@astrosheep/keiyaku 2.9.9 → 2.9.10

package/build/core/settlement/claim.js

@@ -1,174 +1,256 @@
 import { FlowError } from "../../flow-error.js";
 import { assertCleanTrackedWorkingTree } from "../../git/worktree.js";
-import { activeLedgerRef, appendWithRetry, readLedger } from "../ledger.js";
+import { runLifecycle } from "../lifecycle-runner.js";
+import { isJsonObject } from "../outcome-base.js";
+import { terminalCleanupFacts } from "../worktree-path.js";
 import { assertClaimQueueHead, readQueueReadModel } from "./queue.js";
-import { releaseScope } from "../registry.js";
-import { deriveContractState } from "../status/lifecycle.js";
-import { commissionTarget, latestBase } from "../status/drift.js";
-import { cleanupContractWorkspace, findContractWorktreePath, stableRepoRoot } from "../worktree-path.js";
-import { defaultMergeDelivery, relativeDisplayPath, resolveCommit, resolveCommitOrNull, } from "./claim-delivery.js";
-async function cleanupClaim(cwd, contractId, actor, at) {
-    const stableRoot = await stableRepoRoot(cwd);
-    await releaseScope(stableRoot, { contractId, actor, at });
-    return await cleanupContractWorkspace(stableRoot, contractId);
-}
-function findClaim(entries) {
-    return entries.find((entry) => entry.kind === "claim");
+import { buildClaimLanding, relativeDisplayPath, } from "./claim-delivery.js";
+export function claimDeliveryCoordinateMismatch(published, delivery) {
+    const assertion = published.observations.find((observation) => (observation.ref === delivery.ref
+        && observation.expectedOldOid === delivery.head));
+    if (!assertion || assertion.observed.status === "unknown")
+        return undefined;
+    if (assertion.observed.status === "present" && assertion.observed.objectId === delivery.head)
+        return undefined;
+    return {
+        code: "CONCURRENT_MODIFICATION",
+        message: "claim delivery coordinate changed before atomic publication",
+        facts: {
+            delivery: {
+                expected: { ref: delivery.ref, head: delivery.head },
+                observed: assertion.observed,
+            },
+        },
+    };
 }
-/** Verdict belonging to the open petition window (after last petition, before claim). */
-function latestCurrentPetitionVerdict(entries) {
-    for (let index = entries.length - 1; index >= 0; index -= 1) {
-        const entry = entries[index];
-        if (entry.kind === "verdict")
-            return entry;
-        if (entry.kind === "petition")
-            return undefined;
-    }
-    return undefined;
+function acceptedClaim(model) {
+    const row = [...model.history].reverse().find(({ entry }) => entry.kind === "claim");
+    return row?.entry.kind === "claim" ? { objectId: row.objectId, entry: row.entry } : undefined;
 }
-/**
- * Delivery requires an approved verdict for the current petition.
- * Already-claimed cleanup retry remains legal without re-proving judgment.
- */
-function assertClaimableFromLedger(contractId, ledger) {
-    if (!ledger) {
-        throw new FlowError("INTERNAL_STATE", `contract ${contractId} not found`);
-    }
-    const state = deriveContractState(ledger.entries);
-    const claim = findClaim(ledger.entries);
-    // Already-claimed cleanup retry: legal head even if a prior crash left debris.
-    if (claim && state.state === "claimed")
-        return claim;
-    if (state.state === "petitioned") {
-        const verdict = latestCurrentPetitionVerdict(ledger.entries);
-        if (verdict?.data.result !== "approved") {
-            throw new FlowError("INTERNAL_STATE", `contract ${contractId} cannot claim without approved verdict for current petition`);
-        }
+function assertClaimable(contractId, model) {
+    const claim = acceptedClaim(model);
+    if (model.phase === "claimed" && claim)
         return claim;
+    if (model.phase === "approved" && model.petition.state === "approved" && model.petition.intent === "claim")
+        return undefined;
+    if (model.phase === "forfeited") {
+        throw new FlowError("CONTRACT_TERMINAL", `contract ${contractId} is terminal (${model.phase})`);
     }
-    if (state.state === "forfeited") {
-        throw new FlowError("INTERNAL_STATE", `contract ${contractId} forfeited`);
-    }
-    throw new FlowError("INTERNAL_STATE", `contract ${contractId} cannot claim from state ${state.state}`);
-}
-async function publishClaimLedger(input) {
-    const result = await appendWithRetry(input.cwd, activeLedgerRef(input.contractId), (_head, entries) => {
-        if (entries.some((entry) => entry.kind === "claim"))
-            return null;
-        const entry = {
-            v: 1,
-            kind: "claim",
-            contract: input.contractId,
-            at: input.at,
-            actor: input.actor,
-            data: { mergeCommit: input.mergeCommit },
-        };
-        return entry;
-    });
-    if (!result.ok && result.reason !== "aborted") {
-        throw new FlowError("INTERNAL_STATE", `failed to append claim for ${input.contractId}: ${result.reason}`);
+    if (model.phase === "awaiting-verdict") {
+        throw new FlowError("INTERNAL_STATE", `contract ${contractId} cannot claim without approved verdict for current petition`);
     }
+    throw new FlowError("INTERNAL_STATE", `contract ${contractId} cannot claim from state ${model.phase}`);
 }
-export async function previewClaimContract(input) {
-    const model = await readQueueReadModel(input.cwd);
-    const membership = assertClaimQueueHead(model, input.contractId);
-    const ledger = await readLedger(input.cwd, input.contractId);
-    assertClaimableFromLedger(input.contractId, ledger);
-    const entries = ledger.entries;
-    const cleanupPath = await findContractWorktreePath(input.cwd, input.contractId);
-    const state = deriveContractState(entries);
-    const base = latestBase(entries);
-    const commission = commissionTarget(entries);
-    if (!commission) {
-        throw new FlowError("INTERNAL_STATE", `cannot preview claim ${input.contractId}: missing commission target`);
+function freezeClaimCoordinates(contractId, model, pins) {
+    if (model.petition.state !== "approved" || model.petition.intent !== "claim" || !model.petition.targetHead) {
+        throw new FlowError("INTERNAL_STATE", `contract ${contractId} has no approved claim coordinates`);
     }
-    const targetHead = await resolveCommitOrNull(input.cwd, commission.ref);
-    if (!targetHead) {
-        throw new FlowError("INTERNAL_STATE", `cannot preview claim ${input.contractId}: commission target ${commission.ref} does not resolve`);
-    }
-    const freshness = base
-        ? base === targetHead ? "fresh" : "stale"
-        : "unknown";
-    const deliveryBranch = `keiyaku/${input.contractId}`;
-    let deliveryHead;
-    try {
-        deliveryHead = await resolveCommit(input.cwd, deliveryBranch);
-    }
-    catch {
-        deliveryHead = undefined;
+    if (pins.target.ref !== model.petition.target ||
+        pins.target.head !== model.petition.targetHead ||
+        pins.delivery.head !== model.pins.delivery) {
+        throw new FlowError("CONCURRENT_MODIFICATION", `claim coordinates for ${contractId} no longer match approved petition`);
     }
     return {
-        contractId: input.contractId,
-        queueHead: membership.queueHead,
-        queuePosition: membership.position,
-        state: state.state,
-        freshness,
-        ...(base ? { base } : {}),
-        targetBranch: commission.branch,
-        targetHead,
-        deliveryBranch,
-        ...(deliveryHead ? { deliveryHead } : {}),
-        cleanupEffects: [
-            `release registry scope for ${input.contractId}`,
-            cleanupPath ? `remove worktree ${relativeDisplayPath(input.cwd, cleanupPath)} when present` : "no linked worktree to remove",
-            `delete branch keiyaku/${input.contractId} when present`,
-        ],
+        base: model.pins.base,
+        target: model.petition.target,
+        targetHead: model.petition.targetHead,
+        deliveryHead: model.pins.delivery,
     };
 }
-export async function claimContract(input) {
-    const at = new Date(input.nowMs).toISOString();
-    const deliveryWorktree = await findContractWorktreePath(input.cwd, input.contractId);
-    await assertCleanTrackedWorkingTree(deliveryWorktree ?? input.cwd);
-    const existing = await readLedger(input.cwd, input.contractId);
-    const existingClaim = assertClaimableFromLedger(input.contractId, existing);
-    const existingState = existing ? deriveContractState(existing.entries) : undefined;
-    // Already-claimed retry: skip queue-head gating and merge; finish cleanup.
-    if (existingClaim && existingState?.state === "claimed") {
-        const cleanup = await cleanupClaim(input.cwd, input.contractId, input.actor, at);
+export async function previewClaimContract(input) {
+    const { withContractCarrierSession } = await import("../contract-carrier.js");
+    return withContractCarrierSession({ cwd: input.cwd, contractId: input.contractId, mode: "observe-only", signal: input.signal }, async (session) => {
+        const queue = await readQueueReadModel(session.stableRoot);
+        const membership = assertClaimQueueHead(queue, input.contractId);
+        assertClaimable(input.contractId, session.lifecycle);
+        const targetHead = session.pins.target.head;
+        const base = session.lifecycle.pins.base;
+        const deliveryBranch = `keiyaku/${input.contractId}`;
+        const cleanupPath = session.target.status === "available" ? session.target.root : undefined;
         return {
             contractId: input.contractId,
-            mergeCommit: existingClaim.data.mergeCommit,
-            cleanup,
+            queueHead: membership.queueHead,
+            queuePosition: membership.position,
+            state: session.lifecycle.phase,
+            freshness: targetHead ? (base === targetHead ? "fresh" : "stale") : "unknown",
+            base,
+            targetBranch: session.lifecycle.pins.target.ref.slice("refs/heads/".length),
+            ...(targetHead ? { targetHead } : {}),
+            deliveryBranch,
+            ...(session.pins.delivery.head ? { deliveryHead: session.pins.delivery.head } : {}),
+            cleanupEffects: [
+                `release registry scope for ${input.contractId}`,
+                cleanupPath ? `remove worktree ${relativeDisplayPath(input.cwd, cleanupPath)} when present` : "no linked worktree to remove",
+                `delete branch ${deliveryBranch} when present`,
+            ],
         };
-    }
-    // Still petitioned: prove target-local head before merge.
-    const model = await readQueueReadModel(input.cwd);
-    assertClaimQueueHead(model, input.contractId);
-    let mergeCommit = existingClaim?.data.mergeCommit;
-    let warnings;
-    if (!mergeCommit) {
-        const usesDefaultMerger = input.mergeDelivery === undefined;
-        const mergeDelivery = input.mergeDelivery ?? defaultMergeDelivery;
-        const publishClaim = async (acceptedMergeCommit) => publishClaimLedger({
-            cwd: input.cwd,
-            contractId: input.contractId,
-            actor: input.actor,
-            at,
-            mergeCommit: acceptedMergeCommit,
-        });
-        // mergeDelivery must be idempotent: if a prior attempt merged delivery but
-        // crashed before appending claim, a retry must return the existing merge
-        // receipt without creating a second merge effect.
-        const merged = await mergeDelivery({
-            cwd: input.cwd,
-            contractId: input.contractId,
-            writeClaimReceipt: input.writeClaimReceipt,
-            ...(usesDefaultMerger ? { publishClaim } : {}),
-        });
-        await input.afterMerge?.(merged);
-        mergeCommit = merged.mergeCommit;
-        if (merged.warnings && merged.warnings.length > 0) {
-            warnings = [...merged.warnings];
-        }
-        if (!usesDefaultMerger)
-            await publishClaim(mergeCommit);
-    }
-    // Claim entry naturally removes membership; no dequeue record.
-    const cleanup = await cleanupClaim(input.cwd, input.contractId, input.actor, at);
+    });
+}
+export async function claimContract(input) {
+    const at = new Date(input.nowMs).toISOString();
+    const execution = await runLifecycle({
+        cwd: input.cwd,
+        contractId: input.contractId,
+        mutation: {
+            verb: "claim",
+            coordinateChangeRefusal: {
+                code: "CONCURRENT_MODIFICATION",
+                message: "claim target or repository ledger changed during atomic publication preparation",
+            },
+        },
+        signal: input.signal,
+        admit: async (session) => {
+            const existing = assertClaimable(input.contractId, session.lifecycle);
+            if (existing) {
+                return {
+                    existing,
+                    coordinates: null,
+                    closedDelivery: null,
+                    queuePin: null,
+                    taskIds: session.lifecycle.resources.tasks.map(({ taskId }) => taskId),
+                };
+            }
+            if (session.target.status !== "available")
+                throw new FlowError("INTERNAL_STATE", session.target.reason);
+            await assertCleanTrackedWorkingTree(session.target.root);
+            const queue = await readQueueReadModel(session.stableRoot);
+            assertClaimQueueHead(queue, input.contractId);
+            const coordinates = freezeClaimCoordinates(input.contractId, session.lifecycle, session.pins);
+            return {
+                coordinates,
+                closedDelivery: { ref: session.pins.delivery.ref, head: coordinates.deliveryHead },
+                targetRoot: session.target.root,
+                queuePin: JSON.stringify(queue),
+                taskIds: session.lifecycle.resources.tasks.map(({ taskId }) => taskId),
+            };
+        },
+        prepare: async (admission) => {
+            if (admission.business.coordinates === null)
+                return null;
+            const landing = await buildClaimLanding({
+                cwd: input.cwd,
+                contractId: input.contractId,
+                actor: input.actor,
+                at,
+                coordinates: admission.business.coordinates,
+            });
+            await input.beforePublication?.({
+                cwd: input.cwd,
+                contractId: input.contractId,
+                repositoryLedgerHead: admission.ledgerHead,
+                coordinates: Object.freeze({ ...admission.business.coordinates }),
+                landing: Object.freeze({ mergeCommit: landing.mergeCommit, mergeTree: landing.mergeTree }),
+            });
+            return landing;
+        },
+        revalidate: async ({ session, admission }) => {
+            if (admission.business.existing) {
+                const current = acceptedClaim(session.lifecycle);
+                return current?.objectId === admission.business.existing.objectId
+                    ? undefined
+                    : { code: "CLAIM_STATE_CHANGED", message: "accepted claim changed during replay admission" };
+            }
+            if (session.target.status !== "available" || session.target.root !== admission.business.targetRoot) {
+                return { code: "DELIVERY_WORKTREE_CHANGED", message: "registered delivery worktree changed during claim preparation" };
+            }
+            await assertCleanTrackedWorkingTree(session.target.root);
+            const currentCoordinates = freezeClaimCoordinates(input.contractId, session.lifecycle, session.pins);
+            if (JSON.stringify(currentCoordinates) !== JSON.stringify(admission.business.coordinates)) {
+                return { code: "CLAIM_COORDINATES_CHANGED", message: "claim coordinates changed during preparation" };
+            }
+            const queue = await readQueueReadModel(session.stableRoot);
+            try {
+                assertClaimQueueHead(queue, input.contractId);
+            }
+            catch (error) {
+                return { code: "QUEUE_HEAD_CHANGED", message: error instanceof Error ? error.message : String(error) };
+            }
+            return JSON.stringify(queue) === admission.business.queuePin
+                ? undefined
+                : { code: "QUEUE_CHANGED", message: "settlement queue changed during claim preparation" };
+        },
+        effect: async ({ context, admission, prepared }) => {
+            const existing = admission.business.existing;
+            const mergeCommit = existing?.entry.data.mergeCommit ?? prepared?.mergeCommit;
+            if (!mergeCommit)
+                throw new FlowError("INTERNAL_STATE", `claim ${input.contractId} has no merge commit`);
+            const published = existing
+                ? await context.replayCommitted({ transactionObjectId: admission.replay.state === "verb-committed" ? admission.replay.transaction.transactionObjectId : (() => { throw new FlowError("INTERNAL_STATE", "claim replay has no accepted transaction"); })(), carrier: "retire" })
+                : await context.publishAuthoritative({
+                    verb: "claim",
+                    admittedLedgerHead: admission.ledgerHead,
+                    acceptedLifecycleTail: context.session.lifecycle.history.at(-1).objectId,
+                    entries: [{
+                            v: 2,
+                            kind: "claim",
+                            contract: input.contractId,
+                            at,
+                            actor: input.actor,
+                            data: {
+                                ...admission.business.coordinates,
+                                mergeCommit,
+                            },
+                        }],
+                    target: {
+                        ref: admission.business.coordinates.target,
+                        expectedOid: admission.business.coordinates.targetHead,
+                    },
+                    delivery: {
+                        ref: admission.business.closedDelivery.ref,
+                        expectedOid: admission.business.closedDelivery.head,
+                    },
+                });
+            if (published.status !== "committed") {
+                const deliveryMismatch = published.status === "refused-before-effects"
+                    ? claimDeliveryCoordinateMismatch(published, admission.business.closedDelivery)
+                    : undefined;
+                return {
+                    kind: "refused-before-effects",
+                    authoritativeHead: published.currentHead ?? admission.ledgerHead,
+                    refusal: deliveryMismatch ?? { code: "CONCURRENT_MODIFICATION", message: "claim target or repository ledger changed before atomic publication" },
+                };
+            }
+            await context.journal.run({
+                effect: "after-landing-hook",
+                ...(context.journal.all().some((row) => row.effect === "ledger-cas" && row.status === "succeeded")
+                    ? { dependency: `${input.contractId}:${published.head}:ledger-cas` }
+                    : {}),
+                run: async () => {
+                    await input.afterPublication?.({ mergeCommit });
+                    return { mergeCommit };
+                },
+            });
+            await context.session.completeReplay("retire");
+            const taskRow = context.journal.all().find((row) => row.effect === "task-board-projection" && row.status === "succeeded");
+            const taskFacts = taskRow?.status === "succeeded" ? taskRow.receipt?.facts : undefined;
+            const warnings = isJsonObject(taskFacts) && Array.isArray(taskFacts.warnings)
+                ? taskFacts.warnings.filter((warning) => typeof warning === "string")
+                : [];
+            const cleanupRow = context.journal.all().find((row) => row.effect === "worktree-projection" && row.status === "succeeded");
+            const cleanupFacts = cleanupRow?.status === "succeeded" ? cleanupRow.receipt?.facts : undefined;
+            const deliveryRefRow = context.journal.all().find((row) => row.effect === "delivery-ref-projection" && row.status === "succeeded");
+            const deliveryRefFacts = deliveryRefRow?.status === "succeeded" ? deliveryRefRow.receipt?.facts : undefined;
+            const cleanup = terminalCleanupFacts(cleanupFacts, deliveryRefFacts);
+            if (!cleanup)
+                throw new FlowError("INTERNAL_STATE", "terminal replay completed without typed cleanup facts");
+            return {
+                kind: "committed",
+                commit: published,
+                entryKind: "claim",
+                value: { mergeCommit, ...(warnings.length > 0 ? { warnings } : {}), ...(cleanup ? { cleanup } : {}) },
+            };
+        },
+    });
+    if (execution.kind === "noncommitted")
+        return execution.outcome;
+    if (execution.kind === "contained")
+        return { ...execution.outcome, contractId: input.contractId };
     return {
+        ...execution.outcome,
         contractId: input.contractId,
-        mergeCommit: mergeCommit,
-        cleanup,
-        ...(warnings && warnings.length > 0 ? { warnings } : {}),
+        mergeCommit: execution.payload.mergeCommit,
+        ...(execution.payload.warnings ? { warnings: execution.payload.warnings } : {}),
+        ...(execution.payload.cleanup ? { cleanup: execution.payload.cleanup } : {}),
+        carrier: execution.carrier,
     };
 }

package/build/core/settlement/index.js

@@ -7,13 +7,13 @@
  * Foundations (queue, claim-delivery) may be depended on downward by stage modules.
  * Stage modules (petition, verdict, claim) do not import one another.
  */
-export { claimKeiyaku, petitionKeiyaku, } from "./settlement.js";
-export { buildPetitionClaimInput, petitionContract, loadPetitionPreflightContext, assertPetitionFresh, assertPetitionArcReady, assertPetitionable, } from "./petition.js";
+export { claimKeiyaku, petitionKeiyaku, reconcilePetitionRetry, } from "./settlement.js";
+export { buildPetitionClaimInput, petitionContract, } from "./petition.js";
 export { previewPetition, PETITION_PREVIEW_GATE_NAMES, } from "./petition-preview.js";
 export { verdictContract, } from "./verdict.js";
 export { claimContract, previewClaimContract, } from "./claim.js";
-export { defaultMergeDelivery, relativeDisplayPath, resolveCommit, resolveCommitOrNull, } from "./claim-delivery.js";
-export { allocateSettlementSeat, assertClaimQueueHead, deriveQueueReadModel, queueMembership, readQueueReadModel, seatAllocatorRef, } from "./queue.js";
+export { relativeDisplayPath, resolveCommit, resolveCommitOrNull, } from "./claim-delivery.js";
+export { assertClaimQueueHead, deriveQueueReadModel, queueMembership, readQueueReadModel, } from "./queue.js";
 export { buildClaimGatePipeline, createAgentReviewGate, createOathGate, } from "./petition-claim-gates.js";
 export { assertHeadUnchanged } from "./petition-head-guard.js";
 export { forfeitKeiyaku } from "./petition-forfeit.js";

package/build/core/settlement/petition-claim-gates.js

@@ -8,13 +8,14 @@ import { getDiffStats } from "../../git/diff/preview.js";
 import { readDiff } from "../../git/diff/read.js";
 import { getCurrentBranch } from "../../git/branches.js";
 import { getLatestCommitHash } from "../../git/staging.js";
+import { createGit } from "../../git/core.js";
 import { DIFF_PREVIEW_TEXT_MAX_CHARS } from "../../keiyaku.js";
 import { FlowError } from "../../flow-error.js";
 import { persistResponseHistory } from "../transcripts.js";
 import { logInfo } from "../../telemetry/logger.js";
 import { execSubagent } from "../call/call.js";
 import { readContractLog } from "../log.js";
-import { runVerificationCommand } from "./verification.js";
+import { runVerificationPlan } from "./verification.js";
 const CLAIM_VERIFICATION_OUTPUT_MAX_CHARS = 1200;
 const REVIEW_PASS_TOKEN = "PASS";
 const REVIEW_REJECTION_MESSAGE = "CLAIM rejected by independent reviewer.";
@@ -29,7 +30,6 @@ const REVIEW_PROMPT_LINES = [
     "You may use read-only repository inspection commands and tools as needed.",
     "",
     "## Workflow Context",
-    "- KEIYAKU.md is a workflow protocol file that will be removed before merge. Ignore it.",
     "- Commit messages in this branch are intermediate; the branch will be squash-merged. Do not evaluate commit hygiene.",
     "",
     "## Output Rules",
@@ -100,25 +100,41 @@ export function createOathGate() {
 export function createCommandVerificationGate() {
     return {
         name: "command",
-        async evaluate({ cwd, verificationCommands }) {
-            for (const verification of verificationCommands) {
-                logInfo(`[CLAIM] Running verification: ${verification.label}`, { cwd, section: "script", progressOnly: true });
-                const result = await runVerificationCommand(cwd, verification);
-                if (result.code !== 0) {
-                    return {
-                        pass: false,
-                        code: "CLOSE_QUALITY_GATE_FAILED",
-                        message: `CLAIM blocked: verification failed at '${verification.label}' (exit ${result.code}).`,
-                        facts: {
-                            kind: "verification_failure",
-                            label: verification.label,
-                            stdout: clipCommandOutput(result.stdout.tail),
-                            stderr: clipCommandOutput(result.stderr.tail),
-                        },
-                    };
-                }
+        async evaluate({ cwd, coordinationRoot, verificationPlan, verificationCandidate, input }) {
+            const repositoryRoot = coordinationRoot ?? cwd;
+            for (const verification of verificationPlan) {
+                logInfo(`[CLAIM] Running ${verification.source}: ${verification.label}`, { cwd, section: "script", progressOnly: true });
             }
-            return { pass: true };
+            const evidence = await runVerificationPlan({ cwd, candidate: verificationCandidate, plan: verificationPlan, signal: input.signal, coordinationKey: JSON.stringify({ repository: repositoryRoot, candidate: verificationCandidate, plan: verificationPlan }), coordinationRoot: repositoryRoot });
+            const runnerFailure = evidence.find((result) => result.execution.status === "runner_failed");
+            if (runnerFailure?.execution.status === "runner_failed") {
+                return {
+                    pass: false,
+                    code: "CLOSE_QUALITY_GATE_FAILED",
+                    message: `CLAIM blocked: verification runner uncertainty at ${runnerFailure.source} '${runnerFailure.label}' (${runnerFailure.execution.cause.code}: ${runnerFailure.execution.cause.message}).`,
+                    facts: {
+                        kind: "verification_failure",
+                        label: `${runnerFailure.source} ${runnerFailure.label}`,
+                        stdout: clipCommandOutput(runnerFailure.execution.stdout.tail),
+                        stderr: clipCommandOutput(runnerFailure.execution.stderr.tail),
+                    },
+                };
+            }
+            const commandFailure = evidence.find((result) => result.execution.status === "executed" && result.execution.code !== 0);
+            if (commandFailure?.execution.status === "executed") {
+                return {
+                    pass: false,
+                    code: "CLOSE_QUALITY_GATE_FAILED",
+                    message: `CLAIM blocked: verification failed at ${commandFailure.source} '${commandFailure.label}' (exit ${commandFailure.execution.code}).`,
+                    facts: {
+                        kind: "verification_failure",
+                        label: `${commandFailure.source} ${commandFailure.label}`,
+                        stdout: clipCommandOutput(commandFailure.execution.stdout.tail),
+                        stderr: clipCommandOutput(commandFailure.execution.stderr.tail),
+                    },
+                };
+            }
+            return { pass: true, verification: [...evidence] };
         },
     };
 }
@@ -177,25 +193,13 @@ export function createAgentReviewGate() {
                 authority: { kind: "repository" },
                 binding: { kind: "commission", commissionId: contractId },
             });
-            const reviewHeadBeforeWrite = await getLatestCommitHash(cwd);
+            const reviewHeadBeforeWrite = (await createGit(cwd).revparse(["--verify", "HEAD^{commit}"])).trim();
             const raw = subagentResult.finalMessage.trim();
             const passed = raw.startsWith(REVIEW_PASS_TOKEN);
             const observations = passed ? raw.slice(REVIEW_PASS_TOKEN.length).trim() || undefined : undefined;
-            const persisted = await persistResponseHistory({
-                cwd,
-                tool: "review",
-                provenance: { authority: { kind: "repository" }, binding: { kind: "commission", commissionId: contractId }, evidenceCwd: cwd },
-                title: String(reviewNumber),
-                prompt,
-                response: subagentResult.finalMessage,
-                session: subagentResult.session,
-                subagentName: selectedReviewerAgentName,
-                launchSnapshot: subagentResult.launchSnapshot,
-            });
             const review = {
                 review: reviewNumber,
                 result: passed ? "passed" : "rejected",
-                historyPath: persisted.responsePath,
                 findings: passed ? observations : raw || REVIEW_RESPONSE_FALLBACK,
             };
             if (review.result === "passed") {
@@ -204,6 +208,21 @@ export function createAgentReviewGate() {
                     review,
                     reviewHeadBeforeWrite,
                     reviewerActor: selectedReviewerAgentName,
+                    reviewPersistence: {
+                        reviewNumber,
+                        reviewedHead: reviewHeadBeforeWrite,
+                        persist: () => persistResponseHistory({
+                            cwd,
+                            tool: "review",
+                            provenance: { authority: { kind: "repository" }, binding: { kind: "commission", commissionId: contractId }, evidenceCwd: cwd },
+                            title: String(reviewNumber),
+                            prompt,
+                            response: subagentResult.finalMessage,
+                            session: subagentResult.session,
+                            subagentName: selectedReviewerAgentName,
+                            launchSnapshot: subagentResult.launchSnapshot,
+                        }),
+                    },
                 };
             }
             return {

package/build/core/settlement/petition-forfeit.js

@@ -1,5 +1,6 @@
 import { forfeitContract } from "../forfeit.js";
 import { readContractLog } from "../log.js";
+import { isCompleteLifecycleOutcome } from "../outcome-base.js";
 function maxArc(entries) {
     return entries.filter((entry) => entry.kind === "arc").length;
 }
@@ -8,32 +9,38 @@ function cleanupWarnings(cleanup) {
         ...(cleanup.worktreeRemoveFailure
             ? [`Could not remove contract worktree ${cleanup.worktreeRemoveFailure.path}: ${cleanup.worktreeRemoveFailure.reason}`]
             : []),
-        ...(cleanup.branchDeleteFailure
-            ? [`Could not delete contract branch ${cleanup.branchDeleteFailure.name}: ${cleanup.branchDeleteFailure.reason}`]
+        ...(cleanup.deliveryRef.status === "mismatch"
+            ? [`Delivery ref ${cleanup.deliveryRef.mismatch.ref} remains present at ${cleanup.deliveryRef.mismatch.observed.head}; terminal replay preserved it as a projected-surface mismatch.`]
             : []),
     ];
 }
-export async function forfeitKeiyaku(context) {
+export async function forfeitKeiyaku(context, signal) {
     const { cwd, baseBranch, contractId } = context;
-    const log = await readContractLog({ cwd, contractId });
+    const log = await readContractLog({ cwd, contractId, signal });
     const forfeited = await forfeitContract({
         cwd,
         contractId,
         actor: "keiyaku",
         nowMs: Date.now(),
         reason: "manual",
+        signal,
     });
+    if (!isCompleteLifecycleOutcome(forfeited))
+        return forfeited;
+    if (!forfeited.cleanup)
+        return forfeited;
     return {
+        ...forfeited,
         status: "success",
         result: "dropped",
         arc: maxArc(log.entries),
         currentBranch: baseBranch,
         baseBranch,
-        ...(forfeited.cleanup.deletedBranch ? { deletedBranch: forfeited.cleanup.deletedBranch } : {}),
         cleanup: forfeited.cleanup,
         ledgerView: log.markdown,
         diff: "Forfeited without merge.",
         droppedChanges: [],
+        carrier: forfeited.carrier,
         ...(cleanupWarnings(forfeited.cleanup).length > 0 ? { meta: { warnings: cleanupWarnings(forfeited.cleanup) } } : {}),
     };
 }

package/build/core/settlement/petition-head-guard.js

@@ -1,10 +1,13 @@
 import { FlowError } from "../../flow-error.js";
-import { getLatestCommitHash } from "../../git/staging.js";
+import { createGit } from "../../git/core.js";
 const CONCURRENT_MODIFICATION_CODE = "CONCURRENT_MODIFICATION";
 export async function assertHeadUnchanged(cwd, expectedHead, operation) {
-    const currentHead = await getLatestCommitHash(cwd);
-    if (currentHead === expectedHead) {
+    const git = createGit(cwd);
+    const [expectedCommit, currentHead] = await Promise.all([
+        git.raw(["rev-parse", "--verify", `${expectedHead}^{commit}`]),
+        git.raw(["rev-parse", "--verify", "HEAD^{commit}"]),
+    ]);
+    if (currentHead.trim() === expectedCommit.trim())
         return;
-    }
-    throw new FlowError(CONCURRENT_MODIFICATION_CODE, `concurrent ${operation} modification detected: repository HEAD changed from ${expectedHead} to ${currentHead} while the ${operation} was running`);
+    throw new FlowError(CONCURRENT_MODIFICATION_CODE, `concurrent ${operation} modification detected: repository HEAD changed from ${expectedHead} to ${currentHead.trim()} while the ${operation} was running`);
 }