Module reducer 

Pure, deterministic fold of the event log into MissionState.

state.json is only a cache of fold(events); the log is the source of truth. fold == fold(first) + repeated apply (property-tested), so the engine can maintain state incrementally while any reader can rebuild it from scratch and get byte-identical JSON.

Constants

ENGINE_RUN_ID

Reserved run_id for validation.finding events produced by the engine itself (final contract gate command failures) rather than a validator run.

Functions

apply

Apply one event on top of an existing state. event.seq must be exactly state.last_seq + 1 (fold passes contiguous events; anything else is a caller bug or log corruption).

dry_run_revised_plan

Validate that a PlanRevised { revision, plan } event would fold cleanly onto state, WITHOUT mutating it. The orchestrator calls this before it durably appends the event — emit appends before it folds — so a revision the reducer would reject is refused up front instead of poisoning the append-only log. A failed fold on replay would otherwise error on every subsequent load and permanently brick the mission.

fold

Fold a contiguous event slice into a state. The first event MUST be mission.created.

read_snapshot

Read a snapshot previously written by write_snapshot. A symlinked state.json — or any symlinked component above it — is refused (P1 mission-path-no-follow), never read through: mission-layout paths are pinned capability-relative from the trusted repo-root anchor (7th-pass review); out-of-layout paths (test scratch) use the weaker canonicalize tier — see crate::paths::open_read_nofollow.

write_snapshot

Serialize the state pretty-printed to a sibling tmp file, then atomically rename over path so readers never observe a half-written snapshot.