@everystack/cli 0.4.93 → 0.4.95

package/src/cli/git-descent.ts

@@ -1,51 +1,30 @@
 /**
- * git-descent — a protected database is a git ref (brick 7 of the
- * migration-authority design).
+ * git-descent — a protected database is a git ref (brick 7 of the migration-authority design).
  *
- * The rule git already taught everyone: `db:apply` is a fast-forward push.
- * The target's live fingerprint maps to the git commit whose committed
- * models DECLARE that state; the deploying checkout must be a descendant
- * of such a commit, or the apply refuses — "rebase first". This is what
- * stops the multi-dev disaster case: A merges and deploys, B (branched
- * before A merged) mints against the target — the concurrency lock passes,
- * because B's plan was minted against current reality, but B's edge would
- * REVERT A's merged work. The descent check catches exactly that: the
- * commit declaring the target's state is not in B's history.
+ * The rule git already taught everyone: `db:apply` is a fast-forward push. The commit that last
+ * deployed the target's state must be in the deploying checkout's history, or the apply refuses —
+ * "rebase first". This stops the multi-dev disaster case: A merges and deploys, B (branched before
+ * A merged) mints against the target — the concurrency lock passes, because B's plan was minted
+ * against current reality, but B's edge would REVERT A's work. The deploying commit is not in B's
+ * history, so B is refused.
  *
- * The search runs over GIT ALONE, never `schema_log` (the ledger is a
- * memoir, not a control surface — design decision 7): enumerate every
- * historical state of the models directory across all refs, compile each
- * unique tree, and ask whether its predicted live endpoint equals the
- * target's live fingerprint (brick 4's merged prediction, so unmodeled
- * brownfield tables ride through the test). Identity is the models-directory
- * TREE, not the commit: a cherry-picked identical state is the same declared
- * state.
+ * The proof reads the `schema_log` ledger and asks git about ancestry — nothing else. A row is a
+ * witness only when its fingerprint matches live (so a stale or forged row proves nothing); the
+ * newest recorded apply's commit must be in HEAD's history either way. A database whose ledger
+ * shows no successful apply was never deployed by everystack, so there is nothing to revert. Any
+ * drift PASSES with its origin recorded; every removal still meets the destructive ceremony.
  *
- * A fingerprint NO commit on ANY ref declares is DRIFT, and proven drift is the
- * operator's decision the design promised: it PASSES at apply. The rule exists to
- * stop an apply from reverting MERGED work, and when no ref anywhere declares the
- * live state there is no merged work to revert — by construction. The proof is
- * refuse-closed: a ref you do not descend from that DOES declare live refuses by
- * name (`declared-elsewhere`, a teammate got there first); a tree that could not be
- * read, or a clone that is shallow, partial, or behind a remote, is UNVERIFIABLE,
- * never drift. `--force-descent` used to be the operator's drift decision; its
- * retirement (2026-08-26) left drift with no escape at all, and a consumer walked
- * into that dead end on 2026-09-07. The proof replaced the flag (Fable-ruled).
+ * Retired 2026-09-25 (Fable-ruled): recompiling every historical models tree to look for one that
+ * declares live. On a consumer with 257 trees it took 7.6 minutes and refused, because 33 no longer
+ * compiled; every path that records an apply already surfaces as the newest ledger row.
  */
 
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import type { ModelDescriptor } from '@everystack/model';
 import type { SchemaSnapshot } from './schema-introspect';
 import type { AuthzContract } from './authz-contract';
 import { fingerprintLive, fingerprintLiveAtVersion, type CanonHasher } from './schema-fingerprint';
-import { predictLiveFingerprint, governedLiveFingerprint } from './edge-plan';
-import { governedRolesForModels } from './schema-fingerprint';
-
-/** Compile a models barrel on disk. The default rides the CLI's runtime (tsx). */
-export type ModelsLoader = (barrel: string) => Promise<ModelDescriptor[]>;
 
 export interface LiveState {
   snapshot: SchemaSnapshot;
@@ -55,23 +34,6 @@ export interface LiveState {
 export interface DescentOptions {
   /** Where git commands run. Default: process.cwd(). */
   cwd?: string;
-  /** The Postgres schema the Models default to. Default: `public`. */
-  schema?: string;
-  loader?: ModelsLoader;
-  /**
-   * How a tree is extracted. Default: {@link materializeTree}.
-   *
-   * Injected for the same reason `loader` is: an in-module call goes through the local
-   * binding, so it cannot be spied on, and extraction failure is a condition that MUST be
-   * covered by a test — it is the one that used to be misreported as database drift.
-   */
-  materialize?: (tree: string, dest: string, cwd: string) => void;
-  /**
-   * Where historical trees materialize. Default: a fresh temp dir under the
-   * repo's node_modules — bare imports (`@everystack/model`) must resolve
-   * from the materialized files, and node walks parent directories.
-   */
-  materializeRoot?: string;
   /** The ref that must descend from the declaring commit. Default: HEAD. */
   headRef?: string;
 }
@@ -97,13 +59,6 @@ function git(args: string[], cwd: string): string | null {
   }
 }
 
-const defaultLoader: ModelsLoader = async (barrel) => {
-  const mod: any = await import(pathToFileURL(path.resolve(barrel)).href);
-  const models = mod.models ?? mod.default;
-  if (!Array.isArray(models)) throw new Error(`${barrel} does not export a \`models\` array`);
-  return models;
-};
-
 /**
  * The SQUASHED SUCCESSOR of a witness commit HEAD does not descend from: an ancestor of HEAD that
  * carries the witness's models tree UNCHANGED (same tree oid) and is not itself an ancestor of
@@ -154,13 +109,9 @@ export function enumerateModelTrees(
   cwd: string,
   opts: { ancestorsOf?: string } = {},
 ): ModelTreeCandidate[] {
-  // Default: every historical state across ALL refs (the whole-history search). With
-  // `ancestorsOf`, restrict to the ancestors of one commit — the fallback proof only ever
-  // considers trees the checkout descends from, so a diverged side branch is not even a
-  // candidate (a non-ancestor declaring commit is the ledger's REVERT case, not recompile's).
-  // `--all` walks refs/stash too. A stash is a WIP snapshot, never a deployed state: one that will
-  // not compile would poison the drift proof to unverifiable, and one that happens to match live
-  // would be named as a teammate's deployment. Excluded here and in refsContaining, consistently.
+  // Default: every historical state across ALL refs. With `ancestorsOf`, only the ancestors of one
+  // commit — the squash-successor check's question. `--all` would walk refs/stash too; a stash is a
+  // WIP snapshot, never a deployed state, so it is excluded.
   const range = opts.ancestorsOf ? [opts.ancestorsOf] : ['--exclude=refs/stash', '--all'];
   const out = git(['rev-list', ...range, '--full-history', '--date-order', '--', modelsDir], cwd);
   if (out === null) return [];
@@ -194,259 +145,6 @@ export function enumerateModelTrees(
   return order.map((tree) => ({ tree, commits: byTree.get(tree)! }));
 }
 
-/**
- * Extract a tree into `dest`, via a temporary archive FILE — never a pipe.
- *
- * This used to buffer `git archive` into memory (512MB `maxBuffer`) and hand that buffer to
- * `tar` as `input`. `execFileSync` writes the whole buffer to the child's stdin, so if the
- * child is not draining it the write fails with **EPIPE** — and under a loaded machine it
- * does. Measured 2026-08-11 on a full-repo run: `spawnSync tar EPIPE`, recorded against a
- * historical tree, twice in four runs.
- *
- * It failed badly, not loudly: the descent recompile recorded it as a COMPILE failure and
- * returned `drift`, telling the operator their database had been hand-edited. See the
- * `unverifiable` verdict for that half of the fix; this is the half that stops the failure happening.
- *
- * `git archive -o` writes the archive itself and `tar -xf <file>` reads it — two independent
- * processes, no shared pipe, no backpressure to lose, and no multi-hundred-MB buffer through
- * the parent. Retrying the pipe harder would only have made it rarer.
- */
-export function materializeTree(tree: string, dest: string, cwd: string): void {
-  fs.mkdirSync(dest, { recursive: true });
-  // Sibling of `dest`, not inside it — a file under `dest` would be extracted over.
-  const archivePath = `${dest}.tar`;
-  try {
-    execFileSync('git', ['archive', '--format=tar', '-o', archivePath, tree], { cwd });
-    execFileSync('tar', ['-xf', archivePath, '-C', dest]);
-  } finally {
-    fs.rmSync(archivePath, { force: true });
-  }
-}
-
-/**
- * TWO KINDS OF FAILURE, and conflating them is what made this path lie once.
- *
- *  - `declares`: this tree's committed models DECLARE the live state (or not) — a real,
- *    deterministic property of the tree.
- *  - `compile-failed`: the tree no longer builds against today's @everystack/model. Also a
- *    real property of the tree; skipping it is correct, but it means the search was not able
- *    to read that state.
- *  - `unevaluated`: extraction (git archive / tar) failed. This says NOTHING about the tree —
- *    we never saw it. Reporting it as drift told operators their database was hand-edited; the
- *    real cause was a lost pipe under load. It must never harden into a drift conclusion.
- */
-type TreeEval =
-  | { kind: 'declares' }
-  | { kind: 'no' }
-  /** `detail` is the one-line record (`<tree> (at <commit>): <error>`); `error` is the bare cause. */
-  | { kind: 'compile-failed'; detail: string; error: string }
-  | { kind: 'unevaluated'; detail: string; error: string };
-
-interface EvalContext {
-  repoRoot: string;
-  materializeRoot: string;
-  barrel: string;
-  loader: ModelsLoader;
-  materialize: (tree: string, dest: string, cwd: string) => void;
-  schema?: string;
-}
-
-/**
- * Materialize a candidate tree (one retry — extraction can fail transiently under load) and
- * ask whether its committed models declare the live state. The declares-test is GOVERNED on
- * both sides, per candidate: the commit's models define the governed set, and the live hash is
- * filtered through the SAME set — comparing a governed prediction against a raw live hash can
- * never match on a brownfield target with foreign roles.
- */
-async function evaluateTree(candidate: ModelTreeCandidate, live: LiveState, ctx: EvalContext): Promise<TreeEval> {
-  const dest = path.join(ctx.materializeRoot, candidate.tree);
-  const where = `${short(candidate.tree)} (at ${short(candidate.commits[0])})`;
-
-  try {
-    if (!fs.existsSync(dest)) ctx.materialize(candidate.tree, dest, ctx.repoRoot);
-  } catch {
-    try {
-      fs.rmSync(dest, { recursive: true, force: true });
-      ctx.materialize(candidate.tree, dest, ctx.repoRoot);
-    } catch (err: any) {
-      const error = `could not extract — ${firstLine(err.message)}`;
-      return { kind: 'unevaluated', detail: `${where}: ${error}`, error };
-    }
-  }
-
-  // A materialized tree that carries NO barrel DECLARES NOTHING — a clean, deterministic 'no',
-  // not a failure to read. Every pre-Models repo has such ancestors: the models directory
-  // scaffolded (or present for another reason) before its barrel existed. Letting the loader
-  // throw on the absent file would classify it `compile-failed`, poisoning the verdict to
-  // UNVERIFIABLE — which sends a never-adopted database to "retry/upgrade" instead of to the
-  // first-adoption lane (db:pull → commit → db:plan). So the missing barrel is decided here,
-  // before the loader is ever consulted.
-  const barrelPath = path.join(dest, ctx.barrel);
-  if (!fs.existsSync(barrelPath)) return { kind: 'no' };
-
-  const evaluate = async (): Promise<boolean> => {
-    const models = await ctx.loader(barrelPath);
-    // A barrel that compiles to ZERO models declares NOTHING. The prediction rides every
-    // undeclared live table through unchanged, so an empty models array "predicts" any live
-    // state exactly — it would declare every database there is. Absent barrel and empty barrel
-    // are the same clean 'no'. (Closing-gate review round 2, 2026-09-07: on a side branch this
-    // minted a false declared-elsewhere; as a HEAD ancestor it silently proved a fast-forward.)
-    if (models.length === 0) return false;
-    const governedRoles = governedRolesForModels(models);
-    const predicted = predictLiveFingerprint(models, live.snapshot, live.contract, { schema: ctx.schema, governedRoles });
-    return predicted === governedLiveFingerprint(live.snapshot, live.contract, governedRoles);
-  };
-  try {
-    let declares: boolean;
-    try {
-      declares = await evaluate();
-    } catch {
-      declares = await evaluate();
-    }
-    return declares ? { kind: 'declares' } : { kind: 'no' };
-  } catch (err: any) {
-    const error = firstLine(err.message);
-    return { kind: 'compile-failed', detail: `${where}: ${error}`, error };
-  }
-}
-
-/** One tree the walk could not read, with where it sits in history — the refusal names it. */
-interface UnreadableTree {
-  candidate: ModelTreeCandidate;
-  /** Carried by a commit HEAD descends from — no ref prune removes it. */
-  ancestor: boolean;
-  error: string;
-}
-
-/** The git verb that removes one ref, or null for a ref shape we do not prescribe deleting. */
-export function pruneCommand(ref: string): string | null {
-  const head = ref.match(/^refs\/heads\/(.+)$/);
-  if (head) return `git branch -D ${head[1]}`;
-  const remote = ref.match(/^refs\/remotes\/([^/]+)\/(.+)$/);
-  if (remote) return `git push ${remote[1]} --delete ${remote[2]}`;
-  const tag = ref.match(/^refs\/tags\/(.+)$/);
-  if (tag) return `git tag -d ${tag[1]}`;
-  return null;
-}
-
-/**
- * The unreadable-tree refusal, built from what the walk KNOWS: each tree, the refs that carry it,
- * whether HEAD descends from it, and what the target's ledger says about who deployed what.
- *
- * Consumer cutover, cli 0.4.77 (2026-09-07): four August trees carried only by one backup branch
- * on origin refused a production apply, and the message led with "upgrade/pin the CLI that last
- * deployed this state" — on a database no CLI had ever deployed (schema_log was empty). The
- * operator reconstructed the carrying ref with `git rev-list --all -- db/models` and a per-tree
- * grep. Every fact in that reconstruction was already in this function's hands.
- *
- * The verdict does not change here; only the account of it. A tree we cannot read may still
- * describe live, so the walk stays refuse-closed; the ledger is a memoir and never decides
- * (decision 7). What the ledger DOES decide is which fix comes first: with no recorded apply,
- * no CLI deployed these trees and "pin the CLI" is false, so bundle + prune leads; with one, pin
- * the CLI only when the recorded commit is itself among the unreadable trees.
- */
-function unreadableRunbook(
-  unreadable: readonly UnreadableTree[],
-  lastApplied: DescentLedgerRow | undefined,
-  probe: GitLineageProbe,
-): string {
-  // Bounded on both axes, because this reason is RECORDED in schema_log and each ref lookup is a
-  // full ref walk: at most MAX_TREES trees are named, and a tree's refs are the union over its
-  // first MAX_COMMITS carrying commits (a tree is often carried by several commits on several
-  // branches — naming one commit's refs under-named the prune; closing-gate review, 2026-09-07).
-  const MAX_TREES = 10;
-  const MAX_COMMITS = 5;
-  const listed = unreadable.slice(0, MAX_TREES);
-  const refsOf = new Map<string, string[]>();
-  for (const u of listed) {
-    const refs = new Set<string>();
-    for (const commit of u.candidate.commits.slice(0, MAX_COMMITS)) {
-      for (const ref of probe.refsContaining(commit)) if (ref !== 'refs/stash') refs.add(ref);
-    }
-    refsOf.set(u.candidate.tree, [...refs].sort());
-  }
-  const lines = listed.map((u) => {
-    const refs = refsOf.get(u.candidate.tree)!;
-    const carried = refs.length === 0
-      ? 'carried by no ref'
-      : `carried by ${refs.slice(0, 3).join(', ')}${refs.length > 3 ? ` and ${refs.length - 3} more` : ''}`;
-    const where = u.ancestor ? "on your checkout's own history" : 'not an ancestor of your checkout';
-    return `  ${short(u.candidate.tree)} at ${short(u.candidate.commits[0])} — ${carried} (${where}) — ${scrubPaths(u.error)}`;
-  });
-  if (unreadable.length > listed.length) {
-    lines.push(`  … and ${unreadable.length - listed.length} more unreadable tree(s) not listed — their refs are not in the prune list below; re-run after pruning to see them`);
-  }
-
-  const prunable = listed.filter((u) => !u.ancestor);
-  const ancestors = unreadable.filter((u) => u.ancestor);
-  const pruneRefs = [...new Set(prunable.flatMap((u) => refsOf.get(u.candidate.tree)!))];
-  const pruneCmds = pruneRefs.map(pruneCommand).filter((c): c is string => c !== null);
-  const prune = pruneRefs.length === 0
-    ? ''
-    : `Keep them if you want (git bundle create unreadable-trees.bundle ${pruneRefs.join(' ')}), then prune: ${pruneCmds.join('; ')}; then re-run.`;
-  const rewrite = ancestors.length === 0
-    ? ''
-    : `${ancestors.length === unreadable.length ? 'These trees are' : `${ancestors.length} of them ${ancestors.length === 1 ? 'is' : 'are'}`} on your checkout's own history, which no ref prune removes; the walk needs every ancestor tree readable. Rewriting that history is the git-native remedy — keep it first (git bundle create everything.bundle --all).`;
-
-  let lead: string;
-  if (!lastApplied) {
-    lead = 'No everystack apply is recorded on this target, so no CLI deployed these trees.';
-  } else {
-    const at = lastApplied.gitRef ? `at ${short(lastApplied.gitRef)} ` : '';
-    const among = lastApplied.gitRef !== null && unreadable.some((u) => u.candidate.commits.includes(lastApplied.gitRef!));
-    lead = `everystack last applied here ${at}on ${shortDate(lastApplied.appliedAt)}.`
-      + (among ? ' That commit is among the unreadable trees — pin the CLI that applied it (the version in that commit\'s lockfile) and re-run.' : '');
-    if (among) return `${lines.join('\n')}\n${lead}`;
-  }
-  return `${lines.join('\n')}\n${[lead, prune, rewrite].filter(Boolean).join(' ')}`;
-}
-
-/**
- * A compile/extraction error, summarized for a refusal that is RECORDED in a shared stage's
- * schema_log: the cause, never the operator's filesystem.
- *
- *  - MODULE_NOT_FOUND: line 1 is the cause ("Cannot find module '@everystack/model'"); the
- *    `Require stack:` that follows is absolute local paths — dropped.
- *  - An esbuild TransformError (the "older tree that no longer builds" case): line 1 is only the
- *    header "Transform failed with 1 error:" and the cause is on line 2 — kept, with the sandbox
- *    path prefix stripped so what remains is `db/models/index.ts:2:0: ERROR: …`.
- *  - An empty message says so instead of rendering nothing.
- *
- * (Closing-gate review round 5: a bare first-line take blanked the cause on exactly the class the
- * `unverifiable` message exists to explain.)
- */
-export function summarizeCompileError(message: unknown): string {
-  const lines = String(message ?? '').split('\n').map((l) => l.trimEnd());
-  const stop = lines.findIndex((l) => /^\s*Require stack:/.test(l));
-  const useful = (stop === -1 ? lines : lines.slice(0, stop)).filter((l) => l.trim().length > 0);
-  if (useful.length === 0) return '(error with no message)';
-  const take = /^Transform failed with \d+ errors?:?$/.test(useful[0].trim()) && useful.length > 1 ? useful.slice(0, 2) : useful.slice(0, 1);
-  return take
-    .map((l) => l.replace(/\/[^\s:'"]*\.everystack-descent-[^/\s]+\/[0-9a-f]+\//g, '').trim())
-    .join(' — ');
-}
-const firstLine = summarizeCompileError;
-
-/**
- * Where historical trees materialize so that the materialized barrel can `import '@everystack/model'`:
- * node walks UP from the importing file, so the sandbox must sit below a `node_modules` that holds
- * the package. That is the nearest `node_modules` ABOVE THE MODELS BARREL, not the repo root's —
- * in a monorepo the app (`apps/expo/db/models`) has `apps/expo/node_modules`, and the root
- * `node_modules` may not carry the package at all (closing-gate review round 4, reproduced). No
- * `node_modules` anywhere up to the repo root → the repo root itself (a nested checkout still walks
- * up to its host's). Never the OS temp dir — that resolves nothing (the 0.4.74 sandbox-resolution bug).
- */
-export function materializeBase(repoRoot: string, modelsAbs: string): string {
-  let dir = path.dirname(modelsAbs);
-  while (dir.startsWith(repoRoot)) {
-    const nm = path.join(dir, 'node_modules');
-    if (fs.existsSync(nm)) return nm;
-    if (dir === repoRoot) break;
-    dir = path.dirname(dir);
-  }
-  return repoRoot;
-}
-
 /** Resolve the repo root, HEAD, and the models directory/barrel split — shared setup. */
 function resolveRepoContext(
   modelsPath: string,
@@ -737,182 +435,204 @@ export interface DescentLedgerRow {
 export const isAppliedOutcome = (outcome: string): boolean => outcome === 'applied' || outcome.startsWith('applied — ');
 
 /**
- * Where a proven drift came from — informs the warning and the schema_log note, never the
- * verdict (the ledger is a memoir, decision 7). `never-declared`: no successful state apply is
- * recorded here — first adoption of a database everystack never wrote. `hand-edited`: everystack
- * did apply here once (the newest such row is named), and the database has moved since, outside
- * the tool.
+ * Where a drift came from — informs the warning and the schema_log note, never the verdict.
+ * `never-declared`: no successful apply here recorded a commit — none at all (first adoption), or
+ * only no-git ones. `hand-edited`: everystack applied here from `commit`, your checkout contains it,
+ * and the database has moved since, outside the tool.
  */
 export type DriftOrigin =
-  | { kind: 'never-declared' }
+  | { kind: 'never-declared'; skipped?: NeverDeclaredSkip }
   /** `dirty`: that last apply ran from a dirty worktree, so its commit never declared what it applied. */
-  | { kind: 'hand-edited'; commit: string | null; appliedAt: string; dirty?: boolean };
+  | { kind: 'hand-edited'; commit: string; appliedAt: string; dirty?: boolean };
 
 export type ProveVerdict =
   /** The database has no tables — first apply bootstraps it. */
   | { status: 'fresh-target' }
   /** Not a git checkout — the rule cannot be verified here. */
   | { status: 'no-git' }
-  /** Fast-forward proven — via a ledger witness, its squashed successor, or an ancestor recompile.
-   *  For `squash`, `commit` is the CARRIER (an ancestor of HEAD holding the deploying commit's
-   *  models tree) and `witness` is the deploying commit the ledger names, which HEAD does not
-   *  descend from — both are surfaced and the weaker proof is recorded in schema_log. */
-  | { status: 'proven'; via: 'ledger' | 'squash' | 'recompile'; commit: string; witness?: string }
-  /** The newest ledger witness is NOT an ancestor of HEAD — applying would revert merged work. */
+  /** Fast-forward proven by a ledger witness, or by its squashed successor. For `squash`, `commit`
+   *  is the CARRIER (an ancestor of HEAD holding the deploying commit's models tree) and `witness`
+   *  is the deploying commit the ledger names — both surfaced, the weaker proof recorded. */
+  | { status: 'proven'; via: 'ledger' | 'squash'; commit: string; witness?: string; newerOffHead?: { commit: string; appliedAt: string } }
+  /** The deploying commit is NOT in HEAD's history — applying would revert deployed work. */
   | { status: 'revert'; commit: string; appliedAt: string; reason: string }
-  /** The witness names a commit this clone does not have (shallow) — fetch, do not guess. */
+  /** The ledger names a commit this clone does not have — fetch, do not guess. */
   | { status: 'unknown-commit'; commit: string; reason: string }
-  /** A ref HEAD does not descend from declares the live state — a teammate's merged work. */
-  | { status: 'declared-elsewhere'; commit: string; reason: string }
-  /** The search could not read every tree, or the clone is not full and current — inconclusive. */
-  | { status: 'unverifiable'; reason: string; unevaluated: string[]; compileFailures: string[] }
-  /** Every tree on every ref read cleanly in a full, current clone, and none declares live —
-   *  PROVEN drift. Passes at apply: nothing merged exists to revert. */
-  | { status: 'drift'; reason: string; scannedTrees: number; origin: DriftOrigin };
+  /** The ledger could not be read, so it cannot vouch for anything — retry. */
+  | { status: 'unverifiable'; reason: string }
+  /** No recorded apply matches live, and nothing deployed is outside HEAD's history. Passes at
+   *  apply: the reviewed plan becomes the origin every later apply descends from. */
+  | { status: 'drift'; reason: string; origin: DriftOrigin };
+
+/**
+ * What the schema_log read found, told apart from the rows. Only a clean read may say the ledger is
+ * empty: a ledger that could not be read is not an empty one.
+ */
+export type LedgerRead =
+  | { kind: 'absent' }
+  /** `applied` counts every successful state apply, not only the witness rows the proof can use. */
+  | { kind: 'present'; applied: number; refusals: number; anchored: boolean }
+  | { kind: 'unreadable'; reason: string };
+
+/** The record of a never-declared verdict — the only forensic trace that separates a wiped ledger from a new one. */
+export interface NeverDeclaredSkip {
+  ledger: 'absent' | 'present';
+  /** Successful applies on record — none of which recorded a commit. */
+  applied: number;
+  refusals: number;
+  head: string;
+  from: string;
+}
+
+/** Printed on every plan and apply of a never-declared database — never behind --verbose. */
+export const NEVER_DECLARED_NOTICE =
+  "No prior everystack apply on this database. Descent proof skipped — everystack cannot tell if this schema came from another branch. " +
+  "Another branch's `db:pull` may describe this database; if one exists, merge it first. The plan's drops are the whole review.";
 
 export interface ProveDescentOptions extends DescentOptions {
+  /** What the ledger read proved (readDescentLedgerRead / liveBaseAndLedger). Required: "empty" is
+   *  only ever believed from a read that says so. */
+  ledgerRead: LedgerRead;
   /** Retained-canon registry override — the cross-bump recompute path (tests inject a
    *  synthetic retired canon). Defaults to the module's RETAINED_CANONS. */
   canons?: Readonly<Record<number, CanonHasher>>;
-  /** The git probe the drift proof uses to establish the clone is full and current.
-   *  Default: {@link realLineageProbe} over the repo root. Injected so tests can prove each
-   *  currency refusal without a remote. */
-  probe?: GitLineageProbe;
 }
 
 const shortDate = (at: string): string => at.slice(0, 10);
 
 /**
- * The origin, in words — ONE rendering for the plan warning, the apply warning, and the recorded
- * note, so the dirty-worktree sub-case can never be surfaced in one place and dropped in another
- * (closing-gate review round 4: the flag was computed and reached no human and no record).
+ * The origin, in words — ONE rendering for the recorded note, so no sub-case is surfaced in one
+ * place and dropped in another (closing-gate review round 4).
  *
- *   never-declared                      — no everystack apply is recorded here
- *   hand-edited since <sha>, <date>     — everystack applied from that commit; the database moved since
- *   applied from a DIRTY worktree at <sha>, <date> — that commit never declared what was applied,
- *                                          so nothing committed can declare this state
+ *   never-declared (ledger: …; ancestry walk retired; HEAD …; from …)
+ *   hand-edited since <sha>, <date>
+ *   applied from a DIRTY worktree at <sha>, <date>
  */
-export function describeDriftOrigin(origin: DriftOrigin, opts: { human?: boolean } = {}): string {
-  if (origin.kind === 'never-declared') return opts.human ? 'never declared: no everystack apply is recorded here' : 'never-declared';
-  const at = origin.commit ? `${short(origin.commit)}, ${shortDate(origin.appliedAt)}` : `an apply on ${shortDate(origin.appliedAt)}`;
+export function describeDriftOrigin(origin: DriftOrigin): string {
+  if (origin.kind === 'never-declared') {
+    const s = origin.skipped;
+    if (!s) return 'never-declared';
+    const ledger = s.ledger === 'absent'
+      ? 'absent'
+      : s.applied === 0
+        ? `present, 0 successful, ${s.refusals} refusal(s)`
+        : `present, ${s.applied} successful, 0 anchored, ${s.refusals} refusal(s)`;
+    return `never-declared (ledger: ${ledger}; ancestry walk retired; HEAD ${short(s.head)}; from ${short(s.from)})`;
+  }
+  const at = `${short(origin.commit)}, ${shortDate(origin.appliedAt)}`;
   return origin.dirty ? `applied from a DIRTY worktree at ${at}` : `hand-edited since ${at}`;
 }
 
-/** The recorded note for a proven drift — goes in the apply row's schema_log outcome. */
+/** The recorded note for a drift — goes in the apply row's schema_log outcome. */
 export function driftOriginNote(origin: DriftOrigin): string {
-  return `descent: drift-origin proven (${describeDriftOrigin(origin)})`;
+  return `descent: drift-origin ${describeDriftOrigin(origin)}`;
+}
+
+/** The loud line plan and apply both print for a drift — never behind --verbose. */
+export function driftNotice(origin: DriftOrigin): string {
+  if (origin.kind === 'never-declared') {
+    const applied = origin.skipped?.applied ?? 0;
+    if (applied === 0) return NEVER_DECLARED_NOTICE;
+    return `everystack has applied here ${applied} time(s), but none recorded a commit (no git checkout), so nothing ` +
+      'deployed from any branch is on record. Descent proof skipped — everystack cannot tell if this schema came from ' +
+      "another branch. Another branch's `db:pull` may describe this database; if one exists, merge it first. The " +
+      "plan's drops are the whole review.";
+  }
+  const dirty = origin.dirty ? ' That apply ran from a DIRTY worktree, so its commit never declared what it applied.' : '';
+  return `This database changed since everystack last applied here from ${short(origin.commit)} (${shortDate(origin.appliedAt)}), ` +
+    `and no recorded apply matches it now.${dirty} Your checkout contains that commit, so nothing deployed is reverted. ` +
+    "everystack cannot tell whether another branch's Models describe this state. The plan's drops are the whole review.";
 }
 
-/**
- * Is this clone full and current with every remote? The drift proof's precondition: "no ref
- * anywhere declares live" is only a claim we may make when we hold every ref there is. Same
- * probe as the lineage proof, but the question differs — currency, not the fate of one commit —
- * so an empty remote set is simply current (a purely local repo has nothing to be behind).
- * Refuse-closed: a failed `git remote` or an unreachable remote is NOT current.
- *
- * The test is REF reachability, never object presence. The scan this guards is `git rev-list
- * --all`, which walks refs; an advertised tip that is present as an object but contained by no
- * ref (a `git fetch origin <branch>` that wrote only FETCH_HEAD, or a locally deleted branch
- * the remote still has) is invisible to the scan and MUST count as behind. Testing
- * `objectExists` here let exactly that tip satisfy currency while the scan missed the models
- * it declared — found by the closing-gate review 2026-09-07, before it shipped.
- */
-export function proveCloneCurrent(git: GitLineageProbe): { current: true } | { current: false; reason: string } {
-  if (git.isShallow()) {
-    return { current: false, reason: 'this is a shallow clone, so a ref that declares the live state may simply not be here — unshallow first (git fetch --unshallow), then re-run.' };
-  }
-  if (git.isPartial()) {
-    return { current: false, reason: 'this is a partial clone, so objects can be missing locally — fetch the full history, then re-run.' };
-  }
-  const remotes = git.remotes();
-  if (remotes === null) {
-    return { current: false, reason: "could not list this repo's git remotes to confirm the clone is current — retry, or fetch the remotes first." };
-  }
-  for (const remote of remotes) {
-    const tips = git.lsRemote(remote);
-    if (tips === null) {
-      return { current: false, reason: `cannot confirm the clone is current: ${unreadableRemote(remote, git)}` };
-    }
-    for (const tip of tips) {
-      // refs/stash is excluded from the scan (enumerateModelTrees), so a tip contained ONLY by a
-      // stash counts as behind here — the two sides of the currency proof see the same refs, and
-      // this direction is refuse-closed. The probe itself stays raw: for the lineage proof a stash
-      // that reaches a commit is a REACHABLE commit, and filtering it there would fall open.
-      if (git.refsContaining(tip).filter((ref) => ref !== 'refs/stash').length === 0) {
-        // A tip we HOLD that is not a commit and peels to none (a tag on a blob or tree — the
-        // `junio-gpg-pub` shape) carries no models and can never be contained by a ref; it is
-        // not evidence of being behind. An ABSENT tip, or a present commit no ref contains, is.
-        if (git.peelsToCommit && git.peelsToCommit(tip) === false) continue;
-        return { current: false, reason: `this clone is behind ${remote} (it advertises ${short(tip)}, which no ref here contains) — fetch it first (git fetch ${remote} --tags); a ref there may declare the live state.` };
-      }
-    }
-  }
-  return { current: true };
+/** Said beside a PROVEN verdict when a newer apply came from a commit outside HEAD's history — disclosure, not a gate. */
+export function newerOffHeadNotice(verdict: ProveVerdict): string | null {
+  if (verdict.status !== 'proven' || !verdict.newerOffHead) return null;
+  const n = verdict.newerOffHead;
+  return `descent: a newer apply (${short(n.commit)}, ${shortDate(n.appliedAt)}) came from a commit outside your history; ` +
+    'the database has since returned to a state your checkout declares. Applying moves forward from here.';
 }
 
 /**
- * The fast-forward proof, ledger-first. Refuse-closed: no inconclusive branch passes.
+ * The fast-forward proof: the ledger and git ancestry, nothing else. Refuse-closed.
  *
- *   Phase A — the newest successful ledger row whose `to_fingerprint` matches the live state
- *   (recomputed under the ROW'S canon) and whose git_ref is usable (non-null, not a dirty
- *   mint) is THE witness — newest wins. Ancestor of HEAD → PROVEN; not an ancestor → REVERT;
- *   absent from the clone → UNKNOWN-COMMIT. A null git_ref, a dirty mint, an unrecomputable
- *   canon (pre-fp_version or a retired canon we no longer retain), or a non-matching
- *   fingerprint SKIPS the row — the search continues to older rows.
+ *   Ledger witness — the newest successful row whose `to_fingerprint` matches live (recomputed
+ *   under the ROW'S canon) with a usable git_ref (non-null, not a dirty mint). Ancestor of HEAD →
+ *   PROVEN; a squashed successor → PROVEN via squash; absent → UNKNOWN-COMMIT; else REVERT.
  *
- *   Phase B — no usable ledger witness: recompile RESTRICTED TO HEAD ANCESTORS. A declaring
- *   ancestor → PROVEN. Otherwise the classification is honest about what it could read: any
- *   tree we could not extract or compile makes "nothing declares this" a claim we cannot make
- *   → UNVERIFIABLE (never "drift"). Only a clean, exhaustive no-match is DRIFT.
+ *   No witness — W is the newest successful row with a git_ref (a legacy row with no fp_version,
+ *   or a dirty one, still anchors ancestry). W absent → UNKNOWN-COMMIT; W outside HEAD's history
+ *   (no squashed successor) → REVERT; else DRIFT, hand-edited since W. No W on a clean read (no
+ *   apply, or none that recorded a commit) → DRIFT, never-declared. A drift never rests on an
+ *   unreadable read → UNVERIFIABLE.
  *
- * The old descent recompiled ALL history under the CURRENT CLI, so a stage whose declaring
- * commit no longer compiled was reported as drift and stranded. Phase A never recompiles; the
- * ledger carries the proof across a canon or API bump.
+ * Retired 2026-09-25 (Fable-ruled): recompiling every historical models tree to look for one that
+ * declares live. Every path that records an apply surfaces as the newest row and is checked above;
+ * what the walk added was a label, and on a consumer with 257 trees it took 7.6 minutes and then
+ * refused because 33 no longer compiled. Every removal still meets the destructive ceremony.
  */
 export async function proveDescent(
   modelsPath: string,
   live: LiveState,
   ledger: DescentLedgerRow[],
-  opts: ProveDescentOptions = {},
+  opts: ProveDescentOptions,
 ): Promise<ProveVerdict> {
   if (live.snapshot.tables.length === 0) return { status: 'fresh-target' };
 
   const ctx = resolveRepoContext(modelsPath, opts);
   if (ctx === null) return { status: 'no-git' };
-  const { repoRoot, head, modelsDir, barrel, modelsAbs } = ctx;
+  const { repoRoot, head, modelsDir } = ctx;
 
-  // ---- Phase A: the ledger witness (newest usable row wins). ----
-  // "Newest wins" (the S→T→S pre-episode refusal) is a security-relevant property, so do not
-  // TRUST the caller's ordering — enforce it. Production callers read ORDER BY id DESC, but a
-  // future caller passing an unsorted ledger must not silently let a pre-episode row win.
+  // "Newest wins" (the S→T→S pre-episode refusal) is security-relevant, so enforce the order here.
   const ordered = [...ledger].sort((a, b) => Number(b.id) - Number(a.id));
-  for (const r of ordered) {
-    if (!isAppliedOutcome(r.outcome)) continue; // only a successful state apply is a witness
-    if (!r.toFingerprint) continue;
-    if (!r.gitRef) continue; // a null git_ref cannot declare a commit
-    if (r.dirty) continue; // a dirty mint's git_ref does not declare what was applied
-    const liveFp = fingerprintLiveAtVersion(r.fpVersion, live.snapshot, live.contract, {}, opts.canons);
-    if (liveFp === null) continue; // canon we cannot reproduce — skip, never guess
-    if (liveFp !== r.toFingerprint) continue; // not this witness (a stale/forged hash fails here)
+  const applied = ordered.filter((r) => isAppliedOutcome(r.outcome));
+  const read = opts.ledgerRead;
+  // The anchor: the newest SUCCESSFUL apply that recorded a commit. Refusal rows never anchor, and a
+  // newer no-git row never hides an older commit — the read fetches this row uncapped.
+  const w = applied.find((r) => r.gitRef);
+  const outsideHead = (commit: string): boolean =>
+    !isAncestor(commit, head, repoRoot) && !squashedSuccessor(commit, head, modelsDir, repoRoot);
+  const unverifiable = (reason: string): ProveVerdict => ({
+    status: 'unverifiable',
+    reason:
+      `cannot verify the fast-forward rule — everystack.schema_log could not be read (${reason}). ` +
+      'An unreadable ledger is not an empty one, so this is NOT drift. Retry; if it persists, the ' +
+      'connection needs SELECT on everystack.schema_log.',
+  });
 
-    // r is THE witness — the newest matching row with a usable git_ref. Decide on it; do not
-    // fall back to an older row (the pre-episode branch of an S→T→S history is refused).
-    if (!commitPresent(r.gitRef, repoRoot)) {
+  const behind = (commit: string, appliedAt: string, what: string): ProveVerdict | null => {
+    if (!commitPresent(commit, repoRoot)) {
       return {
         status: 'unknown-commit',
-        commit: r.gitRef,
+        commit,
         reason:
-          `the commit that last deployed this state (${short(r.gitRef)}) is not in this clone — ` +
-          'it is a shallow checkout, or the branch was not fetched. Fetch the full history ' +
-          '(git fetch --unshallow, or fetch the deploying branch) and re-run; the fast-forward ' +
-          'rule cannot be proven against a commit you do not have.',
+          `${what} (${short(commit)}, ${shortDate(appliedAt)}) is not in this clone — it is a shallow checkout, ` +
+          'or the branch was not fetched. Fetch the full history (git fetch --unshallow, or fetch the deploying ' +
+          'branch) and re-run; the fast-forward rule cannot be proven against a commit you do not have.',
       };
     }
-    if (isAncestor(r.gitRef, head, repoRoot)) {
-      return { status: 'proven', via: 'ledger', commit: r.gitRef };
+    return null;
+  };
+
+  // ---- The ledger witness (newest usable matching row wins). ----
+  for (const r of applied) {
+    if (!r.toFingerprint || !r.gitRef || r.dirty) continue;
+    const liveFp = fingerprintLiveAtVersion(r.fpVersion, live.snapshot, live.contract, {}, opts.canons);
+    if (liveFp === null || liveFp !== r.toFingerprint) continue; // unrecomputable canon, or not this state
+    const missing = behind(r.gitRef, r.appliedAt, 'the commit that last deployed this state');
+    if (missing) return missing;
+    const ancestor = isAncestor(r.gitRef, head, repoRoot);
+    const squash = ancestor ? null : squashedSuccessor(r.gitRef, head, modelsDir, repoRoot);
+    if (ancestor || squash) {
+      const proven: ProveVerdict = squash
+        ? { status: 'proven', via: 'squash', commit: squash, witness: r.gitRef }
+        : { status: 'proven', via: 'ledger', commit: r.gitRef };
+      // A NEWER apply from outside HEAD's history, since reverted to this state by hand: the proof
+      // stands (live is what HEAD declares), but the operator is told.
+      if (w && Number(w.id) > Number(r.id) && w.gitRef !== r.gitRef && commitPresent(w.gitRef!, repoRoot) && outsideHead(w.gitRef!)) {
+        return { ...proven, newerOffHead: { commit: w.gitRef!, appliedAt: w.appliedAt } };
+      }
+      return proven;
     }
-    const squash = squashedSuccessor(r.gitRef, head, modelsDir, repoRoot);
-    if (squash) return { status: 'proven', via: 'squash', commit: squash, witness: r.gitRef };
     return {
       status: 'revert',
       commit: r.gitRef,
@@ -925,184 +645,55 @@ export async function proveDescent(
     };
   }
 
-  // ---- Phase B: no usable ledger witness → ancestor-restricted recompile. ----
-  const candidates = enumerateModelTrees(modelsDir, repoRoot, { ancestorsOf: head });
-
-  // No ancestor carries a committed models directory to compare against — a shallow clone that
-  // truncated the deploying history, or the deploying branch is simply not in this checkout.
-  // That is a limit of THIS clone, not a hand-edit: UNVERIFIABLE, never drift.
-  if (candidates.length === 0) {
-    return {
-      status: 'unverifiable',
-      reason:
-        'cannot verify the fast-forward rule — no ancestor of your checkout carries a committed ' +
-        'models directory to compare against. This is a shallow clone (fetch the full history: ' +
-        'git fetch --unshallow) or the deploying branch is not in this checkout, not evidence ' +
-        'about the database — it is NOT drift. Fetch the deploying history and re-run.',
-      unevaluated: [],
-      compileFailures: [],
-    };
-  }
-
-  // Historical trees materialize INSIDE the project, below the nearest node_modules above the
-  // models barrel — see materializeBase. Never the OS temp dir.
-  const materializeRoot = opts.materializeRoot
-    ?? fs.mkdtempSync(path.join(materializeBase(repoRoot, modelsAbs), '.everystack-descent-'));
-  const ownsRoot = !opts.materializeRoot;
-  const evalCtx: EvalContext = {
-    repoRoot,
-    materializeRoot,
-    barrel,
-    loader: opts.loader ?? defaultLoader,
-    materialize: opts.materialize ?? materializeTree,
-    schema: opts.schema,
-  };
-
-  const compileFailures: string[] = [];
-  const unevaluated: string[] = [];
-  const unreadable: UnreadableTree[] = [];
-  const probe = opts.probe ?? realLineageProbe(repoRoot);
-  const lastApplied = ordered.find((r) => isAppliedOutcome(r.outcome));
-  const unverifiable = (scope: string, scanned: number): ProveVerdict => {
-    const notes: string[] = [];
-    if (compileFailures.length > 0) notes.push(`${compileFailures.length} would not compile under this CLI`);
-    if (unevaluated.length > 0) notes.push(`${unevaluated.length} could not be extracted`);
-    // Every unreadable tree is NAMED — with the refs that carry it, its place in history, and its
-    // own error ("Cannot find module '@everystack/model'" is a resolution problem with a different
-    // fix than "an older tree that no longer builds") — and the runbook leads with the fix the
-    // ledger supports. See unreadableRunbook for the incident that shaped this.
-    return {
-      status: 'unverifiable',
-      reason:
-        `cannot verify the fast-forward rule — of ${scanned} ${scope} model state(s), ` +
-        `${notes.join(' and ')}, and none of the readable ones declares the live state. This is a ` +
-        'limit of THIS run (an older tree that no longer builds, or a failed extraction), not ' +
-        `evidence about the database — it is NOT drift. Unreadable:\n${unreadableRunbook(unreadable, lastApplied, probe)}`,
-      unevaluated,
-      compileFailures,
-    };
-  };
-  const record = (candidate: ModelTreeCandidate, result: Extract<TreeEval, { error: string }>, ancestor: boolean): void => {
-    (result.kind === 'unevaluated' ? unevaluated : compileFailures).push(result.detail);
-    unreadable.push({ candidate, ancestor, error: result.error });
-  };
-
-  let others: ModelTreeCandidate[] = [];
-  try {
-    for (const candidate of candidates) {
-      const result = await evaluateTree(candidate, live, evalCtx);
-      if (result.kind === 'unevaluated' || result.kind === 'compile-failed') {
-        record(candidate, result, true);
-        continue;
-      }
-      if (result.kind === 'no') continue;
-      // Enumerated over HEAD's ancestors, so every commit here descends into HEAD — but confirm,
-      // since a tree can be carried by commits on more than one line of history.
-      const ancestor = candidate.commits.find((commit) => isAncestor(commit, head, repoRoot)) ?? candidate.commits[0];
-      return { status: 'proven', via: 'recompile', commit: ancestor };
-    }
-
-    // A tree we could not READ is not evidence about the database. If any ancestor tree could not
-    // be extracted or compiled, "nothing declares this state" is a claim we are not entitled to
-    // make — the answer is UNVERIFIABLE, and its next move is retry/upgrade, never db:pull.
-    if (unevaluated.length > 0 || compileFailures.length > 0) return unverifiable('ancestor', candidates.length);
-
-    // ---- Phase C: the drift proof — no ancestor declares live, so scan EVERY ref. ----
-    // The fast-forward rule protects MERGED work. Before calling the live state undeclared, look
-    // at every tree on every ref this clone holds: one that declares live belongs to a line of
-    // history HEAD does not descend from — a teammate deployed it — and applying our edge would
-    // revert it. That refuses BY NAME. Only when no tree anywhere declares live is there nothing
-    // to protect.
-    const seen = new Set(candidates.map((c) => c.tree));
-    const all = enumerateModelTrees(modelsDir, repoRoot);
-    // The all-refs walk must be a SUPERSET of the ancestor walk — every ancestor tree is reachable
-    // from `--all`. When it is not, `git rev-list --all` failed (a broken or dangling ref makes it
-    // exit 128 while the ancestor walk still succeeds) and returned nothing, which is NOT "no
-    // other refs". Reading an empty result as "nothing else declares live" fell open to drift;
-    // found by the closing-gate review 2026-09-07.
-    const allTrees = new Set(all.map((c) => c.tree));
-    if ([...seen].some((tree) => !allTrees.has(tree))) {
-      return {
-        status: 'unverifiable',
-        reason:
-          'cannot verify the fast-forward rule — the walk over EVERY ref (git rev-list --all) did not ' +
-          'return the trees the ancestor walk did, so it failed part-way: a broken or dangling ref ' +
-          '(run `git fsck`, prune the bad ref) or a git error. That is a limit of THIS clone, not ' +
-          'evidence about the database — it is NOT drift. Repair the ref and re-run.',
-        unevaluated,
-        compileFailures,
-      };
-    }
-    // Currency BEFORE the all-refs compile: a clone that is shallow, partial, or behind a remote
-    // is told to fetch now, not after paying for every historical tree on every ref.
-    const currency = proveCloneCurrent(probe);
-    if (!currency.current) {
-      return {
-        status: 'unverifiable',
-        reason:
-          `cannot verify the fast-forward rule — no ancestor of your checkout declares the live state, and ` +
-          `${currency.reason} That is a limit of THIS clone, not evidence about the database — it is NOT drift.`,
-        unevaluated,
-        compileFailures,
-      };
-    }
-    others = all.filter((c) => !seen.has(c.tree));
-    for (const candidate of others) {
-      const result = await evaluateTree(candidate, live, evalCtx);
-      if (result.kind === 'unevaluated' || result.kind === 'compile-failed') {
-        record(candidate, result, false);
-        continue;
-      }
-      if (result.kind === 'no') continue;
-      const commit = candidate.commits[0];
+  // ---- No witness: the last deployed commit must be in your history. ----
+  // On the stage lane this ledger read and the fingerprint read are separate sessions and can
+  // straddle a concurrent apply. That window is closed at apply by the concurrency lock
+  // (live == plan.from, re-read server-side in one session) — not here.
+  if (w) {
+    const commit = w.gitRef!;
+    const missing = behind(commit, w.appliedAt, 'everystack last applied here from a commit that');
+    if (missing) return missing;
+    if (outsideHead(commit)) {
       return {
-        status: 'declared-elsewhere',
+        status: 'revert',
         commit,
+        appliedAt: w.appliedAt,
         reason:
-          `a ref your checkout does NOT descend from declares the target's live state — commit ` +
-          `${short(commit)} carries the models that match it. Someone deployed from that line of ` +
-          'history; applying your edge would revert their work. Fetch and merge or rebase onto it, ' +
-          'then re-plan.',
+          `everystack last applied here from commit ${short(commit)} (${shortDate(w.appliedAt)}), which is NOT an ` +
+          'ancestor of HEAD, and the database has changed since. Applying now would revert that deployed work. ' +
+          'Pull the branch that deployed it, rebase onto it, and re-plan.',
       };
     }
-  } finally {
-    if (ownsRoot) fs.rmSync(materializeRoot, { recursive: true, force: true });
+    // A drift may only rest on a clean read: a partial one cannot vouch that W is the newest anchor.
+    if (read.kind === 'unreadable') return unverifiable(read.reason);
+    const origin: DriftOrigin = { kind: 'hand-edited', commit, appliedAt: w.appliedAt, ...(w.dirty ? { dirty: true } : {}) };
+    return { status: 'drift', origin, reason: driftNotice(origin) };
   }
 
-  const scannedTrees = candidates.length + others.length;
-  // A side branch we could not read is not evidence either — refuse-closed, naming the count so
-  // the operator can prune the branch that carries it.
-  if (unevaluated.length > 0 || compileFailures.length > 0) return unverifiable('reachable', scannedTrees);
+  if (read.kind === 'unreadable') return unverifiable(read.reason);
+  if (read.kind === 'present' && read.anchored) {
+    return {
+      status: 'unverifiable',
+      reason:
+        'cannot verify the fast-forward rule — everystack.schema_log counts an apply with a commit, but no such row ' +
+        'read back as one (an empty git_ref, or an outcome not written by everystack). That is a hand-edited ledger ' +
+        'row, not a read failure: inspect everystack.schema_log and correct or remove it, then re-run.',
+    };
+  }
 
-  // PROVEN DRIFT (the clone was proven full and current before the all-refs scan). The origin is
-  // read from the ledger for the MESSAGE only (memoir, not control): any successful state apply
-  // recorded here means everystack once wrote this database and it has moved since; none means
-  // this is the first adoption of a database everystack never wrote. A dirty-worktree apply is
-  // still an apply — its git_ref declares nothing (Phase A skips it as a witness), so the state
-  // it produced was never committed anywhere; the origin says so.
-  const origin: DriftOrigin = lastApplied
-    ? { kind: 'hand-edited', commit: lastApplied.gitRef, appliedAt: lastApplied.appliedAt, ...(lastApplied.dirty ? { dirty: true } : {}) }
-    : { kind: 'never-declared' };
-  const fp = short(fingerprintLive(live.snapshot, live.contract).hash);
-  // The scan is scoped to THIS checkout's models path: a ref that declares live from a different
-  // directory (a models move on another line of history) is outside it. Say so — the claim must
-  // be exactly as wide as the search.
-  const scanned = `read ${scannedTrees} model state(s) at ${modelsDir}/ across every ref of a full, current clone, all cleanly, and none matches`;
-  const runbook =
-    'The reviewed plan you mint is the ORIGIN: `everystack db:plan --stage <name>` mints it, ' +
-    '`everystack db:apply --plan <file> --stage <name>` applies it, warns, and records the origin ' +
-    'in schema_log; every later apply descends from that row.';
-  const reason = origin.kind === 'never-declared'
-    ? `no commit on any ref declares the target's live fingerprint ${fp} — ${scanned}. Nothing has ever ` +
-      'declared this database (no everystack state apply is recorded here), so there is no merged work ' +
-      `the fast-forward rule could protect. ${runbook}`
-    : `no commit on any ref declares the target's live fingerprint ${fp} — ${scanned}. everystack last ` +
-      `applied here ${origin.commit ? `at commit ${short(origin.commit)} ` : ''}on ${shortDate(origin.appliedAt)}` +
-      (origin.dirty
-        ? ' from a DIRTY worktree — that commit never declared what was applied, so nothing committed can declare this state. '
-        : ', and the database has been changed outside the tool since (hand-edited). No ref declares what it is now, so ') +
-      `there is no merged work the fast-forward rule could protect; your committed Models are the source of truth. ${runbook}`;
-  return { status: 'drift', scannedTrees, origin, reason };
+  // No successful apply ever recorded a commit — none at all, or only no-git ones. Nothing deployed
+  // from any line of history is on record, so there is nothing to revert.
+  const origin: DriftOrigin = {
+    kind: 'never-declared',
+    skipped: {
+      ledger: read.kind === 'absent' ? 'absent' : 'present',
+      applied: read.kind === 'present' ? read.applied : 0,
+      refusals: read.kind === 'present' ? read.refusals : 0,
+      head,
+      from: fingerprintLive(live.snapshot, live.contract).hash,
+    },
+  };
+  return { status: 'drift', origin, reason: driftNotice(origin) };
 }
 
 // ---------------------------------------------------------------------------
@@ -1196,8 +787,7 @@ export function decideDescentApply(verdict: ProveVerdict, ctx: DescentApplyConte
       return { ok: true, note: driftOriginNote(verdict.origin) };
 
     case 'unverifiable':
-      // The search could not finish (an unreadable tree, or a clone that is not full and current).
-      // The verdict carries its own fetch/retry runbook; nothing to attest ABOUT.
+      // The ledger could not be read. The verdict carries its own retry runbook; nothing to attest ABOUT.
       return {
         ok: false,
         reason: ctx.attestation
@@ -1205,20 +795,6 @@ export function decideDescentApply(verdict: ProveVerdict, ctx: DescentApplyConte
           : verdict.reason,
       };
 
-    case 'declared-elsewhere': {
-      // A commit on a ref we hold declares live and HEAD does not descend from it. Reachable by
-      // construction, so the lineage-lost attestation can never be honoured here — the proof refuses
-      // it as reachable. The escape is git-native: merge or rebase.
-      if (!ctx.attestation) return { ok: false, reason: verdict.reason };
-      if (!attestsCommit(ctx.attestation, verdict.commit)) {
-        return { ok: false, reason: `--attest-lineage-lost ${ctx.attestation} does not match the commit that declares this state (${verdict.commit}) — drop the flag; that commit is reachable, so merge or rebase instead.` };
-      }
-      const proof = ctx.proveLineage(verdict.commit);
-      return proof.proven
-        ? { ok: true, attested: { commit: verdict.commit, subcase: proof.subcase } }
-        : { ok: false, reason: proof.reason };
-    }
-
     case 'revert':
     case 'unknown-commit': {
       // These name a declaring commit. Without an attestation the flagless escape (git revert / fetch)