ace-assign 0.69.0 → 0.71.0

data/lib/ace/assign/molecules/canonical_read_commands.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module Molecules
+      # Closed bounded read dialect shared by isolated protected snapshots and
+      # trusted installed journals. Neither boundary can dispatch a Git write.
+      module CanonicalReadCommands
+        BYTE_LIMIT = 256 * 1_048_576
+        OID = /\A[0-9a-f]{40}\z/
+
+        attr_reader :commit
+
+        # EvidenceJournal uses this only as its existing read command boundary.
+        def call(argv, stdin_data: "", output_limit: BYTE_LIMIT)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless read_command?(argv, stdin_data)
+            refuse!("write_or_unsupported_command")
+          end
+          result = read_result(argv, stdin_data: stdin_data, limit: [output_limit, BYTE_LIMIT].min)
+          [result.stdout.to_s.strip, result.stderr.to_s.strip, result.status]
+        end
+
+        def blob_batch(entries, output_limit:)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless entries.is_a?(Array) && entries.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
+            refuse!("unsupported_command")
+          end
+          result = run!(["cat-file", "--batch"], stdin_data: entries.join("\n") + "\n",
+            limit: [output_limit, BYTE_LIMIT].min)
+          result.stdout.to_s.b
+        end
+
+        def history_diff(commits, paths, output_limit:)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless commits.is_a?(Array) && commits.size.between?(1, 64) && commits.uniq.size == commits.size &&
+              commits.all? { |commit| commit.is_a?(String) && commit.match?(OID) } &&
+              paths.is_a?(Array) && !paths.empty? && paths.uniq.size == paths.size &&
+              (paths == ["execution/"] || paths.all? { |path| path.is_a?(String) && path.match?(%r{\Aexecution/[a-zA-Z0-9_.:-]+/events/\z}) }) &&
+              output_limit.is_a?(Integer) && output_limit.positive?
+            refuse!("unsupported_command")
+          end
+          result = run!(%w[diff-tree --stdin --always --root -r --raw -z --no-renames --no-ext-diff
+            --no-textconv --no-abbrev --] + paths, stdin_data: commits.join("\n") + "\n",
+            limit: [output_limit, BYTE_LIMIT].min)
+          result.stdout.to_s.b
+        end
+
+        def blob_sizes(oids)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless oids.is_a?(Array) && oids.size.between?(1, 64) && oids.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
+            refuse!("unsupported_command")
+          end
+          run!(%w[cat-file --batch-check], stdin_data: oids.join("\n") + "\n", limit: oids.size * 128).stdout.to_s.b
+        end
+
+        def blob(path, commit:, max_bytes:)
+          refuse!("read_outside_snapshot") unless @view && @commit
+          unless commit.is_a?(String) && commit.match?(OID) && max_bytes.is_a?(Integer) && max_bytes.positive?
+            refuse!("unsupported_command")
+          end
+          result = run!(["cat-file", "blob", "#{commit}:#{path}"], limit: [max_bytes, BYTE_LIMIT].min)
+          result.stdout.to_s.b
+        end
+
+        private
+
+        def read_result(argv, **options)
+          run!(argv, **options)
+        end
+
+        def read_command?(argv, stdin)
+          return false unless argv.is_a?(Array) && argv.all? { |item| item.is_a?(String) && !item.include?("\0") } && stdin.empty?
+          allowed = {"rev-parse" => %w[--verify --quiet --git-dir], "cat-file" => %w[-t -s blob],
+            "rev-list" => %w[--first-parent --parents], "ls-tree" => %w[-r -l -d --name-only --],
+            "show" => [], "log" => %w[--diff-filter=A -1 --format=%H --]}
+          flags = allowed[argv.first]
+          flags && argv.drop(1).all? { |item| !item.start_with?("-") || flags.include?(item) || item == "--max-count=100001" }
+        end
+
+      end
+    end
+  end
+end

data/lib/ace/assign/molecules/canonical_read_snapshot.rb

@@ -5,6 +5,7 @@ require "fileutils"
 require "tmpdir"
 require "ace/herdr/molecules/bounded_process"
 require_relative "evidence_journal"
+require_relative "canonical_read_commands"
 require_relative "../authority/private_directory"
 
 module Ace
@@ -13,6 +14,7 @@ module Ace
       # Isolates read-only Git from an installed authority's live configuration.
       # The copied view never publishes evidence or mutates the source journal.
       class CanonicalReadSnapshot
+        include CanonicalReadCommands
         class Unavailable < AttemptErrors::EvidenceUnavailable; end
         BYTE_LIMIT = 256 * 1_048_576
         ENTRY_LIMIT = 4096
@@ -94,60 +96,6 @@ module Ace
         end
         private :with_snapshot
 
-        attr_reader :commit
-
-        # EvidenceJournal uses this only as its existing read command boundary.
-        def call(argv, stdin_data: "", output_limit: BYTE_LIMIT)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless read_command?(argv, stdin_data)
-            refuse!("write_or_unsupported_command")
-          end
-          result = run!(argv, stdin_data: stdin_data, limit: [output_limit, BYTE_LIMIT].min)
-          [result.stdout.to_s.strip, result.stderr.to_s.strip, result.status]
-        end
-
-        def blob_batch(entries, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless entries.is_a?(Array) && entries.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "--batch"], stdin_data: entries.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def history_diff(commits, paths, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commits.is_a?(Array) && commits.size.between?(1, 64) && commits.uniq.size == commits.size &&
-              commits.all? { |commit| commit.is_a?(String) && commit.match?(OID) } &&
-              paths.is_a?(Array) && !paths.empty? && paths.uniq.size == paths.size &&
-              (paths == ["execution/"] || paths.all? { |path| path.is_a?(String) && path.match?(%r{\Aexecution/[a-zA-Z0-9_.:-]+/events/\z}) }) &&
-              output_limit.is_a?(Integer) && output_limit.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(%w[diff-tree --stdin --always --root -r --raw -z --no-renames --no-ext-diff
-            --no-textconv --no-abbrev --] + paths, stdin_data: commits.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def blob_sizes(oids)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless oids.is_a?(Array) && oids.size.between?(1, 64) && oids.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          run!(%w[cat-file --batch-check], stdin_data: oids.join("\n") + "\n", limit: oids.size * 128).stdout.to_s.b
-        end
-
-        def blob(path, commit:, max_bytes:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commit.is_a?(String) && commit.match?(OID) && max_bytes.is_a?(Integer) && max_bytes.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "blob", "#{commit}:#{path}"], limit: [max_bytes, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
         private
 
         def refuse!(reason)
@@ -352,15 +300,6 @@ module Ace
           File.binwrite(ref, "#{@commit}\n")
         end
 
-        def read_command?(argv, stdin)
-          return false unless argv.is_a?(Array) && argv.all? { |item| item.is_a?(String) && !item.include?("\0") } && stdin.empty?
-          allowed = {"rev-parse" => %w[--verify --quiet --git-dir], "cat-file" => %w[-t -s blob],
-            "rev-list" => %w[--first-parent --parents], "ls-tree" => %w[-r -l -d --name-only --],
-            "show" => [], "log" => %w[--diff-filter=A -1 --format=%H --]}
-          flags = allowed[argv.first]
-          flags && argv.drop(1).all? { |item| !item.start_with?("-") || flags.include?(item) || item == "--max-count=100001" }
-        end
-
         def run!(argv, stdin_data: "", limit:)
           result = Herdr::Molecules::BoundedProcess.call([@git, "--git-dir=#{@view}", "--no-pager", *argv],
             environment: ENVIRONMENT, chdir: @view, stdin_data: stdin_data,

data/lib/ace/assign/molecules/evidence_journal.rb

@@ -7,6 +7,7 @@ require_relative "../atoms/fixed_merge_schemas"
 require "digest"
 require "fileutils"
 require "json"
+require_relative "../atoms/git_blob_batch"
 require "open3"
 require "pathname"
 require "ace/herdr/molecules/bounded_process"
@@ -62,6 +63,7 @@ module Ace
         def initialize(repo_root:, ref: nil, checkout_root: nil, mode: :local,
           evidence_reader: nil, service_authorizer: nil, read_boundary: nil)
           unless %i[local protected].include?(mode) &&
+              (evidence_reader.nil? || evidence_reader.respond_to?(:call)) &&
               (mode != :protected || [evidence_reader, service_authorizer].all? { |owner| owner.respond_to?(:call) })
             raise ArgumentError, "protected journal requires source-owned evidence and service boundaries"
           end
@@ -128,7 +130,7 @@ module Ace
             paths.each do |path|
               parts = path.split("/", -1)
               event = parts.size == 4 && parts[0] == "execution" && parts[2] == "events" && JournalMutation::ID.match?(parts[1]) && parts[3].end_with?(".json")
-              request = parts.size == 3 && parts[0, 2] == %w[execution requests] && parts[2].end_with?(".json") && JournalMutation::ID.match?(parts[2].delete_suffix(".json"))
+              request = parts.size == 3 && [%w[execution requests], %w[execution merge-requests]].include?(parts[0, 2]) && parts[2].end_with?(".json") && JournalMutation::ID.match?(parts[2].delete_suffix(".json"))
               # Definitions, prepared packets, candidate bundles and imports
               # retain the SAME mutation owner's closed immutable blob dialect.
               validate_blob_path!(path) unless event || request
@@ -138,6 +140,12 @@ module Ace
             unless records.map { |record| record.fetch("request_id") }.sort == expected_requests
               raise AttemptErrors::EvidenceUnavailable, "canonical initialization service inventory differs"
             end
+            fixed_records = fixed_merge_request_records(commit: value)
+            expected_fixed = paths.select { |path| path.start_with?("execution/merge-requests/") }.map { |path| File.basename(path, ".json") }.sort
+            unless fixed_records.map { |record| record.fetch("request_id") }.sort == expected_fixed
+              raise AttemptErrors::EvidenceUnavailable, "canonical initialization fixed merge inventory differs"
+            end
+            fixed_records.each { |record| verify_fixed_record!(record, commit: value) }
             current = File.stat(@repo_root)
             unless !File.symlink?(@repo_root) && [current.dev, current.ino, current.uid, current.gid, current.mode] == identity && ref_value == value
               raise AttemptErrors::EvidenceUnavailable, "canonical initialization selection changed"
@@ -201,6 +209,21 @@ module Ace
           event_commits_for_assignments!(selectors: {assignment_id => event_digests}, commit: commit).fetch(assignment_id)
         end
 
+        # Cross-attempt projections use canonical publication order, never the
+        # wall-clock timestamps of independently chained attempts. Exactly one
+        # selected event must have been introduced by the latest relevant CAS.
+        def latest_event!(assignment_id:, event_digests:, commit:)
+          introductions = event_commits!(assignment_id: assignment_id, event_digests: event_digests, commit: commit)
+          introduced_commits = introductions.values.to_h { |value| [value, true] }
+          node = canonical_history_nodes!(commit).find { |entry| introduced_commits.key?(entry.first) }
+          selected = node && introductions.select { |_digest, introduced| introduced == node.first }.keys
+          unless selected&.one?
+            raise AttemptErrors::EvidenceUnavailable, "latest canonical event is missing or ambiguous"
+          end
+          read_events(assignment_id, commit: commit).find { |event| event.fetch("digest") == selected.first } ||
+            raise(AttemptErrors::EvidenceUnavailable, "latest canonical event is unavailable")
+        end
+
         # One immutable walk for an operation selecting several assignments.
         # Every selected assignment retains its complete chain and exact raw
         # blob proof; the result is returned, never cached on this owner.
@@ -353,13 +376,10 @@ module Ace
           else
             bounded_history_read!(%w[cat-file --batch-check], oids.join("\n") + "\n", oids.size * 128)
           end
-          lines = raw.lines
-          raise AttemptErrors::EvidenceUnavailable, "historical blob metadata count differs" unless lines.size == oids.size
-          lines.zip(oids).map do |line, oid|
-            match = /\A([0-9a-f]{40}) blob (0|[1-9][0-9]*)\n\z/.match(line)
-            raise AttemptErrors::EvidenceUnavailable, "historical blob metadata differs" unless match && match[1] == oid
-            match[2].to_i
-          end
+          Atoms::GitBlobBatch.sizes(oids, raw)
+        rescue Atoms::GitBlobBatch::Invalid => error
+          message = error.reason == :count ? "historical blob metadata count differs" : "historical blob metadata differs"
+          raise AttemptErrors::EvidenceUnavailable, message
         end
 
         def bounded_history_read!(argv, stdin, limit)
@@ -760,7 +780,9 @@ module Ace
           %w[succeeded failed failed-settled].include?(state)
         end
 
-        def validate_terminal_receipt!(current, state, receipt, pending: nil)
+        # Shared schema/binding checks; storage interpretation belongs to the
+        # caller's source-selected evidence owner, not this pure validator.
+        def validate_terminal_receipt_structure!(current, state, receipt)
           unless receipt.is_a?(Hash) && receipt.keys.sort == TERMINAL_RECEIPT_FIELDS.sort
             raise AttemptErrors::ReceiptRejected,
               "Service terminal receipt has invalid fields"
@@ -787,7 +809,14 @@ module Ace
             raise AttemptErrors::ReceiptRejected,
               "Service settlement requires a no-effect attestation artifact"
           end
-          if @mode == :protected
+          evidence_items
+        end
+
+        def validate_terminal_receipt!(current, state, receipt, pending: nil)
+          evidence_items = validate_terminal_receipt_structure!(current, state, receipt)
+          # Canonical byte ownership is also usable by the ordinary installed
+          # service. It does not opt that service into protected authority.
+          if @evidence_reader
             if (current["operation"] == "prune-preserved-workspace" && %w[succeeded failed-settled].include?(state)) ||
                 (current["operation"] == "publish" && %w[succeeded failed].include?(state))
               # The same installed evidence reader owns the entire imported
@@ -922,6 +951,9 @@ module Ace
         def authorization_conflict(binding)
           authorization = binding["authorization"]
           return nil unless authorization.is_a?(String) && !authorization.empty?
+          if authorization.start_with?("proposal-")
+            return proposal_claim_conflict(authorization, request_id: binding.fetch("request_id"), fixed: false)
+          end
           service_request_records.find do |other|
             next false if other["request_id"] == binding.fetch("request_id")
             next false if other["state"] == "rejected" && other["consumed"] == false
@@ -994,8 +1026,8 @@ module Ace
         #
         # @param assignment_id [String] Assignment ID
         # @return [Array<Models::Attempt>] Derived attempts
-        def derived_attempts(assignment_id)
-          events = read_events(assignment_id)
+        def derived_attempts(assignment_id, commit: ref_value)
+          events = read_events(assignment_id, commit: commit)
           by_attempt = events.group_by { |event| event["attempt_id"] }
           by_attempt.delete(nil)
 
@@ -1006,7 +1038,7 @@ module Ace
             state = derive_state(attempt_events)
             next if state.nil?
 
-            build_attempt(assignment_id, attempt_id, intent["payload"], attempt_events, state)
+            build_attempt(assignment_id, attempt_id, intent["payload"], attempt_events, state, commit: commit)
           end
         end
 
@@ -1052,26 +1084,11 @@ module Ace
         end
 
         def decode_event_blobs!(entries, output)
-          output = output.b
-          offset = 0
-          entries.map do |oid, size|
-            ending = output.index("\n", offset)
-            unless ending && ending - offset <= 127 && output.byteslice(offset, ending - offset) == "#{oid} blob #{size}"
-              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch header is invalid"
-            end
-            offset = ending + 1
-            content = output.byteslice(offset, size)
-            unless content&.bytesize == size && output.byteslice(offset + size, 1) == "\n" &&
-                Digest::SHA1.hexdigest("blob #{size}\0" + content) == oid
-              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch bytes are invalid"
-            end
-            offset += size + 1
-            content
-          end.tap do
-            unless offset == output.bytesize
-              raise AttemptErrors::EvidenceUnavailable, "canonical blob batch has unexpected trailing bytes"
-            end
-          end
+          Atoms::GitBlobBatch.decode(entries, output)
+        rescue Atoms::GitBlobBatch::Invalid => error
+          message = {header: "canonical blob batch header is invalid", bytes: "canonical blob batch bytes are invalid",
+            trailing: "canonical blob batch has unexpected trailing bytes"}.fetch(error.reason, "canonical blob batch selector is invalid")
+          raise AttemptErrors::EvidenceUnavailable, message
         end
 
         def update_service_request(request_id, expected:, replacement:, event_type:, guard: nil)
@@ -1271,7 +1288,7 @@ module Ace
         # opaque reference is receiver-issued, never caller-supplied, and
         # replays return the originally issued one.
         FIXED_MERGE_BINDING_FIELDS = %w[request_id project_id assignment_id attempt_id
-          queue_entry operation authorization input_digest request principal receiver_id
+          queue_entry operation authorization input_digest request principal caller_uid receiver_id
           configuration_sha256 execution_identity].freeze
         FIXED_MERGE_MUTABLE_FIELDS = %w[state receipt reference recorded_at claimed_at finished_at].freeze
 
@@ -1324,25 +1341,27 @@ module Ace
 
         # Claim the start of the fixed effect: pending -> uncertain in one
         # CAS transition, so a receiver restart can never dispatch a second
-        # merge for the same admitted record — begin replays as already
-        # started, and only the owning effect may later settle it.
-        def begin_fixed_merge_request(request_id)
+        # merge for the same admitted record. An already-started claim refuses;
+        # only the winning effect may later settle it.
+        def begin_fixed_merge_request(request_id, guard: nil)
           current = fixed_merge_request(request_id)
           raise AttemptErrors::NotFound, "Fixed merge request #{request_id} not found" unless current
-          return current if current["state"] == "uncertain"
+          if current["state"] == "uncertain"
+            raise AttemptErrors::InvalidState, "Fixed merge request #{request_id} was already started"
+          end
           unless current["state"] == "pending"
             raise AttemptErrors::InvalidState, "Fixed merge request #{request_id} is terminal"
           end
           update_fixed_merge_request(request_id, expected: current,
             replacement: current.merge("state" => "uncertain", "claimed_at" => Time.now.utc.iso8601(9)),
-            event_type: "merge_transition")
+            event_type: "merge_transition", guard: -> { guard&.call; verify_fixed_proposal!(current) })
         end
 
         # Terminal settlement: succeeded/failed with the exact receipt
         # validated HERE at the journal boundary — structure, the closed
         # terminal invariants, and the binding against the current record.
         # Failure is terminal only with immutable no-effect evidence.
-        def settle_fixed_merge_request(request_id, terminal_status:, receipt:)
+        def settle_fixed_merge_request(request_id, terminal_status:, receipt:, attestation: nil)
           unless FIXED_MERGE_STATES.include?(terminal_status) && %w[succeeded failed].include?(terminal_status)
             raise ArgumentError, "invalid fixed merge terminal status"
           end
@@ -1351,17 +1370,40 @@ module Ace
           unless %w[pending uncertain].include?(current["state"])
             raise AttemptErrors::InvalidState, "Fixed merge request #{request_id} is terminal"
           end
+          evidence_files = {}
+          if terminal_status == "failed"
+            unless attestation.is_a?(Hash) &&
+                attestation.values_at("request_id", "input_digest", "reference", "outcome") ==
+                  current.values_at("request_id", "input_digest", "reference") + ["no_effect"] &&
+                attestation["candidate_head"] == current.dig("request", "candidate_head") &&
+                attestation["expected_base_head"] == current.dig("request", "expected_base_head")
+              raise AttemptErrors::ReceiptRejected, "Fixed merge no_effect_evidence requires a bound canonical attestation"
+            end
+            content = JSON.generate(attestation)
+            raise AttemptErrors::ReceiptRejected, "Fixed merge attestation exceeds bound" if content.bytesize > 16_384
+            path = fixed_no_effect_path(request_id)
+            evidence_files[path] = content
+            receipt = receipt.merge("effect" => receipt.fetch("effect").merge(
+              "no_effect_evidence" => {"reference" => path, "sha256" => Digest::SHA256.hexdigest(content)}))
+          elsif attestation
+            raise AttemptErrors::ReceiptRejected, "Successful merge cannot carry no-effect attestation"
+          end
           validate_fixed_receipt!(current, terminal_status, receipt)
           update_fixed_merge_request(request_id, expected: current,
             replacement: current.merge("state" => terminal_status, "receipt" => receipt,
               "finished_at" => Time.now.utc.iso8601(9)),
-            event_type: "merge_transition")
+            event_type: "merge_transition", evidence_files: evidence_files)
         end
 
         def fixed_merge_request_path(request_id)
           "execution/merge-requests/#{request_id}.json"
         end
 
+        def fixed_no_effect_path(request_id)
+          validate_request_id!(request_id)
+          "execution/merge-evidence/#{request_id}.json"
+        end
+
         def validate_fixed_receipt!(current, terminal_status, receipt)
           Atoms::FixedMergeSchemas.validate_receipt!(receipt)
           Atoms::FixedMergeSchemas.validate_receipt_against!(receipt, current)
@@ -1388,25 +1430,39 @@ module Ace
           end
         end
 
-        def fixed_no_effect_intact?(record)
+        def fixed_no_effect_intact?(record, commit: ref_value)
           receipt = record["receipt"]
           return false unless receipt.is_a?(Hash)
           evidence = receipt.dig("effect", "no_effect_evidence")
           return false unless evidence.is_a?(Hash)
-          repo_root = File.realpath(@repo_root)
-          path = File.expand_path(evidence["reference"].to_s, repo_root)
-          real = begin
-            File.realpath(path)
-          rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-            return false
-          end
-          real.start_with?(repo_root + File::SEPARATOR) &&
-            Digest::SHA256.file(real).hexdigest == evidence.fetch("sha256")
-        rescue Errno::ENOENT, AttemptErrors::EvidenceUnavailable
+          path = fixed_no_effect_path(record.fetch("request_id"))
+          return false unless evidence["reference"] == path
+          content = bounded_blob(path, commit: commit, max_bytes: 16_384)
+          proof = JSON.parse(content)
+          Digest::SHA256.hexdigest(content) == evidence["sha256"] &&
+            proof.values_at("request_id", "input_digest", "reference", "outcome") == record.values_at("request_id", "input_digest", "reference") + ["no_effect"] &&
+            proof["candidate_head"] == record.dig("request", "candidate_head") && proof["expected_base_head"] == record.dig("request", "expected_base_head")
+        rescue AttemptErrors::EvidenceUnavailable, JSON::ParserError, NoMethodError
           false
         end
 
-        def update_fixed_merge_request(request_id, expected:, replacement:, event_type:, guard: nil)
+        # Immutable terminal consumption for ordinary completion. It uses the
+        # same receipt and no-effect owners as admission/authorization release.
+        def fixed_merge_settlement!(request_id, commit: ref_value)
+          record = fixed_merge_request(request_id, commit: commit)
+          raise AttemptErrors::EvidenceUnavailable, "canonical fixed merge is missing" unless record
+          verify_fixed_record!(record, commit: commit)
+          unless %w[succeeded failed].include?(record["state"])
+            raise AttemptErrors::ServiceSettlementPending, "canonical fixed merge is unresolved"
+          end
+          validate_fixed_receipt!(record, record.fetch("state"), record.fetch("receipt"))
+          if record["state"] == "failed" && !fixed_no_effect_intact?(record, commit: commit)
+            raise AttemptErrors::EvidenceUnavailable, "canonical fixed merge no-effect proof differs"
+          end
+          record
+        end
+
+        def update_fixed_merge_request(request_id, expected:, replacement:, event_type:, guard: nil, evidence_files: {})
           unless %w[merge_admission merge_transition].include?(event_type)
             raise ArgumentError, "invalid fixed merge event type"
           end
@@ -1419,10 +1475,8 @@ module Ace
               prepared = prepare_fixed_update(request_id: request_id, expected: expected,
                 replacement: replacement, event_type: event_type, guard: guard)
               return prepared.fetch(:record) if prepared[:replayed]
+              write_mutation_blobs(evidence_files, commit: old)
               path = fixed_merge_request_path(request_id)
-              full = File.join(checkout_dir, path)
-              FileUtils.mkdir_p(File.dirname(full))
-              File.write(full, JSON.pretty_generate(prepared.fetch(:record)))
               assignment_id = replacement.fetch("assignment_id")
               attempt_id = replacement.fetch("attempt_id")
               prior = read_events(assignment_id).reverse
@@ -1430,7 +1484,8 @@ module Ace
               event = Models::EvidenceEvent.build(type: event_type, attempt_id: attempt_id,
                 payload: prepared.fetch(:event).fetch(:payload), previous_digest: prior)
               write_event_files(assignment_id, [event])
-              git!("-C", checkout_dir, "add", "--", path, "execution/#{assignment_id}/events")
+              git!("-C", checkout_dir, "add", "--", "execution/#{assignment_id}/events")
+              stage_mutation_blobs(evidence_files.merge(path => JSON.pretty_generate(prepared.fetch(:record))))
               state = replacement.fetch("state")
               git!("-C", checkout_dir, "-c", "user.name=ace-assign", "-c", "user.email=ace-assign@localhost",
                 "commit", "-m", "evidence: fixed merge request #{request_id} #{state}")
@@ -1455,7 +1510,11 @@ module Ace
               raise AttemptErrors::InvalidState, "Fixed merge request needs an initial admission"
             end
             if existing
-              return {record: existing, replayed: true} if fixed_replay?(existing, replacement)
+              if fixed_replay?(existing, replacement)
+                conflict = guard&.call
+                raise_authorization_conflict!(conflict) if conflict
+                return {record: existing, replayed: true}
+              end
               raise AttemptErrors::Conflict, "Fixed merge request #{request_id} has different input"
             end
             unless Molecules::FixedEffectReference.valid?(replacement.fetch("reference"))
@@ -1477,6 +1536,13 @@ module Ace
           end
           conflict = guard&.call
           raise_authorization_conflict!(conflict) if conflict
+          if expected.nil? || replacement["state"] == "uncertain"
+            attempt = derived_attempts(replacement.fetch("assignment_id")).find { |item| item.attempt_id == replacement.fetch("attempt_id") }
+            unless attempt&.managed? && attempt.active? && attempt.binding.project_id == replacement.fetch("project_id")
+              raise AttemptErrors::ReceiptRejected, "Fixed merge admission requires its current active canonical attempt"
+            end
+          end
+          verify_fixed_proposal!(replacement) if event_type == "merge_admission"
           payload = {"request_id" => request_id, "state" => replacement.fetch("state"),
                      "input_digest" => replacement.fetch("input_digest"),
                      "record_digest" => Atoms::EvidenceDigest.digest(replacement),
@@ -1485,6 +1551,21 @@ module Ace
         end
         private :prepare_fixed_update
 
+        def verify_fixed_proposal!(record)
+          return unless record.fetch("authorization").start_with?("proposal-")
+          proposal_authorize!(record.fetch("authorization"), fixed_proposal_binding(record))
+          conflict = proposal_claim_conflict(record.fetch("authorization"),
+            request_id: record.fetch("request_id"), fixed: true)
+          raise AttemptErrors::AuthorizationConflict, "Proposal already holds an effect claim" if conflict
+          nil
+        end
+
+        def fixed_proposal_binding(record)
+          record.slice("operation", "project_id", "assignment_id", "attempt_id", "input_digest", "caller_uid").merge(
+            "target" => {"resource" => record.fetch("request").fetch("pr_url"), "artifact_digest" => nil},
+            "candidate_head" => record.fetch("request").fetch("candidate_head"))
+        end
+
         def fixed_replay?(existing, replacement)
           FIXED_MERGE_BINDING_FIELDS.all? do |field|
             existing[field] == replacement.fetch(field)
@@ -1514,7 +1595,8 @@ module Ace
         # The module marks a private region above; the fixed merge primitive
         # is a public coordinator-facing surface, so it is re-published here.
         public :fixed_merge_request, :fixed_merge_request_records, :admit_fixed_merge_request,
-          :begin_fixed_merge_request, :settle_fixed_merge_request, :fixed_authorization_conflict
+          :begin_fixed_merge_request, :settle_fixed_merge_request, :fixed_authorization_conflict, :fixed_merge_settlement!,
+          :verify_service_attestation!
 
         # Latest lifecycle state implied by the events, or nil when the
         # events do not describe a full attempt (intent missing).
@@ -1522,7 +1604,7 @@ module Ace
           CanonicalAttemptState.derive(events)
         end
 
-        def build_attempt(assignment_id, attempt_id, intent_payload, events, state)
+        def build_attempt(assignment_id, attempt_id, intent_payload, events, state, commit: ref_value)
           process_start = events.reverse.find do |event|
             event["type"] == "process_start" && event["attempt_id"] == attempt_id
           end
@@ -1552,7 +1634,7 @@ module Ace
             binding: binding,
             state: state,
             candidate_head: candidate_head,
-            journal_commit: ref_value
+            journal_commit: commit
           )
         end
 
@@ -1658,7 +1740,7 @@ module Ace
           File.join(@checkout_root, ".evidence.lock")
         end
 
-        def with_lock(cleanup_on_failure: true, owner_uid: nil, owner_gid: nil)
+        def with_lock(cleanup_on_failure: true, owner_uid: nil, owner_gid: nil, deadline: nil)
           raise AttemptErrors::EvidenceUnavailable, "read-only journal cannot mutate canonical evidence" if @read_boundary
           FileUtils.mkdir_p(@checkout_root)
           lock = if owner_uid
@@ -1667,7 +1749,19 @@ module Ace
             File.open(lock_path, File::RDWR | File::CREAT, 0o600)
           end
           begin
-            lock.flock(File::LOCK_EX)
+            if deadline
+              unless deadline.is_a?(Numeric) && deadline.finite?
+                raise ArgumentError, "canonical lock deadline must be finite"
+              end
+              loop do
+                remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+                raise AttemptErrors::Conflict, "canonical journal lock deadline elapsed" unless remaining.positive?
+                break if lock.flock(File::LOCK_EX | File::LOCK_NB)
+                sleep [remaining, 0.01].min
+              end
+            else
+              lock.flock(File::LOCK_EX)
+            end
             begin
               yield
             rescue