@astrosheep/keiyaku 2.9.2 → 2.9.4

package/build/core/{petition-forfeit.js → settlement/petition-forfeit.js}

@@ -1,5 +1,5 @@
-import { forfeitContract } from "./forfeit.js";
-import { readContractLog } from "./log.js";
+import { forfeitContract } from "../forfeit.js";
+import { readContractLog } from "../log.js";
 function maxArc(entries) {
     return entries.filter((entry) => entry.kind === "arc").length;
 }

package/build/core/{petition-head-guard.js → settlement/petition-head-guard.js}

@@ -1,5 +1,5 @@
-import { FlowError } from "../flow-error.js";
-import { getLatestCommitHash } from "../git/staging.js";
+import { FlowError } from "../../flow-error.js";
+import { getLatestCommitHash } from "../../git/staging.js";
 const CONCURRENT_MODIFICATION_CODE = "CONCURRENT_MODIFICATION";
 export async function assertHeadUnchanged(cwd, expectedHead, operation) {
     const currentHead = await getLatestCommitHash(cwd);

package/build/core/settlement/petition-io.js

@@ -0,0 +1 @@
+export {};

package/build/core/{petition-preview.js → settlement/petition-preview.js}

@@ -1,6 +1,6 @@
 import { createOathGate } from "./petition-claim-gates.js";
 import { assertPetitionArcReady, assertPetitionFresh, assertPetitionable, loadPetitionPreflightContext, } from "./petition.js";
-import { petitionSealSource, previewSeal } from "./seal.js";
+import { petitionSealSource, previewSeal } from "../seal.js";
 export const PETITION_PREVIEW_GATE_NAMES = [
     "contract",
     "freshness",

package/build/core/{petition.js → settlement/petition.js}

@@ -1,12 +1,13 @@
-import { FlowError } from "../flow-error.js";
-import { createGit, errorContainsAnyPattern, MISSING_HEAD_PATTERNS, wrapGitError } from "../git/core.js";
-import { parseCommandMarkdown } from "./command-io.js";
-import { activeLedgerRef, appendWithRetry, readLedger } from "./ledger.js";
+import { FlowError } from "../../flow-error.js";
+import { createGit, errorContainsAnyPattern, MISSING_HEAD_PATTERNS, wrapGitError } from "../../git/core.js";
+import { parseCommandMarkdown } from "../command-markdown.js";
+import { activeLedgerRef, appendWithRetry, readLedger } from "../ledger.js";
 import { allocateSettlementSeat, queueMembership, readQueueReadModel } from "./queue.js";
-import { findOpenArc, getMaxArc, receiptsAfterFence, sealCurrentArc } from "./seal.js";
-import { deriveContractState } from "./status/lifecycle.js";
-import { commissionTarget, latestBase } from "./status/drift.js";
-import { findContractWorktreePath } from "./worktree-path.js";
+import { findOpenArc, getMaxArc, receiptsAfterFence, sealCurrentArc } from "../seal.js";
+import { deriveContractState } from "../status/lifecycle.js";
+import { commissionTarget, latestBase } from "../status/drift.js";
+import { findContractWorktreePath } from "../worktree-path.js";
+import { assertCleanTrackedWorkingTree } from "../../git/worktree.js";
 async function resolveCommit(cwd, ref) {
     const git = createGit(cwd);
     try {
@@ -47,7 +48,7 @@ export async function assertPetitionFresh(cwd, contractId, entries, base) {
         throw new FlowError("INTERNAL_STATE", `contract ${contractId} commission target ${target.ref} does not resolve`);
     }
     if (base !== head) {
-        throw new FlowError("INTERNAL_STATE", `contract ${contractId} must renew onto ${target.branch} before petition`, { hints: [`keiyaku @${contractId} renew — renews delivery before petition`] });
+        throw new FlowError("INTERNAL_STATE", `contract ${contractId} must renew onto ${target.branch} before petition`, { facts: { kind: "needs_renew", contractId } });
     }
 }
 export async function assertPetitionArcReady(deliveryCwd, contractId, entries) {
@@ -55,7 +56,7 @@ export async function assertPetitionArcReady(deliveryCwd, contractId, entries) {
         return;
     const loose = await receiptsAfterFence(deliveryCwd, entries);
     if (loose.length > 0) {
-        throw new FlowError("NO_OPEN_ARC", `${loose.length} commits after fence have no arc to receipt them`, { hints: [`keiyaku @${contractId} arc — opens a new arc to receipt them, then petition`] });
+        throw new FlowError("NO_OPEN_ARC", `${loose.length} commits after fence have no arc to receipt them`, { facts: { kind: "loose_commits", contractId, nextVerb: "petition" } });
     }
 }
 export function assertPetitionable(contractId, entries) {
@@ -68,6 +69,7 @@ export function assertPetitionable(contractId, entries) {
 export async function petitionContract(input) {
     const at = new Date(input.nowMs).toISOString();
     const { ledger, deliveryCwd, base, target } = await loadPetitionPreflightContext(input.cwd, input.contractId);
+    await assertCleanTrackedWorkingTree(deliveryCwd);
     await assertPetitionFresh(input.cwd, input.contractId, ledger.entries, base);
     await assertPetitionArcReady(deliveryCwd, input.contractId, ledger.entries);
     assertPetitionable(input.contractId, ledger.entries);

package/build/core/settlement/queue-read-model.js

@@ -0,0 +1,143 @@
+import { listContractIds, readLedger } from "../ledger.js";
+import { deriveContractState } from "../status/lifecycle.js";
+import { commissionTarget } from "../status/drift.js";
+export function isCurrentPetitionData(data) {
+    return "target" in data && "seat" in data;
+}
+function latestPetition(entries) {
+    for (let index = entries.length - 1; index >= 0; index -= 1) {
+        const entry = entries[index];
+        if (entry.kind === "petition")
+            return entry;
+    }
+    return undefined;
+}
+export function deriveQueueReadModel(ledgers) {
+    const seatsByContract = new Map();
+    const diagnosticsByContract = new Map();
+    const orderedByTarget = new Map();
+    for (const ledger of ledgers) {
+        if (deriveContractState(ledger.entries).state !== "petitioned")
+            continue;
+        const petition = latestPetition(ledger.entries);
+        if (!petition)
+            continue;
+        const derived = commissionTarget(ledger.entries);
+        if (!derived)
+            continue;
+        const diagnostics = [];
+        let seat;
+        if (isCurrentPetitionData(petition.data)) {
+            seat = {
+                contract: ledger.contractId,
+                target: petition.data.target,
+                seat: petition.data.seat,
+                legacy: false,
+            };
+            if (petition.data.target !== derived.ref) {
+                diagnostics.push({
+                    kind: "target-mismatch",
+                    petitioned: petition.data.target,
+                    derived: derived.ref,
+                });
+            }
+            const bucket = orderedByTarget.get(petition.data.target) ?? [];
+            bucket.push(seat);
+            orderedByTarget.set(petition.data.target, bucket);
+        }
+        else {
+            seat = {
+                contract: ledger.contractId,
+                target: derived.ref,
+                seat: null,
+                legacy: true,
+            };
+            diagnostics.push({ kind: "legacy-petition" });
+        }
+        seatsByContract.set(ledger.contractId, seat);
+        diagnosticsByContract.set(ledger.contractId, diagnostics);
+    }
+    for (const [target, seats] of orderedByTarget) {
+        const bySeat = new Map();
+        for (const seat of seats) {
+            if (seat.seat === null)
+                continue;
+            const group = bySeat.get(seat.seat) ?? [];
+            group.push(seat);
+            bySeat.set(seat.seat, group);
+        }
+        for (const [seatNumber, group] of bySeat) {
+            if (group.length < 2)
+                continue;
+            const sorted = [...group].sort((a, b) => a.contract.localeCompare(b.contract));
+            for (const member of sorted) {
+                const others = sorted.filter((other) => other.contract !== member.contract);
+                const existing = diagnosticsByContract.get(member.contract) ?? [];
+                for (const other of others) {
+                    existing.push({ kind: "duplicate-seat", seat: seatNumber, with: other.contract });
+                }
+                diagnosticsByContract.set(member.contract, existing);
+            }
+        }
+        seats.sort((a, b) => {
+            const seatA = a.seat ?? Number.POSITIVE_INFINITY;
+            const seatB = b.seat ?? Number.POSITIVE_INFINITY;
+            if (seatA !== seatB)
+                return seatA - seatB;
+            return a.contract.localeCompare(b.contract);
+        });
+        orderedByTarget.set(target, seats);
+    }
+    const targetQueues = [...orderedByTarget.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([target, ordered]) => ({ target, ordered }));
+    return {
+        targetQueues,
+        seatsByContract,
+        diagnosticsByContract,
+    };
+}
+export async function readQueueReadModel(cwd) {
+    const contractIds = await listContractIds(cwd);
+    const ledgers = [];
+    for (const id of contractIds) {
+        const ledger = await readLedger(cwd, id);
+        if (ledger)
+            ledgers.push(ledger);
+    }
+    return deriveQueueReadModel(ledgers);
+}
+export function queueMembership(model, contractId) {
+    const seat = model.seatsByContract.get(contractId);
+    if (!seat)
+        return undefined;
+    const diagnostics = model.diagnosticsByContract.get(contractId) ?? [];
+    if (seat.legacy) {
+        return {
+            seat,
+            position: null,
+            queueLength: 0,
+            queueHead: null,
+            diagnostics,
+        };
+    }
+    const targetQueue = model.targetQueues.find((queue) => queue.target === seat.target);
+    if (!targetQueue) {
+        return {
+            seat,
+            position: null,
+            queueLength: 0,
+            queueHead: null,
+            diagnostics,
+        };
+    }
+    const index = targetQueue.ordered.findIndex((entry) => entry.contract === contractId);
+    const position = index < 0 ? null : index + 1;
+    return {
+        seat,
+        position,
+        queueLength: targetQueue.ordered.length,
+        queueHead: targetQueue.ordered[0]?.contract ?? null,
+        diagnostics,
+    };
+}

package/build/core/settlement/queue-seat-allocation.js

@@ -0,0 +1,156 @@
+import { createHash } from "node:crypto";
+import { FlowError } from "../../flow-error.js";
+import { listContractIds, readLedger } from "../ledger.js";
+import { casUpdateRefLog, createRefLogCommit, listRefLogCommits, readRefLogCommitMessage, resolveRefLogHead, } from "../ref-log.js";
+import { isCurrentPetitionData, queueMembership, } from "./queue-read-model.js";
+const ISO_UTC_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+function isPositiveSafeInteger(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+export function assertClaimQueueHead(model, contractId) {
+    const membership = queueMembership(model, contractId);
+    if (!membership) {
+        throw new FlowError("INTERNAL_STATE", `contract ${contractId} is not queue head; position=not queued`);
+    }
+    if (membership.seat.legacy) {
+        throw new FlowError("QUEUE_LEGACY_PETITION", `contract ${contractId} petitioned before seat law took effect; reject its petition and petition again`);
+    }
+    const mismatch = membership.diagnostics.find((diagnostic) => diagnostic.kind === "target-mismatch");
+    if (mismatch && mismatch.kind === "target-mismatch") {
+        throw new FlowError("QUEUE_TARGET_MISMATCH", `contract ${contractId} petition target ${mismatch.petitioned} disagrees with derived target ${mismatch.derived}; reject its petition and petition again`);
+    }
+    if (membership.position !== 1) {
+        throw new FlowError("INTERNAL_STATE", `contract ${contractId} is not queue head; position=${membership.position ?? "not queued"}`);
+    }
+    return membership;
+}
+export function seatAllocatorRef(target) {
+    const digest = createHash("sha256").update(target, "utf8").digest("hex");
+    return `refs/keiyaku/seat/${digest}`;
+}
+function parseSeatAllocatorMessage(message, expectedTarget) {
+    const normalized = message.replace(/\r\n/g, "\n");
+    const separatorIndex = normalized.indexOf("\n\n");
+    if (separatorIndex < 0)
+        throw new Error("missing blank line");
+    const subject = normalized.slice(0, separatorIndex).trim();
+    const body = normalized.slice(separatorIndex + 2).trim();
+    const parsed = JSON.parse(body);
+    const keys = Object.keys(parsed).sort();
+    if (keys.join(",") !== "actor,at,seat,target,v")
+        throw new Error("unexpected fields");
+    if (parsed.v !== 1)
+        throw new Error("bad version");
+    if (typeof parsed.target !== "string" || parsed.target !== expectedTarget)
+        throw new Error("target mismatch");
+    if (!isPositiveSafeInteger(parsed.seat))
+        throw new Error("bad seat");
+    if (typeof parsed.at !== "string" || !ISO_UTC_RE.test(parsed.at))
+        throw new Error("bad at");
+    if (typeof parsed.actor !== "string" || parsed.actor.trim().length === 0)
+        throw new Error("bad actor");
+    if (subject !== `keiyaku seat: ${parsed.seat}`)
+        throw new Error("bad subject");
+    return {
+        v: 1,
+        target: parsed.target,
+        seat: parsed.seat,
+        at: parsed.at,
+        actor: parsed.actor,
+    };
+}
+async function parseAllocatorChain(cwd, head, expectedTarget) {
+    // Intentional degrade: any rev-list or parse failure treats the chain as corrupt.
+    let commits;
+    try {
+        commits = await listRefLogCommits(cwd, head);
+    }
+    catch {
+        return null;
+    }
+    if (commits.length === 0)
+        return null;
+    const entries = [];
+    let previousSeat = 0;
+    for (const commit of commits) {
+        try {
+            const entry = parseSeatAllocatorMessage(await readRefLogCommitMessage(cwd, commit), expectedTarget);
+            if (entry.seat <= previousSeat)
+                return null;
+            previousSeat = entry.seat;
+            entries.push(entry);
+        }
+        catch {
+            return null;
+        }
+    }
+    return { entries, lastSeat: previousSeat };
+}
+async function ledgerSeatFloor(cwd, target) {
+    const contractIds = await listContractIds(cwd);
+    let maxSeat = 0;
+    for (const id of contractIds) {
+        const ledger = await readLedger(cwd, id);
+        if (!ledger)
+            continue;
+        for (const entry of ledger.entries) {
+            if (entry.kind !== "petition")
+                continue;
+            if (!isCurrentPetitionData(entry.data))
+                continue;
+            if (entry.data.target !== target)
+                continue;
+            if (entry.data.seat > maxSeat)
+                maxSeat = entry.data.seat;
+        }
+    }
+    return maxSeat;
+}
+export async function allocateSettlementSeat(cwd, input) {
+    const ref = seatAllocatorRef(input.target);
+    const maxRetries = 3;
+    for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
+        // Raw observed-head read: any object id, not commit-only.
+        // Non-commit heads are returned so parseAllocatorChain can classify them as corrupt.
+        const observedHead = await resolveRefLogHead(cwd, ref, { peel: "object" });
+        const floor = await ledgerSeatFloor(cwd, input.target);
+        const parsed = observedHead ? await parseAllocatorChain(cwd, observedHead, input.target) : null;
+        const healthy = parsed !== null && parsed.lastSeat >= floor;
+        let seat;
+        let parent;
+        let expectedOld;
+        if (healthy && parsed) {
+            seat = parsed.lastSeat + 1;
+            parent = observedHead;
+            expectedOld = observedHead;
+        }
+        else {
+            // Missing, parse failure, target mismatch, non-monotonic, or stale-behind-ledger:
+            // mint a detached no-parent root at floor+1. Leave the bad chain for Git GC.
+            seat = floor + 1;
+            parent = null;
+            expectedOld = observedHead;
+        }
+        if (!isPositiveSafeInteger(seat)) {
+            throw new FlowError("INTERNAL_STATE", `settlement seats exhausted for ${input.target}`);
+        }
+        const entry = {
+            v: 1,
+            target: input.target,
+            seat,
+            at: input.at,
+            actor: input.actor,
+        };
+        const newHead = await createRefLogCommit(cwd, {
+            subject: `keiyaku seat: ${entry.seat}`,
+            body: JSON.stringify(entry, null, 2),
+            parentHead: parent,
+            errorLabel: `seat ${entry.seat}`,
+        });
+        // Intentional degrade: CAS failure returns false; bounded retry re-reads head.
+        const casOk = await casUpdateRefLog(cwd, ref, newHead, expectedOld);
+        if (casOk)
+            return { head: newHead, seat };
+    }
+    throw new FlowError("INTERNAL_STATE", `failed to allocate settlement seat for ${input.target}`);
+}

package/build/core/settlement/queue.js

@@ -0,0 +1,6 @@
+/**
+ * Settlement queue surface: read-model derivation/query and seat allocation/assertion.
+ * Implementation lives in sibling files; this module preserves the historical import path.
+ */
+export { deriveQueueReadModel, queueMembership, readQueueReadModel, } from "./queue-read-model.js";
+export { allocateSettlementSeat, assertClaimQueueHead, seatAllocatorRef, } from "./queue-seat-allocation.js";

package/build/core/settlement/settlement.js

@@ -0,0 +1,295 @@
+import { assertSettingsKnobUsable } from "../../config/settings/disease.js";
+import { loadKeiyakuSettings } from "../../config/settings/loader.js";
+import { FlowError } from "../../flow-error.js";
+import { readCurrentContractContext } from "../context.js";
+import { readLedger } from "../ledger.js";
+import { commissionTarget } from "../status/drift.js";
+import { deriveContractState } from "../status/lifecycle.js";
+import { getCurrentBranch, requireGitRepository } from "../../git/branches.js";
+import { readContractLog } from "../log.js";
+import { listRefLogCommits } from "../ref-log.js";
+import { effectiveScope } from "../seal.js";
+import { scopePathEvidence } from "../scope.js";
+import { nextReviewResponseNumber } from "../transcripts.js";
+import { claimContract } from "./claim.js";
+import { buildClaimGatePipeline, } from "./petition-claim-gates.js";
+import { forfeitKeiyaku } from "./petition-forfeit.js";
+import { assertHeadUnchanged } from "./petition-head-guard.js";
+import { petitionContract } from "./petition.js";
+import { verdictContract } from "./verdict.js";
+const VERDICT_DENIED_CODE = "VERDICT_DENIED";
+async function resolveClaimGateConfig(cwd) {
+    const merged = {
+        verificationCommands: [],
+    };
+    try {
+        const loaded = await loadKeiyakuSettings(cwd);
+        assertSettingsKnobUsable(loaded, "gate");
+        const gate = loaded.knobs?.gate;
+        if (!gate) {
+            return merged;
+        }
+        merged.verificationCommands = gate.commands ?? merged.verificationCommands;
+        return merged;
+    }
+    catch (error) {
+        if (error instanceof FlowError && error.code === "INVALID_SETTINGS") {
+            throw new FlowError(VERDICT_DENIED_CODE, `Configuration Error: ${error.message}`, {
+                cause: error,
+                facts: error.facts,
+            });
+        }
+        throw error;
+    }
+}
+async function loadCloseContext(cwd, requestedContractId) {
+    await requireGitRepository(cwd, "petition");
+    if (requestedContractId) {
+        const ledger = await readLedger(cwd, requestedContractId);
+        if (!ledger) {
+            throw new FlowError("INTERNAL_STATE", `contract ${requestedContractId} not found or not active`);
+        }
+        const target = commissionTarget(ledger.entries);
+        if (!target) {
+            throw new FlowError("INTERNAL_STATE", `contract ${requestedContractId} active ledger is missing commission target`);
+        }
+        return {
+            cwd,
+            keiyakuBranch: `keiyaku/${requestedContractId}`,
+            baseBranch: target.branch,
+            contractId: requestedContractId,
+        };
+    }
+    let contractContext;
+    try {
+        contractContext = await readCurrentContractContext(cwd);
+    }
+    catch (error) {
+        if (!(error instanceof FlowError) || error.code !== "EMPTY_PARAM") {
+            throw error;
+        }
+        throw new FlowError("NOT_ACTIVE_KEIYAKU_BRANCH", "Current workspace is not addressing an active Keiyaku contract.");
+    }
+    const keiyakuBranch = await getCurrentBranch(cwd);
+    return {
+        cwd,
+        keiyakuBranch,
+        baseBranch: contractContext.baseBranch,
+        contractId: contractContext.contractId,
+    };
+}
+async function throwClaimGateFailure(failure, _input, context, _dependencies) {
+    void _input;
+    void _dependencies;
+    void context.contractId;
+    if (failure.reviewHeadBeforeWrite) {
+        await assertHeadUnchanged(context.cwd, failure.reviewHeadBeforeWrite, "claim review");
+    }
+    throw new FlowError(failure.code, failure.message, {
+        review: failure.review,
+        facts: failure.facts,
+    });
+}
+async function runClaimGatePipelineOrThrow(input, context, dependencies) {
+    const { verificationCommands } = await dependencies.resolveClaimGateConfig(context.cwd);
+    let review;
+    let reviewHeadBeforeWrite;
+    let reviewerActor;
+    for (const gate of buildClaimGatePipeline()) {
+        const result = await gate.evaluate({
+            cwd: context.cwd,
+            contractId: context.contractId,
+            input,
+            verificationCommands,
+            baseBranch: dependencies.baseBranch,
+            reviewNumber: dependencies.reviewNumber,
+        });
+        if (result.review) {
+            review = result.review;
+            reviewHeadBeforeWrite = result.reviewHeadBeforeWrite;
+        }
+        if (result.reviewerActor)
+            reviewerActor = result.reviewerActor;
+        if (!result.pass) {
+            await throwClaimGateFailure(result, input, context, dependencies);
+        }
+    }
+    return { review, reviewHeadBeforeWrite, reviewerActor };
+}
+function maxArc(entries) {
+    return entries.filter((entry) => entry.kind === "arc").length;
+}
+function cleanupWarnings(cleanup) {
+    return [
+        ...(cleanup.worktreeRemoveFailure
+            ? [`Could not remove contract worktree ${cleanup.worktreeRemoveFailure.path}: ${cleanup.worktreeRemoveFailure.reason}`]
+            : []),
+        ...(cleanup.branchDeleteFailure
+            ? [`Could not delete contract branch ${cleanup.branchDeleteFailure.name}: ${cleanup.branchDeleteFailure.reason}`]
+            : []),
+    ];
+}
+function findClaimEntry(entries) {
+    return entries.find((entry) => entry.kind === "claim");
+}
+/** Verdict for the open petition window (after last petition, before claim). */
+function latestCurrentPetitionVerdict(entries) {
+    for (let index = entries.length - 1; index >= 0; index -= 1) {
+        const entry = entries[index];
+        if (entry.kind === "verdict")
+            return entry;
+        if (entry.kind === "petition")
+            return undefined;
+    }
+    return undefined;
+}
+/**
+ * Crash-recovery head: petition → approved verdict → no claim.
+ * Orchestrator resumes claim delivery only; no gates, petition, or re-judgment.
+ */
+function isApprovedVerdictAwaitingClaim(entries) {
+    const state = deriveContractState(entries);
+    if (state.state !== "petitioned")
+        return false;
+    if (findClaimEntry(entries))
+        return false;
+    return latestCurrentPetitionVerdict(entries)?.data.result === "approved";
+}
+async function recoverCurrentPetitionSeal(cwd, ledger) {
+    let petitionIndex = -1;
+    for (let index = ledger.entries.length - 1; index >= 0; index -= 1) {
+        if (ledger.entries[index]?.kind === "petition") {
+            petitionIndex = index;
+            break;
+        }
+    }
+    if (petitionIndex <= 0)
+        return undefined;
+    const seal = ledger.entries[petitionIndex - 1];
+    if (seal.kind !== "seal" || seal.data.sealedBy !== "petition")
+        return undefined;
+    const commits = await listRefLogCommits(cwd, ledger.head, ledger.ref);
+    const ledgerHead = commits[petitionIndex - 1];
+    if (!ledgerHead || commits.length !== ledger.entries.length) {
+        throw new FlowError("INTERNAL_STATE", `contract ${ledger.contractId} ledger entries do not align with ref-log commits during petition recovery`);
+    }
+    const scopeViolationEvidence = await scopePathEvidence(cwd, effectiveScope(ledger.entries), seal.data.scopeAudit.violations);
+    return {
+        ...seal.data,
+        scopeViolationEvidence,
+        ledgerHead,
+    };
+}
+async function finishApprovedClaim(context, options) {
+    const { cwd, baseBranch, contractId } = context;
+    // Capture arc facts before claim cleanup may remove the delivery worktree cwd.
+    const log = await readContractLog({ cwd, contractId });
+    const claimed = await claimContract({
+        cwd,
+        contractId,
+        actor: "keiyaku",
+        nowMs: options.nowMs,
+    });
+    const cleanup = claimed.cleanup ?? { absent: ["worktree", "branch"] };
+    const warnings = [...(claimed.warnings ?? []), ...cleanupWarnings(cleanup)];
+    return {
+        status: "success",
+        result: "merged",
+        arc: maxArc(log.entries),
+        currentBranch: baseBranch,
+        baseBranch,
+        commit: claimed.mergeCommit,
+        mergedInto: baseBranch,
+        ...(cleanup.deletedBranch ? { deletedBranch: cleanup.deletedBranch } : {}),
+        cleanup,
+        diff: `Merged contract ${contractId} with merge-tree/commit-tree CAS.`,
+        // Prior public outcome carried sealed facts when petition sealed an open arc.
+        ...(options.sealed ? { sealed: options.sealed } : {}),
+        ...(warnings.length > 0 ? { meta: { warnings } } : {}),
+    };
+}
+/**
+ * Settlement claim path: gates → petition → pure verdict → claim delivery.
+ * Stage modules do not call each other; this orchestrator owns the sequence.
+ *
+ * Atomicity equivalence: previously verdictContract appended the verdict entry
+ * then immediately invoked claimContract. That remains two sequential append
+ * windows (verdict then claim). Crash after approved verdict leaves state
+ * petitioned with an approved verdict; the orchestrator detects that head and
+ * resumes claimContract idempotently without re-running gates or judgment.
+ */
+export async function claimKeiyaku(input, context, dependencies) {
+    const { cwd, baseBranch, contractId } = context;
+    // Crash recovery: petition → approved verdict → no claim.
+    // Resume claim delivery only; do not re-gate, re-petition, or re-judge.
+    const existing = await readLedger(cwd, contractId);
+    if (existing && isApprovedVerdictAwaitingClaim(existing.entries)) {
+        const sealed = await recoverCurrentPetitionSeal(cwd, existing);
+        return finishApprovedClaim(context, {
+            nowMs: Date.now(),
+            ...(sealed ? { sealed } : {}),
+        });
+    }
+    const claimResult = "dangerouslyBypassGates" in input && input.dangerouslyBypassGates
+        ? { review: undefined, reviewHeadBeforeWrite: undefined, bypassedByArchitect: true }
+        : {
+            ...(await runClaimGatePipelineOrThrow(input, { cwd, contractId }, {
+                ...dependencies,
+                baseBranch,
+                reviewNumber: await nextReviewResponseNumber(cwd),
+            })),
+            bypassedByArchitect: false,
+        };
+    if (claimResult.review && claimResult.reviewHeadBeforeWrite) {
+        await assertHeadUnchanged(cwd, claimResult.reviewHeadBeforeWrite, "claim review");
+    }
+    const oath = String(input.oath ?? "").trim();
+    if (!oath) {
+        throw new FlowError("OATH_MISSING", "Oath missing.");
+    }
+    // 1. Petition: seal + admit onto the target-local settlement queue.
+    const petition = await petitionContract({
+        cwd,
+        contractId,
+        actor: "keiyaku",
+        nowMs: Date.now(),
+        intent: "claim",
+        oath,
+        waivePaths: input.waivePaths,
+    });
+    // 2. Pure verdict: judgment facts only; no claim execution.
+    // Capture one clock for verdict + claim so ledger timestamps match the prior
+    // verdict→claim atomic pair (verdict previously forwarded its own nowMs).
+    const judgmentNowMs = Date.now();
+    const verdict = await verdictContract({
+        cwd,
+        contractId,
+        actor: claimResult.reviewerActor ?? "keiyaku",
+        nowMs: judgmentNowMs,
+        result: "approved",
+        summary: claimResult.review?.findings?.trim() || "礼成",
+    });
+    // 3. Execution: approved → claim delivery (same sequential append window as before).
+    // Rejected verdict publication is verdictContract itself (state returns active).
+    if (verdict.result !== "approved") {
+        throw new FlowError("INTERNAL_STATE", `settlement expected approved verdict for ${contractId}, got ${verdict.result}`);
+    }
+    return finishApprovedClaim(context, {
+        nowMs: judgmentNowMs,
+        ...(petition.sealed ? { sealed: petition.sealed } : {}),
+    });
+}
+/** Public settlement entrypoint for CLI petition (claim or forfeit). */
+export async function petitionKeiyaku(input) {
+    const context = await loadCloseContext(input.cwd, input.contractId);
+    const { intent } = input;
+    if (intent === "FORFEIT") {
+        return forfeitKeiyaku(context);
+    }
+    if (intent === "CLAIM") {
+        return claimKeiyaku(input, context, {
+            resolveClaimGateConfig,
+        });
+    }
+    throw new FlowError("INVALID_CLOSE_INTENT", `unsupported close intent: ${intent}`);
+}