ace-assign 0.64.0 → 0.66.1

data/lib/ace/assign/authority/launch_scope_release.rb

@@ -1,30 +1,130 @@
 # frozen_string_literal: true
+require_relative "../molecules/terminal_scope_receipt"
+require_relative "maintenance_workspace_retirement"
+require "ace/runtime/molecules/execution_boot_baseline"
+require "ace/herdr/molecules/delivery_record_store"
 
 module Ace
   module Assign
     module Authority
       class LaunchLifecycle
+        # Original Installer preparation under its operator lock/inhibition.
+        # This is not a wire operation or a maintenance eligibility grant.
+        def prepare_execution_journals!(candidate_deployment:, initializer:)
+          if Thread.current[:ace_assign_maintenance_contexts]&.key?(object_id)
+            raise AttemptErrors::Conflict, "canonical preparation cannot run inside maintenance"
+          end
+          unless @deployment_history && @deployment_history.selects?(@deployment, selection: :original) &&
+              @deployment_history.selects?(candidate_deployment, selection: :candidate)
+            raise AttemptErrors::EvidenceUnavailable, "canonical preparation requires exact protected history"
+          end
+          raise AttemptErrors::EvidenceUnavailable, "canonical preparation child is unavailable" unless initializer.respond_to?(:call)
+          snapshots = {}
+          @deployment.maintenance_inventory(candidate_deployment).each do |id, owner, map|
+            project = owner.project(map.fetch("project_id"))
+            service = owner.authority(map.fetch("authority_id"))
+            identity = project.values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root")
+            verify_maintenance_root!(service.fetch("state_root"), service.fetch("uid"))
+            identity.values_at(0, 2).each { |root| verify_maintenance_root!(root, service.fetch("uid")) }
+            next if snapshots.key?(identity)
+            journal = maintenance_journal_for(owner, map)
+            unless [journal.repo_root, journal.ref, journal.checkout_root] == identity
+              raise AttemptErrors::EvidenceUnavailable, "canonical preparation journal differs from fixed descriptor"
+            end
+            # The original operator's fixed accepted-source child drops to
+            # this selected authority before all Ruby/Git mutation. Its reply
+            # is only a selector; independently read the configured journal.
+            value = initializer.call(mapping_id: id, descriptor_sha256: owner.artifact_reference.fetch("sha256"))
+            unless value.is_a?(String) && value.match?(/\A[0-9a-f]{40}\z/) && journal.ref_value == value
+              raise AttemptErrors::EvidenceUnavailable, "canonical preparation child reply differs from selected journal"
+            end
+            journal.verify_commit!(value)
+            journal.canonical_event_inventory!(commit: value)
+            raise AttemptErrors::EvidenceUnavailable, "canonical preparation journal changed" unless journal.ref_value == value
+            snapshots[identity.freeze] = value.dup.freeze
+          end
+          snapshots.freeze
+        end
+
         # Source-only maintenance entry. Transport stop/drain/inhibition belongs
         # to the trusted installer; this method supplies the exact same locks
         # and canonical owner query, without a live endpoint or another ledger.
-        def with_execution_slots(mapping_ids:, &block)
-          unless mapping_ids.is_a?(Array) && mapping_ids.size.between?(1, 64) && mapping_ids.uniq == mapping_ids
+        def with_execution_slots(mapping_ids:, candidate_deployment:, deadline: nil, &block)
+          maintenance_deadline!(deadline) unless deadline.nil?
+          if Thread.current[:ace_assign_maintenance_contexts]&.key?(object_id)
+            raise AttemptErrors::Conflict, "maintenance inventory cannot be entered recursively"
+          end
+          unless block && mapping_ids.is_a?(Array) && mapping_ids.size.between?(1, 256) && mapping_ids.uniq == mapping_ids
             raise ArgumentError, "fixed execution slot selections must be unique and bounded"
           end
-          maps = mapping_ids.map { |id| token!(id); [id, @deployment.mapping(id)] }
-            .sort_by { |_id, map| [map.fetch("authority_id"), map.fetch("execution_scope").fetch("slot_id")] }
+          mapping_ids.each { |id| token!(id) }
+          if @deployment_history && !@deployment_history.selects?(@deployment, selection: :original)
+            raise AttemptErrors::EvidenceUnavailable, "maintenance requires original protected transaction descriptor"
+          end
+          if @deployment_history && !@deployment_history.selects?(candidate_deployment, selection: :candidate)
+            raise AttemptErrors::EvidenceUnavailable, "maintenance candidate differs from protected history transaction"
+          end
+          inventory = @deployment.maintenance_inventory(candidate_deployment)
+          missing = mapping_ids - inventory.map(&:first)
+          raise ArgumentError, "maintenance mapping is unavailable" unless missing.empty?
+          # Installer publication cannot omit a removed or added fixed root.
+          changed = (@deployment.data.fetch("launch_mappings").keys | candidate_deployment.data.fetch("launch_mappings").keys).select do |id|
+            original = @deployment.data.fetch("launch_mappings")[id]
+            candidate = candidate_deployment.data.fetch("launch_mappings")[id]
+            original != candidate || (original && candidate &&
+              (@deployment.project(original.fetch("project_id")) != candidate_deployment.project(candidate.fetch("project_id")) ||
+               @deployment.authority(original.fetch("authority_id")) != candidate_deployment.authority(candidate.fetch("authority_id"))))
+          end
+          unless (changed - mapping_ids).empty?
+            raise ArgumentError, "maintenance selection omits changed original/candidate mappings"
+          end
+          selected = inventory.select { |id, _owner, _map| mapping_ids.include?(id) }
+          locks = selected.sort_by do |_id, owner, map|
+            [owner.authority(map.fetch("authority_id")).fetch("state_root"),
+              "execution-slot:#{map.fetch('execution_scope').fetch('slot_id')}"]
+          end
+          locks.each do |_id, owner, map|
+            service = owner.authority(map.fetch("authority_id"))
+            verify_maintenance_root!(service.fetch("state_root"), service.fetch("uid"))
+          end
           enter = lambda do |offset|
-            if offset < maps.size
-              with_slot(maps.fetch(offset).last) { enter.call(offset + 1) }
+            if offset < locks.size
+              _id, owner, map = locks.fetch(offset)
+              with_slot(map, deployment: owner, deadline: deadline) { enter.call(offset + 1) }
             else
-              @mutex.synchronize do
-                commits = {}
-                contexts = maps.map do |id, map|
-                  journal = journal_for(map)
-                  commit = commits.fetch(map.fetch("project_id")) { commits[map.fetch("project_id")] = journal.ref_value }
-                  {mapping_id: id.freeze, journal: journal, commit: commit&.freeze}.freeze
+              with_maintenance_mutex(deadline) do
+                active = Thread.current[:ace_assign_maintenance_contexts] ||= {}
+                raise AttemptErrors::Conflict, "maintenance inventory cannot be entered recursively" if active[object_id]
+                snapshots = {}
+                contexts = selected.map do |id, owner, map|
+                  project = owner.project(map.fetch("project_id"))
+                  identity = project.values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root")
+                  journal, commit = snapshots.fetch(identity) do
+                    service = owner.authority(map.fetch("authority_id"))
+                    identity.values_at(0, 2).each { |root| verify_maintenance_root!(root, service.fetch("uid")) }
+                    journal = maintenance_journal_for(owner, map)
+                    commit = journal.ref_value
+                    unless commit.is_a?(String) && commit.match?(/\A[0-9a-f]{40}\z/)
+                      raise AttemptErrors::EvidenceUnavailable, "maintenance canonical commit is unavailable"
+                    end
+                    unless [journal.repo_root, journal.ref, journal.checkout_root] == identity
+                      raise AttemptErrors::EvidenceUnavailable, "maintenance journal differs from fixed descriptor"
+                    end
+                    journal.verify_commit!(commit)
+                    journal.assignment_ids(commit: commit)
+                    snapshots[identity] = [journal, commit.dup.freeze]
+                  end
+                  {mapping_id: id.dup.freeze, journal: journal, commit: commit}.freeze
                 end.freeze
-                block.call(contexts)
+                active[object_id] = selected.zip(contexts).to_h { |entry, context| [context.fetch(:mapping_id), [entry, context]] }
+                begin
+                  with_maintenance_inbox_inventory(candidate_deployment, deadline: deadline) do
+                    maintenance_deadline!(deadline) unless deadline.nil?
+                    block.call(contexts)
+                  end
+                ensure
+                  active.delete(object_id)
+                end
               end
             end
           end
@@ -32,6 +132,12 @@ module Ace
         end
 
         def slot_reusable!(mapping_id:, journal:, commit:)
+          if Thread.current[:ace_assign_maintenance_contexts]&.key?(object_id)
+            require_maintenance_context!(mapping_id, journal, commit)
+            maintenance_slot_lineages!(mapping_id, journal, commit)
+            require_maintenance_context!(mapping_id, journal, commit)
+            return true
+          end
           map = @deployment.mapping(mapping_id)
           require_slot_snapshot!(map, journal, commit)
           ensure_slot_available!(map, journal, commit: commit)
@@ -39,9 +145,119 @@ module Ace
           true
         end
 
+        # Original proofs for the trusted maintenance consumer, never fresh
+        # pointer selection. Entries remain evidence after this block; only
+        # its held complete inventory grants a live maintenance operation.
+        # Empty history supplies no authority over an unknown host instance.
+        def maintenance_boot_baselines!(mapping_id:, journal:, commit:)
+          require_maintenance_context!(mapping_id, journal, commit)
+          contexts = Thread.current[:ace_assign_maintenance_contexts].fetch(object_id)
+          contexts.each_value { |_entry, context| slot_reusable!(**context) }
+          entries = maintenance_slot_lineages!(mapping_id, journal, commit).map do |lineage|
+            binding = lineage.binding
+            events = journal.read_events(binding.fetch("assignment_id"), commit: commit).select do |event|
+              event.fetch("attempt_id") == binding.fetch("attempt_id") && event["type"] == "scope_provisioning"
+            end
+            unless events.one?
+              raise AttemptErrors::EvidenceUnavailable, "maintenance original descriptor selection is ambiguous"
+            end
+            immutable_maintenance_projection(binding.slice("project_id", "mapping_id", "assignment_id", "attempt_id",
+              "scope_generation", "boot_id", "slot_id", "deployment_digest", "boot_baseline_selection",
+              "network_installation_selection", "network_namespace_identity").merge(
+                "descriptor_sha256" => events.first.fetch("payload").fetch("descriptor_sha256"),
+                "scope_binding_event_id" => lineage.binding_event.fetch("digest"), "proof_id" => lineage.proof_id,
+                "journal_commit" => commit, "baseline" => verify_historical_boot_baseline!(binding)))
+          end.freeze
+          contexts.each_value do |_entry, context|
+            require_maintenance_context!(context.fetch(:mapping_id), context.fetch(:journal), context.fetch(:commit))
+          end
+          entries
+        end
+
+        # A target observation is authoritative only inside the same complete
+        # held maintenance transaction. Historical owner/map selection comes
+        # from the original provisioning fact, never the current deployment.
+        def maintenance_workspace_target!(mapping_id:, journal:, commit:, assignment_id:, attempt_id:,
+          binding_event_digest:, release_event_digest:, descriptor_sha256:, source_commit: commit)
+          require_maintenance_context!(mapping_id, journal, commit)
+          contexts = Thread.current[:ace_assign_maintenance_contexts].fetch(object_id)
+          contexts.each_value { |_entry, context| slot_reusable!(**context) }
+          result = immutable_workspace_target_projection!(mapping_id: mapping_id, journal: journal, commit: commit,
+            assignment_id: assignment_id, attempt_id: attempt_id, binding_event_digest: binding_event_digest,
+            release_event_digest: release_event_digest, descriptor_sha256: descriptor_sha256, source_commit: source_commit)
+          contexts.each_value do |_entry, context|
+            require_maintenance_context!(context.fetch(:mapping_id), context.fetch(:journal), context.fetch(:commit))
+          end
+          result
+        rescue KeyError, TypeError, ArgumentError, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::EvidenceUnavailable, "maintenance workspace original identity is incomplete"
+        end
+
+        # This source capability exists only within the complete original and
+        # candidate maintenance exclusions. The fixed adapter already owns EX.
+        def with_workspace_retirement!(mapping_id:, journal:, commit:, target:, evidence_owner:, deadline:)
+          maintenance_deadline!(deadline)
+          selectors = retirement_target_selectors!(mapping_id, target)
+          projection = maintenance_workspace_target!(mapping_id: mapping_id, journal: journal, commit: commit, **selectors)
+          verify_retirement_target!(target, projection)
+          contexts = Thread.current[:ace_assign_maintenance_contexts].fetch(object_id)
+          session = MaintenanceWorkspaceRetirement::Session.open!(lifecycle: self, mapping_id: mapping_id,
+            journal: journal, commit: commit, target: target, projection: projection, evidence_owner: evidence_owner,
+            deadline: deadline, contexts: contexts)
+          yield session
+        ensure
+          session&.close!
+        end
+
+        def maintenance_workspace_readback!(mapping_id:, journal:, commit:, target:, evidence_owner:, deadline:)
+          maintenance_deadline!(deadline)
+          require_maintenance_context!(mapping_id, journal, commit)
+          projection = immutable_workspace_target_projection!(mapping_id: mapping_id, journal: journal, commit: commit,
+            **retirement_target_selectors!(mapping_id, target))
+          verify_retirement_target!(target, projection)
+          evidence_owner.with_retirement_evidence!(phase: "completed", target: target, projection: projection, deadline: deadline) do |evidence|
+            verify = -> {
+              maintenance_deadline!(deadline)
+              require_maintenance_context!(mapping_id, journal, commit)
+              unless evidence.is_a?(MaintenanceWorkspaceRetirement::Evidence)
+                raise AttemptErrors::EvidenceUnavailable, "retirement readback requires source-owned evidence"
+              end
+              evidence.verify!(owner: evidence_owner, target: target, projection: projection, phase: "completed", deadline: deadline)
+            }
+            evidence.with_consumption(verify) do
+              verify_retirement_contexts!(evidence: evidence, deadline: deadline)
+              result = yield projection, evidence
+              verify_retirement_contexts!(evidence: evidence, deadline: deadline)
+              result
+            end
+          ensure
+            evidence.expire! if evidence.is_a?(MaintenanceWorkspaceRetirement::Evidence)
+          end
+        end
+
         def retire_released_parent!(mapping_id:, journal:, commit:)
+          if (contexts = Thread.current[:ace_assign_maintenance_contexts]&.[](object_id))
+            # The method itself enforces the whole transaction preflight. A
+            # caller cannot validate one root then retire before checking others.
+            contexts.each_value { |_entry, context| slot_reusable!(**context) }
+            require_maintenance_context!(mapping_id, journal, commit)
+            _id, owner, _map = contexts.fetch(mapping_id).first
+            lineages = maintenance_slot_lineages!(mapping_id, journal, commit)
+            result = maintenance_scope_observer_for(owner, mapping_id).retire_released_parent!(lineages)
+            contexts.each_value { |_entry, context| require_maintenance_context!(context.fetch(:mapping_id), context.fetch(:journal), context.fetch(:commit)) }
+            return result
+          end
           slot_reusable!(mapping_id: mapping_id, journal: journal, commit: commit)
           map = @deployment.mapping(mapping_id)
+          if @deployment_history
+            protected = maintenance_journal_for(@deployment, map)
+            return with_maintenance_inbox_inventory(@deployment_history.candidate) do
+              lineages = maintenance_slot_lineages!(mapping_id, protected, commit, selected_context: [@deployment, map])
+              result = scope_observer_for(mapping_id).retire_released_parent!(lineages)
+              require_slot_snapshot!(map, journal, commit)
+              result
+            end
+          end
           slot = map.fetch("execution_scope").fetch("slot_id")
           lineages = journal.assignment_ids(commit: commit).flat_map do |assignment_id|
             journal.read_events(assignment_id, commit: commit).group_by { |event| event.fetch("attempt_id") }.filter_map do |attempt_id, events|
@@ -76,15 +292,413 @@ module Ace
 
         private
 
+        def retirement_target_selectors!(mapping_id, target)
+          unless target.is_a?(Hash) && target.keys.sort == MaintenanceWorkspaceRetirement::TARGET_FIELDS.sort &&
+              target["mapping_id"] == mapping_id
+            raise AttemptErrors::EvidenceUnavailable, "retirement target is not the exact closed original selection"
+          end
+          {assignment_id: target.fetch("assignment_id"), attempt_id: target.fetch("attempt_id"),
+            binding_event_digest: target.fetch("binding_event_digest"), release_event_digest: target.fetch("release_event_digest"),
+            descriptor_sha256: target.fetch("descriptor_sha256"), source_commit: target.fetch("journal_commit")}
+        end
+
+        def verify_retirement_target!(target, projection)
+          expected = projection.slice(*MaintenanceWorkspaceRetirement::TARGET_FIELDS).merge(
+            "resource" => "workspace:#{projection.fetch('project_id')}:#{projection.fetch('mapping_id')}:#{projection.fetch('assignment_id')}")
+          raise AttemptErrors::EvidenceUnavailable, "retirement target original identity differs" unless target == expected
+        end
+
+        def verify_retirement_contexts!(evidence:, deadline:)
+          contexts = Thread.current[:ace_assign_maintenance_contexts].fetch(object_id)
+          contexts.each_value do |_entry, context|
+            maintenance_deadline!(deadline)
+            require_maintenance_context!(context.fetch(:mapping_id), context.fetch(:journal), context.fetch(:commit))
+            snapshot = maintenance_slot_snapshot!(context.fetch(:mapping_id), context.fetch(:journal), context.fetch(:commit))
+            maintenance_scope_observer_for(snapshot.fetch(:owner), snapshot.fetch(:mapping_id)).verify_maintenance_closed!(
+              snapshot.fetch(:lineages), retirement: evidence)
+            require_maintenance_context!(context.fetch(:mapping_id), context.fetch(:journal), context.fetch(:commit))
+          end
+          maintenance_deadline!(deadline)
+        end
+
+        def with_maintenance_inbox_inventory(candidate, deadline: nil)
+          unless @deployment_history && @deployment_history.selects?(candidate, selection: :candidate)
+            # No history grant is silently synthesized for arbitrary descriptors.
+            return yield
+          end
+          require "ace/herdr/organisms/inbox"
+          roots = (@deployment_history.descriptors + [candidate]).flat_map do |owner|
+            owner.data.fetch("projects").values.flat_map do |project|
+              project.fetch("inbox_contexts", {}).values.map { |context| context.fetch("deliveries_dir") }
+            end
+          end.uniq.sort
+          roots.each { |root| verify_maintenance_inbox_root!(root) }
+          enter = lambda do |offset|
+            return yield if offset == roots.size
+            Ace::Herdr::Organisms::Inbox.with_retained_records(deliveries_dir: roots.fetch(offset), deadline: deadline) { enter.call(offset + 1) }
+          end
+          enter.call(0)
+        rescue Ace::Herdr::Molecules::DeliveryRecordStore::LockUnavailable
+          raise AttemptErrors::MaintenanceBusy, "maintenance retained Inbox exclusion is busy"
+        end
+
+        def with_maintenance_mutex(deadline)
+          return @mutex.synchronize { yield } if deadline.nil?
+          maintenance_deadline!(deadline)
+          unless @mutex.try_lock
+            raise AttemptErrors::MaintenanceBusy, "maintenance authority is busy"
+          end
+          begin
+            maintenance_deadline!(deadline)
+            yield
+          ensure
+            @mutex.unlock
+          end
+        end
+
+        def maintenance_deadline!(deadline)
+          unless (deadline.is_a?(Integer) || deadline.is_a?(Float)) && deadline.finite?
+            raise ArgumentError, "maintenance deadline must be finite"
+          end
+          if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+            raise AttemptErrors::MaintenanceBusy, "maintenance admission deadline expired"
+          end
+        end
+
+        def verify_maintenance_inbox_root!(root)
+          PrivateDirectory.verify!(root)
+          @deployment.send(:verify_inbox_acl!, root, private_leaf: true)
+          true
+        rescue AttemptErrors::ReceiptRejected, Ace::Runtime::RuntimeUnavailableError
+          raise AttemptErrors::EvidenceUnavailable, "maintenance retained inbox root is not protected"
+        end
+
+        # Canonical original facts only. This private projection cannot grant
+        # maintenance eligibility or replace current resource/closure checks.
+        def immutable_workspace_target_projection!(mapping_id:, journal:, commit:, assignment_id:, attempt_id:,
+          binding_event_digest:, release_event_digest:, descriptor_sha256:, source_commit:)
+          contexts = Thread.current[:ace_assign_maintenance_contexts].fetch(object_id)
+          journal.verify_canonical_prefix!(commit: source_commit, canonical_commit: commit)
+          matches = maintenance_slot_snapshot!(mapping_id, journal, source_commit).fetch(:lineages).select do |lineage|
+            lineage.binding.values_at("assignment_id", "attempt_id", "mapping_id") == [assignment_id, attempt_id, mapping_id] &&
+              lineage.binding_event.fetch("digest") == binding_event_digest
+          end
+          raise AttemptErrors::EvidenceUnavailable, "maintenance workspace lineage differs" unless matches.one?
+          lineage = matches.first
+          events = journal.read_events(assignment_id, commit: source_commit).select { |event| event.fetch("attempt_id") == attempt_id }
+          provisioning = events.select { |event| event["type"] == "scope_provisioning" }
+          releases = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
+          unless provisioning.one? && releases.one? && releases.first.fetch("digest") == release_event_digest &&
+              provisioning.first.dig("payload", "descriptor_sha256") == descriptor_sha256
+            raise AttemptErrors::EvidenceUnavailable, "maintenance workspace original selectors differ"
+          end
+          original = @deployment_history.descriptor!(sha256: descriptor_sha256)
+          map = original.mapping(lineage.binding.fetch("mapping_id"))
+          repository = map.fetch("workspace_repository_id")
+          cleanup_config = map.fetch("workspace_cleanup_config")
+          cwd = map.fetch("worker_cwd")
+          context_owner = contexts.fetch(mapping_id).first.fetch(1)
+          observer_owner = context_owner.artifact_reference.fetch("sha256") == descriptor_sha256 ? context_owner : original
+          observer = maintenance_scope_observer_for(observer_owner, lineage.binding.fetch("mapping_id"))
+          resource = observer.maintenance_workspace_resource!(lineage)
+          declarations = observer.maintenance_parent_resource_declarations!(lineage)
+          immutable_maintenance_projection(lineage.binding.slice("project_id", "mapping_id", "assignment_id", "attempt_id").merge(
+            "descriptor_sha256" => descriptor_sha256, "journal_commit" => source_commit,
+            "binding_event_digest" => binding_event_digest, "release_event_digest" => release_event_digest,
+            "proof_event_digest" => lineage.proof_event.fetch("digest"), "worker_cwd" => cwd,
+            "workspace_resource" => resource, "workspace_repository_id" => repository, "workspace_cleanup_config" => cleanup_config,
+            "workspace_exclusion" => observer.workspace_exclusion_projection!(lineage),
+            "parent_resource_declarations" => declarations, "resource_identities" => lineage.binding.fetch("resource_identities"),
+            "original_mapping_digest" => original.mapping_digest(lineage.binding.fetch("mapping_id"))))
+        end
+
+        def maintenance_scope_observer_for(owner, mapping_id)
+          return scope_observer_for(mapping_id) if owner.equal?(@deployment)
+          @maintenance_scope_observers ||= {}
+          key = [owner.artifact_reference.fetch("sha256"), mapping_id]
+          @maintenance_scope_observers[key] ||= ExecutionScopeObservation.new(mapping_id: mapping_id, deployment: owner, kernel: @kernel)
+        end
+
+        def maintenance_slot_lineages!(mapping_id, journal, commit, selected_context: nil)
+          snapshot = maintenance_slot_snapshot!(mapping_id, journal, commit, selected_context: selected_context)
+          maintenance_scope_observer_for(snapshot.fetch(:owner), snapshot.fetch(:mapping_id)).verify_maintenance_closed!(snapshot.fetch(:lineages))
+          snapshot.fetch(:lineages)
+        end
+
+        # Complete immutable history and settlement authentication, shared only
+        # by ordinary fresh eligibility and proof-bound retirement readback.
+        def maintenance_slot_snapshot!(mapping_id, journal, commit, selected_context: nil)
+          unless @deployment_history
+            raise AttemptErrors::EvidenceUnavailable, "complete original authentication requires retained deployment history"
+          end
+          unless journal.evidence_mode == :protected
+            raise AttemptErrors::EvidenceUnavailable, "maintenance requires original protected journal reader"
+          end
+          if selected_context
+            selected_owner, selected_map = selected_context
+            mapping_id = selected_owner.data.fetch("launch_mappings").find { |_id, fixed| fixed == selected_map }&.first
+            raise AttemptErrors::EvidenceUnavailable, "historical admission map is unavailable" unless mapping_id
+          else
+            _id, selected_owner, selected_map = Thread.current[:ace_assign_maintenance_contexts].fetch(object_id).fetch(mapping_id).first
+          end
+          lineages = []
+          retained_attempts = []
+          journal.assignment_ids(commit: commit).each do |assignment_id|
+            journal.read_events(assignment_id, commit: commit).group_by { |event| event.fetch("attempt_id") }.each do |attempt_id, events|
+              raise AttemptErrors::EvidenceUnavailable, "maintenance canonical chain corrupt" unless Models::EvidenceEvent.chain_valid?(events)
+              reservations = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
+              # A chain with effect work but no permanent reservation is never
+              # hidden behind the absence of an attributable slot selector.
+              if reservations.empty?
+                if events.any? { |event| %w[service_claim service_transition inbox_binding scope_provisioning].include?(event["type"]) }
+                  raise AttemptErrors::EvidenceUnavailable, "maintenance effect chain lacks reservation"
+                end
+                next
+              end
+              provisioning = events.select { |event| event["type"] == "scope_provisioning" }
+              unless reservations.one? && provisioning.one?
+                raise AttemptErrors::EvidenceUnavailable, "maintenance reservation identity ambiguous"
+              end
+              reservation = reservations.first.dig("payload", "data")
+              identity = provisioning.first.fetch("payload")
+              unless identity.is_a?(Hash) && identity.keys.sort == %w[deployment_digest descriptor_sha256 reservation_generation slot_id] &&
+                  identity["reservation_generation"] == reservation.fetch("reservation_generation")
+                raise AttemptErrors::EvidenceUnavailable, "maintenance provisioning selector differs"
+              end
+              original = @deployment_history.descriptor!(sha256: identity.fetch("descriptor_sha256"))
+              original_map = original.mapping(reservation.fetch("mapping_id"))
+              unless Digest::SHA256.hexdigest(JSON.generate(canonical(original_map))) == identity.fetch("deployment_digest") &&
+                  original_map.fetch("project_id") == reservation.fetch("project_id") &&
+                  original_map.fetch("execution_scope").fetch("slot_id") == identity.fetch("slot_id") &&
+                  original.project(original_map.fetch("project_id")).values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root") ==
+                    [journal.repo_root, journal.ref, journal.checkout_root]
+                raise AttemptErrors::EvidenceUnavailable, "original descriptor canonical association differs"
+              end
+              retained_attempts << [assignment_id, attempt_id, events, original, original_map]
+              next unless identity.fetch("slot_id") == selected_map.fetch("execution_scope").fetch("slot_id")
+              unless original.maintenance_association(original_map) == selected_owner.maintenance_association(selected_map)
+                raise AttemptErrors::EvidenceUnavailable, "original physical slot association differs"
+              end
+              lineage = maintenance_released_lineage!(journal, commit, assignment_id, attempt_id, events, original, original_map)
+              lineages << lineage
+            end
+          end
+          selected_attempts = retained_attempts.select { |entry| entry.last.fetch("execution_scope").fetch("slot_id") == selected_map.fetch("execution_scope").fetch("slot_id") }
+          maintenance_current_inventory!(journal, commit, selected_attempts, all_attempts: retained_attempts,
+            slot_filter: selected_map.fetch("execution_scope").fetch("slot_id"))
+          {owner: selected_owner, mapping_id: mapping_id, lineages: lineages.freeze}.freeze
+        rescue KeyError, TypeError, ArgumentError
+          raise AttemptErrors::EvidenceUnavailable, "maintenance original identity is incomplete"
+        end
+
+        # Only immutable Git introduction verification is shared within one
+        # held slot operation. Current records, keys, inventory, closure and
+        # canonical ref checks remain fresh on every eligibility query.
+        def historical_event_commit!(journal, assignment_id:, event_digest:, commit:)
+          memo = Thread.current[:ace_assign_history_operations]&.[](object_id)
+          held = Thread.current[:ace_assign_scope_exclusions]&.keys&.any? { |key| key.first == object_id }
+          unless memo && held && journal.evidence_mode == :protected
+            raise AttemptErrors::EvidenceUnavailable, "historical prefix requires its held protected operation"
+          end
+          identity = [journal.object_id, journal.repo_root, journal.ref, journal.checkout_root,
+            commit, assignment_id, event_digest].map { |value| value.is_a?(String) ? value.dup.freeze : value }.freeze
+          memo.fetch(identity) do
+            memo[identity] = journal.event_commit!(assignment_id: assignment_id, event_digest: event_digest, commit: commit).dup.freeze
+          end
+        end
+
+        # Immutable terminal authentication is also used by read-only inventory
+        # outside maintenance exclusions. Only a genuinely held operation may
+        # reuse its bounded memo; both paths use the same canonical Git owner.
+        def terminal_event_commit!(journal, assignment_id:, event_digest:, commit:)
+          memo = Thread.current[:ace_assign_history_operations]&.[](object_id)
+          held = Thread.current[:ace_assign_scope_exclusions]&.keys&.any? { |key| key.first == object_id }
+          if memo && held && journal.evidence_mode == :protected
+            historical_event_commit!(journal, assignment_id: assignment_id, event_digest: event_digest, commit: commit)
+          else
+            journal.event_commit!(assignment_id: assignment_id, event_digest: event_digest, commit: commit)
+          end
+        end
+
+        def immutable_maintenance_projection(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable_maintenance_projection(item)] }.freeze
+          when Array then value.map { |item| immutable_maintenance_projection(item) }.freeze
+          when String then value.dup.freeze
+          else value.freeze
+          end
+        end
+
+        def verify_historical_boot_baseline!(binding)
+          Ace::Runtime::Molecules::ExecutionBootBaseline.new.verify!(
+            selection: binding.fetch("boot_baseline_selection"),
+            expected: binding.slice("slot_id", "boot_id", "deployment_digest").merge(
+              "installer_artifact" => binding.fetch("network_installation_selection").fetch("installer_artifact")))
+        rescue Ace::Runtime::RuntimeUnavailableError, KeyError, TypeError, NoMethodError
+          raise AttemptErrors::EvidenceUnavailable, "historical original boot proof unavailable"
+        end
+
+        def maintenance_released_lineage!(journal, commit, assignment_id, attempt_id, events, original, map)
+          releases = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
+          raise AttemptErrors::EvidenceUnavailable, "maintenance reservation lacks unique release" unless releases.one?
+          release = releases.first
+          prefix_commit = historical_event_commit!(journal, assignment_id: assignment_id, event_digest: release.fetch("digest"), commit: commit)
+          verify_released_lineage_at_prefix!(journal, prefix_commit, assignment_id, attempt_id, events, original, map)
+        end
+
+        # The immutable release owner is shared by held maintenance and
+        # read-only discovery. Each caller obtains the introduction from the
+        # existing canonical Git owner; this method grants no maintenance lock.
+        def verify_released_lineage_at_prefix!(journal, prefix_commit, assignment_id, attempt_id, events, original, map, terminal_introduction: nil)
+          releases = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
+          raise AttemptErrors::EvidenceUnavailable, "reservation lacks unique release" unless releases.one?
+          release = releases.first
+          prefix = journal.read_events(assignment_id, commit: prefix_commit).select { |event| event["attempt_id"] == attempt_id }
+          unless prefix == events.take(events.index(release) + 1) && events.last == release
+            raise AttemptErrors::EvidenceUnavailable, "post-release canonical work or release prefix differs"
+          end
+          id = release.dig("payload", "data", "mapping_id")
+          lineage = Molecules::ExecutionScopeLineage.new(events: prefix, project_id: map.fetch("project_id"),
+            assignment_id: assignment_id, attempt_id: attempt_id, mapping_id: id)
+          unless lineage.binding && lineage.seal_event && lineage.proof_id
+            raise AttemptErrors::EvidenceUnavailable, "historical released parent lacks canonical closed proof"
+          end
+          verify_historical_boot_baseline!(lineage.binding)
+          lineage.require_positive!(scope_generation: lineage.binding.fetch("scope_generation"),
+            scope_binding_event_id: lineage.binding_event.fetch("digest"), seal_event_id: lineage.seal_event.fetch("digest"), proof_id: lineage.proof_id)
+          terminal = if prefix.any? { |event| event["type"] == "attempt_stopped" }
+            if terminal_introduction
+              verify_stopped_terminal_at_prefix!(prefix, journal, terminal_introduction, deployment: original)
+            else
+              terminal_scope_stopped!(prefix, journal, prefix_commit, deployment: original)
+            end
+          elsif prefix.any? { |event| event["type"] == "receipt_accepted" }
+            terminal_scope_receipt!(prefix, lineage, journal, prefix_commit, deployment: original)
+          else
+            guarded_scope_abort_receipt!(prefix, lineage, journal, prefix_commit)
+          end
+          expected = {"assignment_id" => assignment_id, "attempt_id" => attempt_id, "mapping_id" => id,
+            "scope_generation" => lineage.binding.fetch("scope_generation"), "scope_binding_event_id" => lineage.binding_event.fetch("digest"),
+            "proof_id" => lineage.proof_id, "terminal_event_id" => terminal.fetch("digest"), "reservation" => "released"}
+          data = release.dig("payload", "data")
+          unless data.is_a?(Hash) && data.except("generation") == expected && prefix.index(terminal) < prefix.index(release) &&
+              data["generation"] == journal.authority_generation(prefix) &&
+              lineage.binding.fetch("deployment_digest") == prefix.find { |event| event["type"] == "scope_provisioning" }.dig("payload", "deployment_digest")
+            raise AttemptErrors::EvidenceUnavailable, "historical release parent/terminal binding differs"
+          end
+          params = expected.slice("assignment_id", "attempt_id", "mapping_id")
+          service_events = prefix.any? { |event| %w[service_claim service_transition].include?(event["type"]) }
+          if !@result_owner && (service_events ||
+              journal.service_request_records(commit: prefix_commit).any? { |record| record.values_at("assignment_id", "attempt_id") == [assignment_id, attempt_id] })
+            raise AttemptErrors::EvidenceUnavailable, "historical settlement receipt owner unavailable"
+          end
+          if @result_owner
+            @result_owner.service_settlement_complete!(journal: journal, events: prefix, params: params, map: map, commit: prefix_commit)
+          end
+          lineage
+        end
+
+        def maintenance_current_inventory!(journal, commit, attempts, all_attempts: nil, slot_filter: nil)
+          indexed = attempts.to_h { |entry| [entry.values_at(0, 1), entry] }
+          raise AttemptErrors::EvidenceUnavailable, "maintenance attempt attribution conflicts" unless indexed.size == attempts.size
+          verified = {}
+          verify_attempt = lambda do |entry|
+            assignment_id, attempt_id, events, original, map = entry
+            verified[[assignment_id, attempt_id]] ||= maintenance_released_lineage!(journal, commit,
+              assignment_id, attempt_id, events, original, map)
+          end
+          journal.service_request_records(commit: commit).each do |record|
+            entry = indexed[record.values_at("assignment_id", "attempt_id")]
+            if !entry && all_attempts&.any? { |known| known.values_at(0, 1) == record.values_at("assignment_id", "attempt_id") &&
+                known.last.fetch("project_id") == record["project_id"] &&
+                known[2].find { |event| event.dig("payload", "operation") == "reserve_attempt" }.dig("payload", "data", "mapping_id") == record["mapping_id"] }
+              next
+            end
+            raise AttemptErrors::EvidenceUnavailable, "current service request is unregistered" unless entry
+            verify_attempt.call(entry)
+            unless record["project_id"] == entry.last.fetch("project_id") &&
+                record["mapping_id"] == entry[2].find { |event| event.dig("payload", "operation") == "reserve_attempt" }.dig("payload", "data", "mapping_id") &&
+                %w[succeeded failed-settled].include?(record["state"])
+              raise AttemptErrors::EvidenceUnavailable, "current service request is not historically settled"
+            end
+            journal.service_request(record.fetch("request_id"), commit: commit)
+            release = entry[2].find { |event| event.dig("payload", "operation") == "scope_reservation_release" }
+            prefix = historical_event_commit!(journal, assignment_id: entry.first, event_digest: release.fetch("digest"), commit: commit)
+            unless journal.service_request(record.fetch("request_id"), commit: prefix) == record
+              raise AttemptErrors::EvidenceUnavailable, "current service request changed after release"
+            end
+          end
+          require "ace/herdr/organisms/inbox"
+          registrations = attempts.flat_map do |entry|
+            entry[2].select { |event| event["type"] == "inbox_binding" }.map do |event|
+              fixed = entry[3].inbox_context(entry[2].find { |item| item.dig("payload", "operation") == "reserve_attempt" }.dig("payload", "data", "mapping_id"),
+                event.dig("payload", "inbox_context_id"))
+              [fixed.fetch("deliveries_dir"), event.dig("payload", "event_id"), entry, event]
+            end
+          end
+          unless registrations.map { |entry| entry.values_at(0, 1) }.uniq.size == registrations.size
+            raise AttemptErrors::EvidenceUnavailable, "current inbox identity attribution conflicts"
+          end
+          fixed_roots = @deployment_history.descriptors.flat_map do |owner|
+            owner.data.fetch("projects").values.select do |project|
+              project.values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root") == [journal.repo_root, journal.ref, journal.checkout_root]
+            end.flat_map do |project|
+              project.fetch("inbox_contexts", {}).values.filter_map do |context|
+                if all_attempts
+                  native = owner.mapping(context.fetch("native_mapping_id"))
+                  next unless slot_filter == native.fetch("execution_scope").fetch("slot_id")
+                end
+                context.fetch("deliveries_dir")
+              end
+            end
+          end.uniq
+          fixed_roots.each do |root|
+            unless Thread.current[:ace_herdr_retained_inventory_locks]&.key?(root)
+              raise AttemptErrors::EvidenceUnavailable, "current inbox inventory lifetime lock is unavailable"
+            end
+            records = Ace::Herdr::Organisms::Inbox.retained_records(deliveries_dir: root)
+            expected = registrations.select { |registration| registration.first == root }
+            unless records.map(&:event_id).sort == expected.map { |registration| registration[1] }.sort
+              raise AttemptErrors::EvidenceUnavailable, "current inbox retained registration set differs"
+            end
+            records.each do |record|
+              registration = expected.find { |entry| entry[1] == record.event_id }
+              entry, registered = registration.values_at(2, 3)
+              verify_attempt.call(entry)
+              public_identity = {"event_id" => record.event_id, "attempt_id" => record.inbox.fetch("attempt_id"),
+                "payload_sha256" => record.answer_digest}
+              unless public_identity == registered.dig("payload", "registration")
+                raise AttemptErrors::EvidenceUnavailable, "current retained inbox registration differs"
+              end
+              original = record.inbox.fetch("origin_target")
+              native = entry[2].find { |event| event["type"] == "scope_native_bound" }&.fetch("payload")
+              unless original.is_a?(Hash) && native && original["session"] == native.fetch("workspace_id")
+                raise AttemptErrors::EvidenceUnavailable, "current retained inbox original native identity differs"
+              end
+              child = entry[2].find { |event| event["type"] == "scope_child_bound" }&.dig("payload", "original_process_binding")
+              if child && original.values_at("session", "pane", "terminal_id") != child.values_at("session", "pane", "terminal_id")
+                raise AttemptErrors::EvidenceUnavailable, "current retained inbox original child identity differs"
+              end
+            end
+          end
+          true
+        rescue KeyError, TypeError, ArgumentError, JSON::ParserError, Ace::Herdr::Error
+          raise AttemptErrors::EvidenceUnavailable, "current retained inventory is unverifiable"
+        end
+
         def release_scope_reservation_held!(params, map, journal, peer, role, digest)
-            @mutex.synchronize do
+            result = @mutex.synchronize do
               current = journal.read_events(params.fetch("assignment_id")).select { |event| event["attempt_id"] == params.fetch("attempt_id") }
               scope_close_owner!(params, map, current, peer, role)
               journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
                 mutation_id: params.fetch("mutation_id"), operation: "scope_reservation_release", parameters_digest: digest,
                 expected_generation: params.fetch("expected_generation"), with_replay: true) do |events, commit, _generation|
                 lineage = scope_close_owner!(params, map, events, peer, role)
-                terminal = guarded_scope_abort_receipt!(events, lineage, journal, commit)
+                native_issuer_pending!(params, map)
+                if pending_prompt_issuers?(events, journal, commit)
+                  raise AttemptErrors::EvidenceUnavailable, "Original prompt issuer has unresolved native writes"
+                end
+                terminal = terminal_scope_receipt!(events, lineage, journal, commit)
                 scope_observer_for(params.fetch("mapping_id")).verify_closed!(lineage)
                 scope_settlement_complete!(journal: journal, events: events, params: params, map: map, commit: commit)
                 if events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
@@ -96,6 +710,11 @@ module Ace
                   "terminal_event_id" => terminal.fetch("digest"), "reservation" => "released"}}
               end
             end
+            # Wake the retained original launcher only after canonical release.
+            # Its EOF is not proof; the driver authenticates the status snapshot.
+            channel = @mutex.synchronize { @control_channels[steering_key(params, map)] }
+            channel&.close
+            result
         end
 
         # A crash after guarded abort must not strand a known-clean reservation.
@@ -116,13 +735,73 @@ module Ace
           release_scope_reservation_held!(params, map, journal, peer, role, digest)
         end
 
+        def verify_maintenance_root!(root, uid)
+          Ace::Runtime::Molecules::ProtectedSocket.root_path!(root, directory: true, owner: uid)
+          unless (File.stat(root).mode & 0o077).zero?
+            raise AttemptErrors::EvidenceUnavailable, "maintenance state root is not private"
+          end
+          true
+        rescue Ace::Runtime::RuntimeUnavailableError, SystemCallError
+          raise AttemptErrors::EvidenceUnavailable, "maintenance fixed state root is unavailable"
+        end
+
+        def maintenance_journal_for(owner, map)
+          project = owner.project(map.fetch("project_id"))
+          if owner.equal?(@deployment)
+            current = journal_for(map)
+            return current if current.evidence_mode == :protected
+          end
+          @maintenance_journals ||= {}
+          key = project.values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root")
+          @maintenance_journals[key] ||= begin
+            require_relative "service_evidence"
+            reader = nil
+            journal = Molecules::EvidenceJournal.new(repo_root: key[0], ref: key[1], checkout_root: key[2],
+              mode: :protected,
+              evidence_reader: ->(reference, record, state, pending) { reader.call(reference, record, state, pending) },
+              service_authorizer: ->(*) {
+                raise AttemptErrors::EvidenceUnavailable, "historical maintenance reader cannot mutate service records"
+              })
+            reader = ServiceEvidence.new(journal: journal)
+            journal
+          end
+        end
+
+        def require_maintenance_context!(mapping_id, journal, commit)
+          pair = Thread.current[:ace_assign_maintenance_contexts]&.dig(object_id, mapping_id)
+          unless pair && pair.last.fetch(:journal).equal?(journal) && pair.last.fetch(:commit) == commit
+            raise AttemptErrors::EvidenceUnavailable, "maintenance query requires its exact live inventory context"
+          end
+          _id, owner, map = pair.first
+          key = [object_id, owner.authority(map.fetch("authority_id")).fetch("state_root"),
+            "execution-slot:#{map.fetch('execution_scope').fetch('slot_id')}"]
+          unless Thread.current[:ace_assign_scope_exclusions]&.fetch(key, false)
+            raise AttemptErrors::EvidenceUnavailable, "maintenance slot exclusion is unavailable"
+          end
+          raise AttemptErrors::Conflict, "maintenance canonical ref changed" unless journal.ref_value == commit
+          true
+        end
+
         def require_slot_snapshot!(map, journal, commit)
-          key = [object_id, map.fetch("authority_id"), map.fetch("execution_scope").fetch("slot_id")]
+          key = [object_id, @deployment.authority(map.fetch("authority_id")).fetch("state_root"),
+            "execution-slot:#{map.fetch('execution_scope').fetch('slot_id')}"]
           unless Thread.current[:ace_assign_scope_exclusions]&.fetch(key, false) && journal.equal?(journal_for(map)) && journal.ref_value == commit
             raise AttemptErrors::EvidenceUnavailable, "slot query requires its held exclusion and exact current canonical ref"
           end
         end
 
+        def terminal_scope_receipt!(events, lineage, journal, commit, deployment: @deployment)
+          if events.any? { |event| event["type"] == "attempt_stopped" }
+            return terminal_scope_stopped!(events, journal, commit, deployment: deployment)
+          end
+          if events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "abort_launch" }
+            return guarded_scope_abort_receipt!(events, lineage, journal, commit)
+          end
+          reservation = events.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
+          mapping = deployment.mapping(reservation.fetch("payload").fetch("data").fetch("mapping_id"))
+          Molecules::TerminalScopeReceipt.verify!(events: events, lineage: lineage, journal: journal, commit: commit, mapping: mapping)
+        end
+
         def guarded_scope_abort_receipt!(events, lineage, journal, commit)
           aborts = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "abort_launch" }
           terminal = aborts.last
@@ -161,7 +840,7 @@ module Ace
           releases = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "scope_reservation_release" }
           return false if releases.empty?
           raise AttemptErrors::EvidenceUnavailable, "canonical reservation release is repeated" unless releases.size == 1
-          terminal = guarded_scope_abort_receipt!(events, lineage, journal, commit)
+          terminal = terminal_scope_receipt!(events, lineage, journal, commit)
           data = releases.first.dig("payload", "data")
           expected = {"assignment_id" => lineage.binding.fetch("assignment_id"), "attempt_id" => lineage.binding.fetch("attempt_id"),
             "mapping_id" => lineage.binding.fetch("mapping_id"), "scope_generation" => lineage.binding.fetch("scope_generation"),