ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/molecules/evidence_journal.rb

@@ -1,10 +1,15 @@
 # frozen_string_literal: true
 
-require "digest"
+require_relative "canonical_attempt_state"
+
 require "digest"
 require "fileutils"
 require "json"
 require "open3"
+require "pathname"
+require "ace/herdr/molecules/bounded_process"
+require_relative "proposal_journal"
+require_relative "journal_mutation"
 
 module Ace
   module Assign
@@ -25,12 +30,43 @@ module Ace
       # reloads the authoritative ref and replays only still-valid,
       # non-duplicate events.
       class EvidenceJournal
+        include JournalMutation
+        include ProposalJournal
         CAS_ATTEMPTS = 3
+        HISTORY_LIMIT = 100_000
+        EVENT_BATCH_BYTES = 1024 * 1024
+
+        OPERATION_INVENTORY_LIMIT = 8
+
+        # A wire operation may retain one event/raw service selection and bounded immutable inventories, never admission
+        # or current-ref truth. Nested operations own independent selections.
+        def self.with_event_read_operation
+          previous = Thread.current[:ace_assign_event_read_operation]
+          Thread.current[:ace_assign_event_read_operation] = {}
+          yield
+        ensure
+          Thread.current[:ace_assign_event_read_operation] = previous
+        end
+
+        # Selected by source composition, never by receipt or wire parameters.
+        def evidence_mode
+          @mode
+        end
 
         # @param repo_root [String] Git repository root holding the evidence ref
         # @param ref [String, nil] Evidence ref (default from config)
         # @param checkout_root [String, nil] Isolated checkout root (default from config)
-        def initialize(repo_root:, ref: nil, checkout_root: nil)
+        def initialize(repo_root:, ref: nil, checkout_root: nil, mode: :local,
+          evidence_reader: nil, service_authorizer: nil, read_boundary: nil)
+          unless %i[local protected].include?(mode) &&
+              (mode != :protected || [evidence_reader, service_authorizer].all? { |owner| owner.respond_to?(:call) })
+            raise ArgumentError, "protected journal requires source-owned evidence and service boundaries"
+          end
+          @mode, @evidence_reader, @service_authorizer = mode, evidence_reader, service_authorizer
+          if read_boundary && !%i[call blob_batch blob history_diff blob_sizes].all? { |method| read_boundary.respond_to?(method) }
+            raise ArgumentError, "read-only journal boundary is malformed"
+          end
+          @read_boundary = read_boundary
           @repo_root = repo_root
           @ref = ref || default_config("evidence_git_ref") || "refs/ace/execution"
           root = checkout_root || default_config("evidence_checkout_root") || ".ace-local/assign/evidence-checkout"
@@ -44,6 +80,71 @@ module Ace
           git_ok?("rev-parse", "--git-dir")
         end
 
+        # Original operator preparation only. Reuse the journal's existing lock
+        # and absent-ref CAS; never manufacture an event or reset existing history.
+        def initialize_canonical!(owner_uid:, owner_gid:, owner_groups:)
+          raise AttemptErrors::EvidenceUnavailable, "read-only journal cannot initialize canonical evidence" if @read_boundary
+          unless [owner_uid, owner_gid].all? { |id| id.is_a?(Integer) && id.between?(0, 2**31 - 1) } && @repo_root.is_a?(String) && @checkout_root.is_a?(String) &&
+              [@repo_root, @checkout_root].all? { |path| Pathname.new(path).absolute? && File.expand_path(path) == path } &&
+              File.directory?(@repo_root) && !File.symlink?(@repo_root) &&
+              git_ok?("check-ref-format", @ref)
+            raise AttemptErrors::EvidenceUnavailable, "canonical initialization selection is invalid"
+          end
+          unless owner_groups.is_a?(Array) && owner_groups.all? { |id| id.is_a?(Integer) && id.between?(0, 2**31 - 1) } &&
+              owner_groups.uniq.size == owner_groups.size &&
+              [Process.uid, Process.euid, Process.gid, Process.egid] == [owner_uid, owner_uid, owner_gid, owner_gid] &&
+              Process.groups.sort == owner_groups.sort
+            raise AttemptErrors::EvidenceUnavailable, "canonical initialization process identity differs"
+          end
+          selected = File.stat(@repo_root)
+          raise AttemptErrors::EvidenceUnavailable, "canonical initialization repository owner differs" unless selected.uid == owner_uid
+          identity = [selected.dev, selected.ino, selected.uid, selected.gid, selected.mode]
+          with_lock(cleanup_on_failure: false, owner_uid: owner_uid, owner_gid: owner_gid) do
+            value = ref_value
+            unless value
+              if File.exist?(checkout_dir) || File.symlink?(checkout_dir)
+                raise AttemptErrors::EvidenceUnavailable, "uninitialized journal has foreign checkout state"
+              end
+              seed_ref
+              value = ref_value
+            end
+            nodes = canonical_history_nodes!(value)
+            seed = nodes.last.first
+            tree = git!("rev-parse", "#{seed}^{tree}").first
+            message = git!("show", "-s", "--format=%B", seed).first
+            unless tree == git!("hash-object", "-t", "tree", "--stdin").first && message == "seed: ace-assign execution evidence"
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization has foreign root history"
+            end
+            canonical_event_inventory!(commit: value)
+            raw_paths = bounded_history_read!(["ls-tree", "-r", "-z", "--name-only", value], "", HISTORY_DIFF_BYTES)
+            paths = raw_paths.empty? ? [] : raw_paths.split("\0", -1)
+            unless paths.empty? || paths.pop == ""
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization tree inventory is incomplete"
+            end
+            raise AttemptErrors::EvidenceUnavailable, "canonical initialization tree inventory is oversized" if paths.size > HISTORY_LIMIT
+            paths.each do |path|
+              parts = path.split("/", -1)
+              event = parts.size == 4 && parts[0] == "execution" && parts[2] == "events" && JournalMutation::ID.match?(parts[1]) && parts[3].end_with?(".json")
+              request = parts.size == 3 && parts[0, 2] == %w[execution requests] && parts[2].end_with?(".json") && JournalMutation::ID.match?(parts[2].delete_suffix(".json"))
+              # Definitions, prepared packets, candidate bundles and imports
+              # retain the SAME mutation owner's closed immutable blob dialect.
+              validate_blob_path!(path) unless event || request
+            end
+            records = service_request_records(commit: value)
+            expected_requests = paths.select { |path| path.start_with?("execution/requests/") }.map { |path| File.basename(path, ".json") }.sort
+            unless records.map { |record| record.fetch("request_id") }.sort == expected_requests
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization service inventory differs"
+            end
+            current = File.stat(@repo_root)
+            unless !File.symlink?(@repo_root) && [current.dev, current.ino, current.uid, current.gid, current.mode] == identity && ref_value == value
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization selection changed"
+            end
+            value.dup.freeze
+          end
+        rescue SystemCallError, ArgumentError
+          raise AttemptErrors::EvidenceUnavailable, "canonical initialization repository is unavailable"
+        end
+
         # Current value of the evidence ref.
         #
         # @return [String, nil] Commit SHA or nil when the ref does not exist
@@ -56,6 +157,376 @@ module Ace
           nil
         end
 
+        # Read-only verification for a fixed immutable maintenance snapshot.
+        def verify_commit!(commit)
+          unless commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+            raise AttemptErrors::EvidenceUnavailable, "canonical journal commit is invalid"
+          end
+          kind, error, status = git("cat-file", "-t", commit)
+          unless status.success? && kind == "commit"
+            raise AttemptErrors::EvidenceUnavailable, "canonical journal commit is unavailable: #{error}"
+          end
+          true
+        end
+
+        # All immutable owner queries select retained canonical evidence, not
+        # arbitrary Git objects or valid-looking abandoned CAS candidates.
+        def verify_canonical_prefix!(commit:, canonical_commit: ref_value)
+          verify_commit!(commit)
+          verify_commit!(canonical_commit)
+          text, _error, status = git("rev-list", "--first-parent", "--parents",
+            "--max-count=#{self.class::HISTORY_LIMIT + 1}", canonical_commit)
+          nodes = text.lines.map(&:split)
+          unless status.success? && nodes.size <= self.class::HISTORY_LIMIT && !nodes.empty? &&
+              nodes.all? { |node| node.size.between?(1, 2) && node.all? { |sha| sha.match?(/\A[0-9a-f]{40}\z/) } } &&
+              nodes.each_cons(2).all? { |left, right| left[1] == right[0] } && nodes.last.size == 1 &&
+              nodes.any? { |node| node.first == commit }
+            raise AttemptErrors::EvidenceUnavailable, "Evidence prefix is not retained canonical first-parent history"
+          end
+          true
+        end
+
+        # Normal append commits inherit the event unchanged. Locate its one
+        # introduction; inherited appearances are not competing provenance.
+        def event_commit!(assignment_id:, event_digest:, commit:)
+          event_commits!(assignment_id: assignment_id, event_digests: [event_digest], commit: commit).fetch(event_digest)
+        end
+
+        # Operation-scoped batch of the same provenance proof. Reuse only the
+        # already authenticated exact wire inventory; never an owner cache.
+        def event_commits!(assignment_id:, event_digests:, commit:)
+          event_commits_for_assignments!(selectors: {assignment_id => event_digests}, commit: commit).fetch(assignment_id)
+        end
+
+        # One immutable walk for an operation selecting several assignments.
+        # Every selected assignment retains its complete chain and exact raw
+        # blob proof; the result is returned, never cached on this owner.
+        def event_commits_for_assignments!(selectors:, commit:)
+          unless selectors.is_a?(Hash) && !selectors.empty? && selectors.size <= HISTORY_LIMIT &&
+              selectors.keys.all? { |id| id.is_a?(String) && id.match?(JournalMutation::ID) } &&
+              selectors.values.all? { |digests| digests.is_a?(Array) && !digests.empty? &&
+                digests.uniq.size == digests.size && digests.all? { |digest| digest.is_a?(String) && digest.match?(/\A[0-9a-f]{64}\z/) } } &&
+              selectors.values.sum(&:size) <= HISTORY_LIMIT
+            raise AttemptErrors::EvidenceUnavailable, "historical event selectors are invalid"
+          end
+          if (inventory = retained_operation_inventory(commit))
+            return selectors.to_h do |id, digests|
+              introductions = inventory.fetch("introductions").fetch(id)
+              [id.dup.freeze, digests.to_h { |digest| [digest.dup.freeze, introductions.fetch(digest)] }.freeze]
+            end.freeze
+          end
+          nodes = canonical_history_nodes!(commit)
+          states = selectors.to_h do |id, digests|
+            [id, digests.to_h { |digest| [digest, {retained: nil, blob: nil, absent: false, introduction: nil}] }]
+          end
+          each_history_event_snapshot!(states.keys, nodes: nodes) do |node, snapshots, files|
+            states.each do |assignment_id, selected_states|
+              events = snapshots.fetch(assignment_id)
+              validated_attempt_chains!(events)
+              matches = events.select { |event| selected_states.key?(event["digest"]) }.group_by { |event| event.fetch("digest") }
+              selected_states.each do |digest, state|
+                selected = matches.fetch(digest, [])
+                raise AttemptErrors::EvidenceUnavailable, "historical event selector is ambiguous" if selected.size > 1
+                if selected.empty?
+                  raise AttemptErrors::EvidenceUnavailable, "historical event disappeared" if state[:retained]
+                  next
+                end
+                event = selected.first
+                blob = files.fetch(assignment_id).fetch(event_filename(event))
+                if (state[:retained] && state[:retained] != event) || (state[:blob] && state[:blob] != blob)
+                  raise AttemptErrors::EvidenceUnavailable, "historical event changed"
+                end
+                state[:blob] ||= blob
+                state[:retained] ||= event
+                state[:introduction] ||= node.first
+              end
+            end
+          end
+          unless states.values.all? { |selected_states| selected_states.values.all? { |state| state[:introduction] } }
+            raise AttemptErrors::EvidenceUnavailable, "historical canonical event is unavailable"
+          end
+          states.to_h do |id, selected_states|
+            [id.dup.freeze, selected_states.to_h { |digest, state| [digest.dup.freeze, state.fetch(:introduction).dup.freeze] }.freeze]
+          end.freeze
+        rescue KeyError, TypeError, ArgumentError, NoMethodError
+          raise AttemptErrors::EvidenceUnavailable, "historical canonical event selectors are unverifiable"
+        end
+
+        HISTORY_DIFF_BYTES = 256 * 1024 * 1024
+        HISTORY_DIFF_FLAGS = %w[diff-tree --stdin --always --root -r --raw -z --no-renames
+          --no-ext-diff --no-textconv --no-abbrev --].freeze
+
+        # The existing history owner still validates every prefix. Git returns
+        # all requested headers, including unchanged commits; only immutable
+        # changed blob bytes are batched rather than respawned at each node.
+        def each_history_event_snapshot!(ids, nodes:)
+          inventory = ids.nil?
+          ids = [] if inventory
+          files = ids.to_h { |id| [id, {}] }
+          contents = ids.to_h { |id| [id, {}] }
+          paths = inventory ? ["execution/"] : ids.map { |id| "execution/#{id}/events/" }
+          nodes.reverse.each_slice(64) do |chunk|
+            commits = chunk.map(&:first)
+            raw = history_diff!(commits, paths)
+            changes = decode_history_diff!(commits, paths, raw, all_paths: inventory)
+            if inventory
+              changes.each_value do |entries|
+                entries.each do |path, *_|
+                  id = path.split("/")[1]
+                  next if id == "requests"
+                  unless id && id.match?(JournalMutation::ID)
+                    raise AttemptErrors::EvidenceUnavailable, "historical assignment path is invalid"
+                  end
+                  unless files.key?(id)
+                    raise AttemptErrors::EvidenceUnavailable, "historical assignment inventory exceeds bound" if ids.size >= HISTORY_LIMIT
+                    ids << id
+                    files[id], contents[id] = {}, {}
+                  end
+                end
+                entries.select! do |path, *_|
+                  id = path.split("/")[1]
+                  id != "requests" && path.start_with?("execution/#{id}/events/") && path.end_with?(".json")
+                end
+              end
+            end
+            oids = changes.values.flatten(1).filter_map { |change| change[3] unless change[3] == "0" * 40 }.uniq
+            decoded = {}
+            oids.each_slice(64) do |batch|
+              sizes = history_blob_sizes!(batch)
+              entries = batch.zip(sizes)
+              groups = []
+              entries.each do |entry|
+                groups << [] if groups.empty? || (!groups.last.empty? && groups.last.sum(&:last) + entry.last > EVENT_BATCH_BYTES)
+                groups.last << entry
+              end
+              groups.each do |group|
+                decode_event_blobs!(group, read_event_blobs!(group)).each_with_index do |bytes, index|
+                  decoded[group.fetch(index).first] = JSON.parse(bytes)
+                end
+              end
+            end
+            chunk.each do |node|
+              changes.fetch(node.first).each do |path, status, old, fresh|
+                id = ids.find { |selected| path.start_with?("execution/#{selected}/events/") }
+                name = path.delete_prefix("execution/#{id}/events/")
+                current = files.fetch(id)[name]
+                unless (status == "A" && old == "0" * 40 && current.nil?) ||
+                    (%w[M D T].include?(status) && current == old)
+                  raise AttemptErrors::EvidenceUnavailable, "historical tree change differs from previous immutable snapshot"
+                end
+                if status == "D"
+                  files.fetch(id).delete(name)
+                  contents.fetch(id).delete(name)
+                else
+                  files.fetch(id)[name] = fresh
+                  contents.fetch(id)[name] = decoded.fetch(fresh)
+                end
+              end
+              snapshots = contents.transform_values do |selected|
+                events = selected.values
+                digests = events.map { |event| event.fetch("digest") }
+                raise AttemptErrors::EvidenceUnavailable, "historical event digest is ambiguous" unless digests.uniq.size == digests.size
+                order_by_chain(events)
+              end
+              yield node, snapshots, files
+            end
+          end
+          _events, actual = ids.empty? ? [{}, {}] : read_event_snapshots!(ids, commit: nodes.first.first)
+          raise AttemptErrors::EvidenceUnavailable, "historical reconstructed tip differs from its immutable tree" unless files == actual
+        rescue JSON::ParserError, KeyError, TypeError, ArgumentError
+          raise AttemptErrors::EvidenceUnavailable, "historical batched snapshots are unverifiable"
+        end
+
+        def history_diff!(commits, paths)
+          return @read_boundary.history_diff(commits, paths, output_limit: HISTORY_DIFF_BYTES) if @read_boundary
+          bounded_history_read!(HISTORY_DIFF_FLAGS + paths, commits.join("\n") + "\n", HISTORY_DIFF_BYTES)
+        end
+
+        def history_blob_sizes!(oids)
+          raw = if @read_boundary
+            @read_boundary.blob_sizes(oids)
+          else
+            bounded_history_read!(%w[cat-file --batch-check], oids.join("\n") + "\n", oids.size * 128)
+          end
+          lines = raw.lines
+          raise AttemptErrors::EvidenceUnavailable, "historical blob metadata count differs" unless lines.size == oids.size
+          lines.zip(oids).map do |line, oid|
+            match = /\A([0-9a-f]{40}) blob (0|[1-9][0-9]*)\n\z/.match(line)
+            raise AttemptErrors::EvidenceUnavailable, "historical blob metadata differs" unless match && match[1] == oid
+            match[2].to_i
+          end
+        end
+
+        def bounded_history_read!(argv, stdin, limit)
+          result = Herdr::Molecules::BoundedProcess.call(["git", *argv], chdir: File.expand_path(@repo_root),
+            stdin_data: stdin, timeout_s: 30, output_limit: limit)
+          raise AttemptErrors::EvidenceUnavailable, "historical batch unavailable or exceeds bound" unless result.status.success? && !result.oversized
+          result.stdout.to_s.b
+        rescue Timeout::Error, Herdr::Molecules::BoundedProcess::PostLaunchError, IOError, SystemCallError
+          raise AttemptErrors::EvidenceUnavailable, "historical batch is unavailable"
+        end
+
+        def decode_history_diff!(commits, paths, raw, all_paths: false)
+          unless raw.is_a?(String) && raw.end_with?("\0")
+            raise AttemptErrors::EvidenceUnavailable, "historical diff frame is incomplete"
+          end
+          tokens = raw.split("\0", -1)
+          tokens.pop
+          result = commits.to_h { |commit| [commit, []] }
+          position = 0
+          commits.each do |commit|
+            raise AttemptErrors::EvidenceUnavailable, "historical commit header differs" unless tokens[position] == commit
+            position += 1
+            seen = {}
+            while tokens[position]&.start_with?(":")
+              metadata, path = tokens.values_at(position, position + 1)
+              match = /\A:([0-7]{6}) ([0-7]{6}) ([0-9a-f]{40}) ([0-9a-f]{40}) ([AMDT])\z/.match(metadata)
+              unless match && path.is_a?(String) && paths.any? { |prefix| path.start_with?(prefix) } && !seen[path]
+                raise AttemptErrors::EvidenceUnavailable, "historical tree metadata differs"
+              end
+              seen[path] = true
+              position += 2
+              next unless all_paths || path.end_with?(".json")
+              old, fresh, status = match.values_at(3, 4, 5)
+              if all_paths && !path.match?(%r{\Aexecution/[^/]+/events/.*\.json\z})
+                # Complete discovery needs these assignment paths, but their
+                # non-event bodies/modes never become canonical event facts.
+                result.fetch(commit) << [path, status, old, fresh]
+                next
+              end
+              if all_paths && path.start_with?("execution/requests/")
+                result.fetch(commit) << [path, status, old, fresh]
+                next
+              end
+              modes = match.values_at(1, 2)
+              unless modes.all? { |mode| %w[000000 100644 100755 120000].include?(mode) } &&
+                  (status == "A" ? old == "0" * 40 && fresh != "0" * 40 && modes.first == "000000" && modes.last != "000000" :
+                    status == "D" ? old != "0" * 40 && fresh == "0" * 40 && modes.first != "000000" && modes.last == "000000" :
+                      old != "0" * 40 && fresh != "0" * 40 && modes.none? { |mode| mode == "000000" })
+                raise AttemptErrors::EvidenceUnavailable, "historical event object type differs"
+              end
+              result.fetch(commit) << [path, status, old, fresh]
+            end
+          end
+          raise AttemptErrors::EvidenceUnavailable, "historical diff has extra headers or bytes" unless position == tokens.size
+          result
+        end
+        private :each_history_event_snapshot!, :history_diff!, :history_blob_sizes!, :bounded_history_read!, :decode_history_diff!
+
+        # Complete immutable index facts are authenticated before any caller
+        # filters ownership. A missing current fact cannot hide an older one.
+        def canonical_event_inventory!(commit:)
+          context = Thread.current[:ace_assign_event_read_operation]
+          reusable = context && @mode == :protected && commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+          selection = operation_inventory_selection(commit) if reusable
+          if reusable
+            inventories = context[:inventories] ||= {}
+            if inventories.key?(selection)
+              # Refresh bounded insertion order, retaining only immutable facts.
+              inventory = inventories.delete(selection)
+              inventories[selection] = inventory
+              return inventory
+            end
+          else
+            context&.delete(:inventories)
+          end
+          inventory = read_canonical_inventory!(commit: commit)
+          if reusable
+            inventories.shift while inventories.size >= OPERATION_INVENTORY_LIMIT
+            inventories[selection] = inventory
+          end
+          inventory
+        end
+
+        # Query only the exact full history already authenticated in this wire
+        # operation. No historical selector builds or advances this snapshot.
+        def operation_inventory_selection(commit)
+          [object_id, @repo_root, @ref, @checkout_root, @mode, @read_boundary&.object_id, commit]
+            .map { |value| value.is_a?(String) ? value.dup.freeze : value }.freeze
+        end
+
+        def retained_operation_inventory(commit)
+          context = Thread.current[:ace_assign_event_read_operation]
+          return unless context && @mode == :protected && commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+          context.fetch(:inventories, {})[operation_inventory_selection(commit)]
+        end
+        private :operation_inventory_selection, :retained_operation_inventory
+
+        def read_canonical_inventory!(commit:)
+          nodes = canonical_history_nodes!(commit)
+          root_events, introductions = {}, {}
+          previous_chains, previous_files = {}, {}
+          each_history_event_snapshot!(nil, nodes: nodes) do |node, snapshots, files|
+            chains = snapshots.transform_values { |events| validated_attempt_chains!(events) }
+            snapshots.each do |id, events|
+              unless events.all? { |event| files.fetch(id).key?(event_filename(event)) }
+                raise AttemptErrors::EvidenceUnavailable, "canonical event filename differs"
+              end
+            end
+            previous_chains.each do |id, attempts|
+              attempts.each do |attempt_id, chain|
+                newer = chains.fetch(id, {}).fetch(attempt_id, [])
+                unless chain == newer.take(chain.size)
+                  raise AttemptErrors::EvidenceUnavailable, "canonical inventory history removed or rewrote an attempt"
+                end
+              end
+            end
+            previous_files.each do |id, selected_files|
+              unless selected_files.all? { |name, oid| files.fetch(id, {})[name] == oid }
+                raise AttemptErrors::EvidenceUnavailable, "canonical inventory history removed or rewrote event bytes"
+              end
+            end
+            snapshots.each do |id, events|
+              introductions[id] ||= {}
+              events.each { |event| introductions.fetch(id)[event.fetch("digest")] ||= node.first }
+            end
+            root_events = snapshots.reject { |_id, events| events.empty? }
+            previous_chains = chains
+            previous_files = files.transform_values(&:dup)
+          end
+          introductions.select! { |id, _| root_events.key?(id) }
+          freeze_inventory_projection("commit" => commit, "events" => root_events, "introductions" => introductions)
+        rescue KeyError, TypeError, ArgumentError, NoMethodError
+          raise AttemptErrors::EvidenceUnavailable, "canonical inventory history is unverifiable"
+        end
+
+        private :read_canonical_inventory!
+
+        def canonical_history_nodes!(commit)
+          verify_commit!(commit)
+          topology, error, status = git("rev-list", "--first-parent", "--parents",
+            "--max-count=#{HISTORY_LIMIT + 1}", commit)
+          nodes = topology.lines.map(&:split)
+          unless status.success? && !nodes.empty? && nodes.size <= HISTORY_LIMIT &&
+              nodes.all? { |node| node.size.between?(1, 2) && node.all? { |sha| sha.match?(/\A[0-9a-f]{40}\z/) } } &&
+              nodes.each_cons(2).all? { |left, right| left[1] == right[0] } && nodes.last.size == 1
+            raise AttemptErrors::EvidenceUnavailable, "canonical history topology is unsupported or incomplete: #{error}"
+          end
+          nodes
+        end
+
+        def validated_attempt_chains!(events)
+          chains = events.group_by { |event| event.fetch("attempt_id") }
+          unless chains.values.all? { |chain| Models::EvidenceEvent.chain_valid?(chain) }
+            raise AttemptErrors::EvidenceUnavailable, "historical canonical event chain is corrupt"
+          end
+          chains
+        end
+
+        def freeze_inventory_projection(value)
+          case value
+          when Hash
+            value.to_h { |key, item| [freeze_inventory_projection(key), freeze_inventory_projection(item)] }.freeze
+          when Array
+            value.map { |item| freeze_inventory_projection(item) }.freeze
+          when String
+            value.dup.freeze
+          else
+            value.freeze
+          end
+        end
+        private :canonical_history_nodes!, :validated_attempt_chains!, :freeze_inventory_projection
+
         # Append accepted events to the journal under lock + CAS.
         #
         # @param assignment_id [String] Assignment ID (journal path segment)
@@ -89,28 +560,112 @@ module Ace
           end
         end
 
+        # Build an event against the latest chain while holding the ref lock.
+        # Re-run the eligibility guard on each CAS retry, never append a
+        # stale chain continuation after another accepted writer.
+        def record(assignment_id:, attempt_id:, type:, payload:, guard: nil)
+          with_lock do
+            CAS_ATTEMPTS.times do
+              old = ref_value
+              ensure_checkout!
+              old = ref_value if old.nil?
+              sync_checkout(old)
+              guard&.call
+              previous = read_events(assignment_id).reverse.find { |event| event["attempt_id"] == attempt_id }&.fetch("digest")
+              event = Models::EvidenceEvent.build(type: type, attempt_id: attempt_id,
+                payload: payload, previous_digest: previous)
+              write_event_files(assignment_id, [event])
+              commit = commit_events(assignment_id, attempt_id, [event])
+              return commit if update_ref_cas(commit, old)
+            end
+            raise AttemptErrors::EvidenceUnavailable, "Evidence ref stayed conflicting during event recording"
+          end
+        end
+
         # Read all journal events recorded for an assignment, ordered by the
         # digest chain (never by filename: same-second events sort
         # alphabetically, which can invert lifecycle order).
         #
         # @param assignment_id [String] Assignment ID
         # @return [Array<Hash>] Parsed events in journal order
-        def read_events(assignment_id)
-          value = ref_value
-          return [] if value.nil?
+        def read_events(assignment_id, commit: ref_value)
+          context = Thread.current[:ace_assign_event_read_operation]
+          if commit.nil?
+            context&.delete(:selection)
+            context&.delete(:events)
+            return []
+          end
+          unless context && @mode == :protected && commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+            context&.delete(:selection)
+            context&.delete(:events)
+            return read_event_snapshots!([assignment_id], commit: commit).first.fetch(assignment_id)
+          end
+          selection = [object_id, @repo_root, @ref, @checkout_root, @mode, @read_boundary&.object_id,
+            assignment_id, commit].map { |value| value.is_a?(String) ? value.dup.freeze : value }.freeze
+          return context.fetch(:events) if context[:selection] == selection
+          context.delete(:selection)
+          context.delete(:events)
+          inventory = retained_operation_inventory(commit) if assignment_id.is_a?(String) && assignment_id.match?(JournalMutation::ID)
+          events = if inventory
+            inventory.fetch("events").fetch(assignment_id, [])
+          else
+            read_event_snapshots!([assignment_id], commit: commit).first.fetch(assignment_id)
+          end
+          frozen = freeze_inventory_projection(events)
+          context[:selection], context[:events] = selection, frozen
+          frozen
+        end
 
-          paths, stderr, status = git("ls-tree", "-r", "--name-only", value, "--",
-            "execution/#{assignment_id}/events/")
-          raise AttemptErrors::EvidenceUnavailable, "Cannot read journal events: #{stderr}" unless status.success?
-          events = paths.lines.map(&:strip).select { |path| path.end_with?(".json") }.map do |path|
-            content, error, read_status = git("show", "#{value}:#{path}")
-            raise AttemptErrors::EvidenceUnavailable, "Cannot read journal event: #{error}" unless read_status.success?
-            JSON.parse(content)
+        # Bounded argv/blob batches from the same immutable tree. Preserve the
+        # actual file OIDs alongside parsed chains for introduction proofs.
+        def read_event_snapshots!(assignment_ids, commit:)
+          unless assignment_ids.is_a?(Array) && !assignment_ids.empty? && assignment_ids.size <= HISTORY_LIMIT &&
+              assignment_ids.uniq.size == assignment_ids.size && assignment_ids.all? { |id| id.is_a?(String) && id.match?(JournalMutation::ID) }
+            raise AttemptErrors::EvidenceUnavailable, "canonical assignment selectors are invalid"
+          end
+          events = assignment_ids.to_h { |id| [id, []] }
+          files = assignment_ids.to_h { |id| [id, {}] }
+          entries = []
+          assignment_ids.each_slice(64) do |ids|
+            paths, stderr, status = git("ls-tree", "-r", "-l", commit, "--", *ids.map { |id| "execution/#{id}/events/" })
+            raise AttemptErrors::EvidenceUnavailable, "Cannot read journal events: #{stderr}" unless status.success?
+            paths.lines.each do |line|
+              metadata, path = line.chomp.split("\t", 2)
+              next unless path&.end_with?(".json")
+              _mode, kind, oid, size = metadata.split
+              id = path.split("/")[1]
+              unless events.key?(id) && path.start_with?("execution/#{id}/events/") && kind == "blob" &&
+                  oid&.match?(/\A[0-9a-f]{40}\z/) && size&.match?(/\A(?:0|[1-9][0-9]*)\z/)
+                raise AttemptErrors::EvidenceUnavailable, "canonical event blob selection is invalid"
+              end
+              name = path.delete_prefix("execution/#{id}/events/")
+              raise AttemptErrors::EvidenceUnavailable, "canonical event file is ambiguous" if files.fetch(id).key?(name)
+              files.fetch(id)[name] = oid
+              entries << [oid, size.to_i, id]
+            end
+          end
+          batches = []
+          entries.each do |entry|
+            batches << [] if batches.empty? || batches.last.size == 64 ||
+              (!batches.last.empty? && batches.last.sum { |item| item[1] } + entry[1] > EVENT_BATCH_BYTES)
+            batches.last << entry
           end
-          order_by_chain(events)
-        rescue JSON::ParserError => e
-          raise AttemptErrors::EvidenceUnavailable, "Corrupt journal event for #{assignment_id}: #{e.message}"
+          batches.each do |batch|
+            selected = batch.map { |oid, size, _id| [oid, size] }
+            contents = decode_event_blobs!(selected, read_event_blobs!(selected))
+            batch.zip(contents).each { |(_oid, _size, id), content| events.fetch(id) << JSON.parse(content) }
+          end
+          events.each_value do |chain|
+            digests = chain.map { |event| event.fetch("digest") }
+            unless digests.uniq.size == digests.size
+              raise AttemptErrors::EvidenceUnavailable, "canonical event digest is ambiguous"
+            end
+          end
+          [events.transform_values { |chain| order_by_chain(chain) }, files]
+        rescue JSON::ParserError
+          raise AttemptErrors::EvidenceUnavailable, "Corrupt canonical journal event"
         end
+        private :read_event_snapshots!
 
         # Accepted receipt payloads recorded for an assignment.
         #
@@ -197,7 +752,7 @@ module Ace
           %w[succeeded failed failed-settled].include?(state)
         end
 
-        def validate_terminal_receipt!(current, state, receipt)
+        def validate_terminal_receipt!(current, state, receipt, pending: nil)
           unless receipt.is_a?(Hash) && receipt.keys.sort == TERMINAL_RECEIPT_FIELDS.sort
             raise AttemptErrors::ReceiptRejected,
               "Service terminal receipt has invalid fields"
@@ -224,6 +779,27 @@ module Ace
             raise AttemptErrors::ReceiptRejected,
               "Service settlement requires a no-effect attestation artifact"
           end
+          if @mode == :protected
+            if (current["operation"] == "prune-preserved-workspace" && %w[succeeded failed-settled].include?(state)) ||
+                (current["operation"] == "publish" && %w[succeeded failed].include?(state))
+              # The same installed evidence reader owns the entire imported
+              # cleanup pair; individual textual markers cannot authorize it.
+              contents = @evidence_reader.call(evidence_items, current, state, pending)
+              unless contents.is_a?(Array) && contents.size == evidence_items.size &&
+                  contents.each_with_index.all? { |content, index| content.is_a?(String) && Digest::SHA256.hexdigest(content.b) == evidence_items.fetch(index).fetch("sha256") }
+                raise AttemptErrors::ReceiptRejected, "Canonical cleanup evidence is unverifiable"
+              end
+              return true
+            end
+            evidence_items.each do |item|
+              content = @evidence_reader.call(item, current, state, pending)
+              unless content.is_a?(String) && Digest::SHA256.hexdigest(content.b) == item["sha256"]
+                raise AttemptErrors::ReceiptRejected, "Canonical service evidence is unverifiable"
+              end
+              verify_service_attestation!(content, current, state)
+            end
+            return true
+          end
           repo_root = File.realpath(@repo_root)
           receipt["evidence"].each do |item|
             path = File.expand_path(item["ref"], repo_root)
@@ -241,30 +817,90 @@ module Ace
             end
             raise AttemptErrors::ReceiptRejected,
               "Service terminal receipt evidence is unverifiable: #{item["ref"]}" unless intact
-            attestation = /^ace-service-attestation request:#{Regexp.escape(current["request_id"])} \
-input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?$/
-            attested = File.read(real).scan(attestation).first
-            attested_outcome = state == "failed-settled" ? "failed" : state
-            unless attested && attested.first == attested_outcome &&
-                (state == "failed-settled" ? attested[2] == "true" : true)
-              raise AttemptErrors::ReceiptRejected,
-                "Service terminal receipt evidence does not attest #{attested_outcome}: #{item["ref"]}"
-            end
+            verify_service_attestation!(File.read(real), current, state)
+          end
+        end
+
+        def service_request(request_id, commit: ref_value)
+          read_service_request(request_id, commit: commit, pending: {commit: commit})
+        end
+
+        # A read operation owns this view only until its caller returns. The
+        # original complete first-parent/raw-blob owner supplies every fact;
+        # it is never retained on the journal or reused for another operation.
+        ServiceReadView = Struct.new(:journal, :commit, :inventory, :projection, keyword_init: true)
+
+        def service_settlement_read(request_id, commit: ref_value)
+          verify_canonical_prefix!(commit: commit)
+          record = read_service_request(request_id, commit: commit, pending: {commit: commit}, terminal: false)
+          return {record: nil, settlement_context: nil, read_view: nil}.freeze unless record
+          id = record.fetch("assignment_id")
+          events = read_events(id, commit: commit)
+          selectors = events.map { |event| event.fetch("digest") }
+          introductions = event_commits!(assignment_id: id, event_digests: selectors, commit: commit)
+          inventory = freeze_inventory_projection("commit" => commit, "events" => {id => events}, "introductions" => {id => introductions})
+          view = ServiceReadView.new(journal: self, commit: commit, inventory: inventory)
+          if @mode == :protected && terminal_state?(record["state"])
+            validate_terminal_receipt!(record, record["state"], record["receipt"],
+              pending: {commit: commit, service_read_view: view})
           end
+          view.freeze
+          {record: freeze_inventory_projection(record), settlement_context: view.projection, read_view: view}.freeze
         end
 
-        def service_request(request_id)
+        def read_service_request(request_id, commit:, pending:, terminal: true)
+          context = Thread.current[:ace_assign_event_read_operation]
           validate_request_id!(request_id)
-          value = ref_value
-          return nil unless value
-          out, stderr, status = git("show", "#{value}:#{service_request_path(request_id)}")
-          return JSON.parse(out) if status.success?
+          reusable = context && @mode == :protected && commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+          selection = if reusable
+            (operation_inventory_selection(commit) + [@evidence_reader&.object_id, @service_authorizer&.object_id, request_id])
+              .map { |value| value.is_a?(String) ? value.dup.freeze : value }.freeze
+          end
+          if reusable && context[:service_record_selection] == selection
+            retained = context[:service_record]
+          else
+            context&.delete(:service_record_selection)
+            context&.delete(:service_record)
+            retained = read_service_request_record(request_id, commit: commit)
+            if reusable && retained
+              retained = freeze_inventory_projection(retained)
+              context[:service_record_selection], context[:service_record] = selection, retained
+            end
+          end
+          # This memo contains JSON and its immutable accepted event proof,
+          # never terminal evidence admission. Every callback remains fresh;
+          # callers receive their own mutable copy rather than cached state.
+          record = retained && (reusable ? JSON.parse(JSON.generate(retained)) : retained)
+          validate_terminal_receipt!(record, record["state"], record["receipt"], pending: pending) if
+            record && terminal && @mode == :protected && terminal_state?(record["state"])
+          # Historical dependency reads may replace this one slot while the
+          # fresh callback executes. Restore only this successful raw view.
+          if reusable && retained
+            context[:service_record_selection], context[:service_record] = selection, retained
+          end
+          record
+        rescue Exception
+          context&.delete(:service_record_selection)
+          context&.delete(:service_record)
+          raise
+        end
+
+        def read_service_request_record(request_id, commit:)
+          return nil unless commit
+          out, stderr, status = git("show", "#{commit}:#{service_request_path(request_id)}")
+          if status.success?
+            record = JSON.parse(out)
+            verify_service_record!(record, commit: commit) if @mode == :protected
+            return record
+          end
           return nil if stderr.include?("does not exist") || stderr.include?("exists on disk")
           raise AttemptErrors::EvidenceUnavailable, "Cannot read service request: #{stderr}"
         rescue JSON::ParserError
           raise AttemptErrors::EvidenceUnavailable, "Corrupt service request #{request_id}"
         end
 
+        private :read_service_request, :read_service_request_record
+
         # Every service request recorded in this evidence ref, whatever the
         # owning assignment. Backs the journal-wide request-ID and
         # authorization-consumption checks.
@@ -292,6 +928,12 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
         def settlement_evidence_intact?(record)
           receipt = record["receipt"]
           return false unless receipt.is_a?(Hash)
+          if @mode == :protected
+            commit = ref_value
+            verify_service_record!(record, commit: commit)
+            validate_terminal_receipt!(record, "failed-settled", receipt, pending: {commit: commit})
+            return true
+          end
           repo_root = File.realpath(@repo_root)
           Array(receipt["evidence"]).all? do |item|
             path = File.expand_path(item["ref"].to_s, repo_root)
@@ -307,10 +949,12 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
               false
             end
           end
+        rescue AttemptErrors::EvidenceUnavailable, AttemptErrors::ReceiptRejected
+          false
         end
 
-        def service_request_records
-          value = ref_value
+        def service_request_records(commit: ref_value)
+          value = commit
           return [] unless value
           paths, stderr, status = git("ls-tree", "-r", "--name-only", value, "--", "execution/requests/")
           raise AttemptErrors::EvidenceUnavailable, "Cannot read service request index: #{stderr}" unless status.success?
@@ -319,7 +963,9 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
             unless read_status.success?
               raise AttemptErrors::EvidenceUnavailable, "Cannot read service request #{path}: #{error}"
             end
-            JSON.parse(content)
+            record = JSON.parse(content)
+            verify_service_record!(record, commit: value) if @mode == :protected
+            record
           end
         rescue JSON::ParserError
           raise AttemptErrors::EvidenceUnavailable, "Corrupt service request index"
@@ -366,8 +1012,8 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
         # ref itself (works even when the local assignment cache is gone).
         #
         # @return [Array<String>] Assignment IDs with journal evidence
-        def assignment_ids
-          value = ref_value
+        def assignment_ids(commit: ref_value)
+          value = commit
           return [] if value.nil?
 
           paths, stderr, status = git("ls-tree", "-d", "--name-only", value, "--", "execution/")
@@ -378,6 +1024,46 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
 
         private
 
+        # Sizes come from the same immutable tree selection. Batch memory is
+        # bounded by that selection; an existing larger single event retains
+        # its previous read semantics rather than gaining a lifetime ceiling.
+        def read_event_blobs!(entries)
+          limit = entries.sum { |_oid, size| size + 128 }
+          return @read_boundary.blob_batch(entries.map(&:first), output_limit: limit) if @read_boundary
+          result = Herdr::Molecules::BoundedProcess.call(["git", "cat-file", "--batch"],
+            chdir: File.expand_path(@repo_root), stdin_data: entries.map { |oid, _size| "#{oid}\n" }.join,
+            timeout_s: 30, output_limit: limit)
+          unless result.status.success? && !result.oversized
+            raise AttemptErrors::EvidenceUnavailable, "canonical blob batch is unavailable or exceeds selected sizes"
+          end
+          result.stdout.to_s.b
+        rescue Timeout::Error, Herdr::Molecules::BoundedProcess::PostLaunchError, IOError, SystemCallError => error
+          raise AttemptErrors::EvidenceUnavailable, "canonical blob batch is unavailable: #{error.message}"
+        end
+
+        def decode_event_blobs!(entries, output)
+          output = output.b
+          offset = 0
+          entries.map do |oid, size|
+            ending = output.index("\n", offset)
+            unless ending && ending - offset <= 127 && output.byteslice(offset, ending - offset) == "#{oid} blob #{size}"
+              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch header is invalid"
+            end
+            offset = ending + 1
+            content = output.byteslice(offset, size)
+            unless content&.bytesize == size && output.byteslice(offset + size, 1) == "\n" &&
+                Digest::SHA1.hexdigest("blob #{size}\0" + content) == oid
+              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch bytes are invalid"
+            end
+            offset += size + 1
+            content
+          end.tap do
+            unless offset == output.bytesize
+              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch has unexpected trailing bytes"
+            end
+          end
+        end
+
         def update_service_request(request_id, expected:, replacement:, event_type:, guard: nil)
           validate_request_id!(request_id)
           with_lock do
@@ -386,47 +1072,20 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
               ensure_checkout!
               old = ref_value if old.nil?
               sync_checkout(old)
-              # Guards (for example authorization consumption) re-run inside
-              # the lock against the ref being committed, so a racing claim
-              # cannot slip through between the check and the CAS.
-              if guard
-                conflict = guard.call
-                if conflict
-                  raise AttemptErrors::Conflict,
-                    "Authorization reference already consumed by request #{conflict.fetch("request_id")}"
-                end
-              end
-              path = File.join(checkout_dir, service_request_path(request_id))
-              existing = File.exist?(path) ? JSON.parse(File.read(path)) : nil
-              if expected.nil? && existing
-                return existing if existing.except("state", "receipt", "reason", "claimed_at") ==
-                  replacement.except("state", "receipt", "reason", "claimed_at")
-                raise AttemptErrors::Conflict, "Service request #{request_id} has different input"
-              end
-              if expected && existing != expected
-                raise AttemptErrors::Conflict, "Service request #{request_id} changed during transition"
-              end
-              terminal = existing && %w[succeeded failed rejected].include?(existing["state"])
-              settlement = existing && existing["state"] == "failed" && replacement["state"] == "failed-settled"
-              if expected && existing && terminal && !settlement
-                raise AttemptErrors::InvalidState, "Service request #{request_id} is terminal"
-              end
-
-              FileUtils.mkdir_p(File.dirname(path))
-              File.write(path, JSON.pretty_generate(replacement))
+              prepared = prepare_service_update(request_id: request_id, expected: expected,
+                replacement: replacement, event_type: event_type, guard: guard)
+              return prepared.fetch(:record) if prepared[:replayed]
+              write_service_records([prepared])
               assignment_id = replacement.fetch("assignment_id")
               attempt_id = replacement.fetch("attempt_id")
               prior = read_events(assignment_id).reverse
                 .find { |entry| entry["attempt_id"] == attempt_id }&.fetch("digest")
-              payload = {"request_id" => request_id, "state" => replacement.fetch("state"),
-                         "input_digest" => replacement.fetch("input_digest"),
-                         "receipt_digest" => replacement["receipt"] &&
-                           Atoms::EvidenceDigest.digest(replacement["receipt"])}
               event = Models::EvidenceEvent.build(type: event_type, attempt_id: attempt_id,
-                payload: payload, previous_digest: prior)
+                payload: prepared.fetch(:event).fetch(:payload), previous_digest: prior)
               write_event_files(assignment_id, [event])
               git!("-C", checkout_dir, "add", "--", service_request_path(request_id),
                 "execution/#{assignment_id}/events")
+              stage_service_records([prepared])
               state = replacement.fetch("state")
               git!("-C", checkout_dir, "-c", "user.name=ace-assign", "-c", "user.email=ace-assign@localhost",
                 "commit", "-m", "evidence: service request #{request_id} #{state}")
@@ -437,6 +1096,146 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
           end
         end
 
+        # Shared owner for ordinary service writes and atomic authority
+        # imports. Call only after checkout sync, under this journal's CAS lock.
+        def prepare_service_update(request_id:, expected:, replacement:, event_type:, guard: nil, pending: nil)
+          validate_request_id!(request_id)
+          unless replacement.is_a?(Hash) && replacement["request_id"] == request_id &&
+              %w[service_claim service_transition service_challenge].include?(event_type) &&
+              %w[accepted uncertain rejected succeeded failed failed-settled].include?(replacement["state"])
+            raise ArgumentError, "invalid service update plan"
+          end
+          existing = service_request(request_id)
+          if expected.nil? && existing
+            return {record: existing, replayed: true} if existing.except("state", "receipt", "reason", "claimed_at") ==
+              replacement.except("state", "receipt", "reason", "claimed_at")
+            raise AttemptErrors::Conflict, "Service request #{request_id} has different input"
+          end
+          if expected && existing != expected
+            raise AttemptErrors::Conflict, "Service request #{request_id} changed during transition"
+          end
+          if expected.nil?
+            unless event_type == "service_claim" && %w[accepted uncertain rejected].include?(replacement["state"])
+              raise AttemptErrors::InvalidState, "Service request needs an initial claim"
+            end
+            if %w[accepted uncertain].include?(replacement["state"])
+              if replacement["authorization"].to_s.start_with?("proposal-")
+                unless respond_to?(:proposal_authorize!, true)
+                  raise AttemptErrors::UnauthorizedIdentity, "Canonical proposal producer is unavailable"
+                end
+                proposal_authorize!(replacement["authorization"], replacement)
+              end
+              conflict = authorization_conflict(replacement)
+              raise_authorization_conflict!(conflict) if conflict
+            end
+          else
+            challenge_update = event_type == "service_challenge" && pending && pending[:operation] == "claim_service_settlement" &&
+              existing["state"] == replacement["state"] && existing["receipt"] == replacement["receipt"] &&
+              %w[uncertain failed].include?(existing["state"])
+            unless event_type == "service_transition" || challenge_update
+              raise AttemptErrors::InvalidState, "Existing service request needs a transition"
+            end
+            terminal = %w[succeeded failed rejected failed-settled].include?(existing["state"])
+            settlement = replacement["state"] == "failed-settled" &&
+              (existing["state"] == "failed" || (existing["state"] == "rejected" && existing["consumed"] != false))
+            recovered_cleanup = @mode == :protected && pending && pending[:operation] == "complete_service" &&
+              existing["operation"] == "prune-preserved-workspace" && existing["state"] == "failed" &&
+              existing["dispatch_phase"] == "dispatch_started" && existing["completion_digest"].nil? &&
+              replacement["state"] == "succeeded"
+            if terminal && !settlement && !challenge_update && !recovered_cleanup
+              raise AttemptErrors::InvalidState, "Service request #{request_id} is terminal"
+            end
+            mutable = %w[state receipt reason claimed_at failed_at dispatch_phase no_effect_challenge
+              challenge_generation challenge_event_digest completion_digest no_effect_completion_digest]
+            # Only this authenticated fresh dispatch may introduce the fixed
+            # root collaborator identity. It is immutable on every later update.
+            if @mode == :protected && pending && pending[:operation] == "begin_dispatch" &&
+                existing["operation"] == "prune-preserved-workspace" && existing["dispatch_phase"] == "issued" &&
+                replacement["dispatch_phase"] == "dispatch_started" &&
+                %w[operation_owner_binding executor_process_binding].none? { |key| existing.key?(key) } &&
+                %w[operation_owner_binding executor_process_binding].all? { |key| replacement.key?(key) }
+              mutable.concat(%w[operation_owner_binding executor_process_binding])
+            end
+            if @mode == :protected && pending && existing["operation"] == "publish"
+              if pending[:operation] == "begin_dispatch" && existing["dispatch_phase"] == "issued" &&
+                  replacement["dispatch_phase"] == "dispatch_started" && !existing.key?("executor_process_binding") &&
+                  replacement.key?("executor_process_binding")
+                mutable << "executor_process_binding"
+              elsif %w[publication_challenge publication_continue].include?(pending[:operation])
+                mutable.concat(%w[publication_challenge_digest publication_challenge_ref publication_challenge_event_digest
+                  publication_challenge_generation publication_issuing_event_digest])
+              end
+            end
+            unless existing.except(*mutable) == replacement.except(*mutable)
+              raise AttemptErrors::Conflict, "Service request #{request_id} changed immutable binding"
+            end
+          end
+          conflict = guard&.call
+          raise_authorization_conflict!(conflict) if conflict
+          @service_authorizer.call(existing, replacement, pending) if @mode == :protected
+          validate_terminal_receipt!(replacement, replacement["state"], replacement["receipt"], pending: pending) if terminal_state?(replacement["state"])
+          payload = {"request_id" => request_id, "state" => replacement.fetch("state"),
+                     "input_digest" => replacement.fetch("input_digest"),
+                     "record_digest" => Atoms::EvidenceDigest.digest(replacement),
+                     "receipt_digest" => replacement["receipt"] && Atoms::EvidenceDigest.digest(replacement["receipt"])}
+          {record: replacement, path: service_request_path(request_id),
+           event: {type: event_type, payload: payload}, replayed: false}
+        end
+
+        def prepare_service_updates(updates, assignment_id:, attempt_id:, pending:)
+          unless updates.is_a?(Array) && updates.length <= 1
+            raise ArgumentError, "one service update is allowed per authority mutation"
+          end
+          updates.map do |update|
+            unless update.is_a?(Hash) && update.keys.sort == %i[event_type expected replacement request_id].sort &&
+                update.dig(:replacement, "assignment_id") == assignment_id && update.dig(:replacement, "attempt_id") == attempt_id
+              raise ArgumentError, "service update does not match mutation attempt"
+            end
+            prepare_service_update(**update, pending: pending)
+          end.reject { |prepared| prepared[:replayed] }
+        end
+
+        def write_service_records(records)
+          records.each do |prepared|
+            path = File.join(checkout_dir, prepared.fetch(:path))
+            FileUtils.mkdir_p(File.dirname(path))
+            File.write(path, JSON.pretty_generate(prepared.fetch(:record)))
+          end
+        end
+
+        def stage_service_records(records)
+          stage_mutation_blobs(records.to_h { |prepared| [prepared.fetch(:path), JSON.pretty_generate(prepared.fetch(:record))] })
+        end
+
+        def verify_service_record!(record, commit: ref_value)
+          events = read_events(record.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == record.fetch("attempt_id") }
+          unless Models::EvidenceEvent.chain_valid?(events)
+            raise AttemptErrors::EvidenceUnavailable, "Canonical service event chain is unverifiable"
+          end
+          event = events.reverse.find do |entry|
+            %w[service_claim service_transition service_challenge].include?(entry["type"]) && entry.dig("payload", "request_id") == record["request_id"]
+          end
+          unless event && event.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(record)
+            raise AttemptErrors::EvidenceUnavailable, "Canonical service record does not match accepted event"
+          end
+        rescue KeyError, TypeError
+          raise AttemptErrors::EvidenceUnavailable, "Canonical service record has invalid binding"
+        end
+
+        def raise_authorization_conflict!(conflict)
+          raise AttemptErrors::Conflict,
+            "Authorization reference already consumed by request #{conflict.fetch('request_id')}"
+        end
+
+        def verify_service_attestation!(content, request, state)
+          expression = /^ace-service-attestation request:#{Regexp.escape(request["request_id"])} input:#{Regexp.escape(request["input_digest"])} outcome:(\S+)( no-effect:(\S+))?$/
+          attested = content.scan(expression).first
+          outcome = state == "failed-settled" ? "failed" : state
+          unless attested && attested.first == outcome && (state != "failed-settled" || attested[2] == "true")
+            raise AttemptErrors::ReceiptRejected, "Service terminal evidence does not attest #{outcome}"
+          end
+        end
+
         def service_request_path(request_id)
           "execution/requests/#{request_id}.json"
         end
@@ -449,39 +1248,31 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
         # Latest lifecycle state implied by the events, or nil when the
         # events do not describe a full attempt (intent missing).
         def derive_state(events)
-          return nil unless events.any? { |event| event["type"] == "intent" }
-
-          state = "running"
-          events.each do |event|
-            case event["type"]
-            when "receipt_accepted"
-              state = event.dig("payload", "receipt", "verdict") || state
-            when "transition"
-              state = event.dig("payload", "to") || state
-            when "reconciliation"
-              state = event.dig("payload", "resolution") || state
-            end
-          end
-          state
+          CanonicalAttemptState.derive(events)
         end
 
         def build_attempt(assignment_id, attempt_id, intent_payload, events, state)
           process_start = events.reverse.find do |event|
             event["type"] == "process_start" && event["attempt_id"] == attempt_id
           end
-          candidate_head = events.select { |event| event["type"] == "receipt_accepted" }
-            .map { |event| event.dig("payload", "receipt", "head") }
-            .compact
-            .first
+          candidate_head = nil
+          events.each do |event|
+            case event["type"]
+            when "candidate_invalidated" then candidate_head = nil
+            when "receipt_accepted" then candidate_head ||= event.dig("payload", "receipt", "head")
+            when "delivery"
+              candidate_head = event.dig("payload", "head") if %w[intent result].include?(event.dig("payload", "stage"))
+            end
+          end
           binding = Models::AttemptBinding.new(
             attempt_id: attempt_id,
             assignment_id: assignment_id,
             scope: intent_payload["scope"],
             project_id: intent_payload["project_id"],
             task_id: intent_payload["task_id"],
-            actor: process_start&.dig("payload", "actor") || "recovered",
-            role: process_start&.dig("payload", "role") || "coordinator",
-            runtime: process_start&.dig("payload", "runtime") || "recovered",
+            actor: process_start&.dig("payload", "actor") || intent_payload["actor"] || "recovered",
+            role: process_start&.dig("payload", "role") || intent_payload["role"] || "coordinator",
+            runtime: process_start&.dig("payload", "runtime") || intent_payload["runtime"] || "recovered",
             base_head: intent_payload["base_head"],
             evidence_git_ref: ref,
             created_at: parse_event_time(intent_time(events, attempt_id))
@@ -596,16 +1387,52 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
           File.join(@checkout_root, ".evidence.lock")
         end
 
-        def with_lock
+        def with_lock(cleanup_on_failure: true, owner_uid: nil, owner_gid: nil)
+          raise AttemptErrors::EvidenceUnavailable, "read-only journal cannot mutate canonical evidence" if @read_boundary
           FileUtils.mkdir_p(@checkout_root)
-          File.open(lock_path, File::RDWR | File::CREAT) do |lock|
+          lock = if owner_uid
+            initialization_lock!(owner_uid: owner_uid, owner_gid: owner_gid)
+          else
+            File.open(lock_path, File::RDWR | File::CREAT, 0o600)
+          end
+          begin
             lock.flock(File::LOCK_EX)
             begin
               yield
+            rescue StandardError
+              # Ordinary mutation rollback is unchanged. Initialization must
+              # not adopt/reset a foreign disposable checkout on refusal.
+              sync_checkout(ref_value) if cleanup_on_failure && File.exist?(File.join(checkout_dir, ".git"))
+              raise
             ensure
               lock.flock(File::LOCK_UN)
             end
+          ensure
+            lock.close
+          end
+        end
+
+        def initialization_lock!(owner_uid:, owner_gid:)
+          created = false
+          begin
+            file = File.open(lock_path, File::RDWR | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600)
+            created = true
+          rescue Errno::EEXIST
+            file = File.open(lock_path, File::RDWR | File::NOFOLLOW)
+          end
+          if created
+            file.flush
+            file.fsync
+          end
+          info = file.stat
+          unless info.file? && info.nlink == 1 && info.size.zero? &&
+              [info.uid, info.gid, info.mode & 0o7777] == [owner_uid, owner_gid, 0o600]
+            raise AttemptErrors::EvidenceUnavailable, "canonical initialization lock protection differs"
           end
+          file
+        rescue Exception
+          file&.close
+          raise
         end
 
         def ensure_checkout!
@@ -648,6 +1475,9 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
           return if target.nil?
 
           git!("-C", checkout_dir, "reset", "--hard", target)
+          # All writers use this boundary, including CAS retries. Only the
+          # journal's disposable namespaces are cleaned, never the candidate.
+          git!("-C", checkout_dir, "clean", "-fd", "--", "execution", "evidence")
         rescue AttemptErrors::EvidenceUnavailable
           # Stale, broken, or unregistered worktree: rebuild from scratch.
           FileUtils.rm_rf(checkout_dir)
@@ -656,6 +1486,7 @@ input:#{Regexp.escape(current["input_digest"])} outcome:(\S+)( no-effect:(\S+))?
         end
 
         def git(*argv)
+          return @read_boundary.call(argv) if @read_boundary
           unless File.directory?(@repo_root)
             return ["", "repository root missing: #{@repo_root}", FAILED_RESULT]
           end