@sensigo/realm-testing 0.37.0 → 0.39.0

package/dist/store/settlement-contract.js

@@ -405,6 +405,10 @@ function terminalRefusalCases(adapter) {
                 await adapter.store.update({
                     ...run,
                     terminal_state: true,
+                    // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                    // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                    // check abstains and the fixture stays a pure terminal-precondition seeder.
+                    sealed_by: { arm: 'complete' },
                     terminal_reason: 'tck-terminal',
                 });
                 const result = await settleStep(run.id, {
@@ -432,6 +436,23 @@ function terminalRefusalCases(adapter) {
 // Reintroducing either trio disjunct into `isTerminal` reds this law; genuine terminal refusal is
 // TERMINAL_REFUSAL's job (`terminal_state: true` — which abandon/abort ALWAYS set atomically,
 // abandon-run.ts:66-71 / execution-loop.ts:1803-1811).
+//
+// REPINNED 2026-08-20 (issue #367) — ARM-WINS. Each case below now also asserts the DERIVED PHASE
+// of its product record, and that phase CHANGED with #367: the run is settled `complete`, so it
+// stamps `sealed_by: {arm: 'complete'}`, and the recorded arm outranks the seeded marker. Before
+// #367 the same record derived `abandoned`/`aborted` from the marker alone.
+//
+// These two product records are the ONLY engine-constructible arm-vs-marker disagreements in the
+// suite, which makes them the keystone: revert the sealed-wins branch in `deriveRunPhase` and the
+// new assertions below are what reds. Nothing else observes that revert — the arm path and the
+// legacy path agree on every honest record.
+//
+// The seeded foreign marker violates nothing: `SEAL_MARKERS_AGREE` is transform-scoped and
+// ONE-DIRECTIONAL (an arm requires its own marker; it never forbids a marker it did not write).
+// Do not "fix" these fixtures by removing the marker — the disagreement IS the test.
+//
+// (The law's own premise comment above — "resume never strips abandoned_at" — has been stale since
+// #281; the honest production channel for this shape is a mixed-version fleet.)
 // ---------------------------------------------------------------------------
 function terminalStateOnlyCases(adapter) {
     const { minimalDefinition } = adapter.settlementFixture;
@@ -460,6 +481,12 @@ function terminalStateOnlyCases(adapter) {
                 if (!result.run.completed_steps.includes('a')) {
                     throw new Error(`expected 'a' to land in completed_steps, got: ${JSON.stringify(result.run.completed_steps)}`);
                 }
+                // issue #367 KEYSTONE: the run sealed `complete`, so the recorded arm decides — even
+                // though `abandoned_at` is still on the record. Pre-#367 this derived 'abandoned'.
+                const phase = deriveRunPhase(result.run);
+                if (phase !== 'completed') {
+                    throw new Error(`arm-wins: expected derived phase 'completed' from sealed_by.arm '${String(result.run.sealed_by?.arm)}' despite the seeded abandoned_at, got '${phase}'`);
+                }
             },
         },
         {
@@ -486,6 +513,11 @@ function terminalStateOnlyCases(adapter) {
                 if (!result.run.completed_steps.includes('a')) {
                     throw new Error(`expected 'a' to land in completed_steps, got: ${JSON.stringify(result.run.completed_steps)}`);
                 }
+                // issue #367 KEYSTONE (the aborted half): same disagreement, other marker.
+                const phase = deriveRunPhase(result.run);
+                if (phase !== 'completed') {
+                    throw new Error(`arm-wins: expected derived phase 'completed' from sealed_by.arm '${String(result.run.sealed_by?.arm)}' despite the seeded aborted_at, got '${phase}'`);
+                }
             },
         },
     ];
@@ -494,6 +526,607 @@ function terminalStateOnlyCases(adapter) {
 // L7 CS-purity — structural: `options` carries VALUES only ({now}); no callback, no registry.
 // In-repo source-text guard (the calling test file greps applySettlement's own signature).
 // ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// issue #367 — the seal-integrity boundary laws. An assertion-capable store (one declaring
+// `settleStep`) must REFUSE each of the four violations rather than persisting them: a record that
+// lies about how it ended is permanent, and an advisory would report success on a write that broke
+// its own invariant.
+// ---------------------------------------------------------------------------
+function sealIntegrityCases(adapter) {
+    const { minimalDefinition } = adapter.settlementFixture;
+    requireSettleStep(adapter.store); // assertion-capable stores only
+    /** Runs `write`, expecting it to reject with `code`. */
+    async function expectRefusedWith(code, what, write) {
+        let threw;
+        try {
+            await write();
+        }
+        catch (err) {
+            threw = err;
+        }
+        if (threw === undefined) {
+            throw new Error(`expected ${what} to be REFUSED with ${code}, but the write succeeded`);
+        }
+        const actual = threw.code;
+        if (actual !== code) {
+            throw new Error(`expected ${what} to be refused with ${code}, got '${String(actual)}'`);
+        }
+    }
+    async function freshRun(name) {
+        const def = minimalDefinition(['a']);
+        const { run } = await adapter.store.create({
+            workflowId: `${def.id}-${name}`,
+            workflowVersion: 1,
+            params: {},
+        });
+        return run;
+    }
+    return [
+        {
+            law: 'SEAL_FRESH_WRITE_REFUSED',
+            name: `[${adapter.storeName}] a live → terminal write carrying NO sealed_by is refused`,
+            run: async () => {
+                const run = await freshRun('unstamped');
+                await expectRefusedWith('STATE_SEAL_UNSTAMPED', 'an unstamped fresh seal', () => 
+                /* eslint-disable-next-line no-restricted-syntax --
+                 * issue #367 (part 2), AUTHORIZED: this violation is the LAW. SEAL_FRESH_WRITE_REFUSED
+                 * exists to prove the store refuses an unstamped fresh seal, so the fixture has to
+                 * construct one. (This file is a published contract source, not a `.test.ts`, which is
+                 * why the test-file scoping does not cover it.)
+                 */
+                adapter.store.update({ ...run, terminal_state: true, terminal_reason: 'tck' }));
+            },
+        },
+        {
+            law: 'SEAL_FRESH_WRITE_REFUSED',
+            name: `[${adapter.storeName}] NEGATIVE CONTROL: re-writing an ALREADY-terminal unstamped record passes (the legacy population stays usable)`,
+            run: async () => {
+                const run = await freshRun('legacy-repersist');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'tck',
+                });
+                // A terminal → terminal rewrite. The forward clause is transition-scoped, so this is fine.
+                await adapter.store.update({ ...sealed, terminal_reason: 'tck (touched)' });
+            },
+        },
+        {
+            law: 'SEAL_ORPHAN_REFUSED',
+            name: `[${adapter.storeName}] a terminal → live write that RETAINS sealed_by is refused`,
+            run: async () => {
+                const run = await freshRun('orphan');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'tck',
+                });
+                await expectRefusedWith('STATE_SEAL_ORPHANED', 'a resume that kept the seal', () => adapter.store.update({ ...sealed, terminal_state: false }));
+            },
+        },
+        {
+            law: 'SEAL_ORPHAN_REFUSED',
+            name: `[${adapter.storeName}] NEGATIVE CONTROL: the same transition WITH the seal stripped passes`,
+            run: async () => {
+                const run = await freshRun('orphan-control');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'tck',
+                });
+                const { sealed_by: _dropped, ...base } = sealed;
+                await adapter.store.update({ ...base, terminal_state: false });
+            },
+        },
+        {
+            law: 'SEAL_ERASE_REFUSED',
+            name: `[${adapter.storeName}] a terminal rewrite that DROPS a stored sealed_by is refused`,
+            run: async () => {
+                const run = await freshRun('erase');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'tck',
+                });
+                const { sealed_by: _erased, ...withoutSeal } = sealed;
+                await expectRefusedWith('STATE_SEAL_ERASED', 'a terminal rewrite dropping the seal', () => adapter.store.update({ ...withoutSeal, terminal_reason: 'tck (erased)' }));
+            },
+        },
+        {
+            law: 'SEAL_ERASE_REFUSED',
+            name: `[${adapter.storeName}] NEGATIVE CONTROL: the same rewrite KEEPING the seal passes`,
+            run: async () => {
+                const run = await freshRun('erase-control');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'tck',
+                });
+                await adapter.store.update({ ...sealed, terminal_reason: 'tck (kept)' });
+            },
+        },
+        {
+            law: 'SEAL_REWRITE_REFUSED',
+            name: `[${adapter.storeName}] a stored arm may NOT be changed while the run stays terminal`,
+            run: async () => {
+                const run = await freshRun('rewrite');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'Workflow completed.',
+                });
+                await expectRefusedWith('STATE_SEAL_REWRITTEN', 'a seal-arm rewrite', () => adapter.store.update({ ...sealed, sealed_by: { arm: 'guard_pass_complete' } }));
+            },
+        },
+        {
+            law: 'SEAL_REWRITE_REFUSED',
+            name: `[${adapter.storeName}] a rewrite WITH truthful adjudication provenance is ACCEPTED`,
+            run: async () => {
+                // The lawful key, published day-one so this law never has to be loosened later. The arm
+                // pair is deliberately SAME-PHASE: a cross-phase ruling on a record whose prose still says
+                // otherwise is refused by SEAL_COHERENT instead, which is a different law's job.
+                const run = await freshRun('adjudicated');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'Workflow completed.',
+                });
+                const ruled = await adapter.store.update({
+                    ...sealed,
+                    sealed_by: {
+                        arm: 'guard_pass_complete',
+                        adjudicated: {
+                            by: 'tck-operator',
+                            at: '2026-01-01T00:00:00.000Z',
+                            previous_arm: 'complete',
+                            reason: 'the guard closed this run',
+                        },
+                    },
+                });
+                if (ruled.sealed_by?.arm !== 'guard_pass_complete') {
+                    throw new Error(`the adjudicated arm did not land: ${JSON.stringify(ruled.sealed_by)}`);
+                }
+                const reread = await adapter.store.get(run.id);
+                // The FULL object, field by field: a store that drops `by` or `reason` keeps the ruling's
+                // arm and loses who made it and why, which is most of what a ruling IS.
+                const expected = {
+                    by: 'tck-operator',
+                    at: '2026-01-01T00:00:00.000Z',
+                    previous_arm: 'complete',
+                    reason: 'the guard closed this run',
+                };
+                if (JSON.stringify(reread.sealed_by?.adjudicated) !== JSON.stringify(expected)) {
+                    throw new Error(`the ruling did not survive the round trip in full: ` +
+                        `${JSON.stringify(reread.sealed_by?.adjudicated)} — expected ${JSON.stringify(expected)}`);
+                }
+            },
+        },
+        {
+            law: 'SEAL_REWRITE_REFUSED',
+            name: `[${adapter.storeName}] a rewrite whose adjudication LIES about previous_arm is refused`,
+            run: async () => {
+                const run = await freshRun('adjudicated-lying');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'Workflow completed.',
+                });
+                await expectRefusedWith('STATE_SEAL_REWRITTEN', 'a lying adjudication', () => adapter.store.update({
+                    ...sealed,
+                    sealed_by: {
+                        arm: 'guard_pass_complete',
+                        adjudicated: { by: 'tck', at: 'now', previous_arm: 'step_failure' },
+                    },
+                }));
+            },
+        },
+        {
+            law: 'SEAL_REWRITE_REFUSED',
+            name: `[${adapter.storeName}] a SAME-arm write minting lying provenance is refused; a truthful acknowledgment is accepted`,
+            run: async () => {
+                const run = await freshRun('adjudicated-same');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'Workflow completed.',
+                });
+                await expectRefusedWith('STATE_SEAL_REWRITTEN', 'a same-arm lying mint', () => adapter.store.update({
+                    ...sealed,
+                    sealed_by: {
+                        arm: 'complete',
+                        adjudicated: { by: 'tck', at: 'now', previous_arm: 'guard_abort' },
+                    },
+                }));
+                // The acknowledgment channel: "looked at it, it stands."
+                await adapter.store.update({
+                    ...sealed,
+                    sealed_by: {
+                        arm: 'complete',
+                        adjudicated: { by: 'tck', at: 'now', previous_arm: 'complete' },
+                    },
+                });
+            },
+        },
+        {
+            law: 'SEAL_REWRITE_REFUSED',
+            name: `[${adapter.storeName}] a terminal rewrite dropping stored adjudication provenance is refused`,
+            run: async () => {
+                const run = await freshRun('adjudicated-erase');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'Workflow completed.',
+                });
+                const ruled = await adapter.store.update({
+                    ...sealed,
+                    sealed_by: {
+                        arm: 'complete',
+                        adjudicated: { by: 'tck', at: 'now', previous_arm: 'complete' },
+                    },
+                });
+                await expectRefusedWith('STATE_SEAL_REWRITTEN', 'erasing a recorded ruling', () => adapter.store.update({ ...ruled, sealed_by: { arm: 'complete' } }));
+            },
+        },
+        // --- Direction 6: an operator's FIRST stamp of a parked record, three legs. ---
+        ...(adapter.seedLegacyTerminal === undefined
+            ? []
+            : [
+                {
+                    law: 'SEAL_REWRITE_REFUSED',
+                    name: `[${adapter.storeName}] a terminal UNSTAMPED record accepts a first stamp with previous_arm: null`,
+                    run: async () => {
+                        // The parked-unclassifiable population's only attributed landing channel. `null` is
+                        // the truthful statement "no arm existed before this ruling".
+                        const seeded = await adapter.seedLegacyTerminal('tck-adjudicate-first');
+                        const ruled = await adapter.store.update({
+                            ...seeded,
+                            sealed_by: {
+                                arm: 'complete',
+                                adjudicated: {
+                                    by: 'tck-operator',
+                                    at: '2026-01-01T00:00:00.000Z',
+                                    previous_arm: null,
+                                    reason: 'operator judgement',
+                                },
+                            },
+                        });
+                        if (ruled.sealed_by?.adjudicated?.previous_arm !== null) {
+                            throw new Error(`the null first-stamp provenance did not land: ${JSON.stringify(ruled.sealed_by)}`);
+                        }
+                        const reread = await adapter.store.get(seeded.id);
+                        if (reread.sealed_by?.adjudicated?.by !== 'tck-operator') {
+                            throw new Error(`the ruling did not survive the round trip: ${JSON.stringify(reread.sealed_by)}`);
+                        }
+                    },
+                },
+                {
+                    law: 'SEAL_REWRITE_REFUSED',
+                    name: `[${adapter.storeName}] a first stamp claiming a NON-NULL previous_arm is refused`,
+                    run: async () => {
+                        const seeded = await adapter.seedLegacyTerminal('tck-adjudicate-first-lying');
+                        await expectRefusedWith('STATE_SEAL_REWRITTEN', 'a fabricated first-stamp claim', () => adapter.store.update({
+                            ...seeded,
+                            sealed_by: {
+                                arm: 'complete',
+                                adjudicated: { by: 'tck', at: 'now', previous_arm: 'step_failure' },
+                            },
+                        }));
+                    },
+                },
+            ]),
+        {
+            law: 'SEAL_REWRITE_REFUSED',
+            name: `[${adapter.storeName}] a LIVE run's first seal cannot claim adjudication, even with null`,
+            run: async () => {
+                // The terminal-scope half of the first-stamp rule: nothing had happened yet to rule on.
+                const run = await freshRun('adjudicate-live');
+                await expectRefusedWith('STATE_SEAL_REWRITTEN', 'adjudication on a live first seal', () => adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    terminal_reason: 'Workflow completed.',
+                    sealed_by: {
+                        arm: 'complete',
+                        adjudicated: { by: 'tck', at: 'now', previous_arm: null },
+                    },
+                }));
+            },
+        },
+        {
+            law: 'SEAL_REWRITE_REFUSED',
+            name: `[${adapter.storeName}] a ruling SUPERSEDES the record's own prose, and keeps doing so`,
+            run: async () => {
+                // Direction 7. The scar rides the ruling write because the boundary itself refuses
+                // parked-scar creation through public channels — that population is minted by old binaries
+                // this suite cannot reproduce. The stored-scar half is pinned in the engine's own cells.
+                const run = await freshRun('adjudicate-supersedes');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'Workflow completed.',
+                });
+                const ruled = await adapter.store.update({
+                    ...sealed,
+                    failed_steps: ['x'],
+                    terminal_reason: 'a scar this classifier cannot place',
+                    sealed_by: {
+                        arm: 'complete',
+                        adjudicated: { by: 'tck-operator', at: 'now', previous_arm: 'complete' },
+                    },
+                });
+                if (ruled.terminal_reason !== 'a scar this classifier cannot place') {
+                    throw new Error('the prose was rewritten — a ruling must never falsify the record');
+                }
+                // Leg 2: the exemption is PERMANENT. A store exempting only the ruling write wedges the
+                // operator on every later spread of the same record.
+                await adapter.store.update({ ...ruled, updated_at: '2099-01-01T00:00:00.000Z' });
+            },
+        },
+        {
+            law: 'SEAL_REWRITE_REFUSED',
+            name: `[${adapter.storeName}] an arm change RIDING a prior ruling is refused — a change needs a FRESH ruling`,
+            run: async () => {
+                // Direction 8.
+                const run = await freshRun('adjudicate-riding');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'Workflow completed.',
+                });
+                const ruled = await adapter.store.update({
+                    ...sealed,
+                    sealed_by: {
+                        arm: 'complete',
+                        adjudicated: {
+                            by: 'tck-operator',
+                            at: '2026-02-02T00:00:00.000Z',
+                            previous_arm: 'complete',
+                        },
+                    },
+                });
+                await expectRefusedWith('STATE_SEAL_REWRITTEN', 'an arm change riding a prior ruling', () => adapter.store.update({
+                    ...ruled,
+                    sealed_by: { arm: 'guard_pass_complete', adjudicated: ruled.sealed_by.adjudicated },
+                }));
+            },
+        },
+        {
+            law: 'SEAL_REWRITE_REFUSED',
+            name: `[${adapter.storeName}] NEGATIVE CONTROL: a rewrite keeping the SAME arm passes`,
+            run: async () => {
+                const run = await freshRun('rewrite-control');
+                const sealed = await adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    sealed_by: { arm: 'complete' },
+                    terminal_reason: 'Workflow completed.',
+                });
+                // Every ordinary terminal rewrite spreads the record — without this passing, the clause
+                // would wedge the engine.
+                await adapter.store.update({ ...sealed, terminal_reason: 'Workflow completed. (touched)' });
+            },
+        },
+        {
+            law: 'SEAL_UNKNOWN_ARM_REFUSED',
+            name: `[${adapter.storeName}] an arm outside SEAL_ARMS never persists`,
+            run: async () => {
+                const run = await freshRun('unknown-arm');
+                await expectRefusedWith('STATE_SEAL_UNKNOWN_ARM', 'a foreign arm', () => adapter.store.update({
+                    ...run,
+                    terminal_state: true,
+                    // Deliberately outside the closed set — the shape a record written by a FUTURE
+                    // binary would have. The cast is the point: the type system cannot stop a foreign arm
+                    // arriving from disk or from another version, which is why the boundary checks it.
+                    sealed_by: { arm: 'from_the_future' },
+                    terminal_reason: 'tck',
+                }));
+            },
+        },
+    ];
+}
+// ---------------------------------------------------------------------------
+// issue #367 part 3 — the `stampSeal` laws. A store that declares the verb is promising a very
+// specific write: the seal arm lands, `version` moves so the CAS protocol can see it, and
+// `updated_at` does NOT move because stamping is not activity. Get that split wrong in either
+// direction and either the stamp is silently erasable or every migrated record looks freshly
+// touched to retention.
+// ---------------------------------------------------------------------------
+function stampSealCases(adapter) {
+    const stampSeal = adapter.store.stampSeal;
+    if (stampSeal === undefined)
+        return []; // dormant store — the laws bind declarers only
+    const stamp = stampSeal.bind(adapter.store);
+    /**
+     * A terminal, ALREADY-STAMPED record — the refusal legs' fixture. (An earlier version of this
+     * comment claimed the seal was "then removed by a direct write"; no such removal existed, and
+     * the boundary's ERASED clause would refuse one. Corrected rather than reworded.)
+     */
+    async function stampedTerminal(name) {
+        const { run } = await adapter.store.create({
+            workflowId: `tck-stamp-${name}`,
+            workflowVersion: 1,
+            params: {},
+        });
+        return adapter.store.update({
+            ...run,
+            completed_steps: ['a'],
+            terminal_state: true,
+            sealed_by: { arm: 'complete' },
+            terminal_reason: 'Workflow completed.',
+        });
+    }
+    return [
+        {
+            law: 'STAMP_PRESERVES_UPDATED_AT',
+            name: `[${adapter.storeName}] stampSeal leaves updated_at byte-identical`,
+            run: async () => {
+                const sealed = await stampedTerminal('clock');
+                // Already stamped, so this exercises the refusal path's clock too — the record must not be
+                // touched at all.
+                const before = await adapter.store.get(sealed.id);
+                await stamp(sealed.id, { arm: 'complete' }, before.version);
+                const after = await adapter.store.get(sealed.id);
+                if (after.updated_at !== before.updated_at) {
+                    throw new Error(`stampSeal moved updated_at (${before.updated_at} -> ${after.updated_at}) — stamping ` +
+                        `is not activity; the retention clock must not move`);
+                }
+            },
+        },
+        // --- SUCCESS legs. These need an UNSTAMPED terminal record, which is why the seed hook
+        // exists: without them a store that NEVER WRITES conforms to all five laws.
+        ...(adapter.seedLegacyTerminal === undefined
+            ? [
+                {
+                    law: 'STAMP_PRESERVES_UPDATED_AT',
+                    name: `[${adapter.storeName}] ADAPTER_WIRING: a stampSeal-declaring store must supply seedLegacyTerminal`,
+                    run: async () => {
+                        throw new Error('This store declares stampSeal but the adapter has no `seedLegacyTerminal` hook, ' +
+                            'so the laws cannot observe an ACTUAL stamp — only its refusals. A store that ' +
+                            'never writes would pass. Supply the hook.');
+                    },
+                },
+            ]
+            : [
+                {
+                    law: 'STAMP_PRESERVES_UPDATED_AT',
+                    name: `[${adapter.storeName}] a SUCCESSFUL stamp leaves updated_at byte-identical`,
+                    run: async () => {
+                        const seeded = await adapter.seedLegacyTerminal('tck-stamp-success-clock');
+                        const result = await stamp(seeded.id, { arm: 'complete', classified: true }, seeded.version);
+                        if (!result.stamped) {
+                            throw new Error(`expected an unstamped terminal record to be STAMPED, got refusal ` +
+                                `'${result.reason}' — a store that never writes is not conformant`);
+                        }
+                        const after = await adapter.store.get(seeded.id);
+                        if (after.sealed_by?.arm !== 'complete') {
+                            throw new Error(`the arm did not land: ${JSON.stringify(after.sealed_by)}`);
+                        }
+                        if (after.updated_at !== seeded.updated_at) {
+                            throw new Error(`stamping moved updated_at (${seeded.updated_at} -> ${after.updated_at}) — ` +
+                                `stamping is not activity`);
+                        }
+                    },
+                },
+                {
+                    law: 'STAMP_BUMPS_VERSION_ONCE',
+                    name: `[${adapter.storeName}] a SUCCESSFUL stamp bumps version exactly once`,
+                    run: async () => {
+                        const seeded = await adapter.seedLegacyTerminal('tck-stamp-success-version');
+                        await stamp(seeded.id, { arm: 'complete', classified: true }, seeded.version);
+                        const after = await adapter.store.get(seeded.id);
+                        if (after.version !== seeded.version + 1) {
+                            throw new Error(`expected version ${seeded.version + 1}, got ${after.version} — the CAS ` +
+                                `protocol is what stops a stale writer erasing the stamp`);
+                        }
+                    },
+                },
+                {
+                    law: 'STAMP_CLASSIFIED_ROUNDTRIP',
+                    name: `[${adapter.storeName}] a \`classified: true\` stamp survives write → read byte-for-byte`,
+                    run: async () => {
+                        // The provenance marker is what keeps a classifier-minted stamp distinguishable from
+                        // a writer's own assertion FOREVER. A store that drops it looks conformant on every
+                        // other law while quietly destroying that distinction.
+                        const seeded = await adapter.seedLegacyTerminal('tck-stamp-classified');
+                        await stamp(seeded.id, { arm: 'complete', classified: true }, seeded.version);
+                        const after = await adapter.store.get(seeded.id);
+                        if (after.sealed_by?.classified !== true) {
+                            throw new Error(`the \`classified\` provenance marker did not survive the round trip: ` +
+                                `${JSON.stringify(after.sealed_by)} — a vehicle-minted stamp must stay ` +
+                                `distinguishable from a writer-asserted one`);
+                        }
+                    },
+                },
+            ]),
+        {
+            law: 'STAMP_RETURNS_NOT_THROWS_PREDICATES',
+            name: `[${adapter.storeName}] a NON-TERMINAL record RETURNS 'not_terminal', never throws`,
+            run: async () => {
+                // No seed hook needed: `create()` makes a live record, which is exactly the shape.
+                const { run } = await adapter.store.create({
+                    workflowId: 'tck-stamp-live',
+                    workflowVersion: 1,
+                    params: {},
+                });
+                const result = await stamp(run.id, { arm: 'complete' }, run.version);
+                if (result.stamped !== false || result.reason !== 'not_terminal') {
+                    throw new Error(`expected a RETURNED {stamped:false, reason:'not_terminal'}, got ` +
+                        `${JSON.stringify(result)}`);
+                }
+            },
+        },
+        {
+            law: 'STAMP_RETURNS_NOT_THROWS_PREDICATES',
+            name: `[${adapter.storeName}] an already-stamped record RETURNS, never throws`,
+            run: async () => {
+                const sealed = await stampedTerminal('already');
+                const fresh = await adapter.store.get(sealed.id);
+                const result = await stamp(fresh.id, { arm: 'complete' }, fresh.version);
+                if (result.stamped !== false || result.reason !== 'already_stamped') {
+                    throw new Error(`expected a RETURNED {stamped:false, reason:'already_stamped'}, got ` +
+                        `${JSON.stringify(result)} — a predicate refusal is not an exceptional condition`);
+                }
+            },
+        },
+        {
+            law: 'STAMP_BUMPS_VERSION_ONCE',
+            name: `[${adapter.storeName}] a refused stamp does not bump version`,
+            run: async () => {
+                const sealed = await stampedTerminal('version');
+                const before = await adapter.store.get(sealed.id);
+                await stamp(before.id, { arm: 'complete' }, before.version);
+                const after = await adapter.store.get(before.id);
+                if (after.version !== before.version) {
+                    throw new Error(`a refused stamp moved version (${before.version} -> ${after.version}) — only a real ` +
+                        `write bumps it`);
+                }
+            },
+        },
+        {
+            law: 'STAMP_REFUSES_ON_VERSION_MOVE',
+            name: `[${adapter.storeName}] a stale expectedVersion THROWS STATE_SNAPSHOT_MISMATCH`,
+            run: async () => {
+                const sealed = await stampedTerminal('cas');
+                let code;
+                try {
+                    await stamp(sealed.id, { arm: 'complete' }, sealed.version + 99);
+                }
+                catch (err) {
+                    code = err.code;
+                }
+                if (code !== 'STATE_SNAPSHOT_MISMATCH') {
+                    throw new Error(`expected STATE_SNAPSHOT_MISMATCH on a version move, got '${String(code)}' — the ` +
+                        `sweep classified a record that has since changed, and must not write over it`);
+                }
+            },
+        },
+        {
+            law: 'STAMP_IDEMPOTENT',
+            name: `[${adapter.storeName}] re-stamping leaves the record byte-identical`,
+            run: async () => {
+                const sealed = await stampedTerminal('idem');
+                const before = JSON.stringify(await adapter.store.get(sealed.id));
+                await stamp(sealed.id, { arm: 'complete' }, sealed.version);
+                await stamp(sealed.id, { arm: 'complete' }, sealed.version);
+                const after = JSON.stringify(await adapter.store.get(sealed.id));
+                if (after !== before) {
+                    throw new Error(`re-stamping changed the record:\n  before ${before}\n  after  ${after}`);
+                }
+            },
+        },
+    ];
+}
 function csPurityCases(_adapter) {
     return [
         {
@@ -1003,6 +1636,10 @@ function refusalSweepCases(adapter) {
             const terminal = await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
             });
             await expectRefusalUnchanged(run.id, { kind: 'settle_step', step: 'b', outcome: 'complete', claimToken: 'x', evidence: [] }, def, 'run_terminal', terminal.version, 'run_terminal');
@@ -1071,6 +1708,10 @@ function refusalSweepCases(adapter) {
             const terminal = await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
             });
             await expectRefusalUnchanged(run.id, {
@@ -1094,6 +1735,10 @@ function refusalSweepCases(adapter) {
             const seeded = await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
                 finalizer_ledger: { fin: { status: 'completed', rank: 0 } },
             });
@@ -1113,6 +1758,10 @@ function refusalSweepCases(adapter) {
             await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
                 finalizer_ledger: { fin: { status: 'pending', rank: 0 } },
             });
@@ -1135,6 +1784,10 @@ function refusalSweepCases(adapter) {
             const seeded = await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
                 finalizer_ledger: {
                     first: { status: 'pending', rank: 0 },
@@ -1162,6 +1815,10 @@ function refusalSweepCases(adapter) {
             await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
                 finalizer_ledger: { fin: { status: 'pending', rank: 0 } },
             });
@@ -1184,6 +1841,10 @@ function refusalSweepCases(adapter) {
             const terminal = await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
             });
             await expectRefusalUnchanged(run.id, {
@@ -1208,6 +1869,10 @@ function refusalSweepCases(adapter) {
             await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
                 finalizer_ledger: { fin: { status: 'pending', rank: 0 } },
             });
@@ -1239,6 +1904,10 @@ function refusalSweepCases(adapter) {
             const seeded = await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
                 finalizer_ledger: { fin: { status: 'voided', rank: 0 } },
             });
@@ -1264,6 +1933,10 @@ function refusalSweepCases(adapter) {
             await adapter.store.update({
                 ...run,
                 terminal_state: true,
+                // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                // check abstains and the fixture stays a pure terminal-precondition seeder.
+                sealed_by: { arm: 'complete' },
                 terminal_reason: 'tck',
                 finalizer_ledger: { fin: { status: 'pending', rank: 0 } },
             });
@@ -1373,8 +2046,13 @@ function mintFreshCases(adapter) {
                 // dropped, and the STILL-PENDING... there are none pending now (onFail was already
                 // marked) — this fixture specifically exercises re-mint on a run with NO pending entries
                 // left post-void, proving mintFresh re-arms fresh regardless of prior history.
+                // issue #367: a real `applyResume` STRIPS `sealed_by` in the same write that flips the run
+                // live — a live run carrying a seal is an orphan, and the store boundary refuses it. This
+                // hand-authored fixture mirrors that, or it would stop mirroring the function it stands in
+                // for.
+                const { sealed_by: _voidSeal, ...markedBase } = marked.run;
                 const postResumeVoid = await adapter.store.update({
-                    ...marked.run,
+                    ...markedBase,
                     terminal_state: false,
                     in_progress_steps: [],
                     failed_steps: [],
@@ -2000,6 +2678,10 @@ function gateMismatchCases(adapter) {
                     ...run,
                     completed_steps: ['a'],
                     terminal_state: true,
+                    // issue #367: a terminal record names its arm. These fixtures mean "this run is over";
+                    // their opaque `tck` prose is deliberately unclassifiable, so the boundary's coherence
+                    // check abstains and the fixture stays a pure terminal-precondition seeder.
+                    sealed_by: { arm: 'complete' },
                     terminal_reason: 'Workflow completed.',
                     pending_gate: {
                         gate_id: gateId,
@@ -2672,8 +3354,11 @@ function cwfsSecondEpochCases(adapter) {
                 // 'onFail' — a FINALIZER, unresumable — stays in failed_steps (the M1 scenario's own
                 // premise). terminal_state:false / in_progress_steps:[] / settled:{} mirror the
                 // mintFreshCases precedent's own void shape.
+                // issue #367: same as the mintFreshCases precedent — the seal fact leaves in the write
+                // that flips the run live again.
+                const { sealed_by: _voidSeal2, ...markedFailedBase } = markedFailed.run;
                 const postResumeVoid = await adapter.store.update({
-                    ...markedFailed.run,
+                    ...markedFailedBase,
                     terminal_state: false,
                     in_progress_steps: [],
                     failed_steps: ['onFail'],
@@ -3227,6 +3912,26 @@ function expireDefaultResolveCases(adapter) {
  */
 export function settlementContract(adapter) {
     if (adapter.store.settleStep === undefined) {
+        // A store that declares NEITHER verb genuinely has nothing here to conform to — the
+        // established optional-capability idiom, and a real vacuous pass.
+        //
+        // But a store declaring `stampSeal` WITHOUT `settleStep` would also have received zero cases,
+        // so its stamp and seal-integrity conformance — every law in this file that binds it — would
+        // report green while never running. That is a wiring gap wearing a vacuous pass's clothes.
+        if (adapter.store.stampSeal !== undefined) {
+            return [
+                {
+                    law: 'ADAPTER_WIRING',
+                    name: `[${adapter.storeName}] declares RunStore.stampSeal but NOT settleStep — every law in this suite would pass without running`,
+                    run: async () => {
+                        throw new Error(`[${adapter.storeName}] settlementContract: the store declares stampSeal but not ` +
+                            'settleStep, and this suite is gated on settleStep — so it would return zero ' +
+                            'cases and report green having tested nothing. Declare settleStep, or run the ' +
+                            'stamp laws through a suite that binds them on their own.');
+                    },
+                },
+            ];
+        }
         return [];
     }
     if (adapter.settlementFixture === undefined) {
@@ -3251,6 +3956,8 @@ export function settlementContract(adapter) {
         ...drainMarkDedupCases(adapter),
         ...terminalRefusalCases(adapter),
         ...terminalStateOnlyCases(adapter),
+        ...sealIntegrityCases(adapter),
+        ...stampSealCases(adapter),
         ...csPurityCases(adapter),
         ...neverDowngradeCases(adapter),
         ...settleOutcomeIntegrityCases(adapter),