fix: fail closed on rows restored into older sequence gaps

Coverage check: every source row inside the anchored range (pos <= upto)
must carry a ledger link. A row imported/restored into an earlier gap was
previously invisible to both the link walk and the unchained tail count —
verification returned true with checked < rows. Gap rows now report
firstDivergence with the row's derived identity and verified:false;
regression covers both surfaces plus heal-on-restore (maintainer's
independent repro shape).

Author: moc

plugins/hetaoBackend/mcode-dynamic-workflows/checks/integrity.check.mjs

@@ -176,3 +176,25 @@ test('full broken-repair-approve-finish flow keeps both chains verified and hone
  assert.equal(v.events.unchained,0);assert.equal(v.repair.unchained,0);
  }finally{await f.cleanup();}
 });
+
+test('a row restored into an older sequence gap fails closed on both surfaces',async()=>{
+ const f=await fixture(async s=>({output:s.id}));try{
+  // Seed rows at seq 1 and 3 directly (legacy, pre-ledger), then anchor 1,3,4 via API writes.
+  const ins=(seq,runId)=>f.store.db.prepare('INSERT INTO events(seq,runId,body) VALUES(?,?,?)').run(seq,runId,JSON.stringify({type:'seed',seq}));
+  ins(1,'run-a');ins(3,'run-a');f.store.event('run-a','anchor',{});
+  assert.equal(f.store.db.prepare('SELECT COUNT(*) n FROM events').get().n,3,'anchored set is 1,3,4');
+  // Simulate a restore/import that fills the gap at seq 2.
+  ins(2,'run-b');
+  const v=f.store.verifyIntegrity().events;
+  assert.equal(v.verified,false,'gap row inside the anchored range must fail closed');
+  assert.deepEqual(v.firstDivergence,{key:'run-b:2',expectedHead:null,actualHead:null});
+  f.store.db.prepare('DELETE FROM events WHERE seq=2').run();
+  assert.equal(f.store.verifyIntegrity().events.verified,true,'restoring the anchored set heals');
+  // Same shape on repair_cache: legacy rows at rowid 1 and 3, anchor, then fill rowid 2.
+  const insr=(runId,id)=>f.store.db.prepare('INSERT INTO repair_cache(runId,id,body) VALUES(?,?,?)').run(runId,id,JSON.stringify({id,kind:'agent'}));
+  insr('run-a','a');insr('run-a','c');f.store.saveRepairCandidate('run-a',{id:'d',kind:'agent'});
+  insr('run-b','b');
+  const r=f.store.verifyIntegrity().repair;
+  assert.equal(r.verified,false);assert.equal(r.firstDivergence.key,'run-b/b');
+  }finally{await f.cleanup();}
+});

plugins/hetaoBackend/mcode-dynamic-workflows/dist/main.mjs

@@ -7880,6 +7880,11 @@ var Store = class {
         if (!firstDivergence && (!row || key !== r.key || actual !== r.hash)) firstDivergence = { key: r.key, expectedHead: r.hash, actualHead: actual };
         prev = r.hash;
       }
+      if (!firstDivergence) {
+        const anchored = new Set(rows.map((r) => r.pos));
+        const gap = this.db.prepare(`SELECT ${posCol} AS __pos, * FROM ${table} WHERE ${posCol}<=? ORDER BY ${posCol}`).all(rec.upto).find((r) => !anchored.has(r.__pos));
+        if (gap) firstDivergence = { key: keyOf(gap, gap.__pos), expectedHead: null, actualHead: null };
+      }
       const verified = !firstDivergence && prev === rec.head && unchained === 0;
       return { head: rec.head, upto: rec.upto, verified, checked: rows.length, unchained, firstDivergence };
     };

plugins/hetaoBackend/mcode-dynamic-workflows/src/store.mjs

@@ -71,6 +71,12 @@ export class Store {
       const actual=row?this.rowHash(prev,kind,key,row.body):null;
       if(!firstDivergence&&(!row||key!==r.key||actual!==r.hash))firstDivergence={key:r.key,expectedHead:r.hash,actualHead:actual};
       prev=r.hash;}
+    // Coverage: every source row inside the anchored range must carry a ledger
+    // link. A row restored into an older sequence gap (pos<=upto, no link) would
+    // otherwise be invisible to both the walk above and the unchained tail count.
+    if(!firstDivergence){const anchored=new Set(rows.map(r=>r.pos));
+      const gap=this.db.prepare(`SELECT ${posCol} AS __pos, * FROM ${table} WHERE ${posCol}<=? ORDER BY ${posCol}`).all(rec.upto).find(r=>!anchored.has(r.__pos));
+      if(gap)firstDivergence={key:keyOf(gap,gap.__pos),expectedHead:null,actualHead:null};}
     // Verification covers the anchored prefix; any unanchored row fails closed.
     const verified=!firstDivergence&&prev===rec.head&&unchained===0;
     return {head:rec.head,upto:rec.upto,verified,checked:rows.length,unchained,firstDivergence};};