@intentius/chant 0.100.0 → 0.101.0

package/src/workspace/records-cli.ts

@@ -50,9 +50,9 @@ import {
 } from "./records";
 import { gitTree, workingTree, type WorkspaceTree } from "./tree";
 import type { DecisionWork } from "./work";
-import { activeAttestors, type ProvenanceLevel } from "./trust/attestor";
+import { activeAttestors, type CommitAttestor, type ProvenanceLevel } from "./trust/attestor";
 import { policyAtBase, recordProvenance, resolveBase, type BaseSource, type RecordProvenance } from "./trust/provenance";
-import type { TrustPolicy } from "./trust/policy";
+import { returnedPolicy, type TrustPolicy } from "./trust/policy";
 import type { SealedRecord } from "./trust/seal";
 
 /** The version of the `records` output this chant writes. */
@@ -129,7 +129,7 @@ export type RecordsDocument =
   | {
       $schema: string;
       contract: number;
-      kind: { name: string; schema: string; file: string; format: RecordFormat };
+      kind: { name: string; schema: string; file: string; format: RecordFormat; spec: boolean };
       at: string | null;
       /** The directory pinned paths resolve in, from the repository root: the workspace holding the kind file, or the repository root (#2549). */
       workspaceRoot: string;
@@ -161,6 +161,47 @@ export interface RecordsSetDocument {
   $schema: string;
   contract: number;
   kinds: (RecordsDocument & { declared: DeclaredKindView })[];
+  /** With `--current`: the workspace's spec (#2524 D20, #2546), from the kinds marked `spec: true`. */
+  spec?: SpecView;
+}
+
+/**
+ * The spec (#2524 D20): the current records of every declared kind marked
+ * `spec: true`, each with the workspace files it pins. `records --current
+ * --json` prints it beside the kinds, so an agent resumes from the
+ * declaration and this one read.
+ */
+export interface SpecView {
+  /** The spec kinds, as the declaration names them, in its order. */
+  kinds: DeclaredKindView[];
+  records: SpecRecord[];
+}
+
+/** One current record of a spec kind. */
+export interface SpecRecord {
+  /** The kind's name, such as decision. */
+  kind: string;
+  id: string | null;
+  path: string;
+  state: string | null;
+  valid: boolean;
+  /** The digest a verdict names (#2672). */
+  digest: string;
+  /** Each workspace file the record pins: its path from the workspace root, the sha256 pinned, and how it compares with the tree read (#2549). */
+  assets: RecordEntry["assets"];
+}
+
+/** The spec of a set of declared kinds already read with `--current`. */
+export function specOf(kinds: RecordsSetDocument["kinds"]): SpecView {
+  const spec: SpecView = { kinds: [], records: [] };
+  for (const doc of kinds) {
+    if ("error" in doc || !doc.kind.spec) continue;
+    spec.kinds.push(doc.declared);
+    for (const r of doc.records) {
+      spec.records.push({ kind: doc.kind.name, id: r.id, path: r.path, state: r.state, valid: r.valid, digest: r.digest, assets: r.assets });
+    }
+  }
+  return spec;
 }
 
 /**
@@ -186,7 +227,7 @@ export async function queryDeclaredRecords(kinds: { declared: RecordKindDeclarat
     const doc = await queryRecords({ ...query, kind: k.file });
     out.push({ ...doc, declared: { member: k.declared.member, path: k.declared.path, name: k.declared.name } });
   }
-  return { $schema: RECORDS_OUTPUT_SCHEMA_ID, contract: RECORDS_CONTRACT_VERSION, kinds: out };
+  return { $schema: RECORDS_OUTPUT_SCHEMA_ID, contract: RECORDS_CONTRACT_VERSION, kinds: out, ...(query.current ? { spec: specOf(out) } : {}) };
 }
 
 /** A records read, before provenance. */
@@ -320,21 +361,30 @@ export async function queryRecords(query: RecordsQuery): Promise<RecordsDocument
     // Provenance, judged by the policy at base and never by the tree read (#2547).
     const base = top ? resolveBase(top, query.base) : { commit: null, from: null };
     const policy = top ? policyAtBase(top, base) : policyAtBase(root, base);
+    const attestors = policy.active ? await activeAttestors() : [];
     const provenance = recordProvenance({
       repo: top,
       policy,
       at,
       paths: result.records.map((r) => r.path),
-      attestors: policy.active ? await activeAttestors() : [],
+      attestors,
+      ...(policy.active ? { revisit: await returnedRevisit(tree, workspaceRoot, policy, attestors) } : {}),
     });
     const seals = loaded.kind.reviews ? await import("./trust/seal") : undefined;
     const quorumOptions = await quorumOptionsFor(loaded, tree, policy);
-    const records: RecordView[] = result.records.map((r) => ({
-      ...r,
-      provenance: provenance.get(r.path)!,
-      ...(quorumOptions ? { quorum: computeQuorum(loaded.kind, r, quorumOptions) } : {}),
-      ...(seals ? authorSeal(loaded.kind, r, policy, seals.checkRecordSeal) : {}),
-    }));
+    const records: RecordView[] = [];
+    for (const r of result.records) {
+      const p = provenance.get(r.path)!;
+      // Returned work (#2552): its seals verify against the signers admitted for its return too.
+      const recordPolicy = p.returned ? returnedPolicy(policy, p.returned.id) : policy;
+      const options = p.returned ? await quorumOptionsFor(loaded, tree, recordPolicy) : quorumOptions;
+      records.push({
+        ...r,
+        provenance: p,
+        ...(options ? { quorum: computeQuorum(loaded.kind, r, options) } : {}),
+        ...(seals ? authorSeal(loaded.kind, r, recordPolicy, seals.checkRecordSeal) : {}),
+      });
+    }
     if (loaded.kind.approval && !loaded.kind.work && top) {
       const decided = decidedCommits(top, at ?? "HEAD", records.map((r) => r.path), loaded.kind);
       for (const r of records) r.decidedIn = decided.get(r.path) ?? null;
@@ -353,6 +403,7 @@ export async function queryRecords(query: RecordsQuery): Promise<RecordsDocument
         schema: loaded.kind.schema.id,
         file: relative(root, loaded.file).split("\\").join("/"),
         format: loaded.kind.format,
+        spec: loaded.kind.spec === true,
       },
       at,
       workspaceRoot,
@@ -368,6 +419,36 @@ export async function queryRecords(query: RecordsQuery): Promise<RecordsDocument
   }
 }
 
+/**
+ * The second look recordProvenance takes at each record (#2552): a record
+ * whose bytes came back in a return is judged by the commit it was made in,
+ * which the return carries, rather than by the import here. `tree` is the
+ * workspace root's tree, as read; record paths are from the repository root.
+ */
+async function returnedRevisit(
+  tree: WorkspaceTree,
+  workspaceRoot: string,
+  policy: TrustPolicy,
+  attestors: readonly CommitAttestor[],
+): Promise<((path: string, host: RecordProvenance) => RecordProvenance | undefined) | undefined> {
+  const { readReturns, returnedProvenance } = await import("./returns");
+  const { returns } = readReturns(tree);
+  if (returns.length === 0) return undefined;
+  const prefix = workspaceRoot === "." ? "" : `${workspaceRoot}/`;
+  return (path, host) => {
+    if (!path.startsWith(prefix)) return undefined;
+    const rel = path.slice(prefix.length);
+    const holding = returns.filter((r) => r.paths[rel] !== undefined);
+    if (holding.length === 0 || tree.stat(rel) !== "file") return undefined;
+    const content = Buffer.from(tree.bytes ? tree.bytes(rel) : tree.read(rel));
+    for (const r of holding) {
+      const p = returnedProvenance(policy, attestors, r, rel, content, host);
+      if (p) return p;
+    }
+    return undefined;
+  };
+}
+
 /**
  * A record's author seal checked against the policy at base (#2688), for a
  * kind with a reviews list: its author is the kind's `reviews.decider` field.
@@ -676,7 +757,7 @@ export async function runWorkspaceUnknown(ctx: CommandContext): Promise<number>
   console.error(
     formatError({
       message: sub ? `Unknown workspace subcommand: ${sub}` : "chant workspace needs a subcommand",
-      hint: `Workspace subcommands: audit, build, check, graph, init, lineage, lint, ls, records, status, upgrade, verify, work. Run "chant --help" for their options.`,
+      hint: `Workspace subcommands: adopt-lineage, audit, build, check, evidence, graph, hash-index, init, lineage, lint, ls, pin, records, signers, status, upgrade, verify, versions, work. Run "chant --help" for their options.`,
     }),
   );
   return 1;

package/src/workspace/records-close.schema.json

@@ -84,8 +84,8 @@
             },
             "digest": {
               "type": "string",
-              "pattern": "^[0-9a-f]{64}$",
-              "description": "The seal written: the lowercase hex SHA-256 of the file with LF line endings and without its seal line, which records checks on every read (session-seal-mismatch)."
+              "pattern": "^sha256:[0-9a-f]{64}$",
+              "description": "The seal written: sha256: and the lowercase hex SHA-256 of the JCS form of the whole session without its seal field (its front matter as core and the text below it as body, line endings LF), which records checks on every read (session-seal-mismatch). Before #2546 it was the bare hex SHA-256 of the file's text without the seal line."
             }
           }
         },
@@ -171,6 +171,9 @@
                 "write-usage-invalid",
                 "record-not-found",
                 "record-closed",
+                "write-scope-member",
+                "write-scope-kind",
+                "agent-unknown",
                 "record-unparseable",
                 "record-schema-invalid",
                 "record-id-duplicate",
@@ -178,6 +181,7 @@
                 "record-supersedes-conflict",
                 "record-remediates-unknown",
                 "record-remediates-not-closed",
+                "record-seal-mismatch",
                 "session-seal-mismatch",
                 "session-verdict-unknown-record"
               ]

package/src/workspace/records-close.ts

@@ -3,7 +3,8 @@
  * session in one write. It sets the session's state to its kind's closed
  * state, the time it closed and the commit it closed at (the fields the
  * kind's `session` block names in `closedOn` and `closedRev`), and then the
- * seal by chant's rule ({@link sessionSeal}), so a UI never computes a seal.
+ * seal by chant's whole-file rule ({@link sessionSeal}, #2546), so a UI never
+ * computes a seal.
  *
  * Like `new`, `amend` and `review`, it reads the records again with the file
  * in place and writes only when the session comes back valid: a verdict
@@ -26,6 +27,7 @@ import {
   readAll,
   RECORDS_WRITE_CONTRACT_VERSION,
   RecordWriteError,
+  refuseOutOfScope,
   replaceFields,
   stableJson,
   validateWrite,
@@ -33,6 +35,7 @@ import {
   type WriteResult,
 } from "./records-write";
 import { headCommit } from "./session-kinds";
+import { WRITE_SCOPE_CODES } from "./write-scope";
 
 export const RECORDS_CLOSE_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/records-close/v1/records-close.schema.json";
 
@@ -42,6 +45,7 @@ export const CLOSE_ERROR_CODES = [
   "write-usage-invalid",
   "record-not-found",
   "record-closed",
+  ...WRITE_SCOPE_CODES,
   ...RECORD_REASON_CODES,
 ] as const satisfies readonly ReasonCode[];
 export type CloseErrorCode = (typeof CLOSE_ERROR_CODES)[number];
@@ -65,6 +69,8 @@ export interface CloseRecordOptions {
   cwd: string;
   /** The close time. Defaults to now. */
   now?: Date;
+  /** The agent session the write is made in (#2548). */
+  agent?: string;
 }
 
 /** An ISO 8601 time in UTC to the second, as the reference session schema's dateTime takes it. */
@@ -76,6 +82,7 @@ function isoSeconds(d: Date): string {
 export async function closeRecord(opts: CloseRecordOptions): Promise<CloseDocument> {
   try {
     const o = await open(opts.kind, opts.cwd);
+    refuseOutOfScope(o, "close", opts.cwd, opts);
     const { kind } = o.loaded;
     const decl = kind.session;
     if (!decl || kind.stateField === undefined) {
@@ -97,12 +104,13 @@ export async function closeRecord(opts: CloseRecordOptions): Promise<CloseDocume
       ...(decl.closedOn ? { [decl.closedOn]: isoSeconds(opts.now ?? new Date()) } : {}),
       ...(decl.closedRev ? { [decl.closedRev]: closedRev } : {}),
     };
-    // The seal line is written last, into text that already holds everything else, so the seal is the digest of the file without it.
+    // The seal is written last, into text that already holds everything else: the whole-file seal of the session without its seal field (#2546).
     const merged = { ...old, ...set };
     delete merged[decl.seal];
     const unsealed = replaceFields(o.source.read(target.path), set, merged);
     if (unsealed === undefined) throw new RecordWriteError("record-unparseable", `${target.path}: its fields can't be rewritten in place without changing the rest of the file`);
     const digest = sessionSeal(unsealed, decl.seal, kind.format);
+    if (digest === null) throw new RecordWriteError("record-unparseable", `${target.path} can't be read, so it can't be sealed`);
     const text = replaceFields(unsealed, { [decl.seal]: digest }, { ...merged, [decl.seal]: digest });
     if (text === undefined || sessionSeal(text, decl.seal, kind.format) !== digest) {
       throw new RecordWriteError("record-unparseable", `${target.path}: the ${decl.seal} line can't be added without changing the text it seals`);

package/src/workspace/records-formats.test.ts

@@ -154,7 +154,8 @@ const SESSION_SCHEMA = {
     comments: { type: "array" },
     follow_ups: { type: "array", items: ref("contractId") },
     closed_at: ref("datetime"),
-    seal: ref("sha256"),
+    // The whole-file seal (#2546): sha256: and the hex SHA-256 of the session's JCS form without it.
+    seal: { type: "string", pattern: "^sha256:[0-9a-f]{64}$" },
   },
 };
 
@@ -294,7 +295,7 @@ const SESSION = {
   comments: [],
   follow_ups: ["C-002"],
   closed_at: "2026-09-24T11:00:00.000Z",
-  seal: "e".repeat(64),
+  seal: `sha256:${"e".repeat(64)}`,
 };
 
 // ── 1. The json format ───────────────────────────────────────────────────────
@@ -372,11 +373,16 @@ describe("format json", () => {
 });
 
 describe("a JSON session kind (#2673)", () => {
-  test("its seal is the digest without the seal member, by the JSON rule", async () => {
+  test("its seal is the whole-file JCS seal without the seal member (#2546)", async () => {
     write("design/session.kind.mjs", kindFile({ ...KINDS.session, session: { verdicts: "approvals", seal: "seal", subjects: { kind: "contract.kind.mjs" } } }));
     write("design/contracts/C-001-first.md", '---\nid: "C-001"\nstatus: "approved"\n---\n');
+    // JCS of the object without its seal: keys sorted, no whitespace. The member order and indentation of the file play no part.
+    const sorted = (v: unknown): unknown =>
+      v === null || typeof v !== "object" ? v : Array.isArray(v) ? v.map(sorted) : Object.fromEntries(Object.keys(v).sort().map((k) => [k, sorted((v as Record<string, unknown>)[k])]));
+    const jcsSeal = (v: object): string => `sha256:${sha256(JSON.stringify(sorted(v)))}`;
     const { seal: _drop, ...unsealed } = SESSION;
-    const seal = sha256(json(unsealed));
+    const seal = jcsSeal(unsealed);
+    // Sealed over SESSION, then changed: a verdict added, or the id.
     write("design/sessions/S-0001.json", json({ ...SESSION, approvals: [{ record: "C-001" }], seal }));
     write("design/sessions/S-0002.json", json({ ...SESSION, id: "S-0002", seal }));
     const doc = await query("session");
@@ -385,7 +391,7 @@ describe("a JSON session kind (#2673)", () => {
       ["S-0002", ["session-seal-mismatch"]],
     ]);
     const good = { ...unsealed, id: "S-0003" };
-    write("design/sessions/S-0003.json", json({ ...good, seal: sha256(json(good)) }));
+    write("design/sessions/S-0003.json", `${JSON.stringify({ seal: jcsSeal(good), ...Object.fromEntries(Object.entries(good).reverse()) })}\n`);
     const [, , third] = (await query("session")).records;
     expect([third.id, codes(third)]).toEqual(["S-0003", []]);
   });
@@ -547,6 +553,8 @@ describe("kinds without a lifecycle", () => {
     ["neither idField nor idFrom", { ...KINDS.closure, idField: undefined }, /idField: a kind names its id with exactly one of idField and idFrom/],
     ["an unknown format", { ...KINDS.closure, format: "yaml" }, /format/],
     ["a session block without states", { ...KINDS.closure, session: { verdicts: "approvals", seal: "seal", subjects: { kind: "contract.kind.mjs" } } }, /session: a session kind must have states/],
+    ["a seal without states (#2546)", { ...KINDS.closure, seal: { field: "seal" } }, /seal: a kind without states cannot have seal/],
+    ["a seal naming another field than session.seal (#2546)", { ...KINDS.session, session: { verdicts: "approvals", seal: "seal", subjects: { kind: "contract.kind.mjs" } }, seal: { field: "closed_digest" } }, /seal: seal.field and session.seal name the field/],
   ])("a kind with %s is kind-invalid, naming the field", async (_label, kind, why) => {
     write("design/closure.kind.mjs", kindFile(kind));
     const error = await failure("closure");

package/src/workspace/records-new.schema.json

@@ -165,6 +165,9 @@
                 "source-harvest-not-proposed",
                 "record-state-not-initial",
                 "ratify-quorum-not-met",
+                "write-scope-member",
+                "write-scope-kind",
+                "agent-unknown",
                 "record-unparseable",
                 "record-schema-invalid",
                 "record-id-duplicate",
@@ -172,6 +175,7 @@
                 "record-supersedes-conflict",
                 "record-remediates-unknown",
                 "record-remediates-not-closed",
+                "record-seal-mismatch",
                 "session-seal-mismatch",
                 "session-verdict-unknown-record"
               ]

package/src/workspace/records-review.schema.json

@@ -259,6 +259,9 @@
                 "review-sign-failed",
                 "session-unknown",
                 "session-not-open",
+                "write-scope-member",
+                "write-scope-kind",
+                "agent-unknown",
                 "record-unparseable",
                 "record-schema-invalid",
                 "record-id-duplicate",
@@ -266,6 +269,7 @@
                 "record-supersedes-conflict",
                 "record-remediates-unknown",
                 "record-remediates-not-closed",
+                "record-seal-mismatch",
                 "session-seal-mismatch",
                 "session-verdict-unknown-record"
               ]

package/src/workspace/records-sessions.test.ts

@@ -5,9 +5,10 @@
  * decision reviews that cite it.
  */
 
-import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import yaml from "js-yaml";
 import { afterAll, describe, expect, test } from "vitest";
 import { cleanScratch, commitAll, contract, REPO } from "./__fixtures__/contract-repo";
 import { reviewed, sessionText, SESSIONS_KIND as SESSIONS, sessionsRepo as fixture } from "./__fixtures__/sessions";
@@ -34,14 +35,30 @@ describe("the session kind (#2673)", () => {
     expect(doc.records[0].citedBy).toEqual([]);
   });
 
-  test("the seal is the awk recipe the docs give", () => {
+  test("the seal is the whole-file JCS rule the docs give (#2546)", () => {
     const file = join(REPO, "reference-workspace", "design", "sessions", "S-0001-first-walk-of-the-reference-decisions.md");
-    const awk = execFileSync("sh", ["-c", `awk 'NR==1&&/^---$/{f=1;print;next} f&&/^---$/{f=0} f&&/^closed_digest:/{next} {print}' "$1" | shasum -a 256`, "sh", file], { encoding: "utf-8" });
     const text = readFileSync(file, "utf-8");
-    expect(awk.split(" ")[0]).toBe(sessionSeal(text, "closed_digest"));
-    expect(text).toContain(`closed_digest: "${sessionSeal(text, "closed_digest")}"`);
+    // The rule worked by hand: the front matter as JSON without closed_digest, the text below it, keys sorted, no whitespace.
+    const [, front, body] = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(text)!;
+    const { closed_digest: _seal, ...core } = yaml.load(front, { schema: yaml.JSON_SCHEMA }) as Record<string, unknown>;
+    const sorted = (v: unknown): unknown =>
+      v === null || typeof v !== "object" ? v : Array.isArray(v) ? v.map(sorted) : Object.fromEntries(Object.keys(v).sort().map((k) => [k, sorted((v as Record<string, unknown>)[k])]));
+    const byHand = `sha256:${createHash("sha256").update(JSON.stringify(sorted({ body, core })), "utf8").digest("hex")}`;
+    expect(sessionSeal(text, "closed_digest")).toBe(byHand);
+    expect(text).toContain(`closed_digest: "${byHand}"`);
     // CRLF line endings hash as LF.
-    expect(sessionSeal(text.replace(/\n/g, "\r\n"), "closed_digest")).toBe(sessionSeal(text, "closed_digest"));
+    expect(sessionSeal(text.replace(/\n/g, "\r\n"), "closed_digest")).toBe(byHand);
+  });
+
+  test("a session sealed by the text rule before #2546 reads as session-seal-mismatch, naming the old rule", async () => {
+    const root = fixture();
+    const file = join(root, "design", "sessions", "S-0001-first-walk-of-the-reference-decisions.md");
+    const text = readFileSync(file, "utf-8");
+    const old = createHash("sha256").update(text.replace(/^closed_digest: .*\n/m, ""), "utf8").digest("hex");
+    writeFileSync(file, text.replace(/^closed_digest: .*$/m, `closed_digest: "${old}"`));
+    const s1 = (await read(root)).records[0];
+    expect(s1.reasons.map((r) => r.code)).toContain("session-seal-mismatch");
+    expect(s1.reasons.find((r) => r.code === "session-seal-mismatch")!.message).toMatch(/the text rule chant used before #2546/);
   });
 
   test("a closed session edited after it closed is session-seal-mismatch", async () => {

package/src/workspace/records-write.test.ts

@@ -10,7 +10,7 @@ import { cpSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
-import { parseFrontMatter, recordTextDigest as textDigest } from "./records";
+import { parseFrontMatter, recordSeal, recordTextDigest as textDigest } from "./records";
 import { queryRecords } from "./records-cli";
 import { allocateId, amendRecord, newRecord, renderRecord, reviewRecord, toYaml } from "./records-write";
 
@@ -21,7 +21,7 @@ const KIND = "decisions/decision.kind.mjs";
 type Data = Record<string, unknown>;
 
 /** The digest of a decision: the kind names a ratified state, so the state leaves the digest with the reviews and seal (#2873). */
-const recordTextDigest = (text: string) => textDigest(text, ["reviews", "seal", "state"]);
+const recordTextDigest = (text: string) => textDigest(text, ["reviews", "seal", "state", "closed_digest"]);
 
 const SAMPLE = (() => {
   const fm = parseFrontMatter(readFileSync(join(DECISIONS, "ws-003-seal-scope.md"), "utf-8"));
@@ -287,7 +287,7 @@ describe("records amend", () => {
     const evidence = [{ title: "A spec", url: "https://example.com/spec" }];
     expect(await amendRecord({ kind: KIND, id: "ws-001", fields: fields({ evidence }), cwd: dir })).toMatchObject({ changed: ["evidence"] });
     for (const by of ["alice", "bob"]) await reviewRecord({ kind: KIND, id: "ws-001", verdict: "agree", by, cwd: dir });
-    expect(await amendRecord({ kind: KIND, id: "ws-001", fields: fields({ state: "ratified" }), cwd: dir })).toMatchObject({ changed: ["state"] });
+    expect(await amendRecord({ kind: KIND, id: "ws-001", fields: fields({ state: "ratified" }), cwd: dir })).toMatchObject({ changed: ["state", "closed_digest"] });
     put("ws-006-six.md", decision({ id: "ws-006", title: "Six" }));
     expect(code(await amendRecord({ kind: KIND, id: "ws-006", fields: fields({ state: "withdrawn" }), cwd: dir }))).toBe("amend-supersede-instead");
   });
@@ -353,12 +353,43 @@ describe("ratifying against the quorum (#2873)", () => {
     await agree("alice");
     await agree("bob");
     const judged = recordTextDigest(text("ws-001-one.md"));
-    expect(await ratify()).toMatchObject({ changed: ["state"] });
+    expect(await ratify()).toMatchObject({ changed: ["state", "closed_digest"] });
     expect(data("ws-001-one.md").state).toBe("ratified");
     expect(recordTextDigest(text("ws-001-one.md"))).toBe(judged);
     expect(await quorumOf("ws-001")).toMatchObject({ need: 2, agreed: 2, met: true, notCounted: [] });
   });
 
+  test("ratifying writes the whole-file seal, which covers the reviews and the state the digest leaves out (#2546)", async () => {
+    await agree("alice");
+    await agree("bob");
+    const judged = textDigest(text("ws-001-one.md"), ["reviews", "seal", "state", "closed_digest"]);
+    await ratify();
+    const sealed = text("ws-001-one.md");
+    expect(data("ws-001-one.md").closed_digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(data("ws-001-one.md").closed_digest).toBe(recordSeal(sealed, "closed_digest"));
+    // The closed_digest line goes last in the front matter, and the digest leaves it out.
+    expect(sealed).toMatch(/\nclosed_digest: "sha256:[0-9a-f]{64}"\n---\n/);
+    expect(textDigest(sealed, ["reviews", "seal", "state", "closed_digest"])).toBe(judged);
+    const read = async () => (await queryRecords({ kind: KIND, cwd: dir })) as { records: { id: string; valid: boolean; reasons: { code: string; message: string }[] }[] };
+    expect((await read()).records.find((r) => r.id === "ws-001")).toMatchObject({ valid: true, reasons: [] });
+    // A verdict, a state or a byte of the body edited by hand after the close breaks the seal.
+    for (const edit of [
+      (t: string) => t.replace('verdict: "agree"', 'verdict: "dissent"\n    note: "no"'),
+      (t: string) => t.replace('state: "ratified"', 'state: "superseded"'),
+      (t: string) => `${t}\nAn afterthought.\n`,
+    ]) {
+      writeFileSync(join(dir, "decisions", "ws-001-one.md"), edit(sealed));
+      const r = (await read()).records.find((x) => x.id === "ws-001")!;
+      expect(r.reasons.map((x) => x.code)).toContain("record-seal-mismatch");
+    }
+    // CRLF line endings, or a value quoted another way, leave the seal as it was.
+    writeFileSync(join(dir, "decisions", "ws-001-one.md"), sealed.replace('area: "D4"', "area: 'D4'").replace(/\n/g, "\r\n"));
+    expect((await read()).records.find((r) => r.id === "ws-001")).toMatchObject({ valid: true });
+    // And a closed record is never written again, so the seal can't be set by hand either.
+    writeFileSync(join(dir, "decisions", "ws-001-one.md"), sealed);
+    expect(code(await amendRecord({ kind: KIND, id: "ws-002", fields: fields({ closed_digest: `sha256:${"0".repeat(64)}` }), cwd: dir }))).toBe("write-input-invalid");
+  });
+
   test("a met quorum with an open concern ratifies, and the concern stays listed", async () => {
     await agree("alice");
     await agree("bob");
@@ -379,7 +410,7 @@ describe("ratifying against the quorum (#2873)", () => {
     await agree("alice");
     const digest = recordTextDigest(text("ws-001-one.md"));
     const reviews = [...(data("ws-001-one.md").reviews as Data[]), { reviewer: "bob", verdict: "agree", on: "2026-09-26", digest }];
-    expect(await amendRecord({ kind: KIND, id: "ws-001", fields: fields({ state: "ratified", reviews }), cwd: dir })).toMatchObject({ changed: ["state", "reviews"] });
+    expect(await amendRecord({ kind: KIND, id: "ws-001", fields: fields({ state: "ratified", reviews }), cwd: dir })).toMatchObject({ changed: ["state", "reviews", "closed_digest"] });
     put("ws-006-six.md", decision({ id: "ws-006", title: "Six" }));
     await agree("alice", "ws-006");
     await agree("bob", "ws-006");
@@ -403,11 +434,11 @@ describe("ratifying against the quorum (#2873)", () => {
     expect(withRatified).toContain('reviews: { field: "reviews", decider: "decided_by", ratified: "ratified" },');
     writeFileSync(kindFile, withRatified.replace(', ratified: "ratified" }', " }"));
     const judged = textDigest(text("ws-001-one.md"), ["reviews", "seal"]);
-    expect(await ratify()).toMatchObject({ changed: ["state"] });
-    expect(textDigest(text("ws-001-one.md"), ["reviews", "seal"])).not.toBe(judged);
+    expect(await ratify()).toMatchObject({ changed: ["state", "closed_digest"] });
+    expect(textDigest(text("ws-001-one.md"), ["reviews", "seal", "closed_digest"])).not.toBe(judged);
     writeFileSync(kindFile, withRatified.replace('  reviews: { field: "reviews", decider: "decided_by", ratified: "ratified" },\n', ""));
     put("ws-006-six.md", decision({ id: "ws-006", title: "Six" }));
-    expect(await ratify("ws-006")).toMatchObject({ changed: ["state"] });
+    expect(await ratify("ws-006")).toMatchObject({ changed: ["state", "closed_digest"] });
   });
 
   test("a kind whose reviews.ratified is not one of its states is refused", async () => {
@@ -417,6 +448,32 @@ describe("ratifying against the quorum (#2873)", () => {
     expect(code(doc)).toBe("kind-invalid");
     expect("error" in doc && doc.error.message).toMatch(/reviews\.ratified must be one of states/);
   });
+
+  test("on a copy of the chant repo's own decisions, verdicts count through ratifying and sealing (#2555, ws-063)", async () => {
+    for (const f of readdirSync(join(dir, "decisions"))) if (f.endsWith(".md")) rmSync(join(dir, "decisions", f));
+    for (const f of readdirSync(DECISIONS)) if (/^ws-\d{3}-.+\.md$/.test(f)) cpSync(join(DECISIONS, f), join(dir, "decisions", f));
+    const read = async () => {
+      const doc = await queryRecords({ kind: KIND, cwd: dir });
+      if ("error" in doc) throw new Error(doc.error.message);
+      return doc.records;
+    };
+    const decided = (await read()).filter((r) => r.state === "decided");
+    expect(decided.length).toBeGreaterThan(50);
+    // Every sixth one, and the last, keeps the test inside the unit-test budget (#2817).
+    const sample = decided.filter((_, i) => i % 6 === 0 || i === decided.length - 1);
+    const judged = new Map(sample.map((r) => [r.id!, r.digest]));
+    for (const id of judged.keys()) {
+      await agree("alice", id);
+      await agree("Bob ", id);
+      expect(await ratify(id)).toMatchObject({ changed: ["state", "closed_digest"] });
+    }
+    for (const r of (await read()).filter((x) => judged.has(x.id!))) {
+      expect(r, r.id!).toMatchObject({ state: "ratified", valid: true, reasons: [], digest: judged.get(r.id!) });
+      expect(r.quorum, r.id!).toMatchObject({ agreed: 2, met: true, notCounted: [] });
+      expect(r.quorum!.counted.map((c) => c.principal), r.id!).toEqual(["alice", "bob"]);
+      expect(r.data?.closed_digest, r.id!).toBe(recordSeal(readFileSync(join(dir, r.path), "utf-8"), "closed_digest"));
+    }
+  });
 });
 
 describe("records review", () => {