Module resume 

Remote-is-ground-truth resume/reconcile (ADR-0003 §4).

release resume continues an interrupted run — but it does not trust the local journal as authoritative for what actually published. The journal is an optimization; the remote registry state is the ground truth (a run whose .git-local journal was lost can still be reconciled from what the registries hold, via each adapter’s verify). This module is the read-only reconcile half: it classifies every planned target against the ADR-0003 §4 state table and returns the per-target action a resume must take. Actually continuing the phase barrier is the coordinator’s job — this module never mutates the journal or the registry; it only decides.

The state table (ADR-0003 §4)

For each target the run planned, its journal state (does a durable PublishReceipt exist?) is crossed with what verify observes remotely:

Journal	verify()	Action (ResumeAction)
published	Matches	Skip — done, idempotent success
published	Conflicts	Conflict — hard stop, never overwrite
published	Missing	Conflict — ambiguous, hard stop + surface
published	Unknown	Unverifiable — needs explicit go-ahead
not recorded	Matches	AdoptForward — publish landed pre-receipt; adopt it
not recorded	Missing	ResumePublish — resume the publish
not recorded	Unknown, publish phase reached	Unverifiable — a publish could have landed pre-receipt; needs explicit go-ahead
not recorded	Unknown, publish phase never reached	ResumePublish — nothing could have published; resume the publish

The Unknown rows are the tri-state discipline (also ADR-0002 §1): a lookup that could not be performed — a registry outage, a package with no name, an ecosystem this binary cannot query, or a structurally-unobservable distribution target (homebrew taps / GitHub Releases) — is never read as Missing (which would drive a dangerous blind re-publish of an already-published version). When a receipt exists (published × Unknown) it is surfaced as unverifiable; a resume proceeds past it only with an explicit human go-ahead (allow_unverified), which collapses Unknown to trust-the-journal (Skip) rather than a hard stop.

For a not-recorded target the Unknown disposition is refined by whether the run ever entered the publish phase (publish_phase_reached, derived from RunState): if publish was never reached (the run failed in dry-run/build), nothing could have published without a receipt, so the cell resolves directly to ResumePublish — no go-ahead needed. Only when publish was reached (a crash mid-publish-all, where a publish could have landed before its receipt fsynced) does it stay Unverifiable pending the allow_unverified go-ahead. This never touches the published × Unknown row: a receipt implies publish ran.

The tag rows of the ADR table (created_local only → retry push; pushed_remote, no Release → create Release) are not reconciled here: the coordinator’s tag-once phase is already an idempotent, step-by-step re-entry (each of tag_created_local / tag_pushed_remote / github_release_created is skipped if journalled and the Tagger treats “already exists” as success), so continuing the barrier is the tag reconcile. Forking a second copy of that logic here is exactly what ADR-0003 forbids.

A target the original run cancelled (a target_cancelled fact) is off the table entirely: it is a deliberate skip, and the coordinator’s publish-all skips only published targets, so continuing would re-publish it. Resume classifies it as ResumeAction::Cancelled — a hard stop — rather than silently un-cancelling it (there is no ADR-0003 cell for cancelled × remote).

Structs

ResumeReconcile

The full reconcile of a run against remote registry state — one TargetDecision per planned target, in the plan’s target order.

TargetDecision

One target’s reconcile decision — the classified cell plus the material a resume needs to act on it.

Enums

JournalState

Whether a target carried a durable publish receipt in the journal at reconcile time — the left axis of the ADR-0003 §4 state table.

ResumeAction

The reconciled action for one target — the resolved cell of the ADR-0003 §4 state table (journal-state × remote-state), with the Unknown rows already collapsed by the caller’s allow_unverified go-ahead.

Functions

reconcile_for_resume

Reconcile a journaled run against current remote registry state, per the ADR-0003 §4 state table.