealth"},"parent_generation":{"tag":"GenerationId","value":"gen-old"},"prior_known_good":{"tag":"RootId","value":"root-old"},"prior_slot":{"tag":"SlotId","value":"slot-old"},"prior_status":"KNOWN_GOOD","recovery_authority":{"tag":"AuthorityId","value":"recovery-root"},"request":{"tag":"RequestId","value":"req-promo-posthealth"},"stage":"PRIOR_BOOT_RESELECTED","transition":{"tag":"TransitionId","value":"promo-posthealth-prior_boot_reselected"},"world":{"tag":"WorldId","value":"world-1"}}},"predecessors":[{"tag":"StepId","value":"C14-07"}]}],"template":"ROLLBACK_POSTHEALTH"},{"family":"F7","id":{"tag":"CaseId","value":"C15"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-effect-amb"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C15-G01"},"id":{"tag":"StepId","value":"C15-01"},"kind":"LOGICAL_COMMIT","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-amb"},"request":{"tag":"RequestId","value":"req-effect-amb"},"status":"AUTHORIZED"},"kind":"EFFECT"},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C15-G02"},"id":{"tag":"StepId","value":"C15-02"},"kind":"DURABLE","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-amb"},"request":{"tag":"RequestId","value":"req-effect-amb"},"status":"DISPATCHING"},"kind":"EFFECT"},"predecessors":[{"tag":"StepId","value":"C15-01"}]},{"branch":"ALWAYS","event_kind":"DISPATCH","group":null,"id":{"tag":"StepId","value":"C15-03"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C15-02"}]},{"branch":"NOT_OCCURRED","event_kind":"NOT_OCCURRED","group":null,"id":{"tag":"StepId","value":"C15-04"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C15-03"}]},{"branch":"OCCURRED","event_kind":"OCCURRED","group":null,"id":{"tag":"StepId","value":"C15-05"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C15-03"}]}],"template":"EFFECT_AMBIGUITY"},{"family":"F7","id":{"tag":"CaseId","value":"C16"},"initial_state":{"accounting":[],"canonical_root":{"tag":"RootId","value":"root-old"},"claims":[],"effects":[],"generation":{"tag":"GenerationId","value":"gen-old"},"grants":[],"known_good":{"tag":"RootId","value":"root-old"},"lineage_nonces":[],"outcomes":[],"promotions":[],"replay_keys":[],"revisions":[],"revocations":[],"uncertainties":[],"world_bindings":[]},"request":{"tag":"RequestId","value":"req-effect-ack"},"steps":[{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C16-G01"},"id":{"tag":"StepId","value":"C16-01"},"kind":"LOGICAL_COMMIT","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-ack"},"request":{"tag":"RequestId","value":"req-effect-ack"},"status":"AUTHORIZED"},"kind":"EFFECT"},"predecessors":[]},{"branch":"ALWAYS","event_kind":"NONE","group":{"tag":"GroupId","value":"C16-G02"},"id":{"tag":"StepId","value":"C16-02"},"kind":"DURABLE","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-ack"},"request":{"tag":"RequestId","value":"req-effect-ack"},"status":"DISPATCHING"},"kind":"EFFECT"},"predecessors":[{"tag":"StepId","value":"C16-01"}]},{"branch":"ALWAYS","event_kind":"DISPATCH","group":null,"id":{"tag":"StepId","value":"C16-03"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C16-02"}]},{"branch":"NOT_OCCURRED","event_kind":"NOT_OCCURRED","group":null,"id":{"tag":"StepId","value":"C16-04"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C16-03"}]},{"branch":"OCCURRED","event_kind":"OCCURRED","group":null,"id":{"tag":"StepId","value":"C16-05"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C16-03"}]},{"branch":"OCCURRED","event_kind":"ACK_RECEIPT","group":null,"id":{"tag":"StepId","value":"C16-06"},"kind":"ENV_EVENT","operation":{"kind":"NOOP"},"predecessors":[{"tag":"StepId","value":"C16-05"}]},{"branch":"OCCURRED","event_kind":"NONE","group":{"tag":"GroupId","value":"C16-G07"},"id":{"tag":"StepId","value":"C16-07"},"kind":"ACK_WRITE","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-ack"},"request":{"tag":"RequestId","value":"req-effect-ack"},"status":"ACKNOWLEDGED"},"kind":"EFFECT"},"predecessors":[{"tag":"StepId","value":"C16-06"}]},{"branch":"OCCURRED","event_kind":"NONE","group":{"tag":"GroupId","value":"C16-G08"},"id":{"tag":"StepId","value":"C16-08"},"kind":"LOGICAL_COMMIT","operation":{"effect":{"id":{"tag":"EffectId","value":"effect-effect-ack"},"request":{"tag":"RequestId","value":"req-effect-ack"},"status":"SETTLED"},"kind":"EFFECT"},"predecessors":[{"tag":"StepId","value":"C16-07"}]}],"template":"EFFECT_ACK_SETTLEMENT"}],"coverage":{"assertion_count":12,"case_count":16,"family_count":8,"history_cell_count":73,"recovery_observation_count":1971,"step_count":56,"unknown_cell_count":7},"decision":{"freezable":true,"frozen":false,"id":"D-004","status":"OPEN"},"evidence_dag":{"edges":[{"from":"PACKET","to":"FREEZE"},{"from":"MANIFEST","to":"FREEZE"},{"from":"EXECUTOR_SOURCE","to":"FREEZE"},{"from":"CHECKER_SOURCE","to":"FREEZE"},{"from":"PACKET","to":"EXECUTOR_SOURCE"},{"from":"MANIFEST","to":"EXECUTOR_SOURCE"},{"from":"PACKET","to":"CHECKER_SOURCE"},{"from":"MANIFEST","to":"CHECKER_SOURCE"},{"from":"MANIFEST","to":"O1"},{"from":"PACKET","to":"O1"},{"from":"EXECUTOR_SOURCE","to":"O1"},{"from":"EXECUTOR_SOURCE","to":"I1"},{"from":"MANIFEST","to":"O2"},{"from":"PACKET","to":"O2"},{"from":"CHECKER_SOURCE","to":"O2"},{"from":"CHECKER_SOURCE","to":"I2"},{"from":"FREEZE","to":"V"},{"from":"O1","to":"V"},{"from":"O2","to":"V"},{"from":"I1","to":"V"},{"from":"I2","to":"V"},{"from":"V","to":"E"}],"nodes":[{"id":"PACKET","type":"LOCK"},{"id":"MANIFEST","type":"LOCK"},{"id":"FREEZE","type":"FREEZE_RECORD"},{"id":"EXECUTOR_SOURCE","type":"IDENTITY_INPUT"},{"id":"CHECKER_SOURCE","type":"IDENTITY_INPUT"},{"id":"O1","type":"SEMANTIC_OUTPUT"},{"id":"I1","type":"PRODUCER_IDENTITY"},{"id":"O2","type":"SEMANTIC_OUTPUT"},{"id":"I2","type":"PRODUCER_IDENTITY"},{"id":"V","type":"FINAL_VERIFIER"},{"id":"E","type":"EVIDENCE_REPORT"}]},"families":[{"case_count":2,"id":"F1"},{"case_count":1,"id":"F2"},{"case_count":2,"id":"F3"},{"case_count":1,"id":"F4"},{"case_count":4,"id":"F5"},{"case_count":4,"id":"F6"},{"case_count":2,"id":"F7"},{"case_count":0,"id":"F8"}],"gates":{"C1":"COMPLETE","C2":"COMPLETE","C3":"COMPLETE_PREREGISTRATION_ONLY","current":"OPEN","direct_highs":{"H1":"REPAIRED","H2":"REPAIRED","H3":"REPAIRED","H4":"REPAIRED","H5":"REPAIRED","H6":"REPAIRED"},"future_adopt_if":"VALID_EXTERNAL_FREEZE_AND_V_AND_E","mechanism_ranking":false,"otherwise":"OPEN"},"independence":{"checker_source_root":"future/d004_checker","distinct_sources_commits_roles":true,"executor_source_root":"future/d004_executor","forbidden_imports":["other_producer","d004_manifest","generated_expected","transition_recovery_helpers","assertion_evaluator","O_fixture"],"shared_only":["packet_bytes","manifest_bytes","independently_transcribed_canonical_constants"],"validator_is_producer":false},"o_contract":{"manifest_identity_fields":["kind","sha256","byte_length"],"packet_identity_fields":["kind","sha256","byte_length"],"packet_kind":"PACKET","producer_identity_inside_o":false,"raw_bytes_agreement":"EXACT_CANONICAL_BYTES","schema":"D004-O-1"},"provenance_contract":{"clean_capture":"SUPPLIED_CLOSED_GIT_FACTS_NOT_LIVE_INSPECTION","content_hash":"sha256","current_freeze_record":null,"dependency_roots":["role_source_root","future/d004_common"],"file_modes":{"executable":"FORBIDDEN","regular":"100644","symlink":"FORBIDDEN","tree":"40000"},"freeze_record_fields":["schema","packet","manifest","executor_source","checker_source","executor_identity","checker_identity","executor_bundle","checker_bundle","runtime_test_capture","commit","tree","timestamp_token"],"git_blob_rule":"SHA1(blob SP decimal-length NUL bytes)","git_commit_rule":"STRICT_TREE_PARENTS_AUTHOR_COMMITTER_MESSAGE","git_object_format":"sha1","git_tree_rule":"RECURSIVE_CANONICAL_RAW_NAME_BYTES_DIRECTORY_SUFFIX_SLASH","invalidation":["packet","manifest","schema","semantics","cases","assertions","source","dependency","lock","identity","package_inventory","runtime","bundle"],"mandatory_locks":["decisions/D-004-PACKET.md","decisions/d004-crash-manifest-v1.json"],"package_capture_schema":"D004-PACKAGE-CAPTURE-2","producer_schema":"D004-PRODUCER-IDENTITY-2","python":{"implementation":"CPython","stdlib_allowlist":["ast","collections","dataclasses","hashlib","itertools","json","pathlib","re","sys","typing","unicodedata"],"version":"3.11"},"raw_bytes_encoding":"LOWERCASE_HEX_WITH_LENGTH_AND_SHA256","required_package_paths":["decisions/D-004-PACKET.md","decisions/d004-crash-manifest-v1.json","decisions/d004_manifest.py","decisions/test_d004_manifest.py","future/d004_executor/producer.py","future/d004_executor/test_producer.py","future/d004_checker/producer.py","future/d004_checker/test_producer.py","decisions/d004_capture.py","decisions/test_d004_capture.py"],"runtime_command":"CPYTHON -I -S -c <bootstrap_sha256> <EXPORT_ROOT> modules...","runtime_test_capture_schema":"RuntimeTestCapture","source_roots":{"CHECKER":"future/d004_checker","EXECUTOR":"future/d004_executor"},"tested_closure":"EXACT_REQUIRED_PACKAGE_PATHS_AND_BYTES","timestamp_token_grammar":"GIT_COMMITTER_TIMESTAMP:<decimal-seconds>:<+/-HHMM>","timestamp_token_semantics":"DERIVED_FROM_UNIQUE_COMMITTER_HEADER_NOT_TRUSTED_TIME_FRESHNESS_OR_NOTARIZATION","tracked_closure":"EXACT_SOURCE_DEPENDENCY_LOCK_UNION"},"recovery_axes":{"crashes":["NONE","BEFORE_EACH_COMMIT","AFTER_EACH_COMMIT"],"modes":["OBSERVE","STALE_REPLAY","RECOVERY_CYCLES"],"outages":["NONE","MODEL","NETWORK"]},"schema":"D004-MANIFEST-1","schemas":{"AccountingOccurrence":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"token","schema":{"kind":"ref","name":"Id"}},{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},"ArtifactIdentity":{"fields":[{"name":"kind","schema":{"kind":"primitive","name":"string"}},{"name":"sha256","schema":{"kind":"primitive","name":"string"}},{"name":"byte_length","schema":{"kind":"primitive","name":"u64"}}],"kind":"record"},"Case":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"family","schema":{"kind":"enum","values":["F1","F2","F3","F4","F5","F6","F7"]}},{"name":"template","schema":{"kind":"primitive","name":"string"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"initial_state","schema":{"kind":"ref","name":"State"}},{"name":"steps","schema":{"items":{"kind":"ref","name":"Step"},"kind":"array"}}],"kind":"record"},"D003Validation":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"verdict","schema":{"kind":"literal","value":"D003_VALIDATED"}},{"name":"presentation","schema":{"kind":"ref","name":"GrantPresentation"}},{"name":"state_authority","schema":{"kind":"ref","name":"Id"}},{"name":"current_epoch","schema":{"kind":"ref","name":"Id"}},{"name":"unrevoked","schema":{"kind":"literal","value":true}},{"name":"live","schema":{"kind":"literal","value":true}},{"name":"delegate","schema":{"kind":"literal","value":true}},{"name":"target","schema":{"kind":"ref","name":"Id"}},{"name":"rights","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"constraint_dimensions","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"expiry_bound","schema":{"kind":"ref","name":"Id"}},{"name":"freshness_identities","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}}],"kind":"record"},"DurableImage":{"fields":[{"name":"state","schema":{"kind":"ref","name":"State"}},{"name":"durable_events","schema":{"items":{"kind":"ref","name":"Id"},"kind":"array"}}],"kind":"record"},"Effect":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"status","schema":{"kind":"enum","values":["AUTHORIZED","DISPATCHING","ACKNOWLEDGED","SETTLED"]}}],"kind":"record"},"GitTreeLeaf":{"fields":[{"name":"path","schema":{"kind":"primitive","name":"string"}},{"name":"mode","schema":{"kind":"literal","value":"100644"}},{"name":"type","schema":{"kind":"literal","value":"blob"}},{"name":"blob_oid","schema":{"kind":"primitive","name":"string"}},{"name":"content","schema":{"kind":"ref","name":"RawBytes"}}],"kind":"record"},"Grant":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"issuer","schema":{"kind":"ref","name":"Id"}},{"name":"epoch","schema":{"kind":"ref","name":"Id"}},{"name":"target","schema":{"kind":"ref","name":"Id"}},{"name":"rights","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"constraints","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"parents","schema":{"items":{"kind":"ref","name":"Id"},"kind":"array"}},{"name":"lineage","schema":{"kind":"ref","name":"Id"}},{"name":"owner","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}},{"name":"witness","schema":{"kind":"ref","name":"Id"}},{"name":"status","schema":{"kind":"enum","values":["LIVE","MOVED"]}}],"kind":"record"},"GrantPresentation":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"grant","schema":{"kind":"ref","name":"Id"}},{"name":"authenticity_ref","schema":{"kind":"ref","name":"Id"}},{"name":"presenter","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},"HistoryCell":{"fields":[{"name":"key","schema":{"items":[{"kind":"ref","name":"Id"},{"items":{"kind":"ref","name":"Id"},"kind":"array"}],"kind":"tuple"}},{"name":"case","schema":{"kind":"ref","name":"Id"}},{"name":"included_steps","schema":{"items":{"kind":"ref","name":"Id"},"kind":"array"}},{"name":"image","schema":{"kind":"ref","name":"DurableImage"}},{"name":"event_mark","schema":{"kind":"enum","values":["UNRESOLVED","NOT_OCCURRED","OCCURRED"]}},{"name":"classification","schema":{"kind":"enum","values":["NOT_COMMITTED","COMMITTED","UNKNOWN_EXTERNAL"]}},{"name":"action","schema":{"kind":"enum","values":["RETRY_SAFE","NO_RETRY_QUERY_RESULT","RECONCILE_ONLY"]}}],"kind":"record"},"Id":{"fields":[{"name":"tag","schema":{"kind":"enum","values":["ActivationId","ActorId","AttemptId","AudienceId","AuthorityId","CaseId","ClaimId","CommitmentId","EffectId","EpochId","FactId","GenerationId","GrantId","GroupId","InstantId","LineageId","NonceId","OpaqueToken","OutcomeId","PresentationId","ReasonId","RequestId","RevisionId","RightId","RootId","SelectionId","SlotId","StepId","TargetId","TransitionId","ValidationId","VerdictId","WitnessId","WorldId"]}},{"name":"value","schema":{"kind":"primitive","name":"string"}}],"kind":"record"},"Operation":{"kind":"union","variants":[{"fields":[{"name":"kind","schema":{"kind":"literal","value":"DENIAL"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"reason","schema":{"kind":"enum","values":["MALFORMED","AUTHORITY"]}},{"name":"semantic_digest_before","schema":{"kind":"ref","name":"Id"}},{"name":"semantic_digest_after","schema":{"kind":"ref","name":"Id"}},{"name":"authority","schema":{"kind":"literal","value":false}},{"name":"outcome","schema":{"kind":"union","variants":[{"kind":"ref","name":"Outcome"},{"kind":"primitive","name":"null"}]}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"AUTHORIZE"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"activation_id","schema":{"kind":"ref","name":"Id"}},{"name":"selection_id","schema":{"kind":"ref","name":"Id"}},{"name":"grant_id","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"generation","schema":{"kind":"ref","name":"Id"}},{"name":"target","schema":{"kind":"ref","name":"Id"}},{"name":"right","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}},{"name":"now","schema":{"kind":"ref","name":"Id"}},{"name":"invocation_nonce","schema":{"kind":"ref","name":"Id"}},{"name":"presentation","schema":{"kind":"ref","name":"GrantPresentation"}},{"name":"current_grant","schema":{"kind":"ref","name":"Grant"}},{"name":"status","schema":{"kind":"literal","value":"ALLOW"}},{"name":"replay_key","schema":{"items":[{"kind":"ref","name":"Id"},{"kind":"ref","name":"Id"}],"kind":"tuple"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"QUERY_OUTCOME"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"result","schema":{"kind":"literal","value":"ALLOW"}},{"name":"outcome","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"REINVOKE"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"activation_id","schema":{"kind":"ref","name":"Id"}},{"name":"selection_id","schema":{"kind":"ref","name":"Id"}},{"name":"grant_id","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"generation","schema":{"kind":"ref","name":"Id"}},{"name":"target","schema":{"kind":"ref","name":"Id"}},{"name":"right","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}},{"name":"now","schema":{"kind":"ref","name":"Id"}},{"name":"invocation_nonce","schema":{"kind":"ref","name":"Id"}},{"name":"presentation","schema":{"kind":"ref","name":"GrantPresentation"}},{"name":"current_grant","schema":{"kind":"ref","name":"Grant"}},{"name":"result","schema":{"kind":"literal","value":"DENY_REPLAY"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"TRANSFER_MOVE"}},{"name":"parent","schema":{"kind":"ref","name":"Id"}},{"name":"sender","schema":{"kind":"ref","name":"Id"}},{"name":"recipient","schema":{"kind":"ref","name":"Id"}},{"name":"audience","schema":{"kind":"ref","name":"Id"}},{"name":"mode","schema":{"kind":"literal","value":"MOVE"}},{"name":"nonce","schema":{"kind":"ref","name":"Id"}},{"name":"fresh_grant","schema":{"kind":"ref","name":"Id"}},{"name":"claim","schema":{"kind":"ref","name":"Id"}},{"name":"validation","schema":{"kind":"ref","name":"D003Validation"}},{"name":"issuer","schema":{"kind":"ref","name":"Id"}},{"name":"current_epoch","schema":{"kind":"ref","name":"Id"}},{"name":"parent_before","schema":{"kind":"ref","name":"Grant"}},{"name":"parent_after","schema":{"kind":"ref","name":"Grant"}},{"name":"successor","schema":{"kind":"ref","name":"Grant"}},{"name":"lineage_nonce","schema":{"items":[{"kind":"ref","name":"Id"},{"kind":"ref","name":"Id"}],"kind":"tuple"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"MATERIALIZE_REVISION"}},{"name":"revision","schema":{"kind":"ref","name":"Revision"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"PUBLISH_WORLD"}},{"name":"binding","schema":{"kind":"ref","name":"WorldBinding"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"REVOKE"}},{"name":"grant","schema":{"kind":"ref","name":"Id"}},{"name":"revoker","schema":{"kind":"ref","name":"Id"}},{"name":"reason","schema":{"kind":"ref","name":"Id"}},{"name":"validation","schema":{"kind":"ref","name":"D003Validation"}},{"name":"fact","schema":{"kind":"ref","name":"RevocationFact"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"ACCOUNT"}},{"name":"occurrence","schema":{"kind":"ref","name":"AccountingOccurrence"}},{"name":"outcome","schema":{"kind":"ref","name":"Outcome"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"PROMOTION"}},{"name":"promotion","schema":{"kind":"ref","name":"Promotion"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"EFFECT"}},{"name":"effect","schema":{"kind":"ref","name":"Effect"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"UNCERTAINTY"}},{"name":"uncertainty","schema":{"kind":"ref","name":"Uncertainty"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"NOOP"}}],"kind":"record"},{"fields":[{"name":"kind","schema":{"kind":"literal","value":"RESTART"}}],"kind":"record"}]},"Outcome":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"status","schema":{"kind":"enum","values":["ALLOW","DENIED","MOVED","REVOKED","RECORDED","PUBLISHED","PROMOTED","ROLLED_BACK","SETTLED"]}},{"name":"authority","schema":{"kind":"primitive","name":"bool"}}],"kind":"record"},"PackageCapture":{"fields":[{"name":"schema","schema":{"kind":"literal","value":"D004-PACKAGE-CAPTURE-2"}},{"name":"commit","schema":{"kind":"primitive","name":"string"}},{"name":"tree","schema":{"kind":"primitive","name":"string"}},{"name":"timestamp_token","schema":{"kind":"primitive","name":"string"}},{"name":"commit_payload","schema":{"kind":"ref","name":"RawBytes"}},{"name":"full_tree","schema":{"items":{"kind":"ref","name":"GitTreeLeaf"},"kind":"array"}},{"name":"selected_required","schema":{"items":{"kind":"ref","name":"SelectedRequiredFile"},"kind":"array"}},{"name":"executor_bundle","schema":{"kind":"ref","name":"RawBytes"}},{"name":"checker_bundle","schema":{"kind":"ref","name":"RawBytes"}},{"name":"executor_bundle_artifact","schema":{"kind":"ref","name":"ArtifactIdentity"}},{"name":"checker_bundle_artifact","schema":{"kind":"ref","name":"ArtifactIdentity"}},{"name":"runtime_test_capture","schema":{"kind":"ref","name":"RuntimeTestCapture"}}],"kind":"record"},"Promotion":{"fields":[{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"attempt","schema":{"kind":"ref","name":"Id"}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"generation","schema":{"kind":"ref","name":"Id"}},{"name":"parent_generation","schema":{"kind":"ref","name":"Id"}},{"name":"old_root","schema":{"kind":"ref","name":"Id"}},{"name":"candidate_root","schema":{"kind":"ref","name":"Id"}},{"name":"candidate_slot","schema":{"kind":"ref","name":"Id"}},{"name":"prior_slot","schema":{"kind":"ref","name":"Id"}},{"name":"prior_known_good","schema":{"kind":"ref","name":"Id"}},{"name":"prior_status","schema":{"kind":"literal","value":"KNOWN_GOOD"}},{"name":"evidence_verdict","schema":{"kind":"ref","name":"Id"}},{"name":"health_verdict","schema":{"kind":"ref","name":"Id"}},{"name":"recovery_authority","schema":{"kind":"ref","name":"Id"}},{"name":"cause","schema":{"kind":"enum","values":["NONE","PREBOOT_FAILURE","WATCHDOG_RESET","POSTHEALTH_REJECTION"]}},{"name":"stage","schema":{"kind":"enum","values":["REQUESTED","VALIDATED","ROOT_PREPARED","ROOT_COMMITTED","BOOT_SELECTED","HEALTH_ACCEPTED","ROLLBACK_INTENT","ROOT_ROLLED_BACK","PRIOR_BOOT_RESELECTED"]}},{"name":"transition","schema":{"kind":"ref","name":"Id"}},{"name":"outcome","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},"RawBytes":{"fields":[{"name":"encoding","schema":{"kind":"literal","value":"lowercase-hex"}},{"name":"byte_length","schema":{"kind":"primitive","name":"u64"}},{"name":"sha256","schema":{"kind":"primitive","name":"string"}},{"name":"data","schema":{"kind":"primitive","name":"string"}}],"kind":"record"},"RecoveryContext":{"fields":[{"name":"case","schema":{"kind":"ref","name":"Id"}},{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"image","schema":{"kind":"ref","name":"DurableImage"}},{"name":"classification","schema":{"kind":"enum","values":["NOT_COMMITTED","COMMITTED","UNKNOWN_EXTERNAL"]}},{"name":"action","schema":{"kind":"enum","values":["RETRY_SAFE","NO_RETRY_QUERY_RESULT","RECONCILE_ONLY"]}}],"kind":"record"},"RecoveryInput":{"fields":[{"name":"cell_key","schema":{"items":[{"kind":"ref","name":"Id"},{"items":{"kind":"ref","name":"Id"},"kind":"array"}],"kind":"tuple"}},{"name":"context","schema":{"kind":"ref","name":"RecoveryContext"}},{"name":"mode","schema":{"kind":"enum","values":["OBSERVE","STALE_REPLAY","RECOVERY_CYCLES"]}},{"name":"crash","schema":{"kind":"enum","values":["NONE","BEFORE_EACH_COMMIT","AFTER_EACH_COMMIT"]}},{"name":"outage","schema":{"kind":"enum","values":["NONE","MODEL","NETWORK"]}}],"kind":"record"},"RecoveryResult":{"fields":[{"name":"image","schema":{"kind":"ref","name":"DurableImage"}},{"name":"operations","schema":{"items":{"kind":"ref","name":"Operation"},"kind":"array"}},{"name":"committed_cycles","schema":{"kind":"primitive","name":"string"}},{"name":"stable","schema":{"kind":"primitive","name":"bool"}},{"name":"classification","schema":{"kind":"enum","values":["NOT_COMMITTED","COMMITTED","UNKNOWN_EXTERNAL"]}},{"name":"action","schema":{"kind":"enum","values":["RETRY_SAFE","NO_RETRY_QUERY_RESULT","RECONCILE_ONLY"]}}],"kind":"record"},"Revision":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"predecessor","schema":{"kind":"union","variants":[{"kind":"ref","name":"Id"},{"kind":"primitive","name":"null"}]}},{"name":"actor","schema":{"kind":"ref","name":"Id"}},{"name":"commitment","schema":{"kind":"ref","name":"Id"}},{"name":"causal_inputs","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"payload","schema":{"kind":"ref","name":"Id"}},{"name":"authoritative","schema":{"kind":"literal","value":false}}],"kind":"record"},"RevocationFact":{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"grant","schema":{"kind":"ref","name":"Id"}},{"name":"revoker","schema":{"kind":"ref","name":"Id"}},{"name":"reason","schema":{"kind":"ref","name":"Id"}}],"kind":"record"},"RuntimeTestCapture":{"fields":[{"name":"schema","schema":{"kind":"literal","value":"D004-RUNTIME-TEST-CAPTURE-2"}},{"name":"implementation","schema":{"kind":"literal","value":"CPython"}},{"name":"version","schema":{"kind":"literal","value":"3.11.14"}},{"name":"interpreter","schema":{"fields":[{"name":"kind","schema":{"kind":"literal","value":"PYTHON_INTERPRETER"}},{"name":"sha256","schema":{"kind":"primitive","name":"string"}},{"name":"byte_length","schema":{"kind":"primitive","name":"u64"}}],"kind":"record"}},{"name":"bootstrap","schema":{"fields":[{"name":"kind","schema":{"kind":"literal","value":"PYTHON_BOOTSTRAP"}},{"name":"sha256","schema":{"kind":"primitive","name":"string"}},{"name":"byte_length","schema":{"kind":"primitive","name":"u64"}}],"kind":"record"}},{"name":"package_commit","schema":{"kind":"primitive","name":"string"}},{"name":"package_tree","schema":{"kind":"primitive","name":"string"}},{"name":"test_paths","schema":{"items":[{"kind":"literal","value":"decisions/test_d004_manifest.py"},{"kind":"literal","value":"future/d004_executor/test_producer.py"},{"kind":"literal","value":"future/d004_checker/test_producer.py"}],"kind":"tuple"}},{"name":"actual_normalized_command","schema":{"items":[{"kind":"literal","value":"CPYTHON"},{"kind":"literal","value":"-I"},{"kind":"literal","value":"-S"},{"kind":"literal","value":"-c"},{"kind":"primitive","name":"string"},{"kind":"literal","value":"<EXPORT_ROOT>"},{"kind":"literal","value":"decisions.test_d004_manifest"},{"kind":"literal","value":"future.d004_executor.test_producer"},{"kind":"literal","value":"future.d004_checker.test_producer"}],"kind":"tuple"}},{"name":"expected_count","schema":{"kind":"literal","value":45}},{"name":"executed_count","schema":{"kind":"literal","value":45}},{"name":"exit_status","schema":{"kind":"literal","value":0}},{"name":"tested_closure","schema":{"fields":[{"name":"kind","schema":{"kind":"literal","value":"TESTED_CLOSURE"}},{"name":"sha256","schema":{"kind":"primitive","name":"string"}},{"name":"byte_length","schema":{"kind":"primitive","name":"u64"}}],"kind":"record"}}],"kind":"record"},"SelectedRequiredFile":{"fields":[{"name":"path","schema":{"kind":"primitive","name":"string"}},{"name":"content","schema":{"kind":"ref","name":"RawBytes"}}],"kind":"record"},"State":{"fields":[{"name":"canonical_root","schema":{"kind":"ref","name":"Id"}},{"name":"generation","schema":{"kind":"ref","name":"Id"}},{"name":"known_good","schema":{"kind":"ref","name":"Id"}},{"name":"world_bindings","schema":{"items":{"kind":"ref","name":"WorldBinding"},"kind":"array"}},{"name":"replay_keys","schema":{"items":{"items":[{"kind":"ref","name":"Id"},{"kind":"ref","name":"Id"}],"kind":"tuple"},"kind":"set"}},{"name":"outcomes","schema":{"items":{"kind":"ref","name":"Outcome"},"kind":"array"}},{"name":"grants","schema":{"items":{"kind":"ref","name":"Grant"},"kind":"array"}},{"name":"lineage_nonces","schema":{"items":{"items":[{"kind":"ref","name":"Id"},{"kind":"ref","name":"Id"}],"kind":"tuple"},"kind":"set"}},{"name":"claims","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"revisions","schema":{"items":{"kind":"ref","name":"Revision"},"kind":"array"}},{"name":"revocations","schema":{"items":{"kind":"ref","name":"RevocationFact"},"kind":"array"}},{"name":"accounting","schema":{"items":{"kind":"ref","name":"AccountingOccurrence"},"kind":"array"}},{"name":"promotions","schema":{"items":{"kind":"ref","name":"Promotion"},"kind":"array"}},{"name":"effects","schema":{"items":{"kind":"ref","name":"Effect"},"kind":"array"}},{"name":"uncertainties","schema":{"items":{"kind":"ref","name":"Uncertainty"},"kind":"array"}}],"kind":"record"},"Step":{"kind":"union","variants":[{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"kind","schema":{"kind":"enum","values":["DURABLE","LOGICAL_COMMIT","ROOT_SWITCH","ACK_WRITE"]}},{"name":"predecessors","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"branch","schema":{"kind":"enum","values":["ALWAYS","NOT_OCCURRED","OCCURRED"]}},{"name":"group","schema":{"kind":"ref","name":"Id"}},{"name":"event_kind","schema":{"kind":"literal","value":"NONE"}},{"name":"operation","schema":{"kind":"ref","name":"Operation"}}],"kind":"record"},{"fields":[{"name":"id","schema":{"kind":"ref","name":"Id"}},{"name":"kind","schema":{"kind":"literal","value":"ENV_EVENT"}},{"name":"predecessors","schema":{"items":{"kind":"ref","name":"Id"},"kind":"set"}},{"name":"branch","schema":{"kind":"enum","values":["ALWAYS","NOT_OCCURRED","OCCURRED"]}},{"name":"group","schema":{"kind":"primitive","name":"null"}},{"name":"event_kind","schema":{"kind":"enum","values":["DISPATCH","NOT_OCCURRED","OCCURRED","ACK_RECEIPT","RESPONSE","QUERY","REINVOKE","DISCARD","RESTART"]}},{"name":"operation","schema":{"kind":"ref","name":"Operation"}}],"kind":"record"}]},"Uncertainty":{"fields":[{"name":"request","schema":{"kind":"ref","name":"Id"}},{"name":"status","schema":{"kind":"literal","value":"UNKNOWN_EXTERNAL"}},{"name":"redispatch_forbidden","schema":{"kind":"literal","value":true}}],"kind":"record"},"WorldBinding":{"fields":[{"name":"world","schema":{"kind":"ref","name":"Id"}},{"name":"revision","schema":{"kind":"ref","name":"Id"}},{"name":"writer_verdict","schema":{"kind":"ref","name":"Id"}},{"name":"proposed_delta","schema":{"kind":"ref","name":"Id"}}],"kind":"record"}},"stage":"PREREGISTERED"}
diff --git a/decisions/d004_capture.py b/decisions/d004_capture.py
new file mode 100644
index 0000000000..df10b578ad
--- /dev/null
+++ b/decisions/d004_capture.py
@@ -0,0 +1,284 @@
+#!/usr/bin/env python3
+"""Narrow external capture boundary for D-004 (standard library + Git only)."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tarfile
+import tempfile
+
+try:
+    from . import d004_manifest as V
+except ImportError:
+    import d004_manifest as V
+
+TEST_PATHS = list(V.TEST_PATHS)
+TEST_MODULES = list(V.TEST_MODULES)
+EXPECTED_TESTS = 45
+DEFAULT_REQUIRED_PATHS = list(V.REQUIRED_PACKAGE_PATHS)
+_HEX40 = re.compile(r"[0-9a-f]{40}")
+_COMMITTER = re.compile(rb"committer [^\n]* <[^<>\n]+> ([0-9]+) ([+-](?:0[0-9]|1[0-4])[0-5][0-9])$")
+_RESULT_PREFIX = b"D004_RUNTIME_RESULT="
+# Audited fixed bootstrap.  -S leaves the standard library paths in sys.path;
+# retain only base-prefix stdlib paths, remove cwd/user/site paths, then insert
+# the explicit archive export root as the sole application import root.
+BOOTSTRAP = b'''import os,sys\nroot=os.path.realpath(sys.argv[1])\nmods=sys.argv[2:]\nbase=os.path.realpath(sys.base_prefix)+os.sep\nkeep=[]\nfor p in sys.path:\n q=os.path.realpath(p) if p else ""\n if q.startswith(base) and "site-packages" not in q and "dist-packages" not in q: keep.append(p)\nsys.path[:]=[root]+keep\nimport io,json,unittest\nstream=io.StringIO()\nsuite=unittest.defaultTestLoader.loadTestsFromNames(mods)\nresult=unittest.TextTestRunner(stream=stream,verbosity=0).run(suite)\nrecord={"errors":len(result.errors),"executed":result.testsRun,"failures":len(result.failures),"success":result.wasSuccessful()}\nsys.stdout.write("D004_RUNTIME_RESULT="+json.dumps(record,sort_keys=True,separators=(",",":"))+"\\n")\nraise SystemExit(0 if result.wasSuccessful() else 1)\n'''
+BOOTSTRAP_ARTIFACT = V.artifact_identity("PYTHON_BOOTSTRAP", BOOTSTRAP)
+
+class CaptureError(ValueError):
+    pass
+
+def _run(args, *, cwd=None, data=None, check=True, env=None):
+    p = subprocess.run([os.fspath(x) for x in args], cwd=cwd, input=data, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env)
+    if check and p.returncode:
+        raise CaptureError("command failed: " + " ".join(map(os.fspath, args)) + ": " + p.stderr.decode("utf-8", "replace").strip())
+    return p
+
+def _git(repo, *args, data=None, check=True):
+    return _run(["git", "-C", repo, *args], data=data, check=check)
+
+def _sha(data):
+    return hashlib.sha256(data).hexdigest()
+
+def artifact(kind, data):
+    return {"kind": kind, "sha256": _sha(data), "byte_length": len(data)}
+
+def _require_sha1(repo):
+    fmt = _git(repo, "rev-parse", "--show-object-format").stdout.strip()
+    if fmt != b"sha1":
+        raise CaptureError("Git object format must be sha1")
+
+def _safe_inventory(expected):
+    if not isinstance(expected, dict) or not expected:
+        raise CaptureError("required path inventory")
+    try:
+        normalized = V._normalized_map(expected)
+    except Exception as e:
+        raise CaptureError("required path inventory") from e
+    if normalized != expected:
+        raise CaptureError("required path inventory normalization")
+    return normalized
+
+def _tree_entries(repo, commit):
+    raw = _git(repo, "ls-tree", "-rz", "--full-tree", "-r", commit).stdout
+    result = {}
+    for record in raw.split(b"\0"):
+        if not record:
+            continue
+        head, path = record.split(b"\t", 1)
+        mode, typ, oid = head.split(b" ")
+        try:
+            name = path.decode("utf-8")
+        except UnicodeDecodeError as e:
+            raise CaptureError("non-UTF-8 committed path") from e
+        if name in result:
+            raise CaptureError("duplicate committed path")
+        result[name] = (mode.decode(), typ.decode(), oid.decode())
+    return result
+
+def _controlled_clean(repo, commit):
+    head = _git(repo, "rev-parse", "HEAD").stdout.decode().strip()
+    status = _git(repo, "status", "--porcelain=v1", "-z", "--untracked-files=all").stdout
+    if head != commit or status:
+        raise CaptureError("controlled capture requires clean current HEAD")
+    # Ignored files are deliberately out of scope: they are absent from both
+    # the committed Git tree and `git archive`, and therefore cannot affect it.
+
+def capture_package_commit(repo, commit, expected_paths):
+    """Bind ten selected package files and every regular blob in a monorepo commit."""
+    repo = Path(repo).resolve(); expected = _safe_inventory(expected_paths)
+    if list(expected) != DEFAULT_REQUIRED_PATHS:
+        raise CaptureError("exact ordered DEFAULT_REQUIRED_PATHS required")
+    _require_sha1(repo)
+    if not _HEX40.fullmatch(commit): raise CaptureError("commit must be a full lowercase SHA-1")
+    typ = _git(repo, "cat-file", "-t", commit, check=False)
+    if typ.returncode or typ.stdout != b"commit\n": raise CaptureError("object does not exist or is not a commit")
+    payload = _git(repo, "cat-file", "commit", commit).stdout
+    tree = _git(repo, "rev-parse", f"{commit}^{{tree}}").stdout.decode().strip()
+    parsed = V.parse_git_commit(payload, tree)
+    if parsed["commit"] != commit: raise CaptureError("commit object hash mismatch")
+    matches = [_COMMITTER.fullmatch(x) for x in payload.split(b"\n") if x.startswith(b"committer ")]
+    matches = [x for x in matches if x]
+    if len(matches) != 1: raise CaptureError("unique raw committer required")
+    epoch, zone = (x.decode() for x in matches[0].groups())
+    entries = _tree_entries(repo, commit); all_bytes = {}; leaves = []
+    for path in sorted(entries):
+        mode, object_type, oid = entries[path]
+        if mode != "100644" or object_type != "blob":
+            raise CaptureError("full tree contains unrepresentable mode/type")
+        data = _git(repo, "cat-file", "blob", oid).stdout
+        if V.git_blob(data) != oid: raise CaptureError("committed blob OID mismatch")
+        all_bytes[path] = data; leaf = V.package_leaf(path, data)
+        if leaf["blob_oid"] != oid: raise CaptureError("package leaf OID mismatch")
+        leaves.append(leaf)
+    if not set(expected).issubset(all_bytes): raise CaptureError("missing selected required path")
+    for path, wanted in expected.items():
+        if all_bytes[path] != wanted: raise CaptureError("selected required bytes mismatch")
+    _controlled_clean(repo, commit)
+    return {"repo":str(repo),"commit":commit,"tree":tree,"commit_payload":payload,"timestamp_token":f"GIT_COMMITTER_TIMESTAMP:{epoch}:{zone}","selected":dict(expected),"all_bytes":all_bytes,"full_tree":leaves}
+
+def _test_only_validate_probe_values(exe, returncode, stdout, stderr):
+    """Parse probe values for tests; this helper cannot run or yield a capture."""
+    try:
+        values = json.loads(stdout)
+    except Exception as e:
+        raise CaptureError("Python probe failed") from e
+    if returncode or stderr or not isinstance(values, list) or len(values) != 3 or values[:2] != ["CPython", "3.11.14"]:
+        raise CaptureError("CPython 3.11.14 required")
+    reported = Path(values[2]).resolve()
+    if reported != exe:
+        raise CaptureError("Python probe executable mismatch")
+
+
+def probe_cpython(executable):
+    exe = Path(executable).resolve()
+    if not exe.is_file():
+        raise CaptureError("explicit Python executable required")
+    code = "import json,platform,sys;print(json.dumps([platform.python_implementation(),platform.python_version(),sys.executable]))"
+    p = _run([exe, "-I", "-c", code], check=False)
+    _test_only_validate_probe_values(exe, p.returncode, p.stdout, p.stderr)
+    raw = exe.read_bytes()
+    return exe, artifact("PYTHON_INTERPRETER", raw)
+
+def _export_commit(repo, commit, destination, expected_full_tree):
+    archive = _git(repo, "archive", "--format=tar", commit).stdout
+    destination.mkdir(); expected = {x["path"]: V._decode_raw(x["content"], "expected tree") for x in expected_full_tree}; observed = {}
+    with tempfile.NamedTemporaryFile() as f:
+        f.write(archive); f.flush()
+        with tarfile.open(f.name, "r:") as tf:
+            for member in tf.getmembers():
+                if member.isdir() or member.type in (tarfile.XHDTYPE, tarfile.XGLTYPE): continue
+                if not member.isfile() or (member.mode & 0o111): raise CaptureError("archive mode/type mismatch")
+                member.mode = 0o644
+                try: path = member.name.encode("utf-8").decode("utf-8")
+                except UnicodeError as e: raise CaptureError("archive non-UTF-8 path") from e
+                if path in observed: raise CaptureError("duplicate archive path")
+                stream = tf.extractfile(member); observed[path] = stream.read() if stream else b""
+            if observed != expected: raise CaptureError("archive tree bytes mismatch")
+            tf.extractall(destination, filter="data")
+    for path, data in expected.items():
+        q = destination / path
+        if not q.is_file() or q.read_bytes() != data or (q.stat().st_mode & 0o777) != 0o644: raise CaptureError("exported tree mismatch")
+
+def _minimal_python_env():
+    env = {"PATH":os.environ.get("PATH", ""), "LANG":"C.UTF-8", "LC_ALL":"C.UTF-8"}
+    for key in ("PYTHONPATH","PYTHONHOME","PYTHONSTARTUP","PYTHONUSERBASE","PYTHONINSPECT","PYTHONWARNINGS"):
+        env.pop(key, None)
+    return env
+
+def runtime_test_capture(package, executable):
+    exe, interpreter = probe_cpython(executable)
+    selected = package["selected"]
+    if list(selected) != DEFAULT_REQUIRED_PATHS: raise CaptureError("runtime exact selected inventory")
+    closure = {"package_commit":package["commit"],"package_tree":package["tree"],"tested_files":[{"path":p,"sha256":_sha(selected[p]),"byte_length":len(selected[p])} for p in DEFAULT_REQUIRED_PATHS]}
+    with tempfile.TemporaryDirectory() as td:
+        root = Path(td,"export"); _export_commit(package["repo"],package["commit"],root,package["full_tree"])
+        command=[str(exe),"-I","-S","-c",BOOTSTRAP.decode("utf-8"),str(root),*TEST_MODULES]
+        p=_run(command,cwd=Path(td),check=False,env=_minimal_python_env())
+    rows=[line for line in p.stdout.splitlines() if line.startswith(_RESULT_PREFIX)]
+    if len(rows)!=1 or p.stderr or any(line and not line.startswith(_RESULT_PREFIX) for line in p.stdout.splitlines()): raise CaptureError("runtime output record")
+    try: record=json.loads(rows[0][len(_RESULT_PREFIX):])
+    except Exception as e: raise CaptureError("runtime result JSON") from e
+    expected_record={"errors":0,"executed":45,"failures":0,"success":True}
+    if p.returncode!=0 or record!=expected_record: raise CaptureError("runtime exact result")
+    normalized=["CPYTHON","-I","-S","-c",BOOTSTRAP_ARTIFACT["sha256"],"<EXPORT_ROOT>",*TEST_MODULES]
+    result={"schema":"D004-RUNTIME-TEST-CAPTURE-2","implementation":"CPython","version":"3.11.14","interpreter":interpreter,"bootstrap":BOOTSTRAP_ARTIFACT,"package_commit":package["commit"],"package_tree":package["tree"],"test_paths":TEST_PATHS[:],"actual_normalized_command":normalized,"expected_count":45,"executed_count":45,"exit_status":0,"tested_closure":V.artifact_identity("TESTED_CLOSURE",V.canonical(closure))}
+    V._runtime_test_capture(result,selected,package["commit"],package["tree"])
+    return result
+
+def package_capture(package, runtime_capture, executor_role, checker_role, packet_raw, manifest_raw):
+    """Construct and cross-validate the exact corrected package handoff."""
+    eb,cb=executor_role["bundle"],checker_role["bundle"]
+    for role_result in (executor_role,checker_role):
+        if role_result.get("derived_package_commit")!=package["commit"] or role_result.get("derived_package_tree")!=package["tree"]: raise CaptureError("role result not derived from package")
+        if role_result["bundle_raw"]!=V.raw_bytes(role_result["bundle_bytes"]) or role_result["bundle_artifact"]!=V.bundle_identity(role_result["bundle"]["role"],role_result["bundle_bytes"]): raise CaptureError("role bundle material")
+        verify_role_bundle(role_result["bundle_bytes"],role_result["bundle"])
+    result={"schema":"D004-PACKAGE-CAPTURE-2","commit":package["commit"],"tree":package["tree"],"timestamp_token":package["timestamp_token"],"commit_payload":V.raw_bytes(package["commit_payload"]),"full_tree":package["full_tree"],"selected_required":[{"path":p,"content":V.raw_bytes(package["selected"][p])} for p in DEFAULT_REQUIRED_PATHS],"executor_bundle":executor_role["bundle_raw"],"checker_bundle":checker_role["bundle_raw"],"executor_bundle_artifact":executor_role["bundle_artifact"],"checker_bundle_artifact":checker_role["bundle_artifact"],"runtime_test_capture":runtime_capture}
+    V._package_capture(result,packet_raw,manifest_raw,eb,cb)
+    return result
+
+def _write_files(root, files):
+    for path, data in files.items():
+        q = root / path; q.parent.mkdir(parents=True, exist_ok=True); q.write_bytes(data); q.chmod(0o644)
+
+def capture_role_bundle(role, sources, dependencies, locks, o_bytes, bundle_output_dir, *, epoch=1700000000, zone="+0000"):
+    """Build, verify and externally bundle one strict isolated zero-parent role commit."""
+    contract = V.provenance_contract(); root_name = contract["source_roots"].get(role)
+    if root_name is None: raise CaptureError("role")
+    sets = [set(sources), set(dependencies), set(locks)]
+    if any(sets[i] & sets[j] for i in range(3) for j in range(i + 1, 3)): raise CaptureError("overlapping closure maps")
+    tracked = {**sources, **dependencies, **locks}
+    if any(Path(p).name.startswith("test") or "/test" in p for p in tracked): raise CaptureError("test files excluded from role closure")
+    pure_tree = V.build_git_tree(tracked)["root"]
+    output = Path(bundle_output_dir).resolve(); output.mkdir(parents=True, exist_ok=True)
+    with tempfile.TemporaryDirectory() as td:
+        repo = Path(td, "role"); repo.mkdir(); _git(repo, "init", "-q"); _require_sha1(repo); _write_files(repo, tracked)
+        _git(repo, "add", "--", *sorted(tracked)); tree = _git(repo, "write-tree").stdout.decode().strip()
+        if tree != pure_tree: raise CaptureError("Git/pure tree mismatch")
+        identity_line = f"D004 {role.title()} <d004-{role.lower()}@invalid> {epoch} {zone}".encode()
+        payload = b"tree " + tree.encode() + b"\nauthor " + identity_line + b"\ncommitter " + identity_line + b"\n\nD-004 isolated " + role.encode() + b" capture\n"
+        commit = _git(repo, "hash-object", "-t", "commit", "-w", "--stdin", data=payload).stdout.decode().strip()
+        if V.git_commit(payload, tree) != commit or V.parse_git_commit(payload, tree)["parents"]: raise CaptureError("strict zero-parent commit mismatch")
+        _git(repo, "update-ref", f"refs/d004/{role.lower()}", commit)
+        _git(repo, "reset", "-q", "--hard", commit)
+        if _git(repo, "status", "--porcelain=v1", "--untracked-files=all").stdout: raise CaptureError("role repo not clean")
+        if set(_tree_entries(repo, commit)) != set(tracked): raise CaptureError("shared or monorepo role commit")
+        _git(repo, "fsck", "--full", "--strict")
+        bundle_path = output / f"d004-{role.lower()}-{commit}.bundle"
+        _git(repo, "bundle", "create", bundle_path, f"refs/d004/{role.lower()}")
+        _git(repo, "bundle", "verify", bundle_path)
+        bundle_bytes = bundle_path.read_bytes()
+    clean = {"head_commit":commit,"index_tree":tree,"worktree_tree":tree,"untracked_paths":[],"modified_paths":[],"tracked_paths":sorted(tracked),"tracked_paths_sha256":V.sha256_bytes(V.canonical(sorted(tracked)))}
+    identity = V.producer_identity(role,sources,dependencies,locks,tracked,payload,clean,o_bytes,contract)
+    bundle = {"identity":identity,"role":role,"sources":sources,"dependencies":dependencies,"locks":locks,"tracked":tracked,"commit_payload":payload,"clean_attestation":clean,"o_bytes":o_bytes}
+    return {"bundle":bundle,"bundle_bytes":bundle_bytes,"bundle_raw":V.raw_bytes(bundle_bytes),"bundle_artifact":V.bundle_identity(role,bundle_bytes),"bundle_path":str(bundle_path),"commit":commit,"tree":tree,"ref":f"refs/d004/{role.lower()}"}
+
+def capture_roles_from_package(package, o_bytes, bundle_output_dir):
+    """Derive both role closures only from captured selected package bytes."""
+    selected=package["selected"]; locks={p:selected[p] for p in V.provenance_contract()["mandatory_locks"]}; out={}
+    for role in ("EXECUTOR","CHECKER"):
+        prefix="future/d004_"+role.lower()+"/"
+        closure={p:selected[p] for p in DEFAULT_REQUIRED_PATHS if p.startswith(prefix) and not p.rsplit("/",1)[-1].startswith("test")}
+        out[role.lower()]=capture_role_bundle(role,closure,{},locks,o_bytes,bundle_output_dir)
+        out[role.lower()]["derived_package_commit"]=package["commit"]
+        out[role.lower()]["derived_package_tree"]=package["tree"]
+    return out
+
+def verify_role_bundle(bundle_bytes, expected_bundle):
+    """Reconstruct a role bundle and bind every Git byte/object to the pure bundle."""
+    if not isinstance(bundle_bytes, bytes) or not bundle_bytes: raise CaptureError("bundle bytes")
+    role=expected_bundle["role"]; identity=expected_bundle["identity"]; commit=identity["git"]["commit"]["commit"]
+    with tempfile.TemporaryDirectory() as td:
+        path=Path(td,"capture.bundle"); path.write_bytes(bundle_bytes)
+        repo=Path(td,"repo"); repo.mkdir(); _git(repo,"init","-q"); _git(repo,"bundle","verify",path); _git(repo,"fetch",path,commit); _git(repo,"update-ref",f"refs/d004/{role.lower()}",commit)
+        _git(repo,"fsck","--full","--strict")
+        payload=_git(repo,"cat-file","commit",commit).stdout
+        if payload != expected_bundle["commit_payload"]: raise CaptureError("bundle commit payload")
+        entries=_tree_entries(repo,commit); tracked=expected_bundle["tracked"]
+        if set(entries)!=set(tracked): raise CaptureError("bundle closure inventory")
+        for p,b in tracked.items():
+            mode,typ,oid=entries[p]
+            if mode!="100644" or typ!="blob" or _git(repo,"cat-file","blob",oid).stdout!=b: raise CaptureError("bundle closure bytes")
+    V.validate_producer_identity(identity,role,expected_bundle["sources"],expected_bundle["dependencies"],expected_bundle["locks"],tracked,expected_bundle["commit_payload"],expected_bundle["clean_attestation"],expected_bundle["o_bytes"],V.provenance_contract())
+    return True
+
+def main(argv=None):
+    p=argparse.ArgumentParser(); p.add_argument("repo"); p.add_argument("python"); p.add_argument("--inventory",required=True,help="JSON object in exact required-path order mapping paths to SHA-256"); p.add_argument("--bundle-dir",required=True); p.add_argument("--o-bytes",required=True)
+    a=p.parse_args(argv); commit=_git(a.repo,"rev-parse","HEAD").stdout.decode().strip(); spec=json.loads(Path(a.inventory).read_text(),object_pairs_hook=dict); expected={}
+    if list(spec)!=DEFAULT_REQUIRED_PATHS: raise CaptureError("inventory must be exact ordered required paths")
+    for path,digest in spec.items():
+        raw=_git(a.repo,"show",f"{commit}:{path}").stdout
+        if _sha(raw)!=digest: raise CaptureError("inventory digest mismatch")
+        expected[path]=raw
+    package=capture_package_commit(a.repo,commit,expected); runtime=runtime_test_capture(package,a.python); roles=capture_roles_from_package(package,Path(a.o_bytes).read_bytes(),a.bundle_dir)
+    result=package_capture(package,runtime,roles["executor"],roles["checker"],expected[DEFAULT_REQUIRED_PATHS[0]],expected[DEFAULT_REQUIRED_PATHS[1]])
+    metadata={"schema":result["schema"],"commit":result["commit"],"tree":result["tree"],"timestamp_token":result["timestamp_token"],"executor_bundle_artifact":result["executor_bundle_artifact"],"checker_bundle_artifact":result["checker_bundle_artifact"],"runtime_test_capture":result["runtime_test_capture"]}
+    print(V.canonical(metadata).decode(),end=""); return 0
+
+if __name__ == "__main__":
+    try: raise SystemExit(main())
+    except CaptureError as e: print(f"capture error: {e}",file=sys.stderr); raise SystemExit(2)
diff --git a/decisions/d004_manifest.py b/decisions/d004_manifest.py
index 763f54deb1..79221fdc11 100644
--- a/decisions/d004_manifest.py
+++ b/decisions/d004_manifest.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """D-004 C1+C2 typed relation validator; stdlib, no evidence/freeze behavior."""
 from __future__ import annotations
-import ast,hashlib,itertools,json,re,sys,unicodedata
+import ast,hashlib,itertools,json,re,sys,unicodedata,zlib
 from pathlib import Path,PurePosixPath
 class ManifestError(ValueError):pass
 STAGE="PREREGISTERED";SCHEMA="D004-MANIFEST-1";U64=2**64-1
@@ -105,7 +105,10 @@ def schemas():
  case=C(id=ID,family=E(FAMILIES[:-1]),template=P("string"),request=ID,initial_state=R("State"),steps=A(R("Step")))
  image=C(state=R("State"),durable_events=A(ID));ck=T([ID,A(ID)]);cell=C(key=ck,case=ID,included_steps=A(ID),image=R("DurableImage"),event_mark=E(["UNRESOLVED","NOT_OCCURRED","OCCURRED"]),classification=E(list(ACTIONS)),action=E(list(ACTIONS.values())))
  rctx=C(case=ID,request=ID,image=R("DurableImage"),classification=E(list(ACTIONS)),action=E(list(ACTIONS.values())));rin=C(cell_key=ck,context=R("RecoveryContext"),mode=E(["OBSERVE","STALE_REPLAY","RECOVERY_CYCLES"]),crash=E(["NONE","BEFORE_EACH_COMMIT","AFTER_EACH_COMMIT"]),outage=E(["NONE","MODEL","NETWORK"]));rr=C(image=R("DurableImage"),operations=A(R("Operation")),committed_cycles=P("string"),stable=P("bool"),classification=E(list(ACTIONS)),action=E(list(ACTIONS.values())))
- return {"Id":C(tag=E(sorted(TAGS)),value=P("string")),"Grant":grant,"GrantPresentation":presentation,"D003Validation":validation,"Outcome":outcome,"Revision":rev,"WorldBinding":wb,"RevocationFact":rf,"AccountingOccurrence":acct,"Promotion":promo,"Effect":effect,"Uncertainty":unc,"Operation":op,"State":state,"Step":step,"Case":case,"DurableImage":image,"HistoryCell":cell,"RecoveryContext":rctx,"RecoveryInput":rin,"RecoveryResult":rr}
+ artifact=C(kind=P("string"),sha256=P("string"),byte_length=P("u64"));raw=C(encoding=L("lowercase-hex"),byte_length=P("u64"),sha256=P("string"),data=P("string"));leaf=C(path=P("string"),mode=L("100644"),type=L("blob"),blob_oid=P("string"),content=R("RawBytes"))
+ runtime=C(schema=L("D004-RUNTIME-TEST-CAPTURE-2"),implementation=L("CPython"),version=L("3.11.14"),interpreter=C(kind=L("PYTHON_INTERPRETER"),sha256=P("string"),byte_length=P("u64")),bootstrap=C(kind=L("PYTHON_BOOTSTRAP"),sha256=P("string"),byte_length=P("u64")),package_commit=P("string"),package_tree=P("string"),test_paths=T([L("decisions/test_d004_manifest.py"),L("future/d004_executor/test_producer.py"),L("future/d004_checker/test_producer.py")]),actual_normalized_command=T([L("CPYTHON"),L("-I"),L("-S"),L("-c"),P("string"),L("<EXPORT_ROOT>"),L("decisions.test_d004_manifest"),L("future.d004_executor.test_producer"),L("future.d004_checker.test_producer")]),expected_count=L(45),executed_count=L(45),exit_status=L(0),tested_closure=C(kind=L("TESTED_CLOSURE"),sha256=P("string"),byte_length=P("u64")))
+ selected=C(path=P("string"),content=R("RawBytes"));package=C(schema=L("D004-PACKAGE-CAPTURE-2"),commit=P("string"),tree=P("string"),timestamp_token=P("string"),commit_payload=R("RawBytes"),full_tree=A(R("GitTreeLeaf")),selected_required=A(R("SelectedRequiredFile")),executor_bundle=R("RawBytes"),checker_bundle=R("RawBytes"),executor_bundle_artifact=R("ArtifactIdentity"),checker_bundle_artifact=R("ArtifactIdentity"),runtime_test_capture=R("RuntimeTestCapture"))
+ return {"Id":C(tag=E(sorted(TAGS)),value=P("string")),"Grant":grant,"GrantPresentation":presentation,"D003Validation":validation,"Outcome":outcome,"Revision":rev,"WorldBinding":wb,"RevocationFact":rf,"AccountingOccurrence":acct,"Promotion":promo,"Effect":effect,"Uncertainty":unc,"Operation":op,"State":state,"Step":step,"Case":case,"DurableImage":image,"HistoryCell":cell,"RecoveryContext":rctx,"RecoveryInput":rin,"RecoveryResult":rr,"ArtifactIdentity":artifact,"RawBytes":raw,"GitTreeLeaf":leaf,"SelectedRequiredFile":selected,"RuntimeTestCapture":runtime,"PackageCapture":package}
 
 def base():return {"canonical_root":I("RootId","root-old"),"generation":I("GenerationId","gen-old"),"known_good":I("RootId","root-old"),"world_bindings":[],"replay_keys":[],"outcomes":[],"grants":[],"lineage_nonces":[],"claims":[],"revisions":[],"revocations":[],"accounting":[],"promotions":[],"effects":[],"uncertainties":[]}
 def upsert(xs,v,identity="id"):
@@ -311,8 +314,12 @@ def git_commit(payload,expected_tree=None):
  return parse_git_commit(payload,expected_tree)["commit"]
 STDLIB=tuple(sorted({"ast","collections","dataclasses","hashlib","itertools","json","pathlib","re","sys","typing","unicodedata"}))
 PYTHON_CONTRACT={"implementation":"CPython","version":"3.11","stdlib_allowlist":list(STDLIB)}
+REQUIRED_PACKAGE_PATHS=["decisions/D-004-PACKET.md","decisions/d004-crash-manifest-v1.json","decisions/d004_manifest.py","decisions/test_d004_manifest.py","future/d004_executor/producer.py","future/d004_executor/test_producer.py","future/d004_checker/producer.py","future/d004_checker/test_producer.py","decisions/d004_capture.py","decisions/test_d004_capture.py"]
+TEST_PATHS=["decisions/test_d004_manifest.py","future/d004_executor/test_producer.py","future/d004_checker/test_producer.py"]
+TEST_MODULES=["decisions.test_d004_manifest","future.d004_executor.test_producer","future.d004_checker.test_producer"]
+FREEZE_FIELDS=["schema","packet","manifest","executor_source","checker_source","executor_identity","checker_identity","executor_bundle","checker_bundle","runtime_test_capture","commit","tree","timestamp_token"]
 def provenance_contract():
- return {"producer_schema":"D004-PRODUCER-IDENTITY-2","git_object_format":"sha1","content_hash":"sha256","git_blob_rule":"SHA1(blob SP decimal-length NUL bytes)","git_tree_rule":"RECURSIVE_CANONICAL_RAW_NAME_BYTES_DIRECTORY_SUFFIX_SLASH","git_commit_rule":"STRICT_TREE_PARENTS_AUTHOR_COMMITTER_MESSAGE","file_modes":{"regular":"100644","tree":"40000","executable":"FORBIDDEN","symlink":"FORBIDDEN"},"python":PYTHON_CONTRACT,"source_roots":{"EXECUTOR":"future/d004_executor","CHECKER":"future/d004_checker"},"dependency_roots":["role_source_root","future/d004_common"],"mandatory_locks":["decisions/D-004-PACKET.md","decisions/d004-crash-manifest-v1.json"],"tracked_closure":"EXACT_SOURCE_DEPENDENCY_LOCK_UNION","clean_capture":"SUPPLIED_CLOSED_GIT_FACTS_NOT_LIVE_INSPECTION","freeze_record_fields":["schema","packet_sha256","manifest_sha256","executor_identity_sha256","checker_identity_sha256","commit","tree","frozen_at"],"invalidation":["packet","manifest","schema","semantics","cases","assertions","source","dependency","lock","identity"],"current_freeze_record":None}
+ return {"producer_schema":"D004-PRODUCER-IDENTITY-2","package_capture_schema":"D004-PACKAGE-CAPTURE-2","git_object_format":"sha1","content_hash":"sha256","raw_bytes_encoding":"LOWERCASE_HEX_WITH_LENGTH_AND_SHA256","git_blob_rule":"SHA1(blob SP decimal-length NUL bytes)","git_tree_rule":"RECURSIVE_CANONICAL_RAW_NAME_BYTES_DIRECTORY_SUFFIX_SLASH","git_commit_rule":"STRICT_TREE_PARENTS_AUTHOR_COMMITTER_MESSAGE","file_modes":{"regular":"100644","tree":"40000","executable":"FORBIDDEN","symlink":"FORBIDDEN"},"python":PYTHON_CONTRACT,"source_roots":{"EXECUTOR":"future/d004_executor","CHECKER":"future/d004_checker"},"dependency_roots":["role_source_root","future/d004_common"],"mandatory_locks":["decisions/D-004-PACKET.md","decisions/d004-crash-manifest-v1.json"],"required_package_paths":REQUIRED_PACKAGE_PATHS,"tested_closure":"EXACT_REQUIRED_PACKAGE_PATHS_AND_BYTES","tracked_closure":"EXACT_SOURCE_DEPENDENCY_LOCK_UNION","clean_capture":"SUPPLIED_CLOSED_GIT_FACTS_NOT_LIVE_INSPECTION","freeze_record_fields":FREEZE_FIELDS,"runtime_test_capture_schema":"RuntimeTestCapture","runtime_command":"CPYTHON -I -S -c <bootstrap_sha256> <EXPORT_ROOT> modules...","timestamp_token_grammar":"GIT_COMMITTER_TIMESTAMP:<decimal-seconds>:<+/-HHMM>","timestamp_token_semantics":"DERIVED_FROM_UNIQUE_COMMITTER_HEADER_NOT_TRUSTED_TIME_FRESHNESS_OR_NOTARIZATION","invalidation":["packet","manifest","schema","semantics","cases","assertions","source","dependency","lock","identity","package_inventory","runtime","bundle"],"current_freeze_record":None}
 def module_map(byte_map):
  out={}
  for p in sorted(_normalized_map(byte_map)):
@@ -696,15 +703,203 @@ def _bundle_schema(b,p="bundle"):
  exact(b,{"identity","role","sources","dependencies","locks","tracked","commit_payload","clean_attestation","o_bytes"},p);validate_identity_schema(b["identity"])
  if not all(isinstance(b[x],dict) for x in ("sources","dependencies","locks","tracked")) or not isinstance(b["commit_payload"],bytes) or not isinstance(b["o_bytes"],bytes):raise ManifestError(p+" bytes")
 def source_identity(bundle):return artifact_identity(bundle["role"]+"_SOURCE",canonical({"sources":inventory(bundle["sources"]),"dependencies":inventory(bundle["dependencies"]),"tracked":inventory(bundle["tracked"])}))
-def _package_capture(capture):
- exact(capture,{"commit","tree","timestamp_token"},"package capture");_hex(capture["commit"],40,"freeze commit");_hex(capture["tree"],40,"freeze tree")
- if not isinstance(capture["timestamp_token"],str) or not capture["timestamp_token"]:raise ManifestError("timestamp token")
+_TIMESTAMP_TOKEN_RE=re.compile(r"GIT_COMMITTER_TIMESTAMP:([0-9]+):([+-])([0-9]{2})([0-9]{2})")
+def _timestamp_token(v):
+ if not isinstance(v,str):raise ManifestError("timestamp token")
+ m=_TIMESTAMP_TOKEN_RE.fullmatch(v)
+ if m is None:raise ManifestError("timestamp token grammar")
+ seconds,hours,minutes=m.group(1),int(m.group(3)),int(m.group(4))
+ if (len(seconds)>1 and seconds[0]=="0") or hours>14 or minutes>59 or (hours==14 and minutes!=0):raise ManifestError("timestamp token value")
+def raw_bytes(data):
+ if not isinstance(data,bytes):raise ManifestError("raw bytes")
+ return {"encoding":"lowercase-hex","byte_length":len(data),"sha256":sha256_bytes(data),"data":data.hex()}
+def _decode_raw(v,p):
+ exact(v,{"encoding","byte_length","sha256","data"},p)
+ if v["encoding"]!="lowercase-hex" or not isinstance(v["data"],str) or re.fullmatch(r"(?:[0-9a-f]{2})*",v["data"]) is None:raise ManifestError(p+" encoding")
+ try:data=bytes.fromhex(v["data"])
+ except ValueError as e:raise ManifestError(p+" hex") from e
+ _hex(v["sha256"],64,p+" hash")
+ if v["byte_length"]!=len(data) or v["sha256"]!=sha256_bytes(data):raise ManifestError(p+" identity")
+ return data
+def package_leaf(path,data):return {"path":path,"mode":"100644","type":"blob","blob_oid":git_blob(data),"content":raw_bytes(data)}
+def _committer_token(payload):
+ try:head=payload.split(b"\n\n",1)[0]
+ except Exception as e:raise ManifestError("commit payload") from e
+ rows=[x for x in head.split(b"\n") if x.startswith(b"committer ")]
+ if len(rows)!=1:raise ManifestError("unique committer")
+ m=_IDENT_RE.fullmatch(rows[0][10:])
+ if m is None:raise ManifestError("committer identity")
+ parts=rows[0].rsplit(b" ",2);token="GIT_COMMITTER_TIMESTAMP:"+parts[-2].decode()+":"+parts[-1].decode();_timestamp_token(token);return token
+def _runtime_test_capture(capture,selected=None,commit=None,tree=None):
+ conforms(capture,schemas()["RuntimeTestCapture"],schemas(),"runtime_test_capture")
+ _artifact(capture["interpreter"],"PYTHON_INTERPRETER","runtime interpreter");_artifact(capture["bootstrap"],"PYTHON_BOOTSTRAP","runtime bootstrap");_hex(capture["package_commit"],40,"runtime commit");_hex(capture["package_tree"],40,"runtime tree");_artifact(capture["tested_closure"],"TESTED_CLOSURE","tested closure")
+ expected_command=["CPYTHON","-I","-S","-c",capture["bootstrap"]["sha256"],"<EXPORT_ROOT>",*TEST_MODULES]
+ if capture["actual_normalized_command"]!=expected_command:raise ManifestError("runtime command")
+ if selected is not None:
+  closure={"package_commit":commit,"package_tree":tree,"tested_files":[{"path":p,"sha256":sha256_bytes(selected[p]),"byte_length":len(selected[p])} for p in REQUIRED_PACKAGE_PATHS]}
+  if capture["package_commit"]!=commit or capture["package_tree"]!=tree or capture["tested_closure"]!=artifact_identity("TESTED_CLOSURE",canonical(closure)):raise ManifestError("runtime tested closure")
+def bundle_identity(role,raw):return artifact_identity(role+"_GIT_BUNDLE",raw)
+def _delta_varint(data,pos):
+ value=0;shift=0
+ while True:
+  if pos>=len(data) or shift>63:raise ManifestError("bundle delta varint")
+  byte=data[pos];pos+=1;value|=(byte&127)<<shift
+  if not byte&128:return value,pos
+  shift+=7
+def _apply_git_delta(base,delta):
+ base_size,pos=_delta_varint(delta,0);result_size,pos=_delta_varint(delta,pos)
+ if base_size!=len(base):raise ManifestError("bundle delta base size")
+ out=bytearray()
+ while pos<len(delta):
+  op=delta[pos];pos+=1
+  if op&128:
+   offset=0;size=0
+   for bit,shift in ((1,0),(2,8),(4,16),(8,24)):
+    if op&bit:
+     if pos>=len(delta):raise ManifestError("bundle delta copy offset")
+     offset|=delta[pos]<<shift;pos+=1
+   for bit,shift in ((16,0),(32,8),(64,16)):
+    if op&bit:
+     if pos>=len(delta):raise ManifestError("bundle delta copy size")
+     size|=delta[pos]<<shift;pos+=1
+   if size==0:size=0x10000
+   if offset+size>len(base):raise ManifestError("bundle delta copy range")
+   out.extend(base[offset:offset+size])
+  elif op:
+   if pos+op>len(delta):raise ManifestError("bundle delta insert range")
+   out.extend(delta[pos:pos+op]);pos+=op
+  else:raise ManifestError("bundle delta opcode")
+ if len(out)!=result_size:raise ManifestError("bundle delta result size")
+ return bytes(out)
+def _git_object_payload(kind,data):return f"{kind} {len(data)}".encode()+b"\0"+data
+def _expected_role_objects(bundle):
+ role=bundle["role"];tracked=_normalized_map(bundle["tracked"]);tree=build_git_tree(tracked);objects={}
+ for path,data in tracked.items():objects[git_blob(data)]=("blob",data)
+ root={}
+ for path,data in tracked.items():
+  node=root
+  for part in path.split("/")[:-1]:node=node.setdefault(part,{})
+  node[path.split("/")[-1]]=data
+ def emit(node):
+  rows=[]
+  for name,value in node.items():
+   if isinstance(value,dict):oid=emit(value);mode=b"40000";key=name.encode()+b"/"
+   else:oid=git_blob(value);mode=b"100644";key=name.encode()
+   rows.append((key,mode+b" "+name.encode()+b"\0"+bytes.fromhex(oid)))
+  payload=b"".join(row for _,row in sorted(rows));oid=git_sha1_object("tree",payload);objects[oid]=("tree",payload);return oid
+ if emit(root)!=tree["root"]:raise ManifestError("bundle expected tree")
+ payload=bundle["commit_payload"];commit=parse_git_commit(payload,tree["root"])
+ if commit["parents"]:raise ManifestError("bundle role commit parents")
+ objects[commit["commit"]]=("commit",payload)
+ return commit["commit"],f"refs/d004/{role.lower()}",objects
+def validate_role_bundle_bytes(raw,bundle):
+ """Purely reconstruct and bind a complete external Git bundle to a logical role."""
+ if not isinstance(raw,bytes):raise ManifestError("bundle bytes")
+ expected_commit,expected_ref,expected_objects=_expected_role_objects(bundle)
+ marker=raw.find(b"\n\n")
+ if marker<0:raise ManifestError("bundle header")
+ header=raw[:marker].split(b"\n");pack=raw[marker+2:]
+ if not header or header[0] not in (b"# v2 git bundle",b"# v3 git bundle"):raise ManifestError("bundle version")
+ refs={}
+ for line in header[1:]:
+  if not line:raise ManifestError("bundle header line")
+  if line.startswith(b"-"):raise ManifestError("bundle prerequisites forbidden")
+  if line.startswith(b"@"):raise ManifestError("bundle capability forbidden")
+  try:oid,name=line.split(b" ",1);name=name.decode("ascii")
+  except (ValueError,UnicodeError) as e:raise ManifestError("bundle ref") from e
+  if re.fullmatch(rb"[0-9a-f]{40}",oid) is None or name in refs:raise ManifestError("bundle ref")
+  refs[name]=oid.decode()
+ if refs!={expected_ref:expected_commit}:raise ManifestError("bundle advertised role ref")
+ if len(pack)<32 or pack[:4]!=b"PACK":raise ManifestError("bundle pack")
+ if int.from_bytes(pack[4:8],"big") not in (2,3):raise ManifestError("bundle pack version")
+ count=int.from_bytes(pack[8:12],"big");end=len(pack)-20
+ if hashlib.sha1(pack[:end]).digest()!=pack[end:]:raise ManifestError("bundle pack checksum")
+ pos=12;records=[]
+ for _ in range(count):
+  offset=pos
+  if pos>=end:raise ManifestError("bundle pack object")
+  byte=pack[pos];pos+=1;kind=(byte>>4)&7;size=byte&15;shift=4
+  while byte&128:
+   if pos>=end or shift>63:raise ManifestError("bundle pack size")
+   byte=pack[pos];pos+=1;size|=(byte&127)<<shift;shift+=7
+  base=None
+  if kind==6:
+   if pos>=end:raise ManifestError("bundle ofs delta")
+   byte=pack[pos];pos+=1;distance=byte&127
+   while byte&128:
+    if pos>=end:raise ManifestError("bundle ofs delta")
+    byte=pack[pos];pos+=1;distance=((distance+1)<<7)|(byte&127)
+   base=("offset",offset-distance)
+  elif kind==7:
+   if pos+20>end:raise ManifestError("bundle ref delta")
+   base=("oid",pack[pos:pos+20].hex());pos+=20
+  elif kind not in (1,2,3,4):raise ManifestError("bundle object type")
+  inflater=zlib.decompressobj()
+  try:data=inflater.decompress(pack[pos:end])
+  except zlib.error as e:raise ManifestError("bundle zlib") from e
+  if not inflater.eof:raise ManifestError("bundle zlib boundary")
+  consumed=(end-pos)-len(inflater.unused_data);pos+=consumed
+  if len(data)!=size:raise ManifestError("bundle object size")
+  records.append({"offset":offset,"kind":kind,"base":base,"data":data})
+ if pos!=end:raise ManifestError("bundle trailing pack data")
+ resolved={};by_offset={};pending=records[:];names={1:"commit",2:"tree",3:"blob",4:"tag"}
+ while pending:
+  progress=False
+  for record in pending[:]:
+   kind=record["kind"];data=record["data"]
+   if kind in names:object_kind=names[kind]
+   else:
+    mode,key=record["base"];base=by_offset.get(key) if mode=="offset" else resolved.get(key)
+    if base is None:continue
+    object_kind,base_data=base;data=_apply_git_delta(base_data,data)
+   oid=hashlib.sha1(_git_object_payload(object_kind,data)).hexdigest()
+   if oid in resolved:raise ManifestError("bundle duplicate object")
+   resolved[oid]=(object_kind,data);by_offset[record["offset"]]=(object_kind,data);pending.remove(record);progress=True
+  if not progress:raise ManifestError("bundle unresolved delta")
+ if resolved!=expected_objects:raise ManifestError("bundle exact object closure")
+ return True
+def _package_capture(capture,packet_raw=None,manifest_raw=None,executor_bundle=None,checker_bundle=None):
+ conforms(capture,schemas()["PackageCapture"],schemas(),"package capture")
+ if capture["schema"]!="D004-PACKAGE-CAPTURE-2":raise ManifestError("package schema")
+ payload=_decode_raw(capture["commit_payload"],"commit payload");full=capture["full_tree"]
+ if not isinstance(full,list) or not full:raise ManifestError("full tree")
+ files={};last=None
+ for row in full:
+  conforms(row,schemas()["GitTreeLeaf"],schemas(),"tree leaf");p=safe_path(row["path"])
+  if last is not None and p<=last:raise ManifestError("full tree order")
+  data=_decode_raw(row["content"],"tree content");_hex(row["blob_oid"],40,"blob oid")
+  if row["mode"]!="100644" or row["type"]!="blob" or row["blob_oid"]!=git_blob(data):raise ManifestError("tree leaf binding")
+  files[p]=data;last=p
+ tree=build_git_tree(files)["root"];commit=parse_git_commit(payload,tree)["commit"];token=_committer_token(payload)
+ if capture["tree"]!=tree or capture["commit"]!=commit or capture["timestamp_token"]!=token:raise ManifestError("package derived facts")
+ selected_rows=capture["selected_required"]
+ if not isinstance(selected_rows,list) or [x.get("path") if isinstance(x,dict) else None for x in selected_rows]!=REQUIRED_PACKAGE_PATHS:raise ManifestError("selected required paths")
+ selected={}
+ for row in selected_rows:
+  exact(row,{"path","content"},"selected required");data=_decode_raw(row["content"],"selected content")
+  if row["path"] not in files or files[row["path"]]!=data:raise ManifestError("selected/full tree binding")
+  selected[row["path"]]=data
+ bundle_raws={role:_decode_raw(capture[role+"_bundle"],role+" bundle") for role in ("executor","checker")}
+ bundle_artifacts={role:bundle_identity(role.upper(),bundle_raws[role]) for role in ("executor","checker")}
+ for role,bundle in (("executor",executor_bundle),("checker",checker_bundle)):
+  if bundle is None:raise ManifestError("logical bundle required")
+  _bundle_schema(bundle,role+" logical bundle");validate_role_bundle_bytes(bundle_raws[role],bundle)
+  _artifact(capture[role+"_bundle_artifact"],role.upper()+"_GIT_BUNDLE",role+" bundle artifact")
+  if capture[role+"_bundle_artifact"]!=bundle_artifacts[role]:raise ManifestError("bundle artifact binding")
+ _runtime_test_capture(capture["runtime_test_capture"],selected,commit,tree)
+ if packet_raw is not None:
+  if selected["decisions/D-004-PACKET.md"]!=packet_raw or selected["decisions/d004-crash-manifest-v1.json"]!=manifest_raw:raise ManifestError("package lock bytes")
+  for b,role in ((executor_bundle,"executor"),(checker_bundle,"checker")):
+   if b["locks"]!={"decisions/D-004-PACKET.md":packet_raw,"decisions/d004-crash-manifest-v1.json":manifest_raw}:raise ManifestError("bundle lock bytes")
+   expected={p:selected[p] for p in selected if p.startswith("future/d004_"+role+"/") and not p.rsplit("/",1)[-1].startswith("test")}
+   if {**b["sources"],**b["dependencies"]}!=expected:raise ManifestError("bundle package source bytes")
+ return {"commit":commit,"tree":tree,"timestamp_token":token,"selected":selected,"bundle_artifacts":bundle_artifacts}
 def freeze_expected(packet_raw,manifest_raw,executor_bundle,checker_bundle,package_capture):
- _bundle_schema(executor_bundle);_bundle_schema(checker_bundle);_package_capture(package_capture);validate_independence(executor_bundle,checker_bundle,provenance_contract())
- ei=canonical(executor_bundle["identity"]);ci=canonical(checker_bundle["identity"]);es=source_identity(executor_bundle);cs=source_identity(checker_bundle)
- return {"schema":"D004-FREEZE-1","packet":artifact_identity("PACKET",packet_raw),"manifest":artifact_identity("MANIFEST",manifest_raw),"executor_source":es,"checker_source":cs,"executor_identity":artifact_identity("EXECUTOR_IDENTITY",ei),"checker_identity":artifact_identity("CHECKER_IDENTITY",ci),"commit":package_capture["commit"],"tree":package_capture["tree"],"timestamp_token":package_capture["timestamp_token"]}
+ _bundle_schema(executor_bundle);_bundle_schema(checker_bundle);derived=_package_capture(package_capture,packet_raw,manifest_raw,executor_bundle,checker_bundle);validate_independence(executor_bundle,checker_bundle,provenance_contract())
+ ei=canonical(executor_bundle["identity"]);ci=canonical(checker_bundle["identity"]);es=source_identity(executor_bundle);cs=source_identity(checker_bundle);runtime_raw=canonical(package_capture["runtime_test_capture"])
+ return {"schema":"D004-FREEZE-1","packet":artifact_identity("PACKET",packet_raw),"manifest":artifact_identity("MANIFEST",manifest_raw),"executor_source":es,"checker_source":cs,"executor_identity":artifact_identity("EXECUTOR_IDENTITY",ei),"checker_identity":artifact_identity("CHECKER_IDENTITY",ci),"executor_bundle":derived["bundle_artifacts"]["executor"],"checker_bundle":derived["bundle_artifacts"]["checker"],"runtime_test_capture":artifact_identity("RUNTIME_TEST_CAPTURE",runtime_raw),"commit":derived["commit"],"tree":derived["tree"],"timestamp_token":derived["timestamp_token"]}
 def validate_freeze_bytes(raw,packet_raw,manifest_raw,executor_bundle,checker_bundle,package_capture):
- f=parse_bytes(raw);exact(f,{"schema","packet","manifest","executor_source","checker_source","executor_identity","checker_identity","commit","tree","timestamp_token"},"freeze")
+ f=parse_bytes(raw);exact(f,FREEZE_FIELDS,"freeze")
  expected=freeze_expected(packet_raw,manifest_raw,executor_bundle,checker_bundle,package_capture)
  if f!=expected or raw!=canonical(expected):raise ManifestError("freeze binding")
  return f
diff --git a/decisions/test_d004_capture.py b/decisions/test_d004_capture.py
new file mode 100644
index 0000000000..c6d45d285a
--- /dev/null
+++ b/decisions/test_d004_capture.py
@@ -0,0 +1,85 @@
+import copy
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import inspect
+import unittest
+try:
+ from . import d004_capture as C
+ from . import d004_manifest as V
+except ImportError:
+ import d004_capture as C
+ import d004_manifest as V
+
+def run(args,cwd=None,data=None): return subprocess.check_output(args,cwd=cwd,input=data)
+class CaptureTests(unittest.TestCase):
+ def setUp(self): self.t=tempfile.TemporaryDirectory();self.root=Path(self.t.name)
+ def tearDown(self): self.t.cleanup()
+ def files(self):
+  d={p:(p+"\n").encode() for p in C.DEFAULT_REQUIRED_PATHS};d["decisions/D-004-PACKET.md"]=b"packet\n";d["decisions/d004-crash-manifest-v1.json"]=b"{}\n";d["future/d004_executor/producer.py"]=b"import json\nVALUE='executor'\n";d["future/d004_checker/producer.py"]=b"import pathlib\nVALUE='checker'\n";return d
+ def repo(self,files=None):
+  files=files or self.files();r=self.root/("r"+str(len(list(self.root.iterdir()))));r.mkdir();run(["git","init","-q",r])
+  for p,b in files.items():q=r/p;q.parent.mkdir(parents=True,exist_ok=True);q.write_bytes(b);q.chmod(0o644)
+  run(["git","-C",r,"add","."]);tree=run(["git","-C",r,"write-tree"]).decode().strip();who=b"Fixture <f@x> 1700000001 -0730";payload=b"tree "+tree.encode()+b"\nauthor "+who+b"\ncommitter "+who+b"\n\nfixture\n";commit=run(["git","-C",r,"hash-object","-t","commit","-w","--stdin"],data=payload).decode().strip();run(["git","-C",r,"update-ref","refs/heads/main",commit]);run(["git","-C",r,"reset","-q","--hard",commit]);return r,commit,tree,payload
+ def capture(self,extras=None):
+  selected=self.files();all_files={**selected,**(extras or {})};r,c,t,p=self.repo(all_files);return C.capture_package_commit(r,c,selected),r
+ def runtime_fixture(self,pkg):
+  selected=pkg["selected"];closure={"package_commit":pkg["commit"],"package_tree":pkg["tree"],"tested_files":[{"path":p,"sha256":V.sha256_bytes(selected[p]),"byte_length":len(selected[p])} for p in C.DEFAULT_REQUIRED_PATHS]}
+  return {"schema":"D004-RUNTIME-TEST-CAPTURE-2","implementation":"CPython","version":"3.11.14","interpreter":{"kind":"PYTHON_INTERPRETER","sha256":"1"*64,"byte_length":1},"bootstrap":C.BOOTSTRAP_ARTIFACT,"package_commit":pkg["commit"],"package_tree":pkg["tree"],"test_paths":C.TEST_PATHS[:],"actual_normalized_command":["CPYTHON","-I","-S","-c",C.BOOTSTRAP_ARTIFACT["sha256"],"<EXPORT_ROOT>",*C.TEST_MODULES],"expected_count":45,"executed_count":45,"exit_status":0,"tested_closure":V.artifact_identity("TESTED_CLOSURE",V.canonical(closure))}
+ def test_multifile_monorepo_full_tree_and_selected_binding(self):
+  pkg,_=self.capture({"README.md":b"unrelated\n","lib/x.py":b"x=1\n"});self.assertEqual([x["path"] for x in pkg["full_tree"]],sorted([*C.DEFAULT_REQUIRED_PATHS,"README.md","lib/x.py"]));self.assertEqual(pkg["full_tree"],[V.package_leaf(p,pkg["all_bytes"][p]) for p in sorted(pkg["all_bytes"])]);self.assertEqual(pkg["timestamp_token"],"GIT_COMMITTER_TIMESTAMP:1700000001:-0730")
+  wrong=self.files();wrong[C.DEFAULT_REQUIRED_PATHS[2]]=b"wrong";r,c,_,_=self.repo({**self.files(),"other":b"ok"})
+  with self.assertRaises(C.CaptureError):C.capture_package_commit(r,c,wrong)
+  missing=self.files();missing.pop(C.DEFAULT_REQUIRED_PATHS[-1])
+  with self.assertRaises(C.CaptureError):C.capture_package_commit(r,c,missing)
+ def test_unrepresentable_modes_and_non_utf8_rejected(self):
+  files=self.files();files["exec.sh"]=b"x";r,c,_,_=self.repo(files);(r/"exec.sh").chmod(0o755);run(["git","-C",r,"add","exec.sh"]);tree=run(["git","-C",r,"write-tree"]).decode().strip();who=b"F <f@x> 1 +0000";payload=b"tree "+tree.encode()+b"\nauthor "+who+b"\ncommitter "+who+b"\n\nx\n";c=run(["git","-C",r,"hash-object","-t","commit","-w","--stdin"],data=payload).decode().strip();run(["git","-C",r,"update-ref","refs/heads/main",c]);run(["git","-C",r,"reset","-q","--hard",c])
+  with self.assertRaises(C.CaptureError):C.capture_package_commit(r,c,self.files())
+ def test_controlled_global_clean_head_attacks_and_ignored_scope(self):
+  self.assertEqual(list(inspect.signature(C.capture_package_commit).parameters),["repo","commit","expected_paths"])
+  with self.assertRaises(TypeError):C.capture_package_commit(None,None,None,controlled=False)
+  pkg,r=self.capture();c=pkg["commit"];run(["git","-C",r,"commit","--allow-empty","-q","-m","next"],cwd=r)
+  with self.assertRaises(C.CaptureError):C.capture_package_commit(r,c,self.files())
+  run(["git","-C",r,"reset","--hard",c]);(r/"unrelated").write_bytes(b"x")
+  with self.assertRaises(C.CaptureError):C.capture_package_commit(r,c,self.files())
+  (r/"unrelated").unlink();p=r/"README.md";p.write_bytes(b"x");run(["git","-C",r,"add","README.md"])
+  with self.assertRaises(C.CaptureError):C.capture_package_commit(r,c,self.files())
+  run(["git","-C",r,"reset","--hard",c]);(r/".git/info/exclude").write_text("ignored\n");(r/"ignored").write_bytes(b"x");C.capture_package_commit(r,c,self.files())
+ def test_runtime_v2_command_env_hostility_and_archive_attack(self):
+  self.assertEqual(list(inspect.signature(C.runtime_test_capture).parameters),["package","executable"])
+  for keyword in ("runner","exporter","probe"):
+   with self.assertRaises(TypeError):C.runtime_test_capture({},sys.executable,**{keyword:lambda:None})
+  exe=Path("/tmp/aos-python311-prefix/bin/python3.11").resolve();good=json.dumps(["CPython","3.11.14",str(exe)]).encode()
+  C._test_only_validate_probe_values(exe,0,good,b"")
+  with self.assertRaises(C.CaptureError):C._test_only_validate_probe_values(exe,0,json.dumps(["CPython","3.11.14","/usr/bin/python3"]).encode(),b"")
+  old=dict(os.environ);os.environ.update(PYTHONPATH="/hostile",PYTHONHOME="/bad",PYTHONSTARTUP="/evil")
+  try:self.assertFalse(any(k.startswith("PYTHON") for k in C._minimal_python_env()))
+  finally:os.environ.clear();os.environ.update(old)
+  pkg,_=self.capture({"extra":b"bound"});tampered=copy.deepcopy(pkg);tampered["full_tree"][0]["content"]=V.raw_bytes(b"archive mismatch")
+  with tempfile.TemporaryDirectory() as td:
+   with self.assertRaises(C.CaptureError):C._export_commit(tampered["repo"],tampered["commit"],Path(td)/"export",tampered["full_tree"])
+ def test_bootstrap_hostile_cwd_and_sitecustomize_cannot_execute(self):
+  py=Path("/tmp/aos-python311-prefix/bin/python3.11");self.assertTrue(py.exists());cwd=self.root/"hostile";cwd.mkdir();(cwd/"sitecustomize.py").write_text("raise RuntimeError('executed')\n");root=self.root/"export";root.mkdir();(root/"t.py").write_text("import unittest\nclass T(unittest.TestCase):\n def test_ok(self): self.assertTrue(True)\n")
+  env={"PATH":os.environ.get("PATH",""),"PYTHONPATH":str(cwd)};p=subprocess.run([py,"-I","-S","-c",C.BOOTSTRAP.decode(),root,"t"],cwd=cwd,env=env,stdout=subprocess.PIPE,stderr=subprocess.PIPE);self.assertEqual(p.returncode,0,p.stderr);self.assertEqual(json.loads(p.stdout.split(b"=",1)[1])["executed"],1)
+ def test_actual_cpython_31114_runtime_capture_45(self):
+  files=self.files();test=b"import unittest\nclass T(unittest.TestCase):\n"+b"".join((f" def test_{i:02d}(self): self.assertTrue(True)\n".encode() for i in range(15)))
+  for p in C.TEST_PATHS:files[p]=test
+  r,c,_,_=self.repo(files);pkg=C.capture_package_commit(r,c,files);rt=C.runtime_test_capture(pkg,"/tmp/aos-python311-prefix/bin/python3.11");self.assertEqual(rt["executed_count"],45);V._runtime_test_capture(rt,pkg["selected"],pkg["commit"],pkg["tree"])
+ def test_role_derivation_bundle_roundtrip_and_corruption(self):
+  pkg,_=self.capture();roles=C.capture_roles_from_package(pkg,b"{}\n",self.root/"bundles");ex,ck=roles["executor"],roles["checker"];self.assertTrue(C.verify_role_bundle(ex["bundle_bytes"],ex["bundle"]));self.assertTrue(V.validate_independence(ex["bundle"],ck["bundle"],V.provenance_contract()));self.assertEqual(ex["bundle_raw"],V.raw_bytes(ex["bundle_bytes"]));self.assertEqual(ex["bundle_artifact"],V.bundle_identity("EXECUTOR",ex["bundle_bytes"]));self.assertEqual(ex["bundle"]["sources"],{"future/d004_executor/producer.py":pkg["selected"]["future/d004_executor/producer.py"]})
+  with self.assertRaises(C.CaptureError):C.verify_role_bundle(ex["bundle_bytes"][:-20],ex["bundle"])
+ def test_package_capture_live_pure_roundtrip_and_material_attacks(self):
+  pkg,_=self.capture({"docs/a":b"a"});rt=self.runtime_fixture(pkg);roles=C.capture_roles_from_package(pkg,b"{}\n",self.root/"bundles");packet=pkg["selected"][C.DEFAULT_REQUIRED_PATHS[0]];manifest=pkg["selected"][C.DEFAULT_REQUIRED_PATHS[1]];cap=C.package_capture(pkg,rt,roles["executor"],roles["checker"],packet,manifest);derived=V._package_capture(cap,packet,manifest,roles["executor"]["bundle"],roles["checker"]["bundle"]);self.assertEqual(derived["commit"],pkg["commit"]);self.assertEqual(V.freeze_expected(packet,manifest,roles["executor"]["bundle"],roles["checker"]["bundle"],cap)["commit"],pkg["commit"])
+  for mutate in (lambda q:q.update(commit="0"*40),lambda q:q.update(tree="0"*40),lambda q:q.update(timestamp_token="GIT_COMMITTER_TIMESTAMP:1:+0000"),lambda q:q["runtime_test_capture"].update(tested_closure={"kind":"TESTED_CLOSURE","sha256":"0"*64,"byte_length":0}),lambda q:q["executor_bundle_artifact"].update(sha256="0"*64)):
+   q=copy.deepcopy(cap);mutate(q)
+   with self.assertRaises(V.ManifestError):V._package_capture(q,packet,manifest,roles["executor"]["bundle"],roles["checker"]["bundle"])
+  bad=copy.deepcopy(roles["executor"]);bad["bundle"]["locks"][C.DEFAULT_REQUIRED_PATHS[0]]=b"wrong"
+  with self.assertRaises(Exception):C.package_capture(pkg,rt,bad,roles["checker"],packet,manifest)
+  bad=copy.deepcopy(roles["executor"]);bad["bundle_bytes"]=bad["bundle_bytes"][:-20]
+  with self.assertRaises(C.CaptureError):C.package_capture(pkg,rt,bad,roles["checker"],packet,manifest)
+  bad=copy.deepcopy(roles["executor"]);bad["derived_package_commit"]="0"*40
+  with self.assertRaises(C.CaptureError):C.package_capture(pkg,rt,bad,roles["checker"],packet,manifest)
+if __name__=="__main__":unittest.main()
diff --git a/decisions/test_d004_manifest.py b/decisions/test_d004_manifest.py
index c769134c68..c0485159dc 100644
--- a/decisions/test_d004_manifest.py
+++ b/decisions/test_d004_manifest.py
@@ -90,8 +90,13 @@ class TestD004C2(unittest.TestCase):
   for bad in ({"kind":"FIXTURE","sha256":"0"*64,"byte_length":1},{"kind":"PACKET","sha256":"x"*64,"byte_length":1},{"kind":"PACKET","sha256":"0"*64}):
    with self.assertRaises(V.ManifestError):V.derive_o(m,RAW,bad)
   with self.assertRaises(V.ManifestError):V.derive_o(m,RAW+b" ",pid)
- def _identity(self,role,root,o,source=None,deps=None,message=b"identity\n"):
-  contract=V.provenance_contract();sources=source or {f"{root}/main.py":b"import json\n"};deps=deps or {};locks={"decisions/D-004-PACKET.md":b"packet","decisions/d004-crash-manifest-v1.json":RAW};tracked={**sources,**deps,**locks};tree=V.build_git_tree(tracked)["root"];payload=b"tree "+tree.encode()+b"\nauthor Test User <test@example.com> 1700000000 +0000\ncommitter Test User <test@example.com> 1700000001 -0730\n\n"+message;commit=V.git_commit(payload,tree);clean={"head_commit":commit,"index_tree":tree,"worktree_tree":tree,"untracked_paths":[],"modified_paths":[],"tracked_paths":sorted(tracked),"tracked_paths_sha256":V.sha256_bytes(V.canonical(sorted(tracked)))};identity=V.producer_identity(role,sources,deps,locks,tracked,payload,clean,o,contract);bundle={"identity":identity,"role":role,"sources":sources,"dependencies":deps,"locks":locks,"tracked":tracked,"commit_payload":payload,"clean_attestation":clean,"o_bytes":o};return identity,bundle
+ def _identity(self,role,root,o,source=None,deps=None,message=b"identity\n",locks=None):
+  contract=V.provenance_contract();sources=source or {f"{root}/main.py":b"import json\n"};deps=deps or {};locks=locks or {"decisions/D-004-PACKET.md":b"packet","decisions/d004-crash-manifest-v1.json":RAW};tracked={**sources,**deps,**locks};tree=V.build_git_tree(tracked)["root"];payload=b"tree "+tree.encode()+b"\nauthor Test User <test@example.com> 1700000000 +0000\ncommitter Test User <test@example.com> 1700000001 -0730\n\n"+message;commit=V.git_commit(payload,tree);clean={"head_commit":commit,"index_tree":tree,"worktree_tree":tree,"untracked_paths":[],"modified_paths":[],"tracked_paths":sorted(tracked),"tracked_paths_sha256":V.sha256_bytes(V.canonical(sorted(tracked)))};identity=V.producer_identity(role,sources,deps,locks,tracked,payload,clean,o,contract);bundle={"identity":identity,"role":role,"sources":sources,"dependencies":deps,"locks":locks,"tracked":tracked,"commit_payload":payload,"clean_attestation":clean,"o_bytes":o};return identity,bundle
+ def _raw_bundle(self,bundle):
+  with tempfile.TemporaryDirectory() as td:
+   base=pathlib.Path(td);root=base/"repo";subprocess.run(["git","init","-q",root],check=True)
+   for p,b in bundle["tracked"].items():q=root/p;q.parent.mkdir(parents=True,exist_ok=True);q.write_bytes(b)
+   subprocess.run(["git","-C",root,"add","."],check=True);self.assertEqual(subprocess.check_output(["git","-C",root,"write-tree"]).decode().strip(),bundle["identity"]["git"]["root_tree"]);commit=subprocess.check_output(["git","-C",root,"hash-object","-t","commit","-w","--stdin"],input=bundle["commit_payload"]).decode().strip();ref=f"refs/d004/{bundle['role'].lower()}";subprocess.run(["git","-C",root,"update-ref",ref,commit],check=True);subprocess.run(["git","-C",root,"reset","-q","--hard",commit],check=True);path=base/"role.bundle";subprocess.run(["git","-C",root,"bundle","create",path,ref],check=True);return path.read_bytes()
  def test_c3_provenance_paths_hash_import_git_clean_mutations(self):
   self.assertEqual(V.git_blob(b""),"e69de29bb2d1d6434b8b29ae775ad8c2e48c5391");self.assertEqual(V.git_blob(b"test content\n"),"d670460b4b4aece5915caf5c68d12f560a9fe3e4")
   files={"a":b"flat\n","a.c":b"prefix\n","a/b.txt":b"nested\n","d/x":b"sibling\n"}
@@ -134,7 +139,7 @@ class TestD004C2(unittest.TestCase):
   self.reject(lambda m:m["evidence_dag"]["nodes"].pop());self.reject(lambda m:m["evidence_dag"]["edges"].pop());self.reject(lambda m:m["evidence_dag"]["edges"].reverse());self.reject(lambda m:m["evidence_dag"]["nodes"][0].update(type="OTHER"));self.reject(lambda m:m["evidence_dag"]["edges"][0].update(to="O2"))
   self.assertEqual(m["gates"]["future_adopt_if"],"VALID_EXTERNAL_FREEZE_AND_V_AND_E");self.assertTrue(m["decision"]["freezable"]);self.assertFalse(m["decision"]["frozen"])
  def synthetic_future(self):
-  packet=b"SYNTHETIC NON-RETAINED D004 PACKET\n";m=self.m();o=V.canonical(V.derive_o(m,RAW,V.packet_identity(packet)));_,eb=self._identity("EXECUTOR","future/d004_executor",o,message=b"synthetic executor\n");_,cb=self._identity("CHECKER","future/d004_checker",o,source={"future/d004_checker/main.py":b"import pathlib\n"},message=b"synthetic checker\n");capture={"commit":"1"*40,"tree":"2"*40,"timestamp_token":"SYNTHETIC-TIMESTAMP-TOKEN"};f=V.canonical(V.freeze_expected(packet,RAW,eb,cb,capture));v=V.canonical(V.build_v_report(packet,RAW,f,o,o,eb,cb,capture));e=V.canonical(V.build_e_report(v,packet,RAW,f,o,o,eb,cb,capture));return packet,o,eb,cb,capture,f,v,e
+  packet=b"SYNTHETIC NON-RETAINED D004 PACKET\n";m=self.m();o=V.canonical(V.derive_o(m,RAW,V.packet_identity(packet)));locks={"decisions/D-004-PACKET.md":packet,"decisions/d004-crash-manifest-v1.json":RAW};exsrc={"future/d004_executor/producer.py":b"import json\nROLE='executor'\n"};cksrc={"future/d004_checker/producer.py":b"import pathlib\nROLE='checker'\n"};_,eb=self._identity("EXECUTOR","future/d004_executor",o,source=exsrc,message=b"synthetic executor\n",locks=locks);_,cb=self._identity("CHECKER","future/d004_checker",o,source=cksrc,message=b"synthetic checker\n",locks=locks);selected={p:(locks[p] if p in locks else exsrc[p] if p in exsrc else cksrc[p] if p in cksrc else (p+"\n").encode()) for p in V.REQUIRED_PACKAGE_PATHS};full={**selected,"README.md":b"complete synthetic tree\n"};tree=V.build_git_tree(full)["root"];payload=b"tree "+tree.encode()+b"\nauthor Package <package@example.invalid> 1700000000 +0000\ncommitter Package <package@example.invalid> 1700000001 -0730\n\nsynthetic package\n";commit=V.git_commit(payload,tree);bootstrap=b"synthetic isolated bootstrap\n";boot=V.artifact_identity("PYTHON_BOOTSTRAP",bootstrap);closure={"package_commit":commit,"package_tree":tree,"tested_files":[{"path":p,"sha256":V.sha256_bytes(selected[p]),"byte_length":len(selected[p])} for p in V.REQUIRED_PACKAGE_PATHS]};runtime={"schema":"D004-RUNTIME-TEST-CAPTURE-2","implementation":"CPython","version":"3.11.14","interpreter":{"kind":"PYTHON_INTERPRETER","sha256":"3"*64,"byte_length":123456},"bootstrap":boot,"package_commit":commit,"package_tree":tree,"test_paths":V.TEST_PATHS,"actual_normalized_command":["CPYTHON","-I","-S","-c",boot["sha256"],"<EXPORT_ROOT>",*V.TEST_MODULES],"expected_count":45,"executed_count":45,"exit_status":0,"tested_closure":V.artifact_identity("TESTED_CLOSURE",V.canonical(closure))};exraw=self._raw_bundle(eb);ckraw=self._raw_bundle(cb);capture={"schema":"D004-PACKAGE-CAPTURE-2","commit":commit,"tree":tree,"timestamp_token":"GIT_COMMITTER_TIMESTAMP:1700000001:-0730","commit_payload":V.raw_bytes(payload),"full_tree":[V.package_leaf(p,b) for p,b in sorted(full.items())],"selected_required":[{"path":p,"content":V.raw_bytes(selected[p])} for p in V.REQUIRED_PACKAGE_PATHS],"executor_bundle":V.raw_bytes(exraw),"checker_bundle":V.raw_bytes(ckraw),"executor_bundle_artifact":V.bundle_identity("EXECUTOR",exraw),"checker_bundle_artifact":V.bundle_identity("CHECKER",ckraw),"runtime_test_capture":runtime};f=V.canonical(V.freeze_expected(packet,RAW,eb,cb,capture));v=V.canonical(V.build_v_report(packet,RAW,f,o,o,eb,cb,capture));e=V.canonical(V.build_e_report(v,packet,RAW,f,o,o,eb,cb,capture));return packet,o,eb,cb,capture,f,v,e
  def test_h5_operator_evidence_exact_and_attacks(self):
   ars=V.evaluate_assertions(self.m());self.assertEqual([x["result"]["observed_count"] for x in ars],[73,46,73,7,2,10,4,1971,1971,56,2044,7]);self.assertEqual(len(ars[3]["evidence"]["witnesses"]),7);self.assertTrue(all(x["no_retry"] and x["no_redispatch"] and x["post_dispatch"] for x in ars[3]["evidence"]["witnesses"]));self.assertEqual(len(ars[5]["evidence"]["witnesses"]),10);self.assertEqual(len(ars[6]["evidence"]["witnesses"]),4);self.assertTrue(all(x["pass"] for x in ars[5]["evidence"]["witnesses"]+ars[6]["evidence"]["witnesses"]));self.assertNotIn("CONTRACT_GATE",[x["operator"] for x in ars])
   for i,field,value in ((0,"selector","x"),(1,"expected_count",45),(2,"quantifier","EXISTS"),(3,"order","NONE"),(4,"equality","COUNT_ONLY"),(5,"operator","COUNT")):
@@ -147,9 +152,31 @@ class TestD004C2(unittest.TestCase):
   with self.assertRaises(V.ManifestError):V.validate_o_bytes(o+b" ",RAW,packet)
   for ident in ({"o_sha256":"0"*64},{**eb["identity"],"extra":True}):
    with self.assertRaises(V.ManifestError):V.validate_identity_schema(ident)
-  for field in ("packet","manifest","executor_source","checker_source","executor_identity","checker_identity","commit","tree","timestamp_token"):
-   x=V.parse_bytes(f);x[field]=("0"*40 if field in ("commit","tree") else "changed") if field not in ("packet","manifest","executor_source","checker_source","executor_identity","checker_identity") else {**x[field],"sha256":"0"*64}
+  self.assertEqual(set(V.parse_bytes(f)),set(V.FREEZE_FIELDS));self.assertEqual(self.m()["provenance_contract"]["freeze_record_fields"],V.FREEZE_FIELDS)
+  for field in V.FREEZE_FIELDS[1:]:
+   x=V.parse_bytes(f);x[field]=("0"*40 if field in ("commit","tree") else "changed") if field not in ("packet","manifest","executor_source","checker_source","executor_identity","checker_identity","runtime_test_capture") else {**x[field],"sha256":"0"*64}
+   with self.assertRaises(V.ManifestError):V.validate_freeze_bytes(V.canonical(x),packet,RAW,eb,cb,capture)
+  for mutate in (lambda x:x.pop("runtime_test_capture"),lambda x:x.update(extra=True),lambda x:x.update(runtime_capture=x.pop("runtime_test_capture"))):
+   x=V.parse_bytes(f);mutate(x)
    with self.assertRaises(V.ManifestError):V.validate_freeze_bytes(V.canonical(x),packet,RAW,eb,cb,capture)
+  attacks=[lambda q:q.update(commit="1"*40),lambda q:q.update(tree="2"*40),lambda q:q.update(timestamp_token="GIT_COMMITTER_TIMESTAMP:1700000002:-0730"),lambda q:q["runtime_test_capture"]["tested_closure"].update(sha256="4"*64),lambda q:q["runtime_test_capture"]["actual_normalized_command"].pop(1),lambda q:q["runtime_test_capture"]["bootstrap"].update(sha256="5"*64),lambda q:q["full_tree"].pop(),lambda q:q["full_tree"].append(V.package_leaf("zzz-extra",b"x")),lambda q:q["full_tree"][0]["content"].update(data="00"),lambda q:q["selected_required"].pop(),lambda q:q.update(executor_bundle=V.raw_bytes(b"swapped bundle"))]
+  for mutate in attacks:
+   q=copy.deepcopy(capture);mutate(q)
+   with self.assertRaises(V.ManifestError):V.freeze_expected(packet,RAW,eb,cb,q)
+  badlock=copy.deepcopy(eb);badlock["locks"]["decisions/D-004-PACKET.md"]=b"wrong"
+  with self.assertRaises(V.ManifestError):V.freeze_expected(packet,RAW,badlock,cb,capture)
+  badsource=copy.deepcopy(eb);badsource["sources"]["future/d004_executor/producer.py"]=b"wrong"
+  with self.assertRaises(V.ManifestError):V.freeze_expected(packet,RAW,badsource,cb,capture)
+  exraw=V._decode_raw(capture["executor_bundle"],"test bundle");header_end=exraw.index(b"\n\n")+2
+  bundle_attacks=[exraw[:header_end],exraw[:-21]+bytes([exraw[-21]^1])+exraw[-20:],exraw.replace(eb["identity"]["git"]["commit"]["commit"].encode(),b"0"*40,1),exraw.replace(b"refs/d004/executor",b"refs/d004/checker",1),b"# v2 git bundle\n"+eb["identity"]["git"]["commit"]["commit"].encode()+b" refs/d004/executor\n\nPACK arbitrary replacement"]
+  for arbitrary in bundle_attacks:
+   q=copy.deepcopy(capture);q["executor_bundle"]=V.raw_bytes(arbitrary);q["executor_bundle_artifact"]=V.bundle_identity("EXECUTOR",arbitrary)
+   with self.assertRaises(V.ManifestError):V.freeze_expected(packet,RAW,eb,cb,q)
+  wrongclosure=copy.deepcopy(eb);wrongclosure["tracked"]["future/d004_executor/producer.py"]=b"coordinated wrong closure"
+  with self.assertRaises(V.ManifestError):V.validate_role_bundle_bytes(exraw,wrongclosure)
+  for token in ("SYNTHETIC-TIMESTAMP-TOKEN","GIT_COMMITTER_TIMESTAMP:01:+0000","GIT_COMMITTER_TIMESTAMP:1:+1460","GIT_COMMITTER_TIMESTAMP:1:+1401","GIT_COMMITTER_TIMESTAMP:-1:+0000","GIT_AUTHOR_TIMESTAMP:1:+0000"):
+   q=copy.deepcopy(capture);q["timestamp_token"]=token
+   with self.assertRaises(V.ManifestError):V.freeze_expected(packet,RAW,eb,cb,q)
  def test_h6_full_v_e_dag_checks_verdict_and_previous_attacks(self):
   packet,o,eb,cb,capture,f,v,e=self.synthetic_future();self.assertTrue(V.validate_v_bytes(v,packet,RAW,f,o,o,eb,cb,capture)["accepted"]);self.assertEqual(V.validate_e_bytes(e,v,packet,RAW,f,o,o,eb,cb,capture)["result"],"ADOPT_ALGEBRA");self.assertEqual(V.future_verdict(e,v,packet,RAW,f,o,o,eb,cb,capture),"ADOPT_ALGEBRA")
   mutations=[(v,lambda x:x["checks"].pop()),(v,lambda x:x["inputs"]["o1"].update(sha256="0"*64)),(v,lambda x:x["dag"]["edges"].reverse()),(v,lambda x:x.update(accepted=False)),(e,lambda x:x["checks"].reverse()),(e,lambda x:x["dag"]["nodes"].pop()),(e,lambda x:x.update(result="OPEN")),(e,lambda x:x.update(extra=True))]
@@ -163,7 +190,7 @@ class TestD004C2(unittest.TestCase):
     self.assertEqual(V.future_verdict(bad,v,packet,RAW,f,o,o,eb,cb,capture),"OPEN")
   bo=V.parse_bytes(o);bo["assertion_results"]=[];boraw=V.canonical(bo);self.assertEqual(V.future_verdict(e,v,packet,RAW,f,boraw,boraw,eb,cb,capture),"OPEN");self.assertEqual(V.future_verdict(e,v,packet,RAW,f,o,o,{"identity":{"o_sha256":V.sha(o)}},cb,capture),"OPEN");changed=copy.deepcopy(cb);changed["sources"]={**changed["sources"],"future/d004_checker/x.py":b"x=1\n"};self.assertEqual(V.future_verdict(e,v,packet,RAW,f,o,o,eb,changed,capture),"OPEN");self.assertEqual(V.future_verdict(e,v,packet,RAW,f,o,o,eb,cb,{**capture,"commit":"0"*40}),"OPEN")
  def test_c3_contract_and_source_guards(self):
-  self.assertIsNone(self.m()["provenance_contract"]["current_freeze_record"]);self.reject(lambda m:m["provenance_contract"].update(current_freeze_record={}));self.reject(lambda m:m["provenance_contract"].update(mandatory_locks=[]));self.reject(lambda m:m["independence"].update(shared_only=[]));self.reject(lambda m:m["independence"].update(validator_is_producer=True));self.reject(lambda m:m["o_contract"].update(producer_identity_inside_o=True));self.reject(lambda m:m.update(trust_policy="local"))
+  contract=self.m()["provenance_contract"];self.assertIsNone(contract["current_freeze_record"]);self.assertEqual(contract["freeze_record_fields"],V.FREEZE_FIELDS);self.assertEqual(contract["required_package_paths"],V.REQUIRED_PACKAGE_PATHS);self.assertEqual(len(V.REQUIRED_PACKAGE_PATHS),10);self.assertEqual(contract["runtime_command"],"CPYTHON -I -S -c <bootstrap_sha256> <EXPORT_ROOT> modules...");self.assertEqual(contract["runtime_test_capture_schema"],"RuntimeTestCapture");self.assertIn("NOT_TRUSTED_TIME",contract["timestamp_token_semantics"]);self.reject(lambda m:m["provenance_contract"].update(current_freeze_record={}));self.reject(lambda m:m["provenance_contract"].update(freeze_record_fields=[]));self.reject(lambda m:m["provenance_contract"].update(mandatory_locks=[]));self.reject(lambda m:m["independence"].update(shared_only=[]));self.reject(lambda m:m["independence"].update(validator_is_producer=True));self.reject(lambda m:m["o_contract"].update(producer_identity_inside_o=True));self.reject(lambda m:m.update(trust_policy="local"))
   src=(HERE/"d004_manifest.py").read_text()
   for bad in ("subprocess","os.system","write_text","write_bytes","select_winner","import d004_executor","import d004_checker","git checkout","git status"):self.assertNotIn(bad,src)
 if __name__=="__main__":unittest.main()
diff --git a/future/d004_checker/producer.py b/future/d004_checker/producer.py
index 74fc99e329..73ec174fa9 100644
--- a/future/d004_checker/producer.py
+++ b/future/d004_checker/producer.py
@@ -8,7 +8,7 @@ _DURABLE = {"DURABLE", "LOGICAL_COMMIT", "ROOT_SWITCH", "ACK_WRITE"}
 _MODES = ("OBSERVE", "STALE_REPLAY", "RECOVERY_CYCLES")
 _CRASHES = ("NONE", "BEFORE_EACH_COMMIT", "AFTER_EACH_COMMIT")
 _OUTAGES = ("NONE", "MODEL", "NETWORK")
-_MANIFEST_SHA256 = "1d8d4da297eca59e359c2559b77ffac661be5fad966106d5b647c31a329154db"
+_MANIFEST_SHA256 = "bdcf183c3df0f4a4942431edfb80761c51b2348a902e9455ca10dbf97b3f22c6"
 
 
 def _canonical(value):
diff --git a/future/d004_checker/test_producer.py b/future/d004_checker/test_producer.py
index e571349323..91e632eb72 100644
--- a/future/d004_checker/test_producer.py
+++ b/future/d004_checker/test_producer.py
@@ -170,6 +170,10 @@ class CheckerProducerTests(unittest.TestCase):
         self.assertEqual(value, changed)
 
     def test_rejects_noncanonical_or_mutated_manifest_and_bad_types(self):
+        import hashlib
+        self.assertNotEqual((len(self.manifest_raw), hashlib.sha256(self.manifest_raw).hexdigest()), (93805, "f689d7cf90c74b76ff1b5d4aeaa8926ab1d216996a1cc0ea2af075c146cb6dd3"))
+        old_identity_shape = (json.dumps({"invalid_development_manifest_sha256": "f689d7cf90c74b76ff1b5d4aeaa8926ab1d216996a1cc0ea2af075c146cb6dd3"}, sort_keys=True, separators=(",", ":")) + "\n").encode()
+        with self.assertRaises(producer.CheckerError): producer.produce(old_identity_shape, self.packet_raw)
         attacks = [self.manifest_raw[:-1], self.manifest_raw.replace(b'"artifact_kind":', b'"artifact_kind": ', 1), b'\xff', b'{"x":1.0}\n', b'{"x":"e\xcc\x81"}\n']
         for raw in attacks:
             with self.assertRaises(producer.CheckerError): producer.produce(raw, self.packet_raw)
diff --git a/future/d004_executor/producer.py b/future/d004_executor/producer.py
index b405a5f705..0d2b33d679 100644
--- a/future/d004_executor/producer.py
+++ b/future/d004_executor/producer.py
@@ -14,8 +14,8 @@ class ProducerError(ValueError):
     """The supplied bytes do not satisfy the frozen D-004 producer contract."""
 
 
-_MANIFEST_LENGTH = 91807
-_MANIFEST_SHA256 = "1d8d4da297eca59e359c2559b77ffac661be5fad966106d5b647c31a329154db"
+_MANIFEST_LENGTH = 96942
+_MANIFEST_SHA256 = "bdcf183c3df0f4a4942431edfb80761c51b2348a902e9455ca10dbf97b3f22c6"
 _ACTION = {
     "NOT_COMMITTED": "RETRY_SAFE",
     "COMMITTED": "NO_RETRY_QUERY_RESULT",
diff --git a/future/d004_executor/test_producer.py b/future/d004_executor/test_producer.py
index 583293af1b..cbc2b52c98 100644
--- a/future/d004_executor/test_producer.py
+++ b/future/d004_executor/test_producer.py
@@ -63,6 +63,10 @@ class ProducerTests(unittest.TestCase):
         self.assertEqual(derived["assertion_results"], self.output["assertion_results"])
 
     def test_rejects_canonical_manifest_semantic_mutation(self):
+        self.assertNotEqual((len(_MANIFEST), hashlib.sha256(_MANIFEST).hexdigest()), (93805, "f689d7cf90c74b76ff1b5d4aeaa8926ab1d216996a1cc0ea2af075c146cb6dd3"))
+        old_identity_shape = (json.dumps({"invalid_development_manifest_sha256": "f689d7cf90c74b76ff1b5d4aeaa8926ab1d216996a1cc0ea2af075c146cb6dd3"}, sort_keys=True, separators=(",", ":")) + "\n").encode()
+        with self.assertRaisesRegex(ProducerError, "frozen D-004"):
+            produce(old_identity_shape, _PACKET)
         value = json.loads(_MANIFEST)
         value["coverage"]["history_cell_count"] = 72
         mutated = (json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")) + "\n").encode()