falsegreen_agent/

genui_native.rs

//! Read-only FalseGreen-native state surfaces.
//!
//! This module is deliberately conservative. A surface is allowed to show a
//! FalseGreen value only after a typed authority view has validated the exact
//! object that supplied it and all bindings to the other views. Missing or
//! contradictory authority is represented as `Unknown`/`Unavailable`; it is
//! never filled in from a neighbouring event or from Agent session state.

use std::collections::{BTreeMap, BTreeSet};

use serde::{Deserialize, Serialize, Serializer, ser::SerializeStruct};
use serde_json::Value;
use sha2::{Digest, Sha256};
use thiserror::Error;

use crate::event::{
    Event, EventError, EventKind, EventStore, SessionReplacementRecord, history_sha256,
};
use crate::genui::{
    ActionCatalog, Component, ComponentKind, EvidenceItem, GenUiError, StatusLevel, Surface,
    TimelineEntry, TimelineState, default_negotiated_capabilities,
    render_surface_with_capabilities_and_catalog_with_store, sanitize_text,
};
use crate::session::{Session, SessionError, SessionState};

const MAX_DISPLAY_EVIDENCE: usize = 100;
const MAX_EVIDENCE_ITEMS: usize = 100_000;
const MAX_EVIDENCE_VALUE_BYTES: usize = 4_096;

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum AuthorityClass {
    AuthoritativeFalseGreenState,
    AuthoritativeAgentSessionState,
    DiagnosticNonAuthoritativeMetadata,
}

impl AuthorityClass {
    #[must_use]
    pub const fn label(self) -> &'static str {
        match self {
            Self::AuthoritativeFalseGreenState => "authoritative FalseGreen state",
            Self::AuthoritativeAgentSessionState => "authoritative Agent/session state",
            Self::DiagnosticNonAuthoritativeMetadata => "diagnostic/non-authoritative metadata",
        }
    }
}

/// A value carries its source class all the way to the renderer. Values
/// emitted by the projector are created by validated view builders.
#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct NativeField {
    value: Option<String>,
    authority: AuthorityClass,
}

impl Serialize for NativeField {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: Serializer,
    {
        let mut state = serializer.serialize_struct("NativeField", 2)?;
        state.serialize_field("value", &self.value)?;
        state.serialize_field("authority", &self.authority)?;
        state.end()
    }
}

impl NativeField {
    #[must_use]
    pub(crate) fn falsegreen(value: impl Into<String>) -> Self {
        let value = value.into();
        Self {
            value: Some(safe_text(&value)),
            authority: AuthorityClass::AuthoritativeFalseGreenState,
        }
    }

    #[must_use]
    pub(crate) fn agent(value: impl Into<String>) -> Self {
        let value = value.into();
        Self {
            value: Some(safe_text(&value)),
            authority: AuthorityClass::AuthoritativeAgentSessionState,
        }
    }

    #[must_use]
    pub(crate) fn diagnostic(value: impl Into<String>) -> Self {
        let value = value.into();
        Self {
            value: Some(safe_text(&value)),
            authority: AuthorityClass::DiagnosticNonAuthoritativeMetadata,
        }
    }

    #[must_use]
    pub(crate) fn unavailable(authority: AuthorityClass) -> Self {
        Self {
            value: None,
            authority,
        }
    }

    #[must_use]
    pub fn display(&self, unknown: bool) -> String {
        sanitize_text(self.value.as_deref().unwrap_or(if unknown {
            "Unknown"
        } else {
            "Unavailable"
        }))
    }

    #[must_use]
    pub fn value(&self) -> Option<&str> {
        self.value.as_deref()
    }

    #[must_use]
    pub const fn authority(&self) -> AuthorityClass {
        self.authority
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
pub enum NativeStatus {
    Accepted,
    Failed,
    InsufficientEvidence,
    Queued,
    Claimed,
    Running,
    Executing,
    Terminal,
    Recoverable,
    Unknown,
}

impl NativeStatus {
    #[must_use]
    pub const fn label(self) -> &'static str {
        match self {
            Self::Accepted => "ACCEPTED",
            Self::Failed => "FAILED",
            Self::InsufficientEvidence => "INSUFFICIENT EVIDENCE",
            Self::Queued => "QUEUED",
            Self::Claimed => "CLAIMED",
            Self::Running => "RUNNING",
            Self::Executing => "EXECUTING",
            Self::Terminal => "TERMINAL",
            Self::Recoverable => "RECOVERABLE",
            Self::Unknown => "UNKNOWN",
        }
    }

    #[must_use]
    const fn level(self) -> StatusLevel {
        match self {
            Self::Accepted => StatusLevel::Success,
            Self::Failed => StatusLevel::Error,
            Self::InsufficientEvidence | Self::Recoverable | Self::Unknown => StatusLevel::Warning,
            _ => StatusLevel::Info,
        }
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
pub enum NativeVerdict {
    Accepted,
    Failed,
    InsufficientEvidence,
    Incomplete,
    Invalid,
    Unknown,
}

impl NativeVerdict {
    #[must_use]
    pub const fn label(self) -> &'static str {
        match self {
            Self::Accepted => "ACCEPTED",
            Self::Failed => "FAILED",
            Self::InsufficientEvidence => "INSUFFICIENT EVIDENCE",
            Self::Incomplete => "INCOMPLETE",
            Self::Invalid => "INVALID",
            Self::Unknown => "UNKNOWN",
        }
    }

    #[must_use]
    const fn status(self) -> NativeStatus {
        match self {
            Self::Accepted => NativeStatus::Accepted,
            Self::Failed => NativeStatus::Failed,
            Self::InsufficientEvidence => NativeStatus::InsufficientEvidence,
            Self::Incomplete | Self::Invalid | Self::Unknown => NativeStatus::Unknown,
        }
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
pub enum EvidenceState {
    Passed,
    Failed,
    Insufficient,
    Unknown,
}

impl EvidenceState {
    #[must_use]
    const fn label(self) -> &'static str {
        match self {
            Self::Passed => "PASS",
            Self::Failed => "FAIL",
            Self::Insufficient => "INSUFFICIENT",
            Self::Unknown => "UNKNOWN",
        }
    }
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeSnapshotIdentity {
    pub source_session_id: String,
    pub state_generation: u64,
    pub digest: String,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeTask {
    pub task_id: NativeField,
    pub lifecycle: NativeField,
    pub frozen: NativeField,
    pub scope_digest: NativeField,
    pub scope_summary: NativeField,
    pub source_sha256: NativeField,
    pub candidate_sha256: NativeField,
    pub current_job_id: NativeField,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeScopeObligation {
    pub id: NativeField,
    pub requirement: NativeField,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeFrozenScope {
    pub scope_digest: NativeField,
    pub frozen: NativeField,
    pub obligations: Vec<NativeScopeObligation>,
    pub distinction: String,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeJob {
    pub id: NativeField,
    pub status: NativeStatus,
    pub status_raw: NativeField,
    pub task_id: NativeField,
    pub source_sha256: NativeField,
    pub candidate_sha256: NativeField,
    pub entitlement_consumption: NativeField,
    pub run_ids: Vec<NativeField>,
    pub authority_decision: NativeField,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeRun {
    pub id: NativeField,
    pub worker_id: NativeField,
    pub job_id: NativeField,
    pub assignment_generation: NativeField,
    pub status: NativeStatus,
    pub status_raw: NativeField,
    pub execution_started_at: NativeField,
    pub package_runtime_identity: NativeField,
    pub recovery_lease: NativeField,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeObligationOutcome {
    pub obligation_id: NativeField,
    pub outcome: EvidenceState,
    pub detail: NativeField,
    pub evidence_count: usize,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeVerification {
    pub verdict: NativeVerdict,
    pub raw_verdict: NativeField,
    pub source_bound: bool,
    pub candidate_sha256: NativeField,
    pub authoritative_source_sha256: NativeField,
    pub result_digest: NativeField,
    pub report_reference: NativeField,
    pub completion_authority: NativeField,
    pub obligation_outcomes: Vec<NativeObligationOutcome>,
    pub certification_note: String,
    pub binding_error: Option<String>,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeEvidenceItem {
    pub evidence_id: NativeField,
    pub obligation: NativeField,
    pub source: NativeField,
    pub evidence_type: NativeField,
    pub reference: NativeField,
    pub state: EvidenceState,
    pub detail: NativeField,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeEvidence {
    pub items: Vec<NativeEvidenceItem>,
    pub complete: bool,
    pub duplicate_ids: Vec<String>,
    pub unavailable_reason: Option<String>,
    pub total: usize,
    pub passed: usize,
    pub failed: usize,
    pub insufficient: usize,
    pub unknown: usize,
    pub observed_rows: usize,
    pub invalid_rows: usize,
    pub declared_rows: Option<usize>,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeReport {
    pub id: NativeField,
    pub report_digest: NativeField,
    pub candidate_sha256: NativeField,
    pub source_sha256: NativeField,
    pub verdict: NativeVerdict,
    pub key_evidence_summary: NativeField,
    pub created_at: NativeField,
    pub provenance: NativeField,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
pub enum RecoveryState {
    NotApplicable,
    Recoverable,
    Blocked,
    Terminal,
    Unknown,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeRecovery {
    pub state: RecoveryState,
    pub reason: NativeField,
    pub pre_begin_claim: NativeField,
    pub action_available: bool,
    pub distinction: String,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct NativeReplacement {
    pub predecessor_session: NativeField,
    pub replacement_session: NativeField,
    pub predecessor_state: NativeField,
    pub continuity: NativeField,
    pub candidate_sha256: NativeField,
    pub workspace_state: NativeField,
    pub terminal_outcome: NativeField,
}

/// Typed authority inputs. They intentionally contain raw values; rendered
/// `NativeField`s are sanitized only after these values have been bound.
#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct AuthoritativeTaskView {
    task_id: String,
    lifecycle: Option<String>,
    scope_id: String,
    scope_digest: String,
    source_sha256: Option<String>,
    candidate_sha256: Option<String>,
    current_job_id: Option<String>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct AuthoritativeFrozenScopeView {
    scope_id: String,
    scope_digest: String,
    obligations: Vec<(String, String)>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct AuthoritativeJobView {
    id: String,
    status: NativeStatus,
    task_id: String,
    source_sha256: Option<String>,
    candidate_sha256: Option<String>,
    run_ids: Vec<String>,
    entitlement_consumption: Option<String>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct AuthoritativeRunView {
    id: String,
    status: NativeStatus,
    job_id: String,
    worker_id: Option<String>,
    assignment_generation: Option<String>,
    execution_started_at: Option<String>,
    package_runtime_identity: Option<String>,
    recovery_lease: Option<String>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct AuthoritativeRecoveryView {
    state: RecoveryState,
    reason: Option<String>,
    action_available: bool,
    task_id: String,
    job_id: String,
    run_id: String,
    worker_id: String,
    assignment_generation: String,
    source_sha256: String,
    candidate_sha256: Option<String>,
    provenance: String,
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct AuthoritativeResultView {
    verdict: NativeVerdict,
    candidate_sha256: String,
    source_sha256: String,
    run_id: String,
    job_id: String,
    worker_id: Option<String>,
    assignment_generation: Option<String>,
    result_digest: String,
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct AuthoritativeEvidenceView {
    items: Vec<NativeEvidenceItem>,
    total: usize,
    passed: usize,
    failed: usize,
    insufficient: usize,
    unknown: usize,
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct AuthoritativeReportView {
    id: String,
    report_digest: String,
    candidate_sha256: String,
    source_sha256: String,
    verdict: NativeVerdict,
    job_id: String,
    run_id: String,
    result_digest: String,
}

impl AuthoritativeTaskView {
    #[must_use]
    pub fn task_id(&self) -> &str {
        &self.task_id
    }
    #[must_use]
    pub fn lifecycle(&self) -> Option<&str> {
        self.lifecycle.as_deref()
    }
    #[must_use]
    pub fn scope_id(&self) -> &str {
        &self.scope_id
    }
    #[must_use]
    pub fn scope_digest(&self) -> &str {
        &self.scope_digest
    }
    #[must_use]
    pub fn source_sha256(&self) -> Option<&str> {
        self.source_sha256.as_deref()
    }
    #[must_use]
    pub fn candidate_sha256(&self) -> Option<&str> {
        self.candidate_sha256.as_deref()
    }
    #[must_use]
    pub fn current_job_id(&self) -> Option<&str> {
        self.current_job_id.as_deref()
    }
}

impl AuthoritativeFrozenScopeView {
    #[must_use]
    pub fn scope_id(&self) -> &str {
        &self.scope_id
    }
    #[must_use]
    pub fn scope_digest(&self) -> &str {
        &self.scope_digest
    }
    #[must_use]
    pub fn obligations(&self) -> &[(String, String)] {
        &self.obligations
    }
}

impl AuthoritativeJobView {
    #[must_use]
    pub fn id(&self) -> &str {
        &self.id
    }
    #[must_use]
    pub const fn status(&self) -> NativeStatus {
        self.status
    }
    #[must_use]
    pub fn task_id(&self) -> &str {
        &self.task_id
    }
    #[must_use]
    pub fn source_sha256(&self) -> Option<&str> {
        self.source_sha256.as_deref()
    }
    #[must_use]
    pub fn candidate_sha256(&self) -> Option<&str> {
        self.candidate_sha256.as_deref()
    }
    #[must_use]
    pub fn run_ids(&self) -> &[String] {
        &self.run_ids
    }
    #[must_use]
    pub fn entitlement_consumption(&self) -> Option<&str> {
        self.entitlement_consumption.as_deref()
    }
}

impl AuthoritativeRunView {
    #[must_use]
    pub fn id(&self) -> &str {
        &self.id
    }
    #[must_use]
    pub const fn status(&self) -> NativeStatus {
        self.status
    }
    #[must_use]
    pub fn job_id(&self) -> &str {
        &self.job_id
    }
    #[must_use]
    pub fn worker_id(&self) -> Option<&str> {
        self.worker_id.as_deref()
    }
    #[must_use]
    pub fn assignment_generation(&self) -> Option<&str> {
        self.assignment_generation.as_deref()
    }
    #[must_use]
    pub fn execution_started_at(&self) -> Option<&str> {
        self.execution_started_at.as_deref()
    }
    #[must_use]
    pub fn package_runtime_identity(&self) -> Option<&str> {
        self.package_runtime_identity.as_deref()
    }
    #[must_use]
    pub fn recovery_lease(&self) -> Option<&str> {
        self.recovery_lease.as_deref()
    }
}

impl AuthoritativeRecoveryView {
    #[must_use]
    pub const fn state(&self) -> RecoveryState {
        self.state
    }
    #[must_use]
    pub fn reason(&self) -> Option<&str> {
        self.reason.as_deref()
    }
    #[must_use]
    pub const fn action_available(&self) -> bool {
        self.action_available
    }
    #[must_use]
    pub fn task_id(&self) -> &str {
        &self.task_id
    }
    #[must_use]
    pub fn job_id(&self) -> &str {
        &self.job_id
    }
    #[must_use]
    pub fn run_id(&self) -> &str {
        &self.run_id
    }
    #[must_use]
    pub fn worker_id(&self) -> &str {
        &self.worker_id
    }
    #[must_use]
    pub fn assignment_generation(&self) -> &str {
        &self.assignment_generation
    }
    #[must_use]
    pub fn source_sha256(&self) -> &str {
        &self.source_sha256
    }
    #[must_use]
    pub fn candidate_sha256(&self) -> Option<&str> {
        self.candidate_sha256.as_deref()
    }
    #[must_use]
    pub fn provenance(&self) -> &str {
        &self.provenance
    }
}

impl AuthoritativeResultView {
    #[must_use]
    pub const fn verdict(&self) -> NativeVerdict {
        self.verdict
    }
    #[must_use]
    pub fn candidate_sha256(&self) -> &str {
        &self.candidate_sha256
    }
    #[must_use]
    pub fn source_sha256(&self) -> &str {
        &self.source_sha256
    }
    #[must_use]
    pub fn run_id(&self) -> &str {
        &self.run_id
    }
    #[must_use]
    pub fn job_id(&self) -> &str {
        &self.job_id
    }
    #[must_use]
    pub fn worker_id(&self) -> Option<&str> {
        self.worker_id.as_deref()
    }
    #[must_use]
    pub fn assignment_generation(&self) -> Option<&str> {
        self.assignment_generation.as_deref()
    }
    #[must_use]
    pub fn result_digest(&self) -> &str {
        &self.result_digest
    }
}

impl AuthoritativeEvidenceView {
    #[must_use]
    pub fn items(&self) -> &[NativeEvidenceItem] {
        &self.items
    }
    #[must_use]
    pub const fn total(&self) -> usize {
        self.total
    }
    #[must_use]
    pub const fn passed(&self) -> usize {
        self.passed
    }
    #[must_use]
    pub const fn failed(&self) -> usize {
        self.failed
    }
    #[must_use]
    pub const fn insufficient(&self) -> usize {
        self.insufficient
    }
    #[must_use]
    pub const fn unknown(&self) -> usize {
        self.unknown
    }
}

impl AuthoritativeReportView {
    #[must_use]
    pub fn id(&self) -> &str {
        &self.id
    }
    #[must_use]
    pub fn report_digest(&self) -> &str {
        &self.report_digest
    }
    #[must_use]
    pub fn candidate_sha256(&self) -> &str {
        &self.candidate_sha256
    }
    #[must_use]
    pub fn source_sha256(&self) -> &str {
        &self.source_sha256
    }
    #[must_use]
    pub const fn verdict(&self) -> NativeVerdict {
        self.verdict
    }
    #[must_use]
    pub fn job_id(&self) -> &str {
        &self.job_id
    }
    #[must_use]
    pub fn run_id(&self) -> &str {
        &self.run_id
    }
    #[must_use]
    pub fn result_digest(&self) -> &str {
        &self.result_digest
    }
}

impl AuthoritativeTaskView {
    pub fn try_from_value(value: &Value) -> Result<Self, String> {
        parse_task_view(value)
    }
    pub fn from_value(value: &Value) -> Result<Self, String> {
        Self::try_from_value(value)
    }
}
impl AuthoritativeFrozenScopeView {
    pub fn try_from_value(value: &Value) -> Result<Self, String> {
        parse_scope_view(value)
    }
    pub fn from_value(value: &Value) -> Result<Self, String> {
        Self::try_from_value(value)
    }
}
impl AuthoritativeJobView {
    pub fn try_from_value(value: &Value) -> Result<Self, String> {
        parse_job_view(value)
    }
    pub fn from_value(value: &Value) -> Result<Self, String> {
        Self::try_from_value(value)
    }
}
impl AuthoritativeRunView {
    pub fn try_from_value(value: &Value) -> Result<Self, String> {
        parse_run_view(value)
    }
    pub fn from_value(value: &Value) -> Result<Self, String> {
        Self::try_from_value(value)
    }
}
impl AuthoritativeRecoveryView {
    #[allow(clippy::too_many_arguments)]
    pub fn try_from_value(
        value: &Value,
        task: &AuthoritativeTaskView,
        job: &AuthoritativeJobView,
        run: &AuthoritativeRunView,
        source: &str,
    ) -> Result<Self, String> {
        parse_recovery_view(value, Some(task), Some(job), Some(run), Some(source))
    }
    #[allow(clippy::too_many_arguments)]
    pub fn from_value(
        value: &Value,
        task: &AuthoritativeTaskView,
        job: &AuthoritativeJobView,
        run: &AuthoritativeRunView,
        source: &str,
    ) -> Result<Self, String> {
        Self::try_from_value(value, task, job, run, source)
    }
}

impl AuthoritativeEvidenceView {
    pub fn try_from_value(
        _value: &Value,
        _scope: &AuthoritativeFrozenScopeView,
    ) -> Result<Self, String> {
        Err("evidence authority requires a validated parent Result and source context".to_owned())
    }

    pub fn try_from_value_with_result(
        value: &Value,
        scope: &AuthoritativeFrozenScopeView,
        result: &AuthoritativeResultView,
    ) -> Result<Self, String> {
        let values = strict_evidence_array(value)?.ok_or("evidence array is missing")?;
        if values.len() > MAX_EVIDENCE_ITEMS {
            return Err("evidence set exceeds validation bound".to_owned());
        }
        let mut ids = BTreeSet::new();
        let mut items = Vec::with_capacity(values.len());
        let mut counts = [0usize; 4];
        for value in values {
            let (id, item, state) = parse_evidence_item(
                value,
                scope,
                Some(result.job_id()),
                Some(result.run_id()),
                Some(result.source_sha256()),
                Some(result.result_digest()),
            )?;
            if !ids.insert(id) {
                return Err("duplicate evidence ID".to_owned());
            }
            match state {
                EvidenceState::Passed => counts[0] += 1,
                EvidenceState::Failed => counts[1] += 1,
                EvidenceState::Insufficient => counts[2] += 1,
                EvidenceState::Unknown => counts[3] += 1,
            }
            items.push(item);
        }
        Ok(Self {
            items,
            total: values.len(),
            passed: counts[0],
            failed: counts[1],
            insufficient: counts[2],
            unknown: counts[3],
        })
    }

    pub fn from_value(value: &Value, scope: &AuthoritativeFrozenScopeView) -> Result<Self, String> {
        Self::try_from_value(value, scope)
    }

    pub fn from_value_with_result(
        value: &Value,
        scope: &AuthoritativeFrozenScopeView,
        result: &AuthoritativeResultView,
    ) -> Result<Self, String> {
        Self::try_from_value_with_result(value, scope, result)
    }
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct ValidatedReplacementSessionView {
    predecessor_session_id: String,
    replacement_session_id: String,
    predecessor_state: String,
    candidate_sha256: String,
    workspace_state: String,
    source_git_state_sequence: u64,
}

impl ValidatedReplacementSessionView {
    #[must_use]
    pub fn predecessor_session_id(&self) -> &str {
        &self.predecessor_session_id
    }
    #[must_use]
    pub fn replacement_session_id(&self) -> &str {
        &self.replacement_session_id
    }
    #[must_use]
    pub fn predecessor_state(&self) -> &str {
        &self.predecessor_state
    }
    #[must_use]
    pub fn candidate_sha256(&self) -> &str {
        &self.candidate_sha256
    }
    #[must_use]
    pub fn workspace_state(&self) -> &str {
        &self.workspace_state
    }
    #[must_use]
    pub const fn source_git_state_sequence(&self) -> u64 {
        self.source_git_state_sequence
    }
}

impl ValidatedReplacementSessionView {
    fn try_from_record_predecessor(
        record: &SessionReplacementRecord,
        predecessor_events: &[Event],
    ) -> Result<Self, String> {
        validate_replacement_predecessor(record, predecessor_events)?;
        let git = predecessor_events
            .iter()
            .find(|event| {
                event.sequence == record.source_git_state_sequence
                    && event.kind == EventKind::GitState
            })
            .ok_or("replacement GitState sequence is not bound")?;
        let workspace_state = git
            .payload
            .get("workspace_state_sha256")
            .and_then(Value::as_str)
            .filter(|value| valid_digest(value))
            .ok_or("replacement workspace identity is unavailable")?;
        Ok(Self {
            predecessor_session_id: record.predecessor_session_id.clone(),
            replacement_session_id: record.replacement_session_id.clone(),
            predecessor_state: record.predecessor_state.clone(),
            candidate_sha256: record.candidate_sha256.clone(),
            workspace_state: workspace_state.to_owned(),
            source_git_state_sequence: record.source_git_state_sequence,
        })
    }

    /// Construct trusted replacement authority only from both complete,
    /// session-bound histories. The predecessor-only path is intentionally
    /// private so a forged successor ID cannot mint a trusted view.
    pub fn try_from_record_with_related(
        record: &SessionReplacementRecord,
        predecessor_events: &[Event],
        replacement_events: &[Event],
    ) -> Result<Self, String> {
        let view = Self::try_from_record_predecessor(record, predecessor_events)?;
        if replacement_events.is_empty()
            || replacement_events
                .iter()
                .any(|event| event.session_id != record.replacement_session_id)
        {
            return Err("replacement events are not bound to the recorded successor".to_owned());
        }
        let replaced = replacement_events
            .iter()
            .filter(|event| event.kind == EventKind::SessionReplaced)
            .collect::<Vec<_>>();
        if replaced.len() != 1 {
            return Err("replacement relation event is missing or duplicated".to_owned());
        }
        let payload = &replaced[0].payload;
        for (key, expected) in [
            (
                "predecessor_session_id",
                record.predecessor_session_id.as_str(),
            ),
            ("predecessor_state", record.predecessor_state.as_str()),
            (
                "predecessor_history_sha256",
                record.predecessor_history_sha256.as_str(),
            ),
            ("candidate_sha256", record.candidate_sha256.as_str()),
            ("falsegreen_task_id", record.falsegreen_task_id.as_str()),
        ] {
            if payload.get(key).and_then(Value::as_str) != Some(expected) {
                return Err(format!("replacement relation field {key} is not exact"));
            }
        }
        if payload
            .get("candidate_event_sequence")
            .and_then(Value::as_u64)
            != Some(record.candidate_event_sequence)
            || payload
                .get("source_git_state_sequence")
                .and_then(Value::as_u64)
                != Some(record.source_git_state_sequence)
        {
            return Err("replacement relation sequence binding is not exact".to_owned());
        }
        let authority = predecessor_events
            .iter()
            .find(|event| {
                event.kind == EventKind::Checkpoint
                    && event.payload["checkpoint_kind"] == "acceptance_authority"
            })
            .ok_or("predecessor task authority is missing")?;
        let mut expected_authority = authority.payload.clone();
        expected_authority["replacement_predecessor_session_id"] =
            Value::String(record.predecessor_session_id.clone());
        let replacement_authority = replacement_events
            .iter()
            .filter(|event| {
                event.kind == EventKind::Checkpoint
                    && event.payload["checkpoint_kind"] == "acceptance_authority"
            })
            .collect::<Vec<_>>();
        if replacement_authority.len() != 1
            || replacement_authority[0].payload != expected_authority
        {
            return Err("replacement task authority binding is not exact".to_owned());
        }
        let carried = replacement_events
            .iter()
            .filter(|event| {
                event.kind == EventKind::CandidateReady
                    && event.payload["carried_forward"].as_bool() == Some(true)
            })
            .collect::<Vec<_>>();
        if carried.len() != 1
            || carried[0].payload["candidate_sha256"].as_str()
                != Some(record.candidate_sha256.as_str())
            || carried[0].payload["predecessor_session_id"].as_str()
                != Some(record.predecessor_session_id.as_str())
            || carried[0].payload["predecessor_candidate_event_sequence"].as_u64()
                != Some(record.candidate_event_sequence)
        {
            return Err("replacement candidate continuity is incomplete".to_owned());
        }
        let git_states = replacement_events
            .iter()
            .filter(|event| event.kind == EventKind::GitState)
            .collect::<Vec<_>>();
        let source_git = predecessor_events
            .iter()
            .find(|event| event.sequence == record.source_git_state_sequence)
            .ok_or("predecessor GitState is missing")?;
        if git_states.len() != 1
            || git_states[0].sequence <= carried[0].sequence
            || git_states[0].payload != source_git.payload
        {
            return Err("replacement GitState continuity is incomplete".to_owned());
        }
        let validations = replacement_events
            .iter()
            .filter(|event| {
                event.kind == EventKind::Checkpoint
                    && event.payload["checkpoint_kind"] == "replacement_candidate_validation"
            })
            .collect::<Vec<_>>();
        if validations.len() != 1
            || validations[0].payload["state"] != "candidate_ready"
            || validations[0].payload["predecessor_session_id"].as_str()
                != Some(record.predecessor_session_id.as_str())
            || validations[0].payload["expected_candidate_sha256"].as_str()
                != Some(record.candidate_sha256.as_str())
            || validations[0].payload["actual_candidate_sha256"].as_str()
                != Some(record.candidate_sha256.as_str())
            || validations[0].payload["matched"] != true
        {
            return Err("replacement candidate validation checkpoint is incomplete".to_owned());
        }
        Ok(view)
    }
}

fn validate_replacement_predecessor(
    record: &SessionReplacementRecord,
    events: &[Event],
) -> Result<(), String> {
    if record.predecessor_session_id.is_empty()
        || record.replacement_session_id.is_empty()
        || record.predecessor_session_id == record.replacement_session_id
        || record.predecessor_state != "failed"
        || !valid_digest(&record.predecessor_history_sha256)
        || !valid_digest(&record.candidate_sha256)
        || record.falsegreen_task_id.is_empty()
    {
        return Err("replacement record shape is invalid".to_owned());
    }
    if events.is_empty()
        || events
            .iter()
            .any(|event| event.session_id != record.predecessor_session_id)
    {
        return Err("predecessor events are not bound to the recorded session".to_owned());
    }
    if history_sha256(events).map_err(|error| error.to_string())?
        != record.predecessor_history_sha256
    {
        return Err("predecessor history digest is not exact".to_owned());
    }
    let terminal = events.last().ok_or("predecessor history is empty")?;
    if terminal.kind != EventKind::TerminalState
        || terminal.payload["state"] != "failed"
        || terminal.payload["reason"] != "falsegreen_infrastructure_failure"
    {
        return Err("predecessor terminal state is not eligible".to_owned());
    }
    let candidate_index = events
        .iter()
        .position(|event| event.sequence == record.candidate_event_sequence)
        .ok_or("replacement candidate sequence is not bound")?;
    let candidate = &events[candidate_index];
    if candidate.kind != EventKind::CandidateReady
        || candidate.payload["candidate_sha256"].as_str() != Some(record.candidate_sha256.as_str())
        || candidate.payload["summary"]
            .as_str()
            .is_none_or(str::is_empty)
    {
        return Err("replacement candidate event is incomplete".to_owned());
    }
    let boundary = events[..candidate_index]
        .iter()
        .rev()
        .find(|event| {
            event.kind == EventKind::Checkpoint
                && event.payload["checkpoint_kind"] == "turn_boundary"
        })
        .ok_or("replacement turn boundary is missing")?;
    if boundary.payload["candidate_sha256"].as_str() != Some(record.candidate_sha256.as_str()) {
        return Err("replacement turn boundary candidate is not exact".to_owned());
    }
    let git = events
        .iter()
        .find(|event| {
            event.sequence == record.source_git_state_sequence
                && event.kind == EventKind::GitState
                && event.sequence > candidate.sequence
        })
        .ok_or("replacement GitState sequence is not bound")?;
    if git.payload["workspace_state_sha256"]
        .as_str()
        .is_none_or(|value| !valid_digest(value))
    {
        return Err("replacement workspace identity is unavailable".to_owned());
    }
    let authority = events
        .iter()
        .filter(|event| {
            event.kind == EventKind::Checkpoint
                && event.payload["checkpoint_kind"] == "acceptance_authority"
        })
        .collect::<Vec<_>>();
    if authority.len() != 1
        || authority[0].payload["falsegreen_task_id"].as_str()
            != Some(record.falsegreen_task_id.as_str())
    {
        return Err("replacement task binding is not exact".to_owned());
    }
    if events
        .iter()
        .any(|event| event.kind == EventKind::SessionReplaced)
    {
        return Err("predecessor contains a forbidden replacement chain".to_owned());
    }
    Ok(())
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum NativeSurfaceFamily {
    Task,
    FrozenScope,
    Job,
    Run,
    VerificationResult,
    Evidence,
    Report,
    FailureRecovery,
    ReplacementSession,
}

impl NativeSurfaceFamily {
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::Task => "task",
            Self::FrozenScope => "frozen-scope",
            Self::Job => "job",
            Self::Run => "run",
            Self::VerificationResult => "verification-result",
            Self::Evidence => "evidence",
            Self::Report => "report",
            Self::FailureRecovery => "failure-recovery",
            Self::ReplacementSession => "replacement-session",
        }
    }
}

#[derive(Debug, Clone, PartialEq)]
pub struct NativeSurfaceSet {
    pub task: Surface,
    pub frozen_scope: Surface,
    pub job: Surface,
    pub run: Surface,
    pub verification_result: Surface,
    pub evidence: Surface,
    pub report: Surface,
    pub failure_recovery: Surface,
    pub replacement_session: Surface,
}

impl NativeSurfaceSet {
    #[must_use]
    pub fn get(&self, family: NativeSurfaceFamily) -> &Surface {
        match family {
            NativeSurfaceFamily::Task => &self.task,
            NativeSurfaceFamily::FrozenScope => &self.frozen_scope,
            NativeSurfaceFamily::Job => &self.job,
            NativeSurfaceFamily::Run => &self.run,
            NativeSurfaceFamily::VerificationResult => &self.verification_result,
            NativeSurfaceFamily::Evidence => &self.evidence,
            NativeSurfaceFamily::Report => &self.report,
            NativeSurfaceFamily::FailureRecovery => &self.failure_recovery,
            NativeSurfaceFamily::ReplacementSession => &self.replacement_session,
        }
    }

    pub fn iter(&self) -> impl Iterator<Item = (NativeSurfaceFamily, &Surface)> {
        [
            (NativeSurfaceFamily::Task, &self.task),
            (NativeSurfaceFamily::FrozenScope, &self.frozen_scope),
            (NativeSurfaceFamily::Job, &self.job),
            (NativeSurfaceFamily::Run, &self.run),
            (
                NativeSurfaceFamily::VerificationResult,
                &self.verification_result,
            ),
            (NativeSurfaceFamily::Evidence, &self.evidence),
            (NativeSurfaceFamily::Report, &self.report),
            (NativeSurfaceFamily::FailureRecovery, &self.failure_recovery),
            (
                NativeSurfaceFamily::ReplacementSession,
                &self.replacement_session,
            ),
        ]
        .into_iter()
    }
}

#[derive(Debug, Error, Clone, PartialEq, Eq)]
pub enum NativeProjectionError {
    #[error("event-store error while projecting native state: {0}")]
    EventStore(String),
    #[error("session error while projecting native state: {0}")]
    Session(String),
    #[error("native state snapshot drifted while it was being read; refresh required")]
    SnapshotDrift,
    #[error("native state is malformed: {0}")]
    Malformed(String),
    #[error("native surface rendering failed: {0}")]
    Render(String),
}

impl From<EventError> for NativeProjectionError {
    fn from(error: EventError) -> Self {
        Self::EventStore(error.to_string())
    }
}
impl From<SessionError> for NativeProjectionError {
    fn from(error: SessionError) -> Self {
        Self::Session(error.to_string())
    }
}
impl From<GenUiError> for NativeProjectionError {
    fn from(error: GenUiError) -> Self {
        Self::Render(error.to_string())
    }
}

#[derive(Debug, Clone)]
struct Capture {
    session: Session,
    events: Vec<Event>,
    relation: Option<SessionReplacementRecord>,
    related_events: Vec<Event>,
}

#[derive(Debug, Clone, PartialEq)]
pub struct NativeStateProjection {
    pub snapshot: NativeSnapshotIdentity,
    pub task: NativeTask,
    pub frozen_scope: NativeFrozenScope,
    pub job: NativeJob,
    pub run: NativeRun,
    pub verification: NativeVerification,
    pub evidence: NativeEvidence,
    pub report: NativeReport,
    pub recovery: NativeRecovery,
    pub replacement: NativeReplacement,
    surfaces: NativeSurfaceSet,
}

impl NativeStateProjection {
    pub fn from_store(store: &EventStore, session_id: &str) -> Result<Self, NativeProjectionError> {
        let first = capture(store, session_id)?;
        let first_digest = capture_digest(&first)?;
        let second = capture(store, session_id)?;
        if first_digest != capture_digest(&second)? || first.relation != second.relation {
            return Err(NativeProjectionError::SnapshotDrift);
        }
        from_capture(&second)
    }

    pub fn project(store: &EventStore, session_id: &str) -> Result<Self, NativeProjectionError> {
        Self::from_store(store, session_id)
    }

    pub fn from_session(
        store: &EventStore,
        session: &Session,
    ) -> Result<Self, NativeProjectionError> {
        let projection = Self::from_store(store, &session.id)?;
        if projection.task.lifecycle.value.as_deref() != Some(session_state_label(session.state)) {
            return Err(NativeProjectionError::SnapshotDrift);
        }
        Ok(projection)
    }

    #[must_use]
    pub fn surfaces(&self) -> &NativeSurfaceSet {
        &self.surfaces
    }

    #[must_use]
    pub fn surface(&self, family: NativeSurfaceFamily) -> &Surface {
        self.surfaces.get(family)
    }

    pub fn is_stale(&self, store: &EventStore) -> Result<bool, NativeProjectionError> {
        Ok(Self::from_store(store, &self.snapshot.source_session_id)?.snapshot != self.snapshot)
    }

    pub fn refresh(&self, store: &EventStore) -> Result<Self, NativeProjectionError> {
        Self::from_store(store, &self.snapshot.source_session_id)
    }

    pub fn render(
        &self,
        store: &EventStore,
        family: NativeSurfaceFamily,
        terminal_width: usize,
    ) -> Result<String, NativeProjectionError> {
        if self.is_stale(store)? {
            return Err(NativeProjectionError::SnapshotDrift);
        }
        let capabilities = default_negotiated_capabilities(terminal_width.max(1));
        let mut catalog = ActionCatalog::default();
        render_surface_with_capabilities_and_catalog_with_store(
            self.surface(family),
            &capabilities,
            &mut catalog,
            store,
        )
        .map_err(NativeProjectionError::from)
    }
}

pub fn native_state_surfaces(
    store: &EventStore,
    session_id: &str,
) -> Result<NativeSurfaceSet, NativeProjectionError> {
    Ok(NativeStateProjection::from_store(store, session_id)?
        .surfaces
        .clone())
}

pub fn project_native_state(
    store: &EventStore,
    session_id: &str,
) -> Result<NativeStateProjection, NativeProjectionError> {
    NativeStateProjection::from_store(store, session_id)
}

pub fn render_native_surface(
    store: &EventStore,
    session_id: &str,
    family: NativeSurfaceFamily,
    terminal_width: usize,
) -> Result<String, NativeProjectionError> {
    NativeStateProjection::from_store(store, session_id)?.render(store, family, terminal_width)
}

fn capture(store: &EventStore, session_id: &str) -> Result<Capture, NativeProjectionError> {
    let session = Session::reconstruct(store, session_id)?;
    let events = store.events(session_id)?;
    let relation = store
        .replacement_for_session(session_id)?
        .or(store.replacement_for_predecessor(session_id)?);
    let related_events = relation
        .as_ref()
        .map(|relation| {
            let related_id = if relation.predecessor_session_id == session_id {
                &relation.replacement_session_id
            } else {
                &relation.predecessor_session_id
            };
            store.events(related_id)
        })
        .transpose()?
        .unwrap_or_default();
    Ok(Capture {
        session,
        events,
        relation,
        related_events,
    })
}

fn capture_digest(capture: &Capture) -> Result<String, NativeProjectionError> {
    let own = history_sha256(&capture.events)?;
    let related = (!capture.related_events.is_empty())
        .then(|| history_sha256(&capture.related_events))
        .transpose()?;
    serde_json::to_string(&serde_json::json!({
        "schema": "falsegreen.agent.native-state-snapshot.v2",
        "session": capture.session.id,
        "state": session_state_label(capture.session.state),
        "own": own,
        "related": related,
        "relation": capture.relation,
    }))
    .map(|value| sha256_bytes(value.as_bytes()))
    .map_err(|error| NativeProjectionError::Malformed(error.to_string()))
}

fn snapshot_identity(capture: &Capture) -> Result<NativeSnapshotIdentity, NativeProjectionError> {
    let state_generation = capture
        .events
        .iter()
        .chain(capture.related_events.iter())
        .map(|event| event.sequence)
        .max()
        .unwrap_or_default();
    Ok(NativeSnapshotIdentity {
        source_session_id: capture.session.id.clone(),
        state_generation,
        digest: capture_digest(capture)?,
    })
}

struct Facts {
    task: NativeTask,
    frozen_scope: NativeFrozenScope,
    job: NativeJob,
    run: NativeRun,
    verification: NativeVerification,
    evidence: NativeEvidence,
    report: NativeReport,
    recovery: NativeRecovery,
    replacement: NativeReplacement,
}

fn from_capture(capture: &Capture) -> Result<NativeStateProjection, NativeProjectionError> {
    let snapshot = snapshot_identity(capture)?;
    let facts = derive_facts(capture);
    let surfaces = build_surfaces(&snapshot, &facts);
    for (_, surface) in surfaces.iter() {
        surface.validate().map_err(NativeProjectionError::from)?;
    }
    Ok(NativeStateProjection {
        snapshot,
        task: facts.task,
        frozen_scope: facts.frozen_scope,
        job: facts.job,
        run: facts.run,
        verification: facts.verification,
        evidence: facts.evidence,
        report: facts.report,
        recovery: facts.recovery,
        replacement: facts.replacement,
        surfaces,
    })
}

fn derive_facts(capture: &Capture) -> Facts {
    let candidate = candidate_context(&capture.events);
    let source = source_context(&capture.events);
    let task_view = latest_typed_task(&capture.events).filter(|task| {
        latest_typed_scope(&capture.events).is_some_and(|scope| {
            task.scope_id == scope.scope_id
                && task.scope_digest == scope.scope_digest
                && task
                    .candidate_sha256
                    .as_deref()
                    .is_none_or(|digest| candidate.as_deref() == Some(digest))
                && task
                    .source_sha256
                    .as_deref()
                    .is_none_or(|digest| source.as_deref() == Some(digest))
        })
    });
    let scope_view = latest_typed_scope(&capture.events);
    let mut job_view = latest_typed_job(&capture.events).filter(|job| {
        task_view.as_ref().is_some_and(|task| {
            task.task_id == job.task_id
                && task.current_job_id.as_deref().is_none_or(|id| id == job.id)
                && task.candidate_sha256.as_deref().is_some_and(|digest| {
                    job.candidate_sha256.as_deref() == Some(digest)
                        && candidate.as_deref() == Some(digest)
                })
                && task.source_sha256.as_deref().is_some_and(|digest| {
                    job.source_sha256.as_deref() == Some(digest)
                        && source.as_deref() == Some(digest)
                })
        })
    });
    // Run authority is intentionally sourced only from an explicit typed
    // `run_authority` checkpoint. Generic claim/session/checkpoint metadata is
    // diagnostic context and can never manufacture a trusted Run view.
    let mut run_view = latest_typed_run(&capture.events).filter(|run| {
        job_view.as_ref().is_some_and(|job| {
            run.job_id == job.id
                && (job.run_ids.is_empty() || job.run_ids.iter().any(|id| id == &run.id))
        })
    });
    if job_view.as_ref().is_some_and(|job| {
        run_view
            .as_ref()
            .is_some_and(|run| !job.run_ids.iter().any(|id| id == &run.id))
    }) {
        run_view = None;
    }
    // A Job collection is authoritative only when every listed current Run
    // resolves to the same validated Run authority. Never display a loose
    // run alias as a trusted collection member.
    if job_view.as_ref().is_some_and(|job| {
        !job.run_ids.is_empty()
            && run_view
                .as_ref()
                .is_none_or(|run| job.run_ids.len() != 1 || job.run_ids[0] != run.id)
    }) {
        job_view = None;
    }
    let result_view = latest_typed_result(
        &capture.events,
        candidate.as_deref(),
        source.as_deref(),
        scope_view.as_ref(),
        job_view.as_ref(),
        run_view.as_ref(),
    )
    .filter(|result| {
        job_view.as_ref().is_some_and(|job| job.id == result.job_id)
            && run_view.as_ref().is_some_and(|run| run.id == result.run_id)
            && result.worker_id.as_deref().is_none_or(|worker| {
                run_view.as_ref().and_then(|run| run.worker_id.as_deref()) == Some(worker)
            })
            && result
                .assignment_generation
                .as_deref()
                .is_none_or(|generation| {
                    run_view
                        .as_ref()
                        .and_then(|run| run.assignment_generation.as_deref())
                        == Some(generation)
                })
    });
    let report_view = latest_typed_report(
        &capture.events,
        candidate.as_deref(),
        source.as_deref(),
        job_view.as_ref(),
        run_view.as_ref(),
        result_view.as_ref(),
    );
    let evidence = result_view.as_ref().map_or_else(
        || unavailable_evidence("Evidence unavailable: no validated FalseGreen result or frozen scope authority is available."),
        |result| {
            evidence_from_result(
                result,
                scope_view.as_ref(),
                job_view.as_ref().map(|job| job.id.as_str()),
                run_view.as_ref().map(|run| run.id.as_str()),
                source.as_deref(),
            )
        },
    );

    let task_id = task_view.as_ref().map(|view| view.task_id.clone());
    let scope_digest = scope_view.as_ref().map(|view| view.scope_digest.clone());
    let task = NativeTask {
        task_id: task_id.as_deref().map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            NativeField::falsegreen,
        ),
        lifecycle: task_view
            .as_ref()
            .and_then(|view| view.lifecycle.as_deref())
            .map_or_else(
                || NativeField::agent(session_state_label(capture.session.state)),
                NativeField::falsegreen,
            ),
        frozen: scope_view.as_ref().map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            |_| NativeField::falsegreen("FROZEN"),
        ),
        scope_digest: scope_digest.as_deref().map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            NativeField::falsegreen,
        ),
        scope_summary: scope_view.as_ref().map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            |view| {
                NativeField::falsegreen(format!("{} frozen obligation(s)", view.obligations.len()))
            },
        ),
        source_sha256: task_view
            .as_ref()
            .and_then(|view| view.source_sha256.as_deref())
            .map_or_else(
                || {
                    source.as_deref().map_or_else(
                        || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
                        NativeField::agent,
                    )
                },
                NativeField::falsegreen,
            ),
        candidate_sha256: task_view
            .as_ref()
            .and_then(|view| view.candidate_sha256.as_deref())
            .or(candidate.as_deref())
            .map_or_else(
                || NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
                NativeField::agent,
            ),
        current_job_id: task_view
            .as_ref()
            .and_then(|view| view.current_job_id.as_deref())
            .or(job_view.as_ref().map(|view| view.id.as_str()))
            .map_or_else(
                || NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
                NativeField::agent,
            ),
    };
    let frozen_scope = scope_view.as_ref().map_or_else(unavailable_scope, |view| {
        NativeFrozenScope {
            scope_digest: NativeField::falsegreen(view.scope_digest.clone()),
            frozen: NativeField::falsegreen("FROZEN"),
            obligations: view
                .obligations
                .iter()
                .map(|(id, requirement)| NativeScopeObligation {
                    id: NativeField::falsegreen(id),
                    requirement: NativeField::falsegreen(requirement),
                })
                .collect(),
            distinction: "Requirement text is immutable frozen scope; evidence/result state is separate and cannot rewrite it.".to_owned(),
        }
    });

    let mut verification = result_view
        .as_ref()
        .map_or_else(unavailable_verification, |result| {
            verification_from_result(result, scope_view.as_ref())
        });
    let job = job_view
        .as_ref()
        .map_or_else(unavailable_job, |view| NativeJob {
            id: NativeField::falsegreen(view.id.clone()),
            status: view.status,
            status_raw: NativeField::falsegreen(status_wire(view.status)),
            task_id: NativeField::falsegreen(view.task_id.clone()),
            source_sha256: optional_falsegreen(view.source_sha256.as_deref()),
            candidate_sha256: optional_falsegreen(view.candidate_sha256.as_deref()),
            entitlement_consumption: optional_agent(view.entitlement_consumption.as_deref()),
            run_ids: view.run_ids.iter().map(NativeField::agent).collect(),
            authority_decision: NativeField::unavailable(
                AuthorityClass::AuthoritativeFalseGreenState,
            ),
        });
    let run = run_view
        .as_ref()
        .map_or_else(unavailable_run, |view| NativeRun {
            id: NativeField::agent(view.id.clone()),
            worker_id: optional_agent(view.worker_id.as_deref()),
            job_id: NativeField::agent(view.job_id.clone()),
            assignment_generation: optional_agent(view.assignment_generation.as_deref()),
            status: view.status,
            status_raw: NativeField::agent(status_wire(view.status)),
            execution_started_at: optional_agent(view.execution_started_at.as_deref()),
            package_runtime_identity: optional_agent(view.package_runtime_identity.as_deref()),
            recovery_lease: optional_agent(view.recovery_lease.as_deref()),
        });
    let recovery = latest_typed_recovery(
        &capture.events,
        task_view.as_ref(),
        job_view.as_ref(),
        run_view.as_ref(),
        source.as_deref(),
    )
    .map_or_else(|| recovery_unknown(&run), |view| recovery_from_view(&view));
    let report = report_view
        .as_ref()
        .map_or_else(|| unavailable_report(&verification), report_from_view);
    if let Some(report_id) = report.id.value.as_deref() {
        verification.report_reference = NativeField::falsegreen(report_id);
    }
    let replacement = replacement_from_capture(capture, &verification);
    Facts {
        task,
        frozen_scope,
        job,
        run,
        verification,
        evidence,
        report,
        recovery,
        replacement,
    }
}

fn latest_typed_task(events: &[Event]) -> Option<AuthoritativeTaskView> {
    unique_latest(events, |event| {
        checkpoint_object(
            event,
            &["task_authority", "falsegreen_task_authority"],
            "task",
        )
        .or_else(|| {
            (event.kind == EventKind::Checkpoint
                && event.payload["checkpoint_kind"] == "acceptance_authority")
                .then(|| event.payload.get("task"))
                .flatten()
                .filter(|value| value.is_object())
        })
        .or_else(|| {
            (event.kind == EventKind::Checkpoint
                && (event.payload["checkpoint_kind"] == "falsegreen_task_authority"
                    || (event.payload["checkpoint_kind"] == "acceptance_authority"
                        && event.payload.get("task_id").is_some()
                        && event.payload.get("scope_id").is_some())))
            .then_some(&event.payload)
        })
    })
    .and_then(|value| parse_task_view(value).ok())
}

fn latest_typed_scope(events: &[Event]) -> Option<AuthoritativeFrozenScopeView> {
    unique_latest(events, |event| {
        checkpoint_object(event, &["frozen_scope_authority"], "frozen_scope")
            .or_else(|| {
                (event.kind == EventKind::Checkpoint
                    && event.payload["checkpoint_kind"] == "acceptance_authority")
                    .then(|| event.payload.get("frozen_scope"))
                    .flatten()
                    .filter(|value| value.is_object())
            })
            .or_else(|| {
                (event.kind == EventKind::Checkpoint
                    && (event.payload["checkpoint_kind"] == "frozen_scope_authority"
                        || (event.payload["checkpoint_kind"] == "acceptance_authority"
                            && event.payload.get("scope_id").is_some()
                            && event.payload.get("obligations").is_some())))
                .then_some(&event.payload)
            })
    })
    .and_then(|value| parse_scope_view(value).ok())
}

fn latest_typed_job(events: &[Event]) -> Option<AuthoritativeJobView> {
    unique_latest(events, |event| {
        checkpoint_object(event, &["job_authority"], "job").or_else(|| {
            (event.kind == EventKind::Checkpoint
                && event.payload["checkpoint_kind"] == "job_authority"
                && event.payload.get("job_id").is_some())
            .then_some(&event.payload)
        })
    })
    .and_then(|value| parse_job_view(value).ok())
}

fn latest_typed_run(events: &[Event]) -> Option<AuthoritativeRunView> {
    unique_latest(events, |event| {
        checkpoint_object(event, &["run_authority"], "run").or_else(|| {
            (event.kind == EventKind::Checkpoint
                && event.payload["checkpoint_kind"] == "run_authority"
                && event.payload.get("run_id").is_some())
            .then_some(&event.payload)
        })
    })
    .and_then(|value| parse_run_view(value).ok())
}

fn latest_typed_recovery(
    events: &[Event],
    task: Option<&AuthoritativeTaskView>,
    job: Option<&AuthoritativeJobView>,
    run: Option<&AuthoritativeRunView>,
    source: Option<&str>,
) -> Option<AuthoritativeRecoveryView> {
    unique_latest(events, |event| {
        checkpoint_object(event, &["recovery_authority"], "recovery").or_else(|| {
            (event.kind == EventKind::Checkpoint
                && event.payload["checkpoint_kind"] == "recovery_authority"
                && event.payload.get("state").is_some())
            .then_some(&event.payload)
        })
    })
    .and_then(|value| parse_recovery_view(value, task, job, run, source).ok())
}

fn parse_recovery_view(
    value: &Value,
    task: Option<&AuthoritativeTaskView>,
    job: Option<&AuthoritativeJobView>,
    run: Option<&AuthoritativeRunView>,
    source: Option<&str>,
) -> Result<AuthoritativeRecoveryView, String> {
    let object = value
        .as_object()
        .ok_or("recovery authority is not an object")?;
    reject_unknown_keys(
        object,
        &[
            "state",
            "reason",
            "action_available",
            "task_id",
            "falsegreen_task_id",
            "job_id",
            "run_id",
            "worker_id",
            "worker",
            "assignment_generation",
            "generation",
            "source_sha256",
            "authoritative_source_sha256",
            "candidate_sha256",
            "provenance",
            "authority_source",
        ],
        "recovery authority",
    )?;
    let state = match required_string(object, "state")?.as_str() {
        "RECOVERABLE" => RecoveryState::Recoverable,
        "BLOCKED" => RecoveryState::Blocked,
        "TERMINAL" => RecoveryState::Terminal,
        "UNKNOWN" => RecoveryState::Unknown,
        _ => return Err("unknown recovery state".to_owned()),
    };
    let task = task.ok_or("recovery authority requires Task context")?;
    let job = job.ok_or("recovery authority requires Job context")?;
    let run = run.ok_or("recovery authority requires Run context")?;
    let source = source.ok_or("recovery authority requires source context")?;
    let task_id = required_string_any(object, &["task_id", "falsegreen_task_id"])?;
    let job_id = required_string(object, "job_id")?;
    let run_id = required_string(object, "run_id")?;
    let worker_id = required_string_any(object, &["worker_id", "worker"])?;
    let assignment_generation =
        required_string_any(object, &["assignment_generation", "generation"])?;
    let source_sha256 =
        required_digest_any(object, &["source_sha256", "authoritative_source_sha256"])?;
    let candidate_sha256 = optional_digest_any(object, &["candidate_sha256"])?;
    let provenance = required_string_any(object, &["provenance", "authority_source"])?;
    if !matches!(
        provenance.as_str(),
        "canonical" | "falsegreen_core" | "falsegreen"
    ) {
        return Err("recovery provenance is not a known authority source".to_owned());
    }
    if task.task_id != task_id
        || job.id != job_id
        || run.id != run_id
        || run.worker_id.as_deref() != Some(worker_id.as_str())
        || run.assignment_generation.as_deref() != Some(assignment_generation.as_str())
        || source != source_sha256
        || candidate_sha256
            .as_deref()
            .is_some_and(|candidate| task.candidate_sha256.as_deref() != Some(candidate))
    {
        return Err("recovery authority binding conflicts with current graph".to_owned());
    }
    Ok(AuthoritativeRecoveryView {
        state,
        reason: optional_string(object, "reason"),
        action_available: object
            .get("action_available")
            .and_then(Value::as_bool)
            .unwrap_or(false),
        task_id,
        job_id,
        run_id,
        worker_id,
        assignment_generation,
        source_sha256,
        candidate_sha256,
        provenance,
    })
}

fn unique_latest<'a, F>(events: &'a [Event], select: F) -> Option<&'a Value>
where
    F: FnMut(&'a Event) -> Option<&'a Value>,
{
    let matches = events.iter().filter_map(select).collect::<Vec<_>>();
    (matches.len() == 1).then(|| matches[0])
}

fn checkpoint_object<'a>(event: &'a Event, kinds: &[&str], key: &str) -> Option<&'a Value> {
    if event.kind != EventKind::Checkpoint
        || !kinds
            .iter()
            .any(|kind| event.payload["checkpoint_kind"] == *kind)
    {
        return None;
    }
    event.payload.get(key).filter(|value| value.is_object())
}

fn parse_task_view(value: &Value) -> Result<AuthoritativeTaskView, String> {
    let object = value.as_object().ok_or("task authority is not an object")?;
    reject_unknown_keys(
        object,
        &[
            "task_id",
            "lifecycle",
            "scope_id",
            "frozen_scope_id",
            "scope_digest",
            "frozen_scope_digest",
            "source_sha256",
            "authoritative_source_sha256",
            "candidate_sha256",
            "current_job_id",
            "job_id",
            "checkpoint_kind",
            "falsegreen_task_id",
            "task",
            "frozen_scope",
            "obligations",
        ],
        "task authority",
    )?;
    let task_id = required_string(object, "task_id")?;
    if !valid_identity(&task_id) {
        return Err("task ID is malformed".to_owned());
    }
    let lifecycle = optional_string(object, "lifecycle");
    if lifecycle
        .as_deref()
        .is_some_and(|value| !is_known_session_lifecycle(value))
    {
        return Err("task lifecycle is unknown".to_owned());
    }
    Ok(AuthoritativeTaskView {
        task_id,
        lifecycle,
        scope_id: required_string_any(object, &["scope_id", "frozen_scope_id"])?,
        scope_digest: required_digest_any(object, &["scope_digest", "frozen_scope_digest"])?,
        source_sha256: optional_digest_any(
            object,
            &["source_sha256", "authoritative_source_sha256"],
        )?,
        candidate_sha256: optional_digest_any(object, &["candidate_sha256"])?,
        current_job_id: optional_string_any_checked(object, &["current_job_id", "job_id"])?,
    })
}

fn parse_scope_view(value: &Value) -> Result<AuthoritativeFrozenScopeView, String> {
    let object = value
        .as_object()
        .ok_or("frozen scope authority is not an object")?;
    reject_unknown_keys(
        object,
        &[
            "scope_id",
            "id",
            "scope_digest",
            "digest",
            "obligations",
            "checkpoint_kind",
            "falsegreen_task_id",
            "task",
            "frozen_scope",
            "job_id",
        ],
        "frozen scope authority",
    )?;
    let scope_id = required_string_any(object, &["scope_id", "id"])?;
    if !valid_identity(&scope_id) {
        return Err("frozen scope ID is malformed".to_owned());
    }
    let scope_digest = required_digest_any(object, &["scope_digest", "digest"])?;
    let values = object
        .get("obligations")
        .and_then(Value::as_array)
        .ok_or("frozen scope obligations are missing")?;
    if values.is_empty() {
        return Err("frozen scope obligations are empty".to_owned());
    }
    let mut ids = BTreeSet::new();
    let mut obligations = Vec::with_capacity(values.len());
    for value in values {
        let object = value
            .as_object()
            .ok_or("malformed frozen-scope obligation")?;
        let id = required_string_any(object, &["id", "obligation_id"])?;
        if !valid_identity(&id) {
            return Err("frozen-scope obligation ID is malformed".to_owned());
        }
        let requirement = required_string_any(object, &["requirement", "text", "description"])?;
        if !ids.insert(id.clone()) {
            return Err(format!("duplicate obligation ID {id}"));
        }
        obligations.push((id, requirement));
    }
    if scope_digest != scope_digest_for_obligations(&obligations) {
        return Err("frozen scope digest does not match displayed obligations".to_owned());
    }
    Ok(AuthoritativeFrozenScopeView {
        scope_id,
        scope_digest,
        obligations,
    })
}

fn parse_job_view(value: &Value) -> Result<AuthoritativeJobView, String> {
    let object = value.as_object().ok_or("job authority is not an object")?;
    reject_unknown_keys(
        object,
        &[
            "job_id",
            "id",
            "status",
            "task_id",
            "source_sha256",
            "authoritative_source_sha256",
            "candidate_sha256",
            "run_ids",
            "entitlement_consumption",
            "consumption",
            "checkpoint_kind",
        ],
        "Job authority",
    )?;
    let id = required_string_any(object, &["job_id", "id"])?;
    if !valid_identity(&id) {
        return Err("Job ID is malformed".to_owned());
    }
    let status = parse_status_exact(required_string(object, "status")?.as_str())
        .ok_or("unknown job status")?;
    let task_id = required_string(object, "task_id")?;
    if !valid_identity(&task_id) {
        return Err("Job task ID is malformed".to_owned());
    }
    let source_sha256 =
        optional_digest_any(object, &["source_sha256", "authoritative_source_sha256"])?;
    let candidate_sha256 = optional_digest_any(object, &["candidate_sha256"])?;
    let run_ids = object.get("run_ids").map_or(Ok(Vec::new()), |value| {
        let run_ids: Vec<String> = value
            .as_array()
            .ok_or("job run_ids are malformed")?
            .iter()
            .map(|value| {
                value
                    .as_str()
                    .filter(|value| valid_identity(value))
                    .map(str::to_owned)
                    .ok_or_else(|| "job run ID is malformed".to_owned())
            })
            .collect::<Result<_, _>>()?;
        let unique = run_ids.iter().collect::<BTreeSet<_>>().len();
        (unique == run_ids.len())
            .then_some(run_ids)
            .ok_or_else(|| "duplicate Job run ID".to_owned())
    })?;
    Ok(AuthoritativeJobView {
        id,
        status,
        task_id,
        source_sha256,
        candidate_sha256,
        run_ids,
        // Agent-side Job payloads do not carry product entitlement authority.
        // Keep consumption Unknown until a separately validated, fully
        // cross-bound entitlement object is available; never infer it from a
        // loose alias such as `consumption: "consumed"`.
        entitlement_consumption: None,
    })
}

fn parse_run_view(value: &Value) -> Result<AuthoritativeRunView, String> {
    let object = value.as_object().ok_or("run authority is not an object")?;
    reject_unknown_keys(
        object,
        &[
            "run_id",
            "id",
            "status",
            "job_id",
            "worker_id",
            "worker",
            "assignment_generation",
            "generation",
            "execution_started_at",
            "package_runtime_identity",
            "package_identity",
            "runtime_identity",
            "recovery_lease",
            "lease",
            "checkpoint_kind",
        ],
        "Run authority",
    )?;
    let id = required_string_any(object, &["run_id", "id"])?;
    if !valid_identity(&id) {
        return Err("Run ID is malformed".to_owned());
    }
    Ok(AuthoritativeRunView {
        id,
        status: parse_status_exact(required_string(object, "status")?.as_str())
            .ok_or("unknown run status")?,
        job_id: {
            let job_id = required_string(object, "job_id")?;
            if !valid_identity(&job_id) {
                return Err("Run Job ID is malformed".to_owned());
            }
            job_id
        },
        worker_id: optional_string_any_checked(object, &["worker_id", "worker"])?,
        assignment_generation: optional_string_any_checked(
            object,
            &["assignment_generation", "generation"],
        )?,
        execution_started_at: optional_string(object, "execution_started_at"),
        package_runtime_identity: optional_string_any_checked(
            object,
            &[
                "package_runtime_identity",
                "package_identity",
                "runtime_identity",
            ],
        )?,
        recovery_lease: optional_string_any_checked(object, &["recovery_lease", "lease"])?,
    })
}

#[derive(Debug, Clone)]
struct ResultView {
    payload: Value,
    verdict: NativeVerdict,
    candidate_sha256: String,
    source_sha256: String,
    run_id: String,
    job_id: String,
    worker_id: Option<String>,
    assignment_generation: Option<String>,
    completion_authority: Option<String>,
    result_digest: String,
}

impl AuthoritativeResultView {
    pub fn try_from_value(
        value: &Value,
        candidate: &str,
        source: Option<&str>,
        scope: Option<&AuthoritativeFrozenScopeView>,
    ) -> Result<Self, String> {
        if source.is_none() {
            return Err("trusted current source digest is required".to_owned());
        }
        let result = parse_result_view(value, Some(candidate), source, scope)?;
        Ok(Self {
            verdict: result.verdict,
            candidate_sha256: result.candidate_sha256,
            source_sha256: result.source_sha256,
            run_id: result.run_id,
            job_id: result.job_id,
            worker_id: result.worker_id,
            assignment_generation: result.assignment_generation,
            result_digest: result.result_digest,
        })
    }

    pub fn from_value(
        value: &Value,
        candidate: &str,
        source: Option<&str>,
        scope: Option<&AuthoritativeFrozenScopeView>,
    ) -> Result<Self, String> {
        Self::try_from_value(value, candidate, source, scope)
    }
}

fn latest_typed_result(
    events: &[Event],
    candidate: Option<&str>,
    source: Option<&str>,
    scope: Option<&AuthoritativeFrozenScopeView>,
    job: Option<&AuthoritativeJobView>,
    run: Option<&AuthoritativeRunView>,
) -> Option<ResultView> {
    if events
        .iter()
        .filter(|event| event.kind == EventKind::FalsegreenResult)
        .count()
        != 1
    {
        return None;
    }
    let event = events
        .iter()
        .rev()
        .find(|event| event.kind == EventKind::FalsegreenResult)?;
    let result = parse_result_view(&event.payload, candidate, source, scope).ok()?;
    if job.is_some_and(|job| {
        job.id == result.job_id && lifecycle_allows_result(job.status, result.verdict)
    }) && run.is_some_and(|run| {
        run.id == result.run_id && lifecycle_allows_result(run.status, result.verdict)
    }) {
        Some(result)
    } else {
        None
    }
}

fn lifecycle_allows_result(status: NativeStatus, verdict: NativeVerdict) -> bool {
    match status {
        NativeStatus::Accepted => verdict == NativeVerdict::Accepted,
        NativeStatus::Failed => matches!(
            verdict,
            NativeVerdict::Failed | NativeVerdict::InsufficientEvidence
        ),
        NativeStatus::InsufficientEvidence => verdict == NativeVerdict::InsufficientEvidence,
        NativeStatus::Terminal => true,
        NativeStatus::Queued
        | NativeStatus::Claimed
        | NativeStatus::Running
        | NativeStatus::Executing
        | NativeStatus::Recoverable
        | NativeStatus::Unknown => false,
    }
}

fn parse_result_view(
    payload: &Value,
    candidate: Option<&str>,
    source: Option<&str>,
    scope: Option<&AuthoritativeFrozenScopeView>,
) -> Result<ResultView, String> {
    let object = payload.as_object().ok_or("result is not an object")?;
    reject_unknown_keys(
        object,
        &[
            "verification",
            "verification_status",
            "candidate_sha256",
            "authoritative_source_sha256",
            "source_sha256",
            "run_id",
            "job_id",
            "worker_id",
            "worker",
            "assignment_generation",
            "generation",
            "completion_authority",
            "obligation_outcomes",
            "obligations",
            "evidence",
            "error",
            "repairable",
        ],
        "result authority",
    )?;
    let raw = object
        .get("verification")
        .and_then(Value::as_str)
        .ok_or("result verification is missing")?;
    let verdict = parse_verdict_exact(raw).ok_or("result verdict is not canonical")?;
    let status = object
        .get("verification_status")
        .and_then(Value::as_str)
        .ok_or("result verification_status is missing")?;
    if parse_verdict_exact(status) != Some(verdict)
        || !matches!(status, "accepted" | "failed" | "insufficient_evidence")
    {
        return Err("result verification fields disagree".to_owned());
    }
    let candidate_sha256 = object
        .get("candidate_sha256")
        .and_then(Value::as_str)
        .filter(|value| valid_digest(value))
        .ok_or("result candidate digest is malformed")?;
    if candidate != Some(candidate_sha256) {
        return Err("result candidate does not match current candidate".to_owned());
    }
    let expected_source = source.ok_or("current trusted source digest is unavailable")?;
    let source_sha256 =
        required_digest_any(object, &["authoritative_source_sha256", "source_sha256"])?;
    if source_sha256 != expected_source {
        return Err("result source digest conflicts with current source".to_owned());
    }
    let run_id = required_string(object, "run_id")?;
    let job_id = required_string(object, "job_id")?;
    if !valid_identity(&run_id) || !valid_identity(&job_id) {
        return Err("result Run/Job binding is malformed".to_owned());
    }
    for key in ["worker_id", "worker", "assignment_generation", "generation"] {
        if let Some(value) = object.get(key)
            && !value.is_null()
            && value.as_str().filter(|value| !value.is_empty()).is_none()
        {
            return Err(format!("result {key} binding is malformed"));
        }
    }
    if let Some(values) = object
        .get("obligation_outcomes")
        .or_else(|| object.get("obligations"))
    {
        let scope = scope.ok_or("result obligation outcomes have no frozen scope authority")?;
        let values = values
            .as_array()
            .ok_or("result obligation outcomes are malformed")?;
        let ids = values
            .iter()
            .filter_map(|value| {
                value
                    .get("obligation_id")
                    .or_else(|| value.get("id"))
                    .and_then(Value::as_str)
            })
            .collect::<Vec<_>>();
        if ids.len() != scope.obligations.len()
            || ids
                .iter()
                .any(|id| !scope.obligations.iter().any(|(expected, _)| expected == id))
            || ids.iter().collect::<BTreeSet<_>>().len() != ids.len()
        {
            return Err("result obligation outcomes do not exactly bind frozen scope".to_owned());
        }
        let mut outcome_ids = BTreeSet::new();
        for value in values {
            let outcome = value
                .as_object()
                .ok_or("result obligation outcome is malformed")?;
            let id = required_string_any(outcome, &["obligation_id", "id"])?;
            if !outcome_ids.insert(id) {
                return Err("duplicate result obligation outcome".to_owned());
            }
            let raw_status = required_string_any(outcome, &["status", "outcome"])?;
            if parse_evidence_exact(&raw_status).is_none() {
                return Err("result obligation outcome status is unknown".to_owned());
            }
        }
    }
    Ok(ResultView {
        payload: payload.clone(),
        verdict,
        candidate_sha256: candidate_sha256.to_owned(),
        source_sha256,
        run_id,
        job_id,
        worker_id: optional_string_any_checked(object, &["worker_id", "worker"])?,
        assignment_generation: optional_string_any_checked(
            object,
            &["assignment_generation", "generation"],
        )?,
        completion_authority: object
            .get("completion_authority")
            .map(parse_completion_authority)
            .transpose()?,
        result_digest: sha256_json(payload),
    })
}

fn parse_completion_authority(value: &Value) -> Result<String, String> {
    let object = value
        .as_object()
        .ok_or("result completion authority is malformed")?;
    reject_unknown_keys(
        object,
        &["authority_ready", "may_claim_complete"],
        "result completion authority",
    )?;
    if !object.get("authority_ready").is_some_and(Value::is_boolean)
        || !object
            .get("may_claim_complete")
            .is_some_and(Value::is_boolean)
    {
        return Err("result completion authority is malformed".to_owned());
    }
    Ok(display_json(value))
}

#[derive(Debug, Clone)]
struct ReportView {
    id: String,
    digest: String,
    candidate_sha256: String,
    source_sha256: String,
    verdict: NativeVerdict,
    created_at: Option<String>,
    provenance: String,
    evidence_summary: Option<String>,
}

impl AuthoritativeReportView {
    #[allow(clippy::too_many_arguments)]
    pub fn try_from_value(
        value: &Value,
        candidate: &str,
        source: Option<&str>,
        job: Option<&AuthoritativeJobView>,
        run: Option<&AuthoritativeRunView>,
        result: Option<&AuthoritativeResultView>,
    ) -> Result<Self, String> {
        let result = result.ok_or("report requires a validated parent Result")?;
        let job = job.ok_or("report requires a validated Job binding")?;
        let run = run.ok_or("report requires a validated Run binding")?;
        let source = source.ok_or("report requires a trusted source binding")?;
        if result.candidate_sha256() != candidate
            || result.source_sha256() != source
            || result.job_id() != job.id()
            || result.run_id() != run.id()
        {
            return Err("report parent Result bindings are not exact".to_owned());
        }
        let result_view = ResultView {
            payload: Value::Null,
            verdict: result.verdict,
            candidate_sha256: result.candidate_sha256.clone(),
            source_sha256: result.source_sha256.clone(),
            run_id: result.run_id.clone(),
            job_id: result.job_id.clone(),
            worker_id: None,
            assignment_generation: None,
            completion_authority: None,
            result_digest: result.result_digest.clone(),
        };
        let report = parse_report_value(
            value,
            Some(candidate),
            Some(source),
            Some(job),
            Some(run),
            Some(&result_view),
        )?;
        let object = value
            .as_object()
            .ok_or("report authority is not an object")?;
        Ok(Self {
            id: report.id,
            report_digest: report.digest,
            candidate_sha256: report.candidate_sha256,
            source_sha256: report.source_sha256,
            verdict: report.verdict,
            job_id: required_string(object, "job_id")?,
            run_id: required_string(object, "run_id")?,
            result_digest: required_digest_any(object, &["result_digest"])?,
        })
    }

    #[allow(clippy::too_many_arguments)]
    pub fn from_value(
        value: &Value,
        candidate: &str,
        source: Option<&str>,
        job: Option<&AuthoritativeJobView>,
        run: Option<&AuthoritativeRunView>,
        result: Option<&AuthoritativeResultView>,
    ) -> Result<Self, String> {
        Self::try_from_value(value, candidate, source, job, run, result)
    }
}

fn latest_typed_report(
    events: &[Event],
    candidate: Option<&str>,
    source: Option<&str>,
    job: Option<&AuthoritativeJobView>,
    run: Option<&AuthoritativeRunView>,
    result: Option<&ResultView>,
) -> Option<ReportView> {
    let value = unique_latest(events, |event| {
        checkpoint_object(event, &["report_authority"], "report")
    })?;
    let result = result?;
    let job = job?;
    let run = run?;
    let source = source?;
    let object = value.as_object()?;
    reject_unknown_keys(
        object,
        &[
            "report_id",
            "id",
            "report_digest",
            "digest",
            "candidate_sha256",
            "source_sha256",
            "authoritative_source_sha256",
            "verdict",
            "job_id",
            "run_id",
            "result_digest",
            "provenance",
            "authority_source",
            "created_at",
            "created_at_ms",
            "key_evidence_summary",
            "summary",
        ],
        "report authority",
    )
    .ok()?;
    let id = required_string_any(object, &["report_id", "id"]).ok()?;
    if !valid_identity(&id) {
        return None;
    }
    let digest = required_report_digest(object).ok()?;
    let report_candidate = required_digest_any(object, &["candidate_sha256"]).ok()?;
    if candidate != Some(report_candidate.as_str()) {
        return None;
    }
    let report_source =
        required_digest_any(object, &["source_sha256", "authoritative_source_sha256"]).ok()?;
    if report_source != source {
        return None;
    }
    if result.candidate_sha256 != report_candidate
        || result.source_sha256 != report_source
        || result.job_id != job.id
        || result.run_id != run.id
    {
        return None;
    }
    let raw_verdict = object.get("verdict").and_then(Value::as_str)?;
    let verdict = parse_verdict_exact(raw_verdict)?;
    if result.verdict != verdict {
        return None;
    }
    if !matches!(raw_verdict, "accepted" | "failed" | "insufficient_evidence") {
        return None;
    }
    let job_id = optional_string(object, "job_id");
    if job_id.as_deref() != Some(job.id.as_str()) {
        return None;
    }
    let run_id = optional_string(object, "run_id");
    if run_id.as_deref() != Some(run.id.as_str()) {
        return None;
    }
    if object.get("result_digest").and_then(Value::as_str) != Some(result.result_digest.as_str()) {
        return None;
    }
    let provenance = required_string_any(object, &["provenance", "authority_source"]).ok()?;
    if !matches!(
        provenance.as_str(),
        "canonical" | "falsegreen_core" | "falsegreen"
    ) {
        return None;
    }
    Some(ReportView {
        id,
        digest,
        candidate_sha256: report_candidate,
        source_sha256: report_source,
        verdict,
        created_at: optional_string_any_checked(object, &["created_at", "created_at_ms"]).ok()?,
        provenance,
        evidence_summary: optional_string_any_checked(object, &["key_evidence_summary", "summary"])
            .ok()?,
    })
}

fn parse_report_value(
    value: &Value,
    candidate: Option<&str>,
    source: Option<&str>,
    job: Option<&AuthoritativeJobView>,
    run: Option<&AuthoritativeRunView>,
    result: Option<&ResultView>,
) -> Result<ReportView, String> {
    let object = value
        .as_object()
        .ok_or("report authority is not an object")?;
    reject_unknown_keys(
        object,
        &[
            "report_id",
            "id",
            "report_digest",
            "digest",
            "candidate_sha256",
            "source_sha256",
            "authoritative_source_sha256",
            "verdict",
            "job_id",
            "run_id",
            "result_digest",
            "provenance",
            "authority_source",
            "created_at",
            "created_at_ms",
            "key_evidence_summary",
            "summary",
        ],
        "report authority",
    )?;
    let id = required_string_any(object, &["report_id", "id"])?;
    if !valid_identity(&id) {
        return Err("report ID is malformed".to_owned());
    }
    let digest = required_report_digest(object)?;
    let report_candidate = required_digest_any(object, &["candidate_sha256"])?;
    if candidate != Some(report_candidate.as_str()) {
        return Err("report candidate does not match current candidate".to_owned());
    }
    let expected_source = source.ok_or("report requires a trusted source binding")?;
    let report_source =
        required_digest_any(object, &["source_sha256", "authoritative_source_sha256"])?;
    if report_source != expected_source {
        return Err("report source does not match current source".to_owned());
    }
    let raw_verdict = object
        .get("verdict")
        .and_then(Value::as_str)
        .ok_or("report verdict is missing")?;
    let verdict = parse_verdict_exact(raw_verdict).ok_or("report verdict is not canonical")?;
    let result = result.ok_or("report requires a validated parent Result")?;
    let job = job.ok_or("report requires a validated Job binding")?;
    let run = run.ok_or("report requires a validated Run binding")?;
    if result.candidate_sha256 != report_candidate
        || result.source_sha256 != report_source
        || result.job_id != job.id
        || result.run_id != run.id
    {
        return Err("report parent Result bindings are not exact".to_owned());
    }
    if result.verdict != verdict {
        return Err("report verdict conflicts with result".to_owned());
    }
    let job_id = required_string(object, "job_id")?;
    if job.id != job_id {
        return Err("report Job binding conflicts".to_owned());
    }
    let run_id = required_string(object, "run_id")?;
    if run.id != run_id {
        return Err("report Run binding conflicts".to_owned());
    }
    let expected = required_digest_any(object, &["result_digest"])?;
    if expected != result.result_digest {
        return Err("report result binding conflicts".to_owned());
    }
    let provenance = required_string_any(object, &["provenance", "authority_source"])?;
    if !matches!(
        provenance.as_str(),
        "canonical" | "falsegreen_core" | "falsegreen"
    ) {
        return Err("report provenance is not a known authority source".to_owned());
    }
    Ok(ReportView {
        id,
        digest,
        candidate_sha256: report_candidate,
        source_sha256: report_source,
        verdict,
        created_at: optional_string_any_checked(object, &["created_at", "created_at_ms"])?,
        provenance,
        evidence_summary: optional_string_any_checked(
            object,
            &["key_evidence_summary", "summary"],
        )?,
    })
}

fn verification_from_result(
    result: &ResultView,
    scope: Option<&AuthoritativeFrozenScopeView>,
) -> NativeVerification {
    NativeVerification {
        verdict: result.verdict,
        raw_verdict: NativeField::falsegreen(status_wire_verdict(result.verdict)),
        source_bound: true,
        candidate_sha256: NativeField::falsegreen(result.candidate_sha256.clone()),
        authoritative_source_sha256: Some(result.source_sha256.as_str()).map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            NativeField::falsegreen,
        ),
        result_digest: NativeField::falsegreen(result.result_digest.clone()),
        report_reference: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        completion_authority: result.completion_authority.as_deref().map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            NativeField::falsegreen,
        ),
        obligation_outcomes: parse_obligation_outcomes(&result.payload, scope),
        certification_note: "Canonical result is displayed exactly; this read-only surface cannot certify or override it.".to_owned(),
        binding_error: None,
    }
}

fn unavailable_verification() -> NativeVerification {
    NativeVerification {
        verdict: NativeVerdict::Unknown,
        raw_verdict: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        source_bound: false,
        candidate_sha256: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        authoritative_source_sha256: NativeField::unavailable(
            AuthorityClass::AuthoritativeFalseGreenState,
        ),
        result_digest: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        report_reference: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        completion_authority: NativeField::unavailable(
            AuthorityClass::AuthoritativeFalseGreenState,
        ),
        obligation_outcomes: Vec::new(),
        certification_note: "FalseGreen state unavailable: no validated result authority."
            .to_owned(),
        binding_error: Some("no validated result authority".to_owned()),
    }
}

fn unavailable_job() -> NativeJob {
    NativeJob {
        id: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        status: NativeStatus::Unknown,
        status_raw: NativeField::unavailable(AuthorityClass::DiagnosticNonAuthoritativeMetadata),
        task_id: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        source_sha256: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        candidate_sha256: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        entitlement_consumption: NativeField::unavailable(
            AuthorityClass::AuthoritativeAgentSessionState,
        ),
        run_ids: Vec::new(),
        authority_decision: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
    }
}

fn unavailable_run() -> NativeRun {
    NativeRun {
        id: NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
        worker_id: NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
        job_id: NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
        assignment_generation: NativeField::unavailable(
            AuthorityClass::AuthoritativeAgentSessionState,
        ),
        status: NativeStatus::Unknown,
        status_raw: NativeField::unavailable(AuthorityClass::DiagnosticNonAuthoritativeMetadata),
        execution_started_at: NativeField::unavailable(
            AuthorityClass::AuthoritativeAgentSessionState,
        ),
        package_runtime_identity: NativeField::unavailable(
            AuthorityClass::AuthoritativeAgentSessionState,
        ),
        recovery_lease: NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
    }
}

fn unavailable_scope() -> NativeFrozenScope {
    NativeFrozenScope {
        scope_digest: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        frozen: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        obligations: Vec::new(),
        distinction:
            "FalseGreen frozen-scope authority unavailable; no obligation is displayed as frozen."
                .to_owned(),
    }
}

fn unavailable_report(verification: &NativeVerification) -> NativeReport {
    NativeReport {
        id: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        report_digest: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        candidate_sha256: verification.candidate_sha256.clone(),
        source_sha256: verification.authoritative_source_sha256.clone(),
        verdict: NativeVerdict::Unknown,
        key_evidence_summary: NativeField::unavailable(
            AuthorityClass::AuthoritativeFalseGreenState,
        ),
        created_at: NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
        provenance: NativeField::diagnostic(
            "Report: Unavailable; no real authoritative report object",
        ),
    }
}

fn report_from_view(view: &ReportView) -> NativeReport {
    NativeReport {
        id: NativeField::falsegreen(view.id.clone()),
        report_digest: NativeField::falsegreen(view.digest.clone()),
        candidate_sha256: NativeField::falsegreen(view.candidate_sha256.clone()),
        source_sha256: Some(view.source_sha256.as_str()).map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            NativeField::falsegreen,
        ),
        verdict: view.verdict,
        key_evidence_summary: view.evidence_summary.as_deref().map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            NativeField::falsegreen,
        ),
        created_at: view.created_at.as_deref().map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            NativeField::falsegreen,
        ),
        provenance: Some(view.provenance.as_str()).map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            NativeField::falsegreen,
        ),
    }
}

fn evidence_from_result(
    result: &ResultView,
    scope: Option<&AuthoritativeFrozenScopeView>,
    current_job_id: Option<&str>,
    current_run_id: Option<&str>,
    current_source: Option<&str>,
) -> NativeEvidence {
    let Some(scope) = scope else {
        return unavailable_evidence("Evidence unavailable: frozen scope authority is missing.");
    };
    let Some(values) = result
        .payload
        .get("evidence")
        .map(strict_evidence_array)
        .transpose()
        .ok()
        .flatten()
        .flatten()
    else {
        return unavailable_evidence(
            "Evidence unavailable: result supplied no exact evidence array.",
        );
    };
    let declared_rows = result
        .payload
        .get("evidence")
        .and_then(|value| {
            value
                .get("declared_rows")
                .or_else(|| value.get("declared_total"))
        })
        .and_then(Value::as_u64)
        .and_then(|value| usize::try_from(value).ok());
    if result
        .payload
        .get("evidence")
        .is_some_and(evidence_is_partial)
    {
        return unavailable_evidence_with_counts(
            "Evidence unavailable: upstream evidence set is explicitly partial or truncated.",
            values.len(),
            0,
            declared_rows,
            [0; 4],
        );
    }
    if values.len() > MAX_EVIDENCE_ITEMS {
        return unavailable_evidence_with_counts(
            "Evidence unavailable: upstream evidence set exceeds validation bound.",
            values.len(),
            0,
            declared_rows,
            [0; 4],
        );
    }
    let mut ids = BTreeSet::new();
    let mut duplicate_ids = Vec::new();
    let mut items = Vec::with_capacity(values.len().min(MAX_DISPLAY_EVIDENCE));
    let mut counts = [0usize; 4];
    let expected_job_id = Some(result.job_id.as_str()).or(current_job_id);
    let expected_run_id = Some(result.run_id.as_str()).or(current_run_id);
    let expected_source = Some(result.source_sha256.as_str()).or(current_source);
    let mut invalid_rows = 0usize;
    for (index, value) in values.iter().enumerate() {
        let parsed = parse_evidence_item(
            value,
            scope,
            expected_job_id,
            expected_run_id,
            expected_source,
            Some(result.result_digest.as_str()),
        );
        let Ok((id, item, state)) = parsed else {
            invalid_rows += 1;
            continue;
        };
        if !ids.insert(id.clone()) {
            duplicate_ids.push(id);
        }
        match state {
            EvidenceState::Passed => counts[0] += 1,
            EvidenceState::Failed => counts[1] += 1,
            EvidenceState::Insufficient => counts[2] += 1,
            EvidenceState::Unknown => counts[3] += 1,
        }
        if index < MAX_DISPLAY_EVIDENCE {
            items.push(item);
        }
    }
    duplicate_ids.sort();
    duplicate_ids.dedup();
    if !duplicate_ids.is_empty() {
        return NativeEvidence {
            // A duplicate ID invalidates the whole authority set. Keep the
            // exact diagnostic/counts, but do not style any row as trusted.
            items: Vec::new(),
            complete: false,
            duplicate_ids: duplicate_ids.clone(),
            unavailable_reason: Some(format!(
                "Duplicate evidence ID(s): {}",
                duplicate_ids.join(", ")
            )),
            total: values.len(),
            passed: counts[0],
            failed: counts[1],
            insufficient: counts[2],
            unknown: counts[3],
            observed_rows: values.len(),
            invalid_rows: invalid_rows + duplicate_ids.len(),
            declared_rows,
        };
    }
    if invalid_rows > 0 {
        return NativeEvidence {
            items: Vec::new(),
            complete: false,
            duplicate_ids,
            unavailable_reason: Some(format!(
                "Evidence unavailable: {invalid_rows} invalid row(s); diagnostic counts preserve observed data"
            )),
            total: values.len(),
            passed: counts[0],
            failed: counts[1],
            insufficient: counts[2],
            unknown: counts[3],
            observed_rows: values.len(),
            invalid_rows,
            declared_rows,
        };
    }
    NativeEvidence {
        items,
        complete: true,
        duplicate_ids,
        unavailable_reason: (values.len() > MAX_DISPLAY_EVIDENCE).then(|| {
            format!(
                "Showing {} of {} validated evidence items",
                MAX_DISPLAY_EVIDENCE,
                values.len()
            )
        }),
        total: values.len(),
        passed: counts[0],
        failed: counts[1],
        insufficient: counts[2],
        unknown: counts[3],
        observed_rows: values.len(),
        invalid_rows: 0,
        declared_rows,
    }
}

fn unavailable_evidence(reason: &str) -> NativeEvidence {
    unavailable_evidence_with_counts(reason, 0, 0, None, [0; 4])
}

fn unavailable_evidence_with_counts(
    reason: &str,
    observed_rows: usize,
    invalid_rows: usize,
    declared_rows: Option<usize>,
    counts: [usize; 4],
) -> NativeEvidence {
    NativeEvidence {
        items: Vec::new(),
        complete: false,
        duplicate_ids: Vec::new(),
        unavailable_reason: Some(reason.to_owned()),
        total: observed_rows,
        passed: counts[0],
        failed: counts[1],
        insufficient: counts[2],
        unknown: counts[3],
        observed_rows,
        invalid_rows,
        declared_rows,
    }
}

fn strict_evidence_array(value: &Value) -> Result<Option<&Vec<Value>>, String> {
    if let Some(values) = value.as_array() {
        return Ok(Some(values));
    }
    let Some(object) = value.as_object() else {
        return Ok(None);
    };
    let mut selected: Option<&Vec<Value>> = None;
    for key in ["items", "evidence", "obligations"] {
        let Some(candidate) = object.get(key) else {
            continue;
        };
        let values = candidate
            .as_array()
            .ok_or_else(|| format!("evidence alias {key} is malformed"))?;
        if selected.is_some_and(|existing| existing != values) {
            return Err("conflicting evidence array aliases".to_owned());
        }
        selected = Some(values);
    }
    Ok(selected)
}

fn evidence_is_partial(value: &Value) -> bool {
    value.get("partial").and_then(Value::as_bool) == Some(true)
        || value.get("truncated").and_then(Value::as_bool) == Some(true)
}

fn parse_evidence_item(
    value: &Value,
    scope: &AuthoritativeFrozenScopeView,
    expected_job_id: Option<&str>,
    expected_run_id: Option<&str>,
    expected_source: Option<&str>,
    expected_result_digest: Option<&str>,
) -> Result<(String, NativeEvidenceItem, EvidenceState), String> {
    let object = value.as_object().ok_or("evidence item is not an object")?;
    reject_unknown_keys(
        object,
        &[
            "evidence_id",
            "id",
            "obligation_id",
            "job_id",
            "run_id",
            "source_sha256",
            "source_digest",
            "result_digest",
            "provenance",
            "source",
            "evidence_type",
            "type",
            "status",
            "state",
            "outcome",
            "detail",
            "value",
            "message",
            "reference",
            "uri",
            "path",
        ],
        "evidence item",
    )?;
    let id = required_string_any(object, &["evidence_id", "id"])?;
    if !valid_identity(&id) {
        return Err("evidence ID is malformed".to_owned());
    }
    let obligation = required_string_any(object, &["obligation_id"])?;
    if !valid_identity(&obligation) {
        return Err("evidence obligation ID is malformed".to_owned());
    }
    if !scope
        .obligations
        .iter()
        .any(|(expected, _)| expected == &obligation)
    {
        return Err("evidence obligation is not in frozen scope".to_owned());
    }
    if let Some(job_id) = object.get("job_id").and_then(Value::as_str)
        && expected_job_id.is_some()
        && expected_job_id != Some(job_id)
    {
        return Err("evidence Job binding conflicts".to_owned());
    }
    if let Some(run_id) = object.get("run_id").and_then(Value::as_str)
        && expected_run_id.is_some()
        && expected_run_id != Some(run_id)
    {
        return Err("evidence Run binding conflicts".to_owned());
    }
    if let Some(source_digest) = optional_digest_any(object, &["source_sha256", "source_digest"])?
        && expected_source.is_some()
        && expected_source != Some(source_digest.as_str())
    {
        return Err("evidence source digest conflicts".to_owned());
    }
    if let Some(result_digest) = object.get("result_digest") {
        let result_digest = result_digest
            .as_str()
            .filter(|value| valid_digest(value))
            .ok_or("evidence result digest is malformed")?;
        if expected_result_digest.is_some() && expected_result_digest != Some(result_digest) {
            return Err("evidence result digest conflicts".to_owned());
        }
    }
    let source = required_string_any(object, &["provenance", "source"])?;
    if !matches!(
        source.as_str(),
        "canonical" | "falsegreen_core" | "falsegreen"
    ) {
        return Err("evidence provenance is not a known authority source".to_owned());
    }
    let evidence_type = required_string_any(object, &["evidence_type", "type"])?;
    if !matches!(
        evidence_type.as_str(),
        "test" | "gate" | "artifact" | "log" | "report"
    ) {
        return Err("evidence type is unknown".to_owned());
    }
    let raw_state = required_string_any(object, &["status", "state", "outcome"])?;
    let state = parse_evidence_exact(&raw_state).ok_or("evidence status is unknown")?;
    let detail = strict_display_alias(object, &["detail", "value", "message"])?
        .unwrap_or_else(|| "Unavailable".to_owned());
    let reference = optional_string_any_checked(object, &["reference", "uri", "path"])?
        .unwrap_or_else(|| "Unavailable".to_owned());
    let item = NativeEvidenceItem {
        evidence_id: NativeField::falsegreen(id.clone()),
        obligation: NativeField::falsegreen(obligation),
        source: NativeField::falsegreen(source),
        evidence_type: NativeField::falsegreen(evidence_type),
        reference: NativeField::falsegreen(reference),
        state,
        detail: NativeField::falsegreen(detail),
    };
    Ok((id, item, state))
}

fn recovery_unknown(run: &NativeRun) -> NativeRecovery {
    NativeRecovery {
        state: RecoveryState::Unknown,
        reason: NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        pre_begin_claim: if run.status == NativeStatus::Claimed
            && run.execution_started_at.value.is_none()
        {
            NativeField::agent("pre_begin")
        } else {
            NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState)
        },
        action_available: false,
        distinction: "Recovery classification is unavailable without an explicit recovery-authority object; no inference is made from CLAIMED, leases, terminal reasons, or result pointers.".to_owned(),
    }
}

fn recovery_from_view(view: &AuthoritativeRecoveryView) -> NativeRecovery {
    NativeRecovery {
        state: view.state,
        reason: view.reason.as_deref().map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
            NativeField::falsegreen,
        ),
        pre_begin_claim: NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
        action_available: false,
        distinction: "Recovery is read-only state. No retry, recover, repair, resume, or mutation action is exposed.".to_owned(),
    }
}

fn replacement_from_capture(
    capture: &Capture,
    verification: &NativeVerification,
) -> NativeReplacement {
    let Some(relation) = &capture.relation else {
        return NativeReplacement {
            predecessor_session: NativeField::unavailable(
                AuthorityClass::AuthoritativeAgentSessionState,
            ),
            replacement_session: NativeField::unavailable(
                AuthorityClass::AuthoritativeAgentSessionState,
            ),
            predecessor_state: NativeField::unavailable(
                AuthorityClass::AuthoritativeAgentSessionState,
            ),
            continuity: NativeField::diagnostic("No replacement relation for this session"),
            candidate_sha256: verification.candidate_sha256.clone(),
            workspace_state: NativeField::unavailable(
                AuthorityClass::AuthoritativeAgentSessionState,
            ),
            terminal_outcome: NativeField::unavailable(
                AuthorityClass::AuthoritativeAgentSessionState,
            ),
        };
    };
    let source_events = if relation.predecessor_session_id == capture.session.id {
        &capture.events
    } else {
        &capture.related_events
    };
    let replacement_events = if relation.predecessor_session_id == capture.session.id {
        &capture.related_events
    } else {
        &capture.events
    };
    let validated_replacement = ValidatedReplacementSessionView::try_from_record_with_related(
        relation,
        source_events,
        replacement_events,
    )
    .ok();
    let bound_git = source_events.iter().find(|event| {
        event.sequence == relation.source_git_state_sequence && event.kind == EventKind::GitState
    });
    let candidate_ok = source_events.iter().any(|event| {
        event.kind == EventKind::CandidateReady
            && event.sequence == relation.candidate_event_sequence
            && event.payload["candidate_sha256"].as_str()
                == Some(relation.candidate_sha256.as_str())
    });
    let workspace = bound_git
        .and_then(|event| event.payload.get("workspace_state_sha256"))
        .and_then(Value::as_str)
        .filter(|value| valid_digest(value));
    let continuity = if validated_replacement.is_some() && bound_git.is_some() && candidate_ok {
        NativeField::agent("candidate and exact relation-bound GitState are continuous")
    } else {
        NativeField::diagnostic(
            "Replacement provenance unavailable: relation-bound candidate/GitState sequence is missing or conflicting",
        )
    };
    let terminal = source_events
        .iter()
        .rev()
        .find(|event| event.kind == EventKind::TerminalState)
        .map(|event| display_json(&event.payload));
    NativeReplacement {
        predecessor_session: NativeField::agent(relation.predecessor_session_id.clone()),
        replacement_session: NativeField::agent(relation.replacement_session_id.clone()),
        predecessor_state: NativeField::agent(relation.predecessor_state.clone()),
        continuity,
        candidate_sha256: NativeField::agent(relation.candidate_sha256.clone()),
        workspace_state: workspace.map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
            NativeField::agent,
        ),
        terminal_outcome: terminal.map_or_else(
            || NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
            NativeField::agent,
        ),
    }
}

fn candidate_context(events: &[Event]) -> Option<String> {
    let mut selected: Option<String> = None;
    for event in events
        .iter()
        .filter(|event| event.kind == EventKind::CandidateReady)
    {
        let value = event
            .payload
            .get("candidate_sha256")
            .and_then(Value::as_str)
            .filter(|value| valid_digest(value))?;
        if selected
            .as_deref()
            .is_some_and(|existing| existing != value)
        {
            return None;
        }
        selected = Some(value.to_owned());
    }
    selected
}

fn source_context(events: &[Event]) -> Option<String> {
    let mut selected: Option<String> = None;
    for event in events
        .iter()
        .filter(|event| event.kind == EventKind::GitState)
    {
        let object = event.payload.as_object()?;
        let value =
            optional_digest_any(object, &["source_sha256", "authoritative_source_sha256"]).ok()?;
        let Some(value) = value else {
            continue;
        };
        if selected
            .as_deref()
            .is_some_and(|existing| existing != value)
        {
            return None;
        }
        selected = Some(value);
    }
    selected
}

fn build_surfaces(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> NativeSurfaceSet {
    NativeSurfaceSet {
        task: task_surface(snapshot, facts),
        frozen_scope: scope_surface(snapshot, facts),
        job: job_surface(snapshot, facts),
        run: run_surface(snapshot, facts),
        verification_result: verification_surface(snapshot, facts),
        evidence: evidence_surface(snapshot, facts),
        report: report_surface(snapshot, facts),
        failure_recovery: recovery_surface(snapshot, facts),
        replacement_session: replacement_surface(snapshot, facts),
    }
}

fn base_surface(
    snapshot: &NativeSnapshotIdentity,
    family: NativeSurfaceFamily,
    root: Component,
) -> Surface {
    let mut surface = Surface::new(
        format!(
            "native-{}-{}-{}",
            family.as_str(),
            safe_id(&snapshot.source_session_id),
            &snapshot.digest[..12]
        ),
        root,
    );
    surface
        .metadata
        .insert("surface_family".to_owned(), family.as_str().to_owned());
    surface.metadata.insert(
        "snapshot_source_session".to_owned(),
        snapshot.source_session_id.clone(),
    );
    surface.metadata.insert(
        "snapshot_state_generation".to_owned(),
        snapshot.state_generation.to_string(),
    );
    surface
        .metadata
        .insert("snapshot_digest".to_owned(), snapshot.digest.clone());
    surface
        .metadata
        .insert("execution".to_owned(), "read_only_no_actions".to_owned());
    surface
}

fn label(name: &str, field: &NativeField, unknown: bool) -> String {
    format!(
        "{} [{}]: {}",
        name,
        field.authority.label(),
        field.display(unknown)
    )
}

fn task_surface(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> Surface {
    let entries = BTreeMap::from([
        ("task".to_owned(), label("Task", &facts.task.task_id, false)),
        (
            "lifecycle".to_owned(),
            label("Lifecycle", &facts.task.lifecycle, false),
        ),
        (
            "frozen".to_owned(),
            label("Frozen scope", &facts.task.frozen, false),
        ),
        (
            "scope_digest".to_owned(),
            label("Scope digest", &facts.task.scope_digest, false),
        ),
        (
            "scope".to_owned(),
            label("Scope", &facts.task.scope_summary, false),
        ),
        (
            "source".to_owned(),
            label("Source", &facts.task.source_sha256, false),
        ),
        (
            "candidate".to_owned(),
            label("Candidate", &facts.task.candidate_sha256, false),
        ),
        (
            "job".to_owned(),
            label("Current Job", &facts.task.current_job_id, false),
        ),
    ]);
    base_surface(
        snapshot,
        NativeSurfaceFamily::Task,
        Component {
            id: "task-root".to_owned(),
            kind: ComponentKind::Stack {
                children: vec![
                    Component {
                        id: "task-status".to_owned(),
                        kind: ComponentKind::Status {
                            label: "Task lifecycle".to_owned(),
                            value: facts.task.lifecycle.display(false),
                            level: StatusLevel::Info,
                        },
                    },
                    Component {
                        id: "task-facts".to_owned(),
                        kind: ComponentKind::KeyValue { entries },
                    },
                ],
            },
        },
    )
}

fn scope_surface(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> Surface {
    let mut rows = facts
        .frozen_scope
        .obligations
        .iter()
        .map(|item| {
            vec![
                item.id.display(false),
                item.requirement.display(false),
                item.requirement.authority.label().to_owned(),
            ]
        })
        .collect::<Vec<_>>();
    if rows.is_empty() {
        rows.push(vec![
            "Unavailable".to_owned(),
            "FalseGreen frozen-scope authority unavailable".to_owned(),
            facts.frozen_scope.scope_digest.authority.label().to_owned(),
        ]);
    }
    let entries = BTreeMap::from([
        (
            "scope_digest".to_owned(),
            label(
                "Immutable scope digest",
                &facts.frozen_scope.scope_digest,
                false,
            ),
        ),
        (
            "distinction".to_owned(),
            safe_text(&facts.frozen_scope.distinction),
        ),
    ]);
    base_surface(
        snapshot,
        NativeSurfaceFamily::FrozenScope,
        Component {
            id: "scope-root".to_owned(),
            kind: ComponentKind::Stack {
                children: vec![
                    Component {
                        id: "scope-status".to_owned(),
                        kind: ComponentKind::Status {
                            label: "Scope".to_owned(),
                            value: facts.frozen_scope.frozen.display(false),
                            level: StatusLevel::Info,
                        },
                    },
                    Component {
                        id: "scope-facts".to_owned(),
                        kind: ComponentKind::KeyValue { entries },
                    },
                    Component {
                        id: "scope-obligations".to_owned(),
                        kind: ComponentKind::Table {
                            columns: vec![
                                "Obligation".to_owned(),
                                "Requirement text".to_owned(),
                                "Authority".to_owned(),
                            ],
                            rows,
                        },
                    },
                ],
            },
        },
    )
}

fn job_surface(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> Surface {
    let entries = BTreeMap::from([
        ("job".to_owned(), label("Job", &facts.job.id, false)),
        ("task".to_owned(), label("Task", &facts.job.task_id, false)),
        (
            "source".to_owned(),
            label("Source", &facts.job.source_sha256, false),
        ),
        (
            "candidate".to_owned(),
            label("Candidate", &facts.job.candidate_sha256, false),
        ),
        (
            "entitlement".to_owned(),
            label(
                "Entitlement/consumption",
                &facts.job.entitlement_consumption,
                true,
            ),
        ),
        (
            "authority".to_owned(),
            label("Authority decision", &facts.job.authority_decision, true),
        ),
    ]);
    let runs = if facts.job.run_ids.is_empty() {
        vec![vec![
            "Unavailable".to_owned(),
            "diagnostic/non-authoritative metadata".to_owned(),
        ]]
    } else {
        facts
            .job
            .run_ids
            .iter()
            .map(|item| vec![item.display(false), item.authority.label().to_owned()])
            .collect()
    };
    base_surface(
        snapshot,
        NativeSurfaceFamily::Job,
        Component {
            id: "job-root".to_owned(),
            kind: ComponentKind::Stack {
                children: vec![
                    status_component(
                        "job-status",
                        "Job status",
                        facts.job.status,
                        &facts.job.status_raw,
                    ),
                    Component {
                        id: "job-facts".to_owned(),
                        kind: ComponentKind::KeyValue { entries },
                    },
                    Component {
                        id: "job-runs".to_owned(),
                        kind: ComponentKind::Table {
                            columns: vec!["Run".to_owned(), "Authority".to_owned()],
                            rows: runs,
                        },
                    },
                ],
            },
        },
    )
}

fn run_surface(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> Surface {
    let entries = BTreeMap::from([
        ("run".to_owned(), label("Run", &facts.run.id, false)),
        (
            "worker".to_owned(),
            label("Worker", &facts.run.worker_id, true),
        ),
        ("job".to_owned(), label("Job", &facts.run.job_id, false)),
        (
            "assignment_generation".to_owned(),
            label(
                "Assignment generation",
                &facts.run.assignment_generation,
                true,
            ),
        ),
        (
            "execution_started".to_owned(),
            label("Execution started", &facts.run.execution_started_at, true),
        ),
        (
            "package_runtime".to_owned(),
            label(
                "Package/runtime identity",
                &facts.run.package_runtime_identity,
                true,
            ),
        ),
        (
            "recovery_lease".to_owned(),
            label("Recovery/lease", &facts.run.recovery_lease, true),
        ),
    ]);
    base_surface(
        snapshot,
        NativeSurfaceFamily::Run,
        Component {
            id: "run-root".to_owned(),
            kind: ComponentKind::Stack {
                children: vec![
                    status_component(
                        "run-status",
                        "Run status",
                        facts.run.status,
                        &facts.run.status_raw,
                    ),
                    Component {
                        id: "run-facts".to_owned(),
                        kind: ComponentKind::KeyValue { entries },
                    },
                ],
            },
        },
    )
}

fn verification_surface(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> Surface {
    let mut entries = BTreeMap::from([
        (
            "verdict".to_owned(),
            format!(
                "VERDICT [{}]: {}",
                if facts.verification.source_bound {
                    AuthorityClass::AuthoritativeFalseGreenState.label()
                } else {
                    AuthorityClass::DiagnosticNonAuthoritativeMetadata.label()
                },
                facts.verification.verdict.label()
            ),
        ),
        (
            "raw".to_owned(),
            label(
                "Canonical raw status",
                &facts.verification.raw_verdict,
                true,
            ),
        ),
        (
            "source_bound".to_owned(),
            format!(
                "Source binding [{}]: {}",
                AuthorityClass::AuthoritativeFalseGreenState.label(),
                facts.verification.source_bound
            ),
        ),
        (
            "candidate".to_owned(),
            label("Candidate", &facts.verification.candidate_sha256, false),
        ),
        (
            "source".to_owned(),
            label(
                "Source",
                &facts.verification.authoritative_source_sha256,
                false,
            ),
        ),
        (
            "result_digest".to_owned(),
            label("Result digest", &facts.verification.result_digest, false),
        ),
        (
            "report".to_owned(),
            label(
                "Report reference",
                &facts.verification.report_reference,
                false,
            ),
        ),
        (
            "completion_authority".to_owned(),
            label(
                "Completion authority",
                &facts.verification.completion_authority,
                true,
            ),
        ),
    ]);
    if let Some(error) = &facts.verification.binding_error {
        entries.insert(
            "binding_error".to_owned(),
            format!(
                "Binding error [{}]: {}",
                AuthorityClass::DiagnosticNonAuthoritativeMetadata.label(),
                safe_text(error)
            ),
        );
    }
    let rows = if facts.verification.obligation_outcomes.is_empty() {
        vec![vec![
            "Unavailable".to_owned(),
            "UNKNOWN".to_owned(),
            "No validated obligation outcomes supplied".to_owned(),
        ]]
    } else {
        facts
            .verification
            .obligation_outcomes
            .iter()
            .map(|item| {
                vec![
                    item.obligation_id.display(false),
                    item.outcome.label().to_owned(),
                    item.detail.display(true),
                ]
            })
            .collect()
    };
    base_surface(
        snapshot,
        NativeSurfaceFamily::VerificationResult,
        Component {
            id: "verification-root".to_owned(),
            kind: ComponentKind::Stack {
                children: vec![
                    Component {
                        id: "verification-status".to_owned(),
                        kind: ComponentKind::Status {
                            label: "Canonical verification verdict".to_owned(),
                            value: facts.verification.verdict.label().to_owned(),
                            level: facts.verification.verdict.status().level(),
                        },
                    },
                    Component {
                        id: "verification-facts".to_owned(),
                        kind: ComponentKind::KeyValue { entries },
                    },
                    Component {
                        id: "verification-obligations".to_owned(),
                        kind: ComponentKind::Table {
                            columns: vec![
                                "Obligation".to_owned(),
                                "Outcome".to_owned(),
                                "Detail".to_owned(),
                            ],
                            rows,
                        },
                    },
                    Component::text("verification-note", &facts.verification.certification_note),
                ],
            },
        },
    )
}

fn evidence_surface(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> Surface {
    let mut items = facts
        .evidence
        .items
        .iter()
        .map(|item| EvidenceItem {
            label: format!(
                "{} / {} / {} [{}]",
                item.obligation.display(false),
                item.source.display(true),
                item.evidence_type.display(true),
                item.state.label()
            ),
            value: format!(
                "{} — {}",
                item.reference.display(true),
                item.detail.display(true)
            ),
        })
        .collect::<Vec<_>>();
    if facts.evidence.total > MAX_DISPLAY_EVIDENCE {
        items.push(EvidenceItem {
            label: "Evidence count [diagnostic/non-authoritative metadata]".to_owned(),
            value: format!(
                "Showing {} of {}; pass={}, fail={}, insufficient={}, unknown={}, observed={}, invalid={}, declared={:?}",
                facts.evidence.items.len(),
                facts.evidence.total,
                facts.evidence.passed,
                facts.evidence.failed,
                facts.evidence.insufficient,
                facts.evidence.unknown,
                facts.evidence.observed_rows,
                facts.evidence.invalid_rows,
                facts.evidence.declared_rows,
            ),
        });
    }
    if let Some(reason) = &facts.evidence.unavailable_reason {
        items.push(EvidenceItem {
            label: "Projection state [diagnostic/non-authoritative metadata]".to_owned(),
            value: reason.clone(),
        });
    }
    if items.is_empty() {
        items.push(EvidenceItem {
            label: "Evidence".to_owned(),
            value: "Unavailable".to_owned(),
        });
    }
    base_surface(
        snapshot,
        NativeSurfaceFamily::Evidence,
        Component {
            id: "evidence-root".to_owned(),
            kind: ComponentKind::Stack {
                children: vec![
                    Component {
                        id: "evidence-verdict".to_owned(),
                        kind: ComponentKind::Status {
                            label: "Evidence authority".to_owned(),
                            value: facts.verification.verdict.label().to_owned(),
                            level: facts.verification.verdict.status().level(),
                        },
                    },
                    Component {
                        id: "evidence-items".to_owned(),
                        kind: ComponentKind::Evidence {
                            title: "Evidence items (validated provenance)".to_owned(),
                            items,
                        },
                    },
                ],
            },
        },
    )
}

fn report_surface(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> Surface {
    let report_authority = if facts.report.id.value.is_some() {
        AuthorityClass::AuthoritativeFalseGreenState
    } else {
        AuthorityClass::DiagnosticNonAuthoritativeMetadata
    };
    let entries = BTreeMap::from([
        (
            "report".to_owned(),
            label("Report", &facts.report.id, false),
        ),
        (
            "report_digest".to_owned(),
            label("Report digest", &facts.report.report_digest, false),
        ),
        (
            "candidate".to_owned(),
            label("Candidate", &facts.report.candidate_sha256, false),
        ),
        (
            "source".to_owned(),
            label("Source", &facts.report.source_sha256, false),
        ),
        (
            "verdict".to_owned(),
            format!(
                "Verdict [{}]: {}",
                report_authority.label(),
                facts.report.verdict.label()
            ),
        ),
        (
            "evidence".to_owned(),
            label("Key evidence", &facts.report.key_evidence_summary, true),
        ),
        (
            "created".to_owned(),
            label("Created", &facts.report.created_at, true),
        ),
        (
            "provenance".to_owned(),
            label("Provenance", &facts.report.provenance, true),
        ),
    ]);
    base_surface(
        snapshot,
        NativeSurfaceFamily::Report,
        Component {
            id: "report-root".to_owned(),
            kind: ComponentKind::Stack {
                children: vec![
                    Component {
                        id: "report-status".to_owned(),
                        kind: ComponentKind::Status {
                            label: "Report verdict".to_owned(),
                            value: facts.report.verdict.label().to_owned(),
                            level: facts.report.verdict.status().level(),
                        },
                    },
                    Component {
                        id: "report-facts".to_owned(),
                        kind: ComponentKind::KeyValue { entries },
                    },
                ],
            },
        },
    )
}

fn recovery_surface(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> Surface {
    let value = match facts.recovery.state {
        RecoveryState::Recoverable => "RECOVERABLE",
        RecoveryState::Blocked => "BLOCKED",
        RecoveryState::Terminal => "TERMINAL",
        RecoveryState::Unknown => "UNKNOWN",
        RecoveryState::NotApplicable => "NOT APPLICABLE",
    };
    let entries = BTreeMap::from([
        (
            "reason".to_owned(),
            label("Reason", &facts.recovery.reason, true),
        ),
        (
            "claim".to_owned(),
            label("Pre-begin claim", &facts.recovery.pre_begin_claim, true),
        ),
        (
            "actions".to_owned(),
            "Actions [diagnostic/non-authoritative metadata]: none; read-only G4".to_owned(),
        ),
        (
            "distinction".to_owned(),
            safe_text(&facts.recovery.distinction),
        ),
    ]);
    base_surface(
        snapshot,
        NativeSurfaceFamily::FailureRecovery,
        Component {
            id: "recovery-root".to_owned(),
            kind: ComponentKind::Stack {
                children: vec![
                    Component {
                        id: "recovery-status".to_owned(),
                        kind: ComponentKind::Status {
                            label: "Failure/recovery state".to_owned(),
                            value: value.to_owned(),
                            level: if facts.recovery.state == RecoveryState::Terminal {
                                StatusLevel::Error
                            } else if matches!(
                                facts.recovery.state,
                                RecoveryState::Recoverable | RecoveryState::Blocked
                            ) {
                                StatusLevel::Warning
                            } else {
                                StatusLevel::Info
                            },
                        },
                    },
                    Component {
                        id: "recovery-facts".to_owned(),
                        kind: ComponentKind::KeyValue { entries },
                    },
                ],
            },
        },
    )
}

fn replacement_surface(snapshot: &NativeSnapshotIdentity, facts: &Facts) -> Surface {
    let entries = BTreeMap::from([
        (
            "predecessor".to_owned(),
            label(
                "Predecessor session",
                &facts.replacement.predecessor_session,
                false,
            ),
        ),
        (
            "replacement".to_owned(),
            label(
                "Replacement session",
                &facts.replacement.replacement_session,
                false,
            ),
        ),
        (
            "predecessor_state".to_owned(),
            label(
                "Immutable predecessor state",
                &facts.replacement.predecessor_state,
                false,
            ),
        ),
        (
            "continuity".to_owned(),
            label("Continuity", &facts.replacement.continuity, true),
        ),
        (
            "candidate".to_owned(),
            label("Candidate", &facts.replacement.candidate_sha256, false),
        ),
        (
            "workspace".to_owned(),
            label(
                "Workspace identity",
                &facts.replacement.workspace_state,
                true,
            ),
        ),
        (
            "terminal".to_owned(),
            label(
                "Terminal outcome",
                &facts.replacement.terminal_outcome,
                true,
            ),
        ),
    ]);
    base_surface(
        snapshot,
        NativeSurfaceFamily::ReplacementSession,
        Component {
            id: "replacement-root".to_owned(),
            kind: ComponentKind::Stack {
                children: vec![
                    Component {
                        id: "replacement-status".to_owned(),
                        kind: ComponentKind::Status {
                            label: "Replacement continuity".to_owned(),
                            value: facts.replacement.continuity.display(true),
                            level: StatusLevel::Info,
                        },
                    },
                    Component {
                        id: "replacement-facts".to_owned(),
                        kind: ComponentKind::KeyValue { entries },
                    },
                    Component {
                        id: "replacement-timeline".to_owned(),
                        kind: ComponentKind::Timeline {
                            entries: vec![
                                TimelineEntry {
                                    label: "Predecessor".to_owned(),
                                    detail: facts.replacement.predecessor_session.display(false),
                                    state: TimelineState::Complete,
                                },
                                TimelineEntry {
                                    label: "Replacement".to_owned(),
                                    detail: facts.replacement.replacement_session.display(false),
                                    state: TimelineState::Active,
                                },
                            ],
                        },
                    },
                ],
            },
        },
    )
}

fn status_component(id: &str, label: &str, status: NativeStatus, raw: &NativeField) -> Component {
    Component {
        id: id.to_owned(),
        kind: ComponentKind::Status {
            label: label.to_owned(),
            value: if raw.value.is_some() {
                format!("{} (raw: {})", status.label(), raw.display(true))
            } else {
                status.label().to_owned()
            },
            level: status.level(),
        },
    }
}

fn required_string(object: &serde_json::Map<String, Value>, key: &str) -> Result<String, String> {
    object
        .get(key)
        .and_then(Value::as_str)
        .filter(|value| !value.is_empty())
        .map(str::to_owned)
        .ok_or_else(|| format!("missing or malformed {key}"))
}
fn required_string_any(
    object: &serde_json::Map<String, Value>,
    keys: &[&str],
) -> Result<String, String> {
    let mut selected: Option<String> = None;
    for key in keys {
        let Some(value) = object.get(*key) else {
            continue;
        };
        let value = value
            .as_str()
            .filter(|value| !value.is_empty())
            .ok_or_else(|| format!("missing or malformed {}", keys.join("/")))?;
        if selected.as_ref().is_some_and(|existing| existing != value) {
            return Err(format!("conflicting {}", keys.join("/")));
        }
        selected = Some(value.to_owned());
    }
    selected.ok_or_else(|| format!("missing or malformed {}", keys.join("/")))
}
fn optional_string(object: &serde_json::Map<String, Value>, key: &str) -> Option<String> {
    object
        .get(key)
        .and_then(Value::as_str)
        .filter(|value| !value.is_empty())
        .map(str::to_owned)
}
fn optional_string_any_checked(
    object: &serde_json::Map<String, Value>,
    keys: &[&str],
) -> Result<Option<String>, String> {
    let mut selected: Option<String> = None;
    for key in keys {
        let Some(value) = object.get(*key) else {
            continue;
        };
        let value = value
            .as_str()
            .filter(|value| !value.is_empty())
            .ok_or_else(|| format!("malformed {}", keys.join("/")))?;
        if selected.as_ref().is_some_and(|existing| existing != value) {
            return Err(format!("conflicting {}", keys.join("/")));
        }
        selected = Some(value.to_owned());
    }
    Ok(selected)
}

fn reject_unknown_keys(
    object: &serde_json::Map<String, Value>,
    allowed: &[&str],
    subject: &str,
) -> Result<(), String> {
    if let Some(key) = object.keys().find(|key| !allowed.contains(&key.as_str())) {
        return Err(format!("{subject} contains unknown field {key}"));
    }
    Ok(())
}

fn required_digest_any(
    object: &serde_json::Map<String, Value>,
    keys: &[&str],
) -> Result<String, String> {
    let value = required_string_any(object, keys)?;
    valid_digest(&value)
        .then_some(value)
        .ok_or_else(|| format!("malformed digest {}", keys.join("/")))
}

fn required_report_digest(object: &serde_json::Map<String, Value>) -> Result<String, String> {
    required_digest_any(object, &["report_digest", "digest"]).map_err(|error| {
        if error.contains("missing or malformed") {
            "cryptographic report digest is missing".to_owned()
        } else {
            error
        }
    })
}

fn strict_display_alias(
    object: &serde_json::Map<String, Value>,
    keys: &[&str],
) -> Result<Option<String>, String> {
    let mut selected: Option<String> = None;
    for key in keys {
        let Some(value) = object.get(*key) else {
            continue;
        };
        let rendered = display_json(value);
        if selected
            .as_ref()
            .is_some_and(|existing| existing != &rendered)
        {
            return Err(format!("conflicting {}", keys.join("/")));
        }
        selected = Some(rendered);
    }
    Ok(selected)
}
fn optional_digest_any(
    object: &serde_json::Map<String, Value>,
    keys: &[&str],
) -> Result<Option<String>, String> {
    let mut selected: Option<String> = None;
    let mut saw_null = false;
    for key in keys {
        let Some(value) = object.get(*key) else {
            continue;
        };
        let Value::String(value) = value else {
            if value.is_null() {
                if selected.is_some() {
                    return Err(format!("conflicting digest {}", keys.join("/")));
                }
                saw_null = true;
                continue;
            }
            return Err(format!("malformed digest {}", keys.join("/")));
        };
        if !valid_digest(value) {
            return Err(format!("malformed digest {}", keys.join("/")));
        }
        if selected.as_ref().is_some_and(|existing| existing != value) {
            return Err(format!("conflicting digest {}", keys.join("/")));
        }
        if saw_null {
            return Err(format!("conflicting digest {}", keys.join("/")));
        }
        selected = Some(value.clone());
    }
    Ok(selected)
}
fn optional_falsegreen(value: Option<&str>) -> NativeField {
    value.map_or_else(
        || NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState),
        NativeField::falsegreen,
    )
}
fn optional_agent(value: Option<&str>) -> NativeField {
    value.map_or_else(
        || NativeField::unavailable(AuthorityClass::AuthoritativeAgentSessionState),
        NativeField::agent,
    )
}
fn parse_verdict_exact(raw: &str) -> Option<NativeVerdict> {
    match raw {
        "accepted" => Some(NativeVerdict::Accepted),
        "failed" => Some(NativeVerdict::Failed),
        "insufficient_evidence" => Some(NativeVerdict::InsufficientEvidence),
        _ => None,
    }
}
fn parse_status_exact(raw: &str) -> Option<NativeStatus> {
    match raw {
        "QUEUED" => Some(NativeStatus::Queued),
        "CLAIMED" => Some(NativeStatus::Claimed),
        "RUNNING" => Some(NativeStatus::Running),
        "EXECUTING" => Some(NativeStatus::Executing),
        "TERMINAL" => Some(NativeStatus::Terminal),
        "ACCEPTED" => Some(NativeStatus::Accepted),
        "FAILED" => Some(NativeStatus::Failed),
        "INSUFFICIENT_EVIDENCE" => Some(NativeStatus::InsufficientEvidence),
        _ => None,
    }
}
fn parse_evidence_exact(raw: &str) -> Option<EvidenceState> {
    match raw {
        "passed" => Some(EvidenceState::Passed),
        "failed" => Some(EvidenceState::Failed),
        "insufficient" => Some(EvidenceState::Insufficient),
        "unknown" => Some(EvidenceState::Unknown),
        _ => None,
    }
}
fn status_wire(status: NativeStatus) -> &'static str {
    match status {
        NativeStatus::Accepted => "ACCEPTED",
        NativeStatus::Failed => "FAILED",
        NativeStatus::InsufficientEvidence => "INSUFFICIENT_EVIDENCE",
        NativeStatus::Queued => "QUEUED",
        NativeStatus::Claimed => "CLAIMED",
        NativeStatus::Running => "RUNNING",
        NativeStatus::Executing => "EXECUTING",
        NativeStatus::Terminal => "TERMINAL",
        NativeStatus::Recoverable => "RECOVERABLE",
        NativeStatus::Unknown => "UNKNOWN",
    }
}
fn status_wire_verdict(verdict: NativeVerdict) -> &'static str {
    match verdict {
        NativeVerdict::Accepted => "accepted",
        NativeVerdict::Failed => "failed",
        NativeVerdict::InsufficientEvidence => "insufficient_evidence",
        NativeVerdict::Incomplete => "incomplete",
        NativeVerdict::Invalid => "invalid",
        NativeVerdict::Unknown => "unknown",
    }
}
fn parse_obligation_outcomes(
    payload: &Value,
    scope: Option<&AuthoritativeFrozenScopeView>,
) -> Vec<NativeObligationOutcome> {
    let Some(values) = payload
        .get("obligation_outcomes")
        .or_else(|| payload.get("obligations"))
        .and_then(Value::as_array)
    else {
        return Vec::new();
    };
    let Some(scope) = scope else {
        return Vec::new();
    };
    values
        .iter()
        .filter_map(|value| {
            let object = value.as_object()?;
            let id = required_string_any(object, &["obligation_id", "id"]).ok()?;
            if !scope
                .obligations
                .iter()
                .any(|(expected, _)| expected == &id)
            {
                return None;
            }
            let outcome = parse_evidence_exact(
                required_string_any(object, &["status", "outcome"])
                    .ok()?
                    .as_str(),
            )?;
            Some(NativeObligationOutcome {
                obligation_id: NativeField::falsegreen(id),
                outcome,
                detail: object
                    .get("detail")
                    .map(display_json)
                    .map(NativeField::falsegreen)
                    .unwrap_or_else(|| {
                        NativeField::unavailable(AuthorityClass::AuthoritativeFalseGreenState)
                    }),
                evidence_count: object
                    .get("evidence_count")
                    .and_then(Value::as_u64)
                    .unwrap_or_default() as usize,
            })
        })
        .collect()
}
fn scope_digest_for_obligations(obligations: &[(String, String)]) -> String {
    let value = serde_json::json!({"obligations": obligations.iter().map(|(id, requirement)| serde_json::json!({"id": id, "requirement": requirement})).collect::<Vec<_>>()});
    sha256_json(&value)
}
pub fn frozen_scope_digest(obligations: &[(String, String)]) -> String {
    scope_digest_for_obligations(obligations)
}
fn display_json(value: &Value) -> String {
    safe_text(&value.to_string())
}
fn safe_text(value: &str) -> String {
    let value = sanitize_text(value);
    let mut output = String::new();
    for character in value.chars() {
        let character = if matches!(character, '\n' | '\r' | '\t') {
            ' '
        } else {
            character
        };
        if output.len() + character.len_utf8() > MAX_EVIDENCE_VALUE_BYTES {
            output.push('…');
            break;
        }
        output.push(character);
    }
    output
}
fn sha256_json(value: &Value) -> String {
    sha256_bytes(serde_json::to_string(value).unwrap_or_default().as_bytes())
}
fn sha256_bytes(value: &[u8]) -> String {
    format!("{:x}", Sha256::digest(value))
}
fn valid_digest(value: &str) -> bool {
    value.len() == 64
        && value
            .bytes()
            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
}
fn valid_identity(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= 256
        && value.chars().all(|character| {
            !character.is_control()
                && !matches!(
                    character,
                    '\u{061c}'
                        | '\u{200b}'
                        | '\u{200c}'
                        | '\u{200d}'
                        | '\u{200e}'
                        | '\u{200f}'
                        | '\u{202a}'..='\u{202e}'
                        | '\u{2060}'
                        | '\u{2066}'..='\u{2069}'
                        | '\u{feff}'
                )
        })
}
fn safe_id(value: &str) -> String {
    value
        .chars()
        .filter(|character| {
            character.is_ascii_alphanumeric() || matches!(character, '_' | '-' | '.' | ':')
        })
        .take(64)
        .collect()
}
fn session_state_label(state: SessionState) -> &'static str {
    match state {
        SessionState::Initializing => "INITIALIZING",
        SessionState::Working => "WORKING",
        SessionState::WaitingForTool => "WAITING_FOR_TOOL",
        SessionState::CandidateReady => "CANDIDATE_READY",
        SessionState::Verifying => "VERIFYING",
        SessionState::Repairing => "REPAIRING",
        SessionState::Paused => "PAUSED",
        SessionState::AcceptedAwaitingAuthority => "ACCEPTED_AWAITING_AUTHORITY",
        SessionState::Completed => "COMPLETED",
        SessionState::Failed => "FAILED",
        SessionState::BudgetExhausted => "BUDGET_EXHAUSTED",
    }
}

fn is_known_session_lifecycle(value: &str) -> bool {
    matches!(
        value,
        "INITIALIZING"
            | "WORKING"
            | "WAITING_FOR_TOOL"
            | "CANDIDATE_READY"
            | "VERIFYING"
            | "REPAIRING"
            | "PAUSED"
            | "ACCEPTED_AWAITING_AUTHORITY"
            | "COMPLETED"
            | "FAILED"
            | "BUDGET_EXHAUSTED"
    )
}