@astrosheep/keiyaku 2.9.12 → 2.9.13

package/build/core/run-control/detached-lease-bootstrap.js

@@ -0,0 +1,208 @@
+import { launchDetachedProcess } from "./detached-process.js";
+import { terminateProcessGroup } from "./process-tree.js";
+import { acquireRunnerLeaseTransferTarget, observeRunnerLease, } from "./runner-lease.js";
+export const RUN_CONTROL_BOOTSTRAP_ENV = "KEIYAKU_RUN_CONTROL_BOOTSTRAP";
+function detail(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function send(child, message) {
+    return new Promise((resolve, reject) => {
+        if (!child.send || !child.connected)
+            return reject(new Error("bootstrap channel is unavailable"));
+        child.send(message, (error) => error ? reject(error) : resolve());
+    });
+}
+function waitForMessage(child, coordinate, expected, deadline, now, setTimer, clearTimer) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            child.off("message", onMessage);
+            child.off("error", onError);
+            child.off("exit", onExit);
+            clearTimer(timer);
+        };
+        const onMessage = (value) => {
+            const message = value;
+            if (message.coordinate !== coordinate || message.kind !== expected)
+                return;
+            cleanup();
+            resolve();
+        };
+        const onError = (error) => { cleanup(); reject(error); };
+        const onExit = () => onError(new Error("child exited during bootstrap"));
+        const remaining = deadline - now();
+        const timer = setTimer(() => onError(new Error(`bootstrap deadline passed before ${expected}`)), Math.max(0, remaining));
+        child.on("message", onMessage);
+        child.on("error", onError);
+        child.on("exit", onExit);
+    });
+}
+async function stop(child, prefix, terminate) {
+    try {
+        await terminate(child);
+        return { status: "failed", stage: "transfer", detail: prefix };
+    }
+    catch (error) {
+        return { status: "failed", stage: "cleanup", detail: `${prefix}; termination could not be verified: ${detail(error)}` };
+    }
+}
+export async function openDetachedLeaseBootstrap(input) {
+    const terminate = input.terminate ?? terminateProcessGroup;
+    const now = input.now ?? Date.now;
+    let child;
+    try {
+        child = launchDetachedProcess(input.launch, input.spawn);
+    }
+    catch (error) {
+        try {
+            input.parentLease.close();
+            return { status: "failed", stage: "spawn", detail: detail(error) };
+        }
+        catch (closeError) {
+            return { status: "failed", stage: "cleanup", detail: `${detail(error)}; parent lease release failed: ${detail(closeError)}` };
+        }
+    }
+    const ready = waitForMessage(child, input.coordinate, "transfer-ready", input.deadline, now, setTimeout, clearTimeout);
+    const acquired = waitForMessage(child, input.coordinate, "ownership-acquired", input.deadline, now, setTimeout, clearTimeout);
+    void acquired.catch(() => { });
+    try {
+        await ready;
+    }
+    catch (error) {
+        let failure = detail(error);
+        try {
+            input.parentLease.close();
+        }
+        catch (closeError) {
+            failure += `; parent lease release failed: ${detail(closeError)}`;
+        }
+        return stop(child, failure, terminate);
+    }
+    let decision;
+    let result;
+    return {
+        status: "ready",
+        bootstrap: {
+            child,
+            async authorize() {
+                if (decision === "reject")
+                    return { status: "failed", stage: "transfer", detail: "bootstrap was already rejected" };
+                if (decision)
+                    return result;
+                decision = "authorize";
+                result = (async () => {
+                    let transferFailure;
+                    let transferMayBeOwnedByChild = false;
+                    try {
+                        input.parentLease.releaseReservationForTransfer();
+                        await send(child, { kind: "promote", coordinate: input.coordinate });
+                        transferMayBeOwnedByChild = true;
+                        try {
+                            input.parentLease.close();
+                        }
+                        catch (error) {
+                            transferFailure = error;
+                        }
+                        try {
+                            await acquired;
+                        }
+                        catch (error) {
+                            transferFailure ??= error;
+                        }
+                        if (transferFailure && observeRunnerLease(input.leasePath).state !== "held")
+                            throw transferFailure;
+                        await send(child, { kind: "authorize", coordinate: input.coordinate });
+                        return { status: "authorized", child };
+                    }
+                    catch (error) {
+                        try {
+                            input.parentLease.close();
+                        }
+                        catch { /* cleanup detail is secondary to transfer failure */ }
+                        if (transferMayBeOwnedByChild && observeRunnerLease(input.leasePath).state === "held") {
+                            try {
+                                await send(child, { kind: "authorize", coordinate: input.coordinate });
+                            }
+                            catch { /* held lease already proves authority */ }
+                            return { status: "authorized", child };
+                        }
+                        return stop(child, detail(error), terminate);
+                    }
+                })();
+                return result;
+            },
+            async reject() {
+                if (decision === "authorize")
+                    return { status: "failed", stage: "transfer", detail: "bootstrap was already authorized" };
+                if (decision)
+                    return result;
+                decision = "reject";
+                result = (async () => {
+                    try {
+                        await send(child, { kind: "reject", coordinate: input.coordinate });
+                    }
+                    catch { /* termination proves rejection */ }
+                    let failure = "launch rejected";
+                    try {
+                        input.parentLease.close();
+                    }
+                    catch (error) {
+                        failure += `; parent lease release failed: ${detail(error)}`;
+                    }
+                    const stopped = await stop(child, failure, terminate);
+                    return stopped.stage === "cleanup" ? stopped : { status: "rejected" };
+                })();
+                return result;
+            },
+        },
+    };
+}
+function sendUpstream(message) {
+    return new Promise((resolve, reject) => {
+        if (!process.send || !process.connected)
+            return reject(new Error("bootstrap channel is unavailable"));
+        process.send(message, (error) => error ? reject(error) : resolve());
+    });
+}
+function receive(coordinate, expected) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            process.off("message", onMessage);
+            process.off("disconnect", onDisconnect);
+        };
+        const onDisconnect = () => { cleanup(); reject(new Error("bootstrap channel disconnected")); };
+        const onMessage = (value) => {
+            const message = value;
+            if (message.coordinate !== coordinate || (message.kind !== expected && message.kind !== "reject"))
+                return;
+            cleanup();
+            resolve(message);
+        };
+        process.on("message", onMessage);
+        process.on("disconnect", onDisconnect);
+    });
+}
+export async function receiveDetachedLease(input) {
+    if (process.env[RUN_CONTROL_BOOTSTRAP_ENV] !== "1")
+        throw new Error("process lacks bootstrap authority");
+    let target;
+    let lease;
+    try {
+        target = acquireRunnerLeaseTransferTarget(input.leasePath);
+        await sendUpstream({ kind: "transfer-ready", coordinate: input.coordinate });
+        if ((await receive(input.coordinate, "promote")).kind === "reject")
+            return { status: "rejected" };
+        lease = target.promote();
+        target = undefined;
+        await sendUpstream({ kind: "ownership-acquired", coordinate: input.coordinate });
+        if ((await receive(input.coordinate, "authorize")).kind === "reject")
+            return { status: "rejected" };
+        process.disconnect?.();
+        const owned = lease;
+        lease = undefined;
+        return { status: "authorized", lease: owned };
+    }
+    finally {
+        lease?.close();
+        target?.close();
+    }
+}

package/build/core/run-control/detached-process.js

@@ -0,0 +1,14 @@
+import { spawn as nodeSpawn } from "node:child_process";
+/** Launches a process in its own POSIX process group when the platform supports it. */
+export function launchDetachedProcess(input, spawnProcess = nodeSpawn) {
+    const child = spawnProcess(input.command, input.args, {
+        ...input.options,
+        detached: process.platform !== "win32",
+    });
+    if (child.pid === undefined) {
+        throw new Error("detached process did not expose a process id");
+    }
+    if (input.unref)
+        child.unref();
+    return child;
+}

package/build/core/run-control/index.js

@@ -0,0 +1,6 @@
+export { PROCESS_GROUP_KILL_GRACE_MS, ProcessTreeTerminationError, ownedProcessIdentity, ownedProcessIsLive, terminateOwnedProcess, terminateProcessGroup, } from "./process-tree.js";
+export { launchDetachedProcess, } from "./detached-process.js";
+export { openDetachedLeaseBootstrap, receiveDetachedLease, RUN_CONTROL_BOOTSTRAP_ENV, } from "./detached-lease-bootstrap.js";
+export { initializeRunnerLeaseDatabase, acquireRunnerLease, acquireRunnerLeaseTransferTarget, acquireRunnerLostProof, observeRunnerLease, RunnerLeaseUnavailableError, } from "./runner-lease.js";
+export { beginConnectionBoundRunnerClose, } from "./connection-bound-close.js";
+export { acquireSqliteProcessLifetimeLock, initializeSqliteProcessLifetimeLockDatabase, isSqliteProcessLifetimeLockContention, openSqliteProcessLifetimeLockTransaction, SqliteProcessLifetimeLockError, sqliteProcessLifetimeLockErrorDetail, } from "./sqlite-process-lifetime-lock.js";

package/build/core/{process-group.js → run-control/process-tree.js}

@@ -88,7 +88,7 @@ async function terminateIdentity(identity, options) {
         throw new Error(`owned process group ${identity.pid} remained after SIGKILL`);
     }
 }
-/** Terminate an orphaned runner identity retained by repository coordination. */
+/** Terminate an orphaned process identity retained by caller-owned coordination. */
 export async function terminateOwnedProcess(identity, options = {}) {
     try {
         await terminateIdentity(identity, {

package/build/core/run-control/runner-lease.js

@@ -0,0 +1,172 @@
+import { initializeSqliteProcessLifetimeLockDatabase, isSqliteProcessLifetimeLockContention, openSqliteProcessLifetimeLockTransaction, SqliteProcessLifetimeLockError, sqliteProcessLifetimeLockErrorDetail, } from "./sqlite-process-lifetime-lock.js";
+export class RunnerLeaseUnavailableError extends Error {
+    code = "RUNNER_LEASE_UNAVAILABLE";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "RunnerLeaseUnavailableError";
+    }
+}
+function errorDetail(error) {
+    return sqliteProcessLifetimeLockErrorDetail(error);
+}
+function isContention(error) {
+    return isSqliteProcessLifetimeLockContention(error)
+        || (error instanceof SqliteProcessLifetimeLockError && error.reason === "busy");
+}
+function openGuard(lockPath, busyTimeoutMs) {
+    return openSqliteProcessLifetimeLockTransaction({ path: lockPath, mode: "deferred", busyTimeoutMs });
+}
+function openReservation(lockPath, busyTimeoutMs) {
+    return openSqliteProcessLifetimeLockTransaction({ path: lockPath, mode: "immediate", busyTimeoutMs });
+}
+function closeTransaction(transaction) {
+    try {
+        transaction.close();
+    }
+    catch (error) {
+        return error;
+    }
+}
+function createHeldLock(lockPath, busyTimeoutMs, guard, initialReservation) {
+    let closed = false;
+    let reservation = initialReservation;
+    return {
+        releaseReservationForTransfer() {
+            if (closed || reservation === undefined)
+                return;
+            const released = reservation;
+            reservation = undefined;
+            const failure = closeTransaction(released);
+            if (failure !== undefined)
+                throw new RunnerLeaseUnavailableError(`runner lease reservation release failed: ${errorDetail(failure)}`, { cause: failure });
+        },
+        reclaimReservation() {
+            if (closed || reservation !== undefined)
+                return;
+            try {
+                reservation = openReservation(lockPath, busyTimeoutMs);
+            }
+            catch (error) {
+                throw new RunnerLeaseUnavailableError(`runner lease reservation reclaim failed: ${errorDetail(error)}`, { cause: error });
+            }
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            let failure;
+            if (reservation !== undefined)
+                failure = closeTransaction(reservation);
+            failure ??= closeTransaction(guard);
+            if (failure !== undefined)
+                throw new RunnerLeaseUnavailableError(`runner lease release failed: ${errorDetail(failure)}`, { cause: failure });
+        },
+    };
+}
+function unavailable(operation, error) {
+    return new RunnerLeaseUnavailableError(`${operation}: ${errorDetail(error)}`, { cause: error });
+}
+export function initializeRunnerLeaseDatabase(leasePath) {
+    try {
+        return initializeSqliteProcessLifetimeLockDatabase(leasePath);
+    }
+    catch (error) {
+        throw unavailable("runner lease database could not be initialized", error);
+    }
+}
+export function acquireRunnerLease(lockPath, busyTimeoutMs = 0) {
+    let guard;
+    try {
+        guard = openGuard(lockPath, busyTimeoutMs);
+    }
+    catch (error) {
+        throw unavailable("runner lease database could not be opened", error);
+    }
+    try {
+        return createHeldLock(lockPath, busyTimeoutMs, guard, openReservation(lockPath, busyTimeoutMs));
+    }
+    catch (error) {
+        closeTransaction(guard);
+        if (isContention(error))
+            throw new RunnerLeaseUnavailableError("runner lease is already held", { cause: error });
+        throw unavailable("runner lease acquisition failed", error);
+    }
+}
+export function acquireRunnerLeaseTransferTarget(lockPath, busyTimeoutMs = 0) {
+    let guard;
+    try {
+        guard = openGuard(lockPath, busyTimeoutMs);
+    }
+    catch (error) {
+        throw unavailable("runner lease transfer acquisition failed", error);
+    }
+    let closed = false;
+    return {
+        promote() {
+            if (closed)
+                throw new RunnerLeaseUnavailableError("runner lease transfer target is closed");
+            try {
+                const reservation = openReservation(lockPath, busyTimeoutMs);
+                closed = true;
+                return createHeldLock(lockPath, busyTimeoutMs, guard, reservation);
+            }
+            catch (error) {
+                throw unavailable("runner lease transfer promotion failed", error);
+            }
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            const failure = closeTransaction(guard);
+            if (failure !== undefined)
+                throw unavailable("runner lease transfer release failed", failure);
+        },
+    };
+}
+export function acquireRunnerLostProof(lockPath, busyTimeoutMs = 0) {
+    let transaction;
+    try {
+        transaction = openSqliteProcessLifetimeLockTransaction({ path: lockPath, mode: "exclusive", busyTimeoutMs });
+    }
+    catch (error) {
+        if (isContention(error))
+            throw new RunnerLeaseUnavailableError("runner lease is already held", { cause: error });
+        throw unavailable("runner lost proof acquisition failed", error);
+    }
+    let closed = false;
+    return {
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            const failure = closeTransaction(transaction);
+            if (failure !== undefined)
+                throw unavailable("runner lost proof release failed", failure);
+        },
+    };
+}
+/** Positive death probe without creating a missing lock database. */
+export function observeRunnerLease(lockPath) {
+    let probe;
+    try {
+        probe = openSqliteProcessLifetimeLockTransaction({ path: lockPath, mode: "exclusive", busyTimeoutMs: 0 });
+        return { state: "released" };
+    }
+    catch (error) {
+        if (isContention(error))
+            return { state: "held" };
+        const detail = errorDetail(error);
+        return {
+            state: "unknown",
+            reason: detail.includes("rollback-journal") ? "unsupported-journal-mode" : "probe-failed",
+            detail,
+        };
+    }
+    finally {
+        try {
+            probe?.close();
+        }
+        catch { /* no probe cleanup result is death evidence */ }
+    }
+}

package/build/core/{sqlite-process-lifetime-lock.js → run-control/sqlite-process-lifetime-lock.js}

@@ -1,7 +1,6 @@
 import * as fs from "node:fs";
 import { DatabaseSync } from "node:sqlite";
 const SQLITE_BUSY = 5;
-const SUPPORTED_PLATFORMS = new Set(["darwin", "linux", "win32"]);
 export class SqliteProcessLifetimeLockError extends Error {
     reason;
     code = "SQLITE_PROCESS_LIFETIME_LOCK_UNAVAILABLE";
@@ -11,16 +10,6 @@ export class SqliteProcessLifetimeLockError extends Error {
         this.name = "SqliteProcessLifetimeLockError";
     }
 }
-export class SqliteProcessLifetimeLockUnsupportedError extends Error {
-    code = "SQLITE_PROCESS_LIFETIME_LOCK_UNSUPPORTED";
-    constructor(platform) {
-        super(`SQLite process-lifetime locks are unsupported on platform '${platform}'`);
-        this.name = "SqliteProcessLifetimeLockUnsupportedError";
-    }
-}
-export function isSqliteProcessLifetimeLockPlatformSupported(platform = process.platform) {
-    return SUPPORTED_PLATFORMS.has(platform);
-}
 export function sqliteProcessLifetimeLockErrorDetail(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -35,11 +24,6 @@ export function isSqliteProcessLifetimeLockContention(error) {
     return errcode === SQLITE_BUSY || code === "ERR_SQLITE_BUSY" || code === "ERR_SQLITE_LOCKED"
         || message.includes("database is locked") || message.includes("database is busy");
 }
-function assertPlatform(platform) {
-    if (!isSqliteProcessLifetimeLockPlatformSupported(platform)) {
-        throw new SqliteProcessLifetimeLockUnsupportedError(platform);
-    }
-}
 function assertBusyTimeout(busyTimeoutMs) {
     if (!Number.isSafeInteger(busyTimeoutMs) || busyTimeoutMs < 0) {
         throw new SqliteProcessLifetimeLockError("SQLite process-lifetime lock busy timeout must be a non-negative safe integer", "invalid");
@@ -69,7 +53,7 @@ function closeTransaction(database) {
     return failure;
 }
 function throwLockError(prefix, error) {
-    if (error instanceof SqliteProcessLifetimeLockError || error instanceof SqliteProcessLifetimeLockUnsupportedError)
+    if (error instanceof SqliteProcessLifetimeLockError)
         throw error;
     if (isSqliteProcessLifetimeLockContention(error)) {
         throw new SqliteProcessLifetimeLockError(`${prefix} is already held`, "busy", { cause: error });
@@ -78,10 +62,9 @@ function throwLockError(prefix, error) {
 }
 /**
  * Creates only a rollback-journal schema anchor. The empty database persists no
- * ownership facts; an open transaction is the complete ownership signal.
+ * ownership facts; an open transaction is the complete physical ownership signal.
  */
-export function initializeSqliteProcessLifetimeLockDatabase(lockPath, platform = process.platform) {
-    assertPlatform(platform);
+export function initializeSqliteProcessLifetimeLockDatabase(lockPath) {
     let database;
     try {
         database = new DatabaseSync(lockPath);
@@ -105,9 +88,7 @@ export function initializeSqliteProcessLifetimeLockDatabase(lockPath, platform =
     return lockPath;
 }
 export function openSqliteProcessLifetimeLockTransaction(input) {
-    const platform = input.platform ?? process.platform;
     const busyTimeoutMs = input.busyTimeoutMs ?? 0;
-    assertPlatform(platform);
     assertBusyTimeout(busyTimeoutMs);
     if (!input.create) {
         try {
@@ -130,7 +111,7 @@ export function openSqliteProcessLifetimeLockTransaction(input) {
             database.exec("CREATE TABLE IF NOT EXISTS lock_anchor (singleton INTEGER PRIMARY KEY CHECK (singleton = 1))");
         }
         database.exec(`BEGIN ${input.mode.toUpperCase()}`);
-        // A DEFERRED transaction becomes the projection guard only after this read
+        // A DEFERRED transaction becomes a process-lifetime guard only after this read
         // acquires its SHARED lock. Keep this inside every transaction mode.
         assertSchema(database);
         if (journalMode(database) !== "delete") {
@@ -182,7 +163,6 @@ export async function acquireSqliteProcessLifetimeLock(input) {
                 mode: "immediate",
                 busyTimeoutMs: 0,
                 create: true,
-                platform: input.platform,
             });
         }
         catch (error) {

package/build/core/seal.js

@@ -1,4 +1,5 @@
 import { FlowError } from "../flow-error.js";
+import { requireCommitCoordinate } from "../git/commits.js";
 import { createGit, parseRevListOutput, wrapGitError } from "../git/core.js";
 import { effectiveScope } from "./lifecycle-history.js";
 import { scopePathEvidence, } from "./scope.js";
@@ -42,13 +43,7 @@ export async function receiptsAfterFence(cwd, entries, head = "HEAD") {
     return revList(cwd, getFence(entries), await resolveCommit(cwd, head));
 }
 async function resolveCommit(cwd, revision) {
-    const git = createGit(cwd);
-    try {
-        return (await git.raw(["rev-parse", "--verify", `${revision}^{commit}`])).trim();
-    }
-    catch (error) {
-        throw wrapGitError(`rev-parse ${revision}`, error, cwd);
-    }
+    return (await requireCommitCoordinate(cwd, revision)).commit;
 }
 async function revList(cwd, from, to) {
     const git = createGit(cwd);
@@ -120,15 +115,18 @@ async function auditScope(cwd, entries, paths) {
         ...await scopeViolations(cwd, paths, scope),
         ...taskNamespaceViolations(paths, findBind(entries).data.scope),
     ].filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
-    if (scopeViolationEvidence.length > 0) {
-        throw new ScopeAuditError(findBind(entries).contract, scope, scopeViolationEvidence);
-    }
     const violations = scopeViolationEvidence.map((violation) => violation.path);
     return {
         scopeAudit: { violations },
         scopeViolationEvidence,
     };
 }
+function admitScope(contract, scope, capture, policy) {
+    if (policy === "refuse" && capture.scopeViolationEvidence.length > 0) {
+        throw new ScopeAuditError(contract, scope, capture.scopeViolationEvidence);
+    }
+    return capture;
+}
 export class ScopeAuditError extends FlowError {
     scopeViolationEvidence;
     constructor(_contractId, scope, evidence) {
@@ -155,7 +153,7 @@ function currentFoldedSealArc(model) {
     return model.seal === null ? model.intent.arc : null;
 }
 /** Current-read admission capture: scope and fence come only from the folded model. */
-export async function captureFoldedSeal(cwd, model, head = "HEAD", scopeAppend = []) {
+export async function captureFoldedSeal(cwd, model, head = "HEAD", scopeAppend = [], scopePolicy) {
     const arc = currentFoldedSealArc(model);
     if (arc === null)
         return null;
@@ -168,14 +166,18 @@ export async function captureFoldedSeal(cwd, model, head = "HEAD", scopeAppend =
     ]);
     const effectiveScope = [...model.effectiveScope, ...scopeAppend];
     const bind = model.history.find((row) => row.entry.kind === "bind")?.entry;
-    const scopeViolationEvidence = [
-        ...await scopeViolations(cwd, paths, effectiveScope),
-        ...taskNamespaceViolations(paths, bind?.kind === "bind" ? bind.data.scope : []),
-    ].filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
-    if (scopeViolationEvidence.length > 0) {
-        throw new ScopeAuditError(model.contract, effectiveScope, scopeViolationEvidence);
+    const ordinaryViolations = await scopeViolations(cwd, paths, effectiveScope);
+    const namespaceViolations = taskNamespaceViolations(paths, bind?.kind === "bind" ? bind.data.scope : []);
+    if (namespaceViolations.length > 0) {
+        throw new ScopeAuditError(model.contract, effectiveScope, namespaceViolations);
     }
-    return { arc, oldFence, newFence, receipts, diffstat: stat, scopeAudit: { violations: [] }, scopeViolationEvidence };
+    const scopeViolationEvidence = ordinaryViolations
+        .filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
+    const scopeAudit = admitScope(model.contract, effectiveScope, {
+        scopeAudit: { violations: scopeViolationEvidence.map((violation) => violation.path) },
+        scopeViolationEvidence,
+    }, scopePolicy);
+    return { arc, oldFence, newFence, receipts, diffstat: stat, ...scopeAudit };
 }
 /** Current seal intent: open explicit arc, else derived a0 while no explicit arc has ever existed. */
 export function currentSealArc(entries) {
@@ -219,7 +221,14 @@ export async function previewSeal(cwd, entries, head = "HEAD") {
     };
 }
 export async function captureSeal(cwd, entries, head = "HEAD") {
-    return (await previewSeal(cwd, entries, head)).capture;
+    const preview = await previewSeal(cwd, entries, head);
+    if (!preview.capture)
+        return null;
+    admitScope("direct seal", effectiveScope(entries), {
+        scopeAudit: preview.capture.scopeAudit,
+        scopeViolationEvidence: preview.capture.scopeViolationEvidence,
+    }, "refuse");
+    return preview.capture;
 }
 /** Folded renew capture: preserve receipt hashes while auditing rebased delivery content. */
 export async function captureFoldedRenewSeal(input) {
@@ -239,21 +248,24 @@ export async function captureFoldedRenewSeal(input) {
     ]);
     const scope = [...input.effectiveScope, ...input.pendingScopeOverlay];
     const bindScope = await acceptedBindScope(input.cwd, input.contract);
-    const scopeViolationEvidence = [
-        ...await scopeViolations(input.cwd, paths, scope),
-        ...taskNamespaceViolations(paths, bindScope),
-    ].filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
-    if (scopeViolationEvidence.length > 0) {
-        throw new ScopeAuditError(input.contract, scope, scopeViolationEvidence);
+    const ordinaryViolations = await scopeViolations(input.cwd, paths, scope);
+    const namespaceViolations = taskNamespaceViolations(paths, bindScope);
+    if (namespaceViolations.length > 0) {
+        throw new ScopeAuditError(input.contract, scope, namespaceViolations);
     }
+    const scopeViolationEvidence = ordinaryViolations
+        .filter((row, index, all) => all.findIndex((candidate) => candidate.path === row.path) === index);
+    const scopeAudit = admitScope(input.contract, scope, {
+        scopeAudit: { violations: scopeViolationEvidence.map((violation) => violation.path) },
+        scopeViolationEvidence,
+    }, input.scopePolicy);
     return {
         arc,
         oldFence,
         newFence: receiptHead,
         receipts,
         diffstat: stat,
-        scopeAudit: { violations: [] },
-        scopeViolationEvidence,
+        ...scopeAudit,
     };
 }
 export async function sealCurrentArc(input) {
@@ -301,7 +313,7 @@ export async function sealCurrentArc(input) {
         prepare: async (admission) => {
             if (admission.business.existing)
                 return { capture: admission.business.existing.capture, existing: { transactionObjectId: admission.business.existing.transactionObjectId } };
-            return { capture: input.capture ?? await captureFoldedSeal(admission.business.targetRoot, admission.business.lifecycle, "HEAD") };
+            return { capture: input.capture ?? await captureFoldedSeal(admission.business.targetRoot, admission.business.lifecycle, "HEAD", [], "refuse") };
         },
         revalidate: ({ session, prepared }) => {
             assertOperable(input.contractId, session.lifecycle);
@@ -319,7 +331,7 @@ export async function sealCurrentArc(input) {
         effect: async ({ context, prepared }) => {
             const capture = prepared.capture;
             if (!capture)
-                return { kind: "refused-before-effects", authoritativeHead: context.session.lifecycle.observedLedgerHead, refusal: { code: "NO_OPEN_ARC", message: "no current arc requires sealing" } };
+                return { kind: "refused-before-effects", authoritativeHead: context.session.pins.repositoryLedgerHead, refusal: { code: "NO_OPEN_ARC", message: "no current arc requires sealing" } };
             const at = new Date(input.nowMs).toISOString();
             {
                 const { scopeViolationEvidence: _scopeViolationEvidence, ...durableCapture } = capture;
@@ -333,11 +345,11 @@ export async function sealCurrentArc(input) {
                 };
                 const result = prepared.existing
                     ? await context.replayCommitted({ transactionObjectId: prepared.existing.transactionObjectId })
-                    : await context.publishAuthoritative({ verb: "seal", admittedLedgerHead: context.session.lifecycle.observedLedgerHead, acceptedLifecycleTail: context.session.lifecycle.history.at(-1).objectId, entries: [entry] });
+                    : await context.publishAuthoritative({ verb: "seal", admittedLedgerHead: context.session.pins.repositoryLedgerHead, acceptedLifecycleTail: context.session.lifecycle.contractHead, entries: [entry] });
                 if (result.status === "indeterminate")
-                    return { kind: "precommit-effects-only", authoritativeHead: result.currentHead ?? context.session.lifecycle.observedLedgerHead };
+                    return { kind: "precommit-effects-only", authoritativeHead: result.currentHead ?? context.session.pins.repositoryLedgerHead };
                 if (result.status !== "committed")
-                    return { kind: "refused-before-effects", authoritativeHead: result.currentHead ?? context.session.lifecycle.observedLedgerHead, refusal: { code: "LEDGER_CAS_CONFLICT", message: `contract ${input.contractId} changed while sealing` } };
+                    return { kind: "refused-before-effects", authoritativeHead: result.currentHead ?? context.session.pins.repositoryLedgerHead, refusal: { code: "LEDGER_CAS_CONFLICT", message: `contract ${input.contractId} changed while sealing` } };
                 return { kind: "committed", commit: result, entryKind: "seal", value: {
                         ...capture,
                         sealedBy: input.sealedBy,