validateAppComponentIntegrity — component-integrity (WIRE-03). A
violation here returns immediately.
validateCommitAccountIdentityProofs — account-identity-proof profile
drift, changed-leaf proof validity, and replacement-leaf identity
binding (D-01/D-02/D-03, UPD-01). Runs before disband/admin-leaf-coupling
reasoning, so an invalid identity blocks a commit before any admin-set
reasoning does. 0x8009 data appearing in the GroupContext dictionary
itself still reports component-integrity (rejected earlier by step
1), so Phase 7 expectations hold. A violation here returns
immediately; an undecidable outcome (Phase 9, D-03) is NOT returned
yet — it is remembered and checks 3-4 still run, so a definite
violation there still outranks it (the same precedence rule this
function's own changed-leaf loop enforces internally).
The remembered undecidable detail from step 2, if any, is returned only
after steps 3-4 both find no violation.
Stays pure: reads two ClientState values, performs no I/O, and calls
nothing from src/engine or src/client.
Returns a CommitLegalityOutcome. Each calling seam supplies its own
disposition: violation throws on send (D-02), yields rejected with the
violation's reason on inbound (D-03), or drops the candidate edge on
convergence/replay (D-04/D-09); undecidable MUST map to that seam's own
existing deferral idiom, never to a terminal rejection (Phase 9, D-03,
refs/marmot/foundation/errors.md lines 63-68). This adapter itself is
seam-agnostic.
The single shared seam adapter for commit legality: derives every argument validateAppComponentIntegrity, validateCommitAccountIdentityProofs, classifyDisbandCommit, and validateAdminLeafCoupling need from
parentState/resultingState/proposals, so no seam re-derives them independently (the mdk#707 bug class — "a guard that exists on one seam only is a documented bug").Runs four checks, in this fixed order (D-07):
validateAppComponentIntegrity— component-integrity (WIRE-03). A violation here returns immediately.validateCommitAccountIdentityProofs— account-identity-proof profile drift, changed-leaf proof validity, and replacement-leaf identity binding (D-01/D-02/D-03, UPD-01). Runs before disband/admin-leaf-coupling reasoning, so an invalid identity blocks a commit before any admin-set reasoning does.0x8009data appearing in the GroupContext dictionary itself still reportscomponent-integrity(rejected earlier by step 1), so Phase 7 expectations hold. Aviolationhere returns immediately; anundecidableoutcome (Phase 9, D-03) is NOT returned yet — it is remembered and checks 3-4 still run, so a definite violation there still outranks it (the same precedence rule this function's own changed-leaf loop enforces internally).classifyDisbandCommit— disband-legality.validateAdminLeafCoupling— admin-leaf-coupling (CONV-01).The remembered undecidable detail from step 2, if any, is returned only after steps 3-4 both find no violation.
Stays pure: reads two
ClientStatevalues, performs no I/O, and calls nothing fromsrc/engineorsrc/client.Returns a CommitLegalityOutcome. Each calling seam supplies its own disposition:
violationthrows on send (D-02), yieldsrejectedwith the violation'sreasonon inbound (D-03), or drops the candidate edge on convergence/replay (D-04/D-09);undecidableMUST map to that seam's own existing deferral idiom, never to a terminal rejection (Phase 9, D-03,refs/marmot/foundation/errors.mdlines 63-68). This adapter itself is seam-agnostic.