fix: commit audit event before mutating the in-memory record

[EauDoon]

Bug review of EauDoon/consequence-rail found:

• HIGH: propose, reserveRecourse, issuePermit, and acceptRecoveryQualification all mutate the in-memory action record (or the actions Map) BEFORE the eventStore.append fires. transition() is documented as failure-atomic (it appends then mutates record.state), but the calling code overwrites that property for its own pre-state writes. A failing event append leaves the record with reservation / permit / recovery_preflight fields set, but no STATE_TRANSITION or ACTION_PROPOSED event. The action is now permanently wedged because the rail cannot retroactively insert the missing event.
• HIGH: PR Preserve state when audit appends fail #15 fixed the same class of bug in authorize and the transition helper, but the four methods above were not updated.

Fix: in each method, build the new field values into a local variable first, perform the eventStore.append (or transition, which appends), and only commit the field writes to the record after the append returns successfully. propose appends the ACTION_PROPOSED event before calling this.actions.set. reserveRecourse and issuePermit call transition() before writing record.reservation / record.permit. acceptRecoveryQualification appends the RECOVERY_PREFLIGHT_ACCEPTED event before writing record.recovery_preflight.

Verified: node --test test/rail.test.js runs 83 tests, all pass.

---

[devin-ai-integration]

Devin Review found 1 potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[devin-ai-integration]

🔴 Recovery acceptance can lose its data

An accessor-backed bundle can pass verification, then deepClone(bundle) fails after acceptance is recorded. The audit log claims acceptance while permit issuance remains blocked.

Prompt for agents

In src/rail.js, acceptRecoveryQualification verifies caller-owned bundle data, appends RECOVERY_PREFLIGHT_ACCEPTED, and only then clones the bundle. verifyRecoveryPreflight permits accessor-backed fields on the top-level bundle, while deepClone rejects accessors. A bundle whose schema_version getter returns the expected value can therefore pass verification, commit the event, and fail during the later clone, leaving no recovery_preflight fields. Create immutable owned snapshots of both the bundle and verification before appending. Use those snapshots for any event values and commit them to the record only after append succeeds. Add a deterministic regression test proving that any snapshot failure occurs before the event revision changes.

---

Was this helpful? React with 👍 or 👎 to provide feedback.