amalgm 0.1.245 → 0.1.246

package/runtime/scripts/amalgm-mcp/tests/entity.registry.test.js

@@ -0,0 +1,967 @@
+'use strict';
+
+/**
+ * The entity registry proving the constitution's registry chapter
+ * (docs/entity-model.md): durable identity with a first-init-vs-loss
+ * sentinel, the ratified version formula with status finally moving
+ * through it, explicit-only lifecycle verbs, slot and container and
+ * acyclicity law, and derived lifecycle inheritance — every rule exercised
+ * through the public surface, with the database schema shown to convict
+ * independently when application checks are bypassed.
+ *
+ * Wave A tests exercise the durable core alone. The Wave B tests at the
+ * bottom exercise the evidence intake's doorbell contract (infallible
+ * onEvent, dirty retry, startup reconciliation) and its durable memory —
+ * channel bindings and contested-ground markers surviving restart and
+ * even observer-store loss; the entity oracle grades the combined system
+ * through the widened boundary adapter.
+ */
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const Database = require('better-sqlite3');
+const { createObserver } = require('../observer');
+const { createRegistry, canonicalVersion } = require('../registry');
+const { createEvidence, createEvidenceMemory } = require('../registry/evidence');
+const { createStore } = require('../registry/store');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-entity-registry-'));
+
+test.after(() => {
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+/** In-memory registry with an event log; enough for every non-sentinel test. */
+function makeRegistry(options = {}) {
+  const events = [];
+  const registry = createRegistry({
+    db: new Database(':memory:'),
+    emit: (event) => events.push(event),
+    ephemeral: true,
+    ...options,
+  });
+  return { registry, events };
+}
+
+/** The single-tree harnesses register exactly one tree, so its top record
+ * is the one parentless active. */
+const rootOf = (registry) => registry.roots()[0] ?? null;
+
+/** Root + one folder + one file under it: the smallest interesting graph. */
+function makeGraph(options = {}) {
+  const made = makeRegistry(options);
+  const root = made.registry.enrollRoot({ type: 'workspace', name: 'ws' });
+  const folder = made.registry.create({ type: 'folder', parentUUID: root.uuid, name: 'den' });
+  const file = made.registry.create({
+    type: 'file.text', parentUUID: folder.uuid, name: 'cub.txt', payloadVersion: 'hash-1',
+  });
+  return { ...made, root, folder, file };
+}
+
+test('first initialization mints the sentinel; reopening finds the same registry', () => {
+  const dir = fs.mkdtempSync(path.join(tempRoot, 'sentinel-'));
+  const dbPath = path.join(dir, 'registry.db');
+  const sentinelPath = path.join(dir, 'registry.epoch');
+
+  const first = createRegistry({ db: new Database(dbPath), emit: () => {}, sentinelPath });
+  const epoch = first.epoch();
+  assert.equal(fs.readFileSync(sentinelPath, 'utf8').trim(), epoch,
+    'the sentinel marker carries the minted epoch');
+  const root = first.enrollRoot({ type: 'workspace', name: 'ws' });
+  const file = first.create({
+    type: 'file.text', parentUUID: root.uuid, name: 'a.txt', payloadVersion: 'h1',
+  });
+
+  const reopened = createRegistry({ db: new Database(dbPath), emit: () => {}, sentinelPath });
+  assert.equal(reopened.epoch(), epoch, 'reopening is the same registry, not a new one');
+  assert.deepEqual(reopened.record(file.uuid), file,
+    'every field of the record — version included — survives the restart byte for byte');
+  assert.deepEqual(rootOf(reopened), reopened.record(root.uuid));
+});
+
+test('a registry that existed is never silently replaced', () => {
+  const dir = fs.mkdtempSync(path.join(tempRoot, 'loss-'));
+  const sentinelPath = path.join(dir, 'registry.epoch');
+
+  // Loss: the sentinel says an epoch lived here, the fresh database has nothing.
+  createRegistry({ db: new Database(path.join(dir, 'one.db')), emit: () => {}, sentinelPath });
+  assert.throws(
+    () => createRegistry({ db: new Database(':memory:'), emit: () => {}, sentinelPath }),
+    /registry lost: .*refusing to mint replacement identities/,
+    'a marker over an empty database is loss, not first init');
+
+  // Corruption: half the tables gone.
+  const halfDb = new Database(path.join(dir, 'two.db'));
+  const halfSentinel = path.join(dir, 'two.epoch');
+  createRegistry({ db: halfDb, emit: () => {}, sentinelPath: halfSentinel });
+  halfDb.exec('DROP TABLE entities');
+  assert.throws(
+    () => createRegistry({ db: halfDb, emit: () => {}, sentinelPath: halfSentinel }),
+    /registry corrupt: entities gone from a database where a registry lived/);
+
+  // Mismatch: the marker belongs to a different registry's epoch.
+  const otherDbPath = path.join(dir, 'three.db');
+  createRegistry({ db: new Database(otherDbPath), emit: () => {}, sentinelPath: path.join(dir, 'three.epoch') });
+  assert.throws(
+    () => createRegistry({ db: new Database(otherDbPath), emit: () => {}, sentinelPath }),
+    /registry mismatch: sentinel epoch .* is not this database's epoch/);
+});
+
+test('a durable registry requires a sentinel; ephemeral is for real memory only', () => {
+  const dir = fs.mkdtempSync(path.join(tempRoot, 'require-'));
+  assert.throws(
+    () => createRegistry({ db: new Database(path.join(dir, 'bare.db')), emit: () => {} }),
+    /a durable registry requires a sentinel/,
+    'a durable database without a sentinel is fail-open loss protection — refused');
+  assert.throws(
+    () => createRegistry({ db: new Database(':memory:'), emit: () => {} }),
+    /a durable registry requires a sentinel/,
+    'even memory must SAY it is ephemeral — the default is never silence');
+  assert.throws(
+    () => createRegistry({ db: new Database(path.join(dir, 'liar.db')), emit: () => {}, ephemeral: true }),
+    /ephemeral is for a real in-memory database/,
+    'the flag is not an escape hatch for durable databases');
+  assert.throws(
+    () => createRegistry({
+      db: new Database(':memory:'), emit: () => {},
+      ephemeral: true, sentinelPath: path.join(dir, 'x.epoch'),
+    }),
+    /contradictory/, 'declaring both is a confused caller, not a choice');
+  assert.ok(createRegistry({ db: new Database(':memory:'), emit: () => {}, ephemeral: true }).epoch(),
+    'a real in-memory database, declared ephemeral, runs');
+});
+
+test('a failed notification is a pending bell, never a permanent miss', () => {
+  let down = false;
+  const events = [];
+  const registry = createRegistry({
+    db: new Database(':memory:'),
+    ephemeral: true,
+    emit: (event) => {
+      if (down) throw new Error('consumer offline');
+      events.push(event);
+    },
+  });
+  const root = registry.enrollRoot({ type: 'workspace', name: 'ws' });
+  const file = registry.create({ type: 'file.text', parentUUID: root.uuid, name: 'a.txt', payloadVersion: 'h1' });
+  events.length = 0;
+
+  down = true;
+  const renamed = registry.move(file.uuid, { parentUUID: root.uuid, name: 'b.txt' });
+  assert.equal(renamed.name, 'b.txt', 'the commit succeeded — the registry is truth');
+  assert.equal(events.length, 0, 'the notification was missed');
+  registry.setPayloadVersion(file.uuid, 'h2');
+  assert.equal(events.length, 0, 'two misses collapse into one owed comparison');
+
+  down = false;
+  registry.setPayloadVersion(file.uuid, 'h3');
+  assert.deepEqual(events.map((event) => event.type), ['registry.changed', 'entity.committed'],
+    'the next commit rings the pending bell first, then its own event');
+  assert.deepEqual(registry.record(file.uuid), events[1].record,
+    'and the registry read gives everything the missed events would have');
+
+  events.length = 0;
+  assert.equal(registry.flush(), true);
+  assert.deepEqual(events.map((event) => event.type), ['registry.changed'],
+    'flush always requests comparison — it never trusts the in-memory flag');
+
+  down = true;
+  assert.equal(registry.flush(), false, 'a failed flush reports itself and leaves the bell pending');
+  down = false;
+  events.length = 0;
+  registry.trash(file.uuid);
+  assert.deepEqual(events.map((event) => event.type), ['registry.changed', 'entity.committed']);
+});
+
+test('trees in one registry: parentless records are roots, and a tree boundary is not identity', () => {
+  const { registry } = makeRegistry();
+  assert.throws(() => registry.enrollRoot({ type: 'folder', name: 'ws' }),
+    /the root is workspace, repo\.git, a registered file, or a registered link/,
+    'a folder inside no workspace is not a thing amalgm registers');
+  const root = registry.enrollRoot({ type: 'workspace', name: 'ws' });
+  const other = registry.enrollRoot({ type: 'workspace', name: 'ws' });
+  assert.notEqual(other.uuid, root.uuid,
+    'the ONE registry holds every tree — even two trees sharing a basename, placed by address, never by name');
+  assert.deepEqual(registry.roots().map((record) => record.uuid).sort(),
+    [root.uuid, other.uuid].sort());
+  assert.throws(() => registry.changeType(root.uuid, 'folder'),
+    /the root is workspace, repo\.git, a registered file, or a registered link/);
+  assert.throws(() => registry.trash(root.uuid), /never trashed/);
+  assert.throws(() => registry.move(root.uuid, { parentUUID: root.uuid, name: 'x' }),
+    /cannot live under itself/, 'acyclicity binds adoption like any move');
+
+  // ADOPTION: a parentless mover is the whole tree joining another —
+  // the same lawful move, one parent update, same UUID.
+  const adopted = registry.move(root.uuid, { parentUUID: other.uuid, name: 'ws' });
+  assert.equal(adopted.uuid, root.uuid, 'a tree boundary is not identity: the UUID rides the move');
+  assert.equal(adopted.parentUUID, other.uuid);
+  assert.deepEqual(registry.roots().map((record) => record.uuid), [other.uuid],
+    'the adopted tree is no longer parentless — it lives inside its new tree');
+
+  // The ratified extension (`amalgm add <file>`): a single registered
+  // file is a tree of one — its root record IS the file entity.
+  const { registry: soloRegistry } = makeRegistry();
+  const solo = soloRegistry.enrollRoot({ type: 'file.text', name: 'notes.md', payloadVersion: 'h1' });
+  assert.equal(rootOf(soloRegistry).uuid, solo.uuid);
+  assert.throws(() => soloRegistry.create({ type: 'file.text', parentUUID: solo.uuid, name: 'x' }),
+    /only containers hold active children/, 'a tree of one stays a tree of one');
+
+  // And its sibling (amended 2026-08-01): `amalgm add` names an ADDRESS,
+  // so a pointer added explicitly is an entity of its own — a tree of
+  // one of the pointer kind, its payload the written target text.
+  const { registry: ptrRegistry } = makeRegistry();
+  const ptr = ptrRegistry.enrollRoot({ type: 'link', name: 'current', payloadVersion: '../v2' });
+  assert.equal(rootOf(ptrRegistry).uuid, ptr.uuid);
+  assert.throws(() => ptrRegistry.create({ type: 'file.text', parentUUID: ptr.uuid, name: 'x' }),
+    /only containers hold active children/, 'a pointer holds no children');
+});
+
+test('a reference\'s payload is identity, never an attestation', () => {
+  const { registry } = makeRegistry();
+  const root = registry.enrollRoot({ type: 'workspace', name: 'ws' });
+  const ref = registry.create({
+    type: 'reference', parentUUID: root.uuid, name: 'proj', payloadVersion: 'target-uuid-123',
+  });
+  assert.equal(ref.type, 'reference');
+  assert.throws(() => registry.setPayloadVersion(ref.uuid, 'other'), /never an attestation/,
+    'the evidence path cannot write a reference\'s payload: ground attests bytes, never identity');
+  assert.throws(() => registry.create({ type: 'file.text', parentUUID: ref.uuid, name: 'x' }),
+    /only containers hold active children/, 'a reference holds no children');
+});
+
+test('only containers take children, names are single segments, types are known', () => {
+  const { registry, root, file } = makeGraph();
+  assert.throws(
+    () => registry.create({ type: 'file.text', parentUUID: file.uuid, name: 'child.txt' }),
+    /only containers hold active children/);
+  assert.throws(
+    () => registry.create({ type: 'workspace', parentUUID: root.uuid, name: 'nested' }),
+    /workspace is the root type only/);
+  assert.throws(
+    () => registry.create({ type: 'directory', parentUUID: root.uuid, name: 'x' }),
+    /unknown entity type/);
+  for (const name of ['', '.', '..', 'a/b', 'a\0b']) {
+    assert.throws(() => registry.create({ type: 'folder', parentUUID: root.uuid, name }),
+      /a name is one non-empty path segment/, `name ${JSON.stringify(name)} must be refused`);
+  }
+});
+
+test('rename and move preserve the uuid; the version is a state fingerprint', () => {
+  const { registry, root, folder, file } = makeGraph();
+  const born = registry.record(file.uuid);
+
+  const renamed = registry.move(file.uuid, { parentUUID: folder.uuid, name: 'wolf.txt' });
+  assert.equal(renamed.uuid, born.uuid);
+  assert.notEqual(renamed.version, born.version, 'a rename is a record change');
+
+  const moved = registry.move(file.uuid, { parentUUID: root.uuid, name: 'wolf.txt' });
+  assert.equal(moved.uuid, born.uuid);
+  assert.notEqual(moved.version, renamed.version);
+
+  const home = registry.move(file.uuid, { parentUUID: folder.uuid, name: 'cub.txt' });
+  assert.equal(home.version, born.version,
+    'identical state is the identical version — a fingerprint, not a history counter');
+
+  const edited = registry.setPayloadVersion(file.uuid, 'hash-2');
+  assert.notEqual(edited.version, home.version);
+  assert.equal(registry.setPayloadVersion(file.uuid, 'hash-2').version, edited.version,
+    'an equal attestation is silence');
+});
+
+test('the slot admits one active owner — and the schema itself convicts', () => {
+  const { registry, folder } = makeGraph();
+  assert.throws(
+    () => registry.create({ type: 'file.text', parentUUID: folder.uuid, name: 'cub.txt' }),
+    /slot taken: active entity .* already owns/);
+
+  // Bypass every application check: the database's partial unique index is
+  // an independent second layer, so a registry bug cannot slip a duplicate in.
+  // Parentless rows are DELIBERATELY exempt — one registry holds many
+  // trees, and a top-level tree is placed by address, never by name.
+  const db = new Database(':memory:');
+  createRegistry({ db, emit: () => {}, ephemeral: true });
+  const store = createStore(db);
+  store.insert({ uuid: 'a', type: 'folder', parentUuid: null, name: 'ws', status: 'active', payloadVersion: null });
+  assert.doesNotThrow(
+    () => store.insert({ uuid: 'b', type: 'folder', parentUuid: null, name: 'ws', status: 'active', payloadVersion: null }),
+    'two trees may even share a basename: the slot law binds under a parent, not at the top level');
+  assert.throws(
+    () => store.insert({ uuid: 'x', type: 'folder', parentUuid: 'ghost', name: 'n', status: 'active', payloadVersion: null }),
+    /FOREIGN KEY/, 'a phantom parent violates the schema too — better-sqlite3 enforces the reference');
+  store.insert({ uuid: 'c', type: 'file.text', parentUuid: 'a', name: 'n.txt', status: 'active', payloadVersion: null });
+  assert.throws(
+    () => store.insert({ uuid: 'd', type: 'file.text', parentUuid: 'a', name: 'n.txt', status: 'active', payloadVersion: null }),
+    /UNIQUE/, 'a second active slot owner violates the schema, whatever code allowed it');
+});
+
+test('an address permutation is one transition: the slot law judges the state after the batch', () => {
+  const { registry, events } = makeRegistry();
+  const root = registry.enrollRoot({ type: 'workspace', name: 'ws' });
+  const north = registry.create({ type: 'folder', parentUUID: root.uuid, name: 'north' });
+  const south = registry.create({ type: 'folder', parentUUID: root.uuid, name: 'south' });
+
+  // Sequential moves cannot thread an exchange — the slot law convicts each
+  // half — but the same two moves as ONE batch are a lawful transition:
+  // the invariant constrains the graph after the batch, never the order
+  // inside it.
+  assert.throws(() => registry.move(north.uuid, { parentUUID: root.uuid, name: 'south' }),
+    /slot taken/);
+  const mark = events.length;
+  const next = registry.moveMany([
+    { uuid: north.uuid, parentUUID: root.uuid, name: 'south' },
+    { uuid: south.uuid, parentUUID: root.uuid, name: 'north' },
+  ]);
+  assert.deepEqual(next.map((record) => [record.name, record.uuid]),
+    [['south', north.uuid], ['north', south.uuid]], 'both records crossed on their own uuids');
+  assert.equal(events.slice(mark).filter((event) => event.type === 'entity.committed').length, 2,
+    'an exchange is two recorded facts, nothing more');
+
+  // The invariant still judges the end state: a batch landing on an owned
+  // slot is refused whole, and so is a batch that collides with itself.
+  assert.throws(() => registry.moveMany([{ uuid: north.uuid, parentUUID: root.uuid, name: 'north' }]),
+    /slot taken: active entity/);
+  assert.throws(() => registry.moveMany([
+    { uuid: north.uuid, parentUUID: root.uuid, name: 'same' },
+    { uuid: south.uuid, parentUUID: root.uuid, name: 'same' },
+  ]), /slot taken: two movers/);
+});
+
+test('the parent graph stays acyclic', () => {
+  const { registry, root, folder } = makeGraph();
+  const inner = registry.create({ type: 'folder', parentUUID: folder.uuid, name: 'inner' });
+  assert.throws(() => registry.move(folder.uuid, { parentUUID: inner.uuid, name: 'den' }),
+    /the parent graph is acyclic/);
+  assert.throws(() => registry.move(folder.uuid, { parentUUID: folder.uuid, name: 'den' }),
+    /the parent graph is acyclic/);
+  // A legal reparent still works after the refusals.
+  assert.equal(registry.move(inner.uuid, { parentUUID: root.uuid, name: 'inner' }).uuid, inner.uuid);
+});
+
+test('lifecycle inherits down as derived status; no descendant record is rewritten', () => {
+  const { registry, folder, file } = makeGraph();
+  const fileBefore = registry.record(file.uuid);
+
+  registry.trash(folder.uuid);
+  assert.equal(registry.record(file.uuid).status, 'active',
+    'the child\'s STORED status never moved');
+  assert.deepEqual(registry.record(file.uuid), fileBefore,
+    'trashing the folder changed nothing on the child record — version included');
+  assert.equal(registry.effectiveStatus(file.uuid), 'trashed',
+    'yet the child is effectively trashed through its ancestor');
+
+  registry.restore(folder.uuid);
+  assert.equal(registry.effectiveStatus(file.uuid), 'active',
+    'one flip back restores the whole subtree in effect');
+});
+
+test('trash frees the slot; restore refuses an occupied one', () => {
+  const { registry, folder, file } = makeGraph();
+  registry.trash(file.uuid);
+  const usurper = registry.create({
+    type: 'file.text', parentUUID: folder.uuid, name: 'cub.txt', payloadVersion: 'other',
+  });
+  assert.throws(() => registry.restore(file.uuid),
+    /slot taken: active entity .* already owns/,
+    'a simple status flip would seat two active owners — refused');
+  registry.trash(usurper.uuid);
+  assert.equal(registry.restore(file.uuid).status, 'active',
+    'with the slot vacated, restore is one flip');
+});
+
+test('a trashed record is not ground: it never moves, never attests, never re-types', () => {
+  const { registry, root, file } = makeGraph();
+  registry.trash(file.uuid);
+  assert.throws(() => registry.move(file.uuid, { parentUUID: root.uuid, name: 'x.txt' }),
+    /only an active entity moves/);
+  assert.throws(() => registry.setPayloadVersion(file.uuid, 'h9'),
+    /only an active entity attests/);
+  assert.throws(() => registry.changeType(file.uuid, 'folder'),
+    /only an active entity changes type/);
+});
+
+test('valid type transitions ride one uuid; an occupied folder never becomes a file', () => {
+  const { registry, folder, file } = makeGraph();
+  assert.throws(() => registry.changeType(folder.uuid, 'file.text'),
+    /would be stranded — only containers hold active children/,
+    'the flip that would canonicalize subtree destruction is refused');
+
+  const asFolder = registry.changeType(file.uuid, 'folder');
+  assert.equal(asFolder.uuid, file.uuid, 'file → folder is always valid, same uuid');
+  assert.equal(asFolder.type, 'folder');
+
+  const asFile = registry.changeType(file.uuid, 'file.text', { payloadVersion: 'reborn' });
+  assert.equal(asFile.uuid, file.uuid, 'empty folder → file is valid, same uuid');
+
+  registry.trash(file.uuid);
+  const emptied = registry.changeType(folder.uuid, 'file.binary', { payloadVersion: 'bytes' });
+  assert.equal(emptied.uuid, folder.uuid,
+    'once its children are explicitly out of the way, the folder may become a file');
+});
+
+test('permanent deletion is owner-only, from Trash only, and unavailable unwired', () => {
+  const unwired = makeGraph();
+  unwired.registry.trash(unwired.file.uuid);
+  assert.throws(() => unwired.registry.deletePermanently(unwired.file.uuid),
+    /permanent deletion is unavailable: no ownership authorization is wired/,
+    'no authorizeDelete means the verb does not exist — never fail-open');
+
+  let allow = false;
+  const { registry, folder, file } = makeGraph({ authorizeDelete: () => allow });
+  assert.throws(() => registry.deletePermanently(file.uuid),
+    /empty-trash deletes from Trash only/);
+  registry.trash(file.uuid);
+  assert.throws(() => registry.deletePermanently(file.uuid),
+    /permanent deletion is owner-only/);
+  allow = true;
+  const deleted = registry.deletePermanently(file.uuid);
+  assert.equal(deleted.status, 'deleted');
+  assert.equal(registry.record(file.uuid).status, 'deleted',
+    'the record remains — it IS the tombstone');
+  assert.throws(() => registry.restore(file.uuid), /deleted is permanent/);
+  assert.equal(
+    registry.create({ type: 'file.text', parentUUID: folder.uuid, name: 'cub.txt' }).name,
+    'cub.txt', 'deletion vacates the slot for a genuinely new entity');
+});
+
+test('status sits inside the version: every lifecycle flip is a version change', () => {
+  const { registry, file } = makeGraph({ authorizeDelete: () => true });
+  const active = registry.record(file.uuid).version;
+  const trashed = registry.trash(file.uuid).version;
+  const deleted = registry.deletePermanently(file.uuid).version;
+  assert.notEqual(trashed, active, 'trash moves the version');
+  assert.notEqual(deleted, trashed, 'deletion moves it again');
+  assert.equal(new Set([active, trashed, deleted]).size, 3,
+    'three statuses, three distinct fingerprints — catch-up is one comparison');
+});
+
+test('a container\'s version is its active membership, nothing else', () => {
+  const { registry, folder, file } = makeGraph();
+  const v0 = registry.record(folder.uuid).version;
+
+  registry.setPayloadVersion(file.uuid, 'hash-2');
+  assert.equal(registry.record(folder.uuid).version, v0,
+    'a child\'s content edit does not change its parent\'s version');
+
+  registry.move(file.uuid, { parentUUID: folder.uuid, name: 'wolf.txt' });
+  const v1 = registry.record(folder.uuid).version;
+  assert.notEqual(v1, v0, 'a child rename changes the parent\'s membership');
+
+  registry.trash(file.uuid);
+  const v2 = registry.record(folder.uuid).version;
+  assert.notEqual(v2, v1, 'a child trash changes the parent\'s membership');
+
+  registry.restore(file.uuid);
+  assert.equal(registry.record(folder.uuid).version, v1,
+    'restore returns the membership, so it returns the version');
+});
+
+test('the public record is exactly the six ratified fields', () => {
+  const { registry, file } = makeGraph();
+  const record = registry.record(file.uuid);
+  assert.deepEqual(Object.keys(record).sort(),
+    ['name', 'parentUUID', 'status', 'type', 'uuid', 'version'],
+    'payload attestations are evidence inputs, never a seventh public field');
+  assert.equal(record.version, canonicalVersion({
+    type: 'file.text', parentUUID: record.parentUUID, name: 'cub.txt',
+    status: 'active', payloadVersion: 'hash-1',
+  }), 'the exposed version is the ratified formula, recomputable by anyone');
+});
+
+test('every commit emits the record and its previous; no-ops emit nothing', () => {
+  const { registry, events, file } = makeGraph();
+  events.length = 0;
+
+  const moved = registry.move(file.uuid, { parentUUID: registry.record(file.uuid).parentUUID, name: 'wolf.txt' });
+  assert.equal(events.length, 1);
+  assert.equal(events[0].type, 'entity.committed');
+  assert.deepEqual(events[0].record, moved);
+  assert.equal(events[0].previous.uuid, moved.uuid);
+  assert.notEqual(events[0].previous.version, moved.version);
+
+  events.length = 0;
+  registry.setPayloadVersion(file.uuid, 'hash-1'); // equal attestation
+  registry.changeType(file.uuid, 'file.text'); // same type
+  assert.equal(events.length, 0, 'silence when nothing changed');
+
+  events.length = 0;
+  const birth = registry.create({
+    type: 'folder', parentUUID: rootOf(registry).uuid, name: 'new',
+  });
+  assert.deepEqual(events[0], { type: 'entity.committed', record: birth, previous: null },
+    'a birth has no previous');
+});
+
+// --- Wave B: the evidence intake's doorbell contract ----------------------
+
+/** A real observer over a scratch dir, wired into a registry's intake.
+ * A lens is keyed by the tree's permanent identity, so `enroll()` is
+ * what births it — enroll the ground, then the lens over its rootId. */
+function makeIntake(name, { registryDb, sentinelPath, classify, wrapMemory } = {}) {
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(tempRoot, `${name}-`)));
+  const regEvents = [];
+  const kit = { dir, regEvents, evidence: null };
+  kit.observer = createObserver({
+    db: new Database(':memory:'),
+    emit: () => kit.evidence?.onEvent(),
+  });
+  const db = registryDb ?? new Database(':memory:');
+  kit.db = db;
+  kit.registry = createRegistry({
+    db,
+    ...(registryDb ? { sentinelPath } : { ephemeral: true }),
+    emit: (event) => regEvents.push(event),
+  });
+  kit.memory = (wrapMemory ?? ((real) => real))(createEvidenceMemory(db));
+  kit.lens = (rootId) => {
+    kit.evidence = createEvidence({
+      observer: kit.observer, registry: kit.registry, memory: kit.memory,
+      rootId, classify: classify ?? (() => 'file.text'),
+    });
+    return kit.evidence;
+  };
+  kit.enroll = () => {
+    const rootId = kit.observer.enrollRoot(dir).rootId;
+    kit.lens(rootId);
+    return rootId;
+  };
+  return kit;
+}
+
+test('the intake is infallible: a failed reconciliation leaves dirty set, and retries recover', async () => {
+  let broken = true;
+  const kit = makeIntake('intake', {
+    classify: () => {
+      if (broken) throw new Error('classifier down');
+      return 'file.text';
+    },
+  });
+  fs.writeFileSync(path.join(kit.dir, 'a.txt'), 'alpha');
+  kit.enroll();
+
+  // The enrollment scan rang onEvent; the scheduled attempt fails inside
+  // its own catch — nothing throws upward, the intake just stays dirty.
+  assert.doesNotThrow(() => kit.evidence.onEvent(), 'onEvent is infallible by construction');
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(kit.evidence.dirty(), true, 'a failed reconciliation leaves the intake dirty');
+  assert.equal(kit.evidence.flushIfDirty(), false, 'flush reports honestly while reconciliation fails');
+  assert.throws(() => kit.evidence.reconcile(), /classifier down/,
+    'the direct call is the loud variant of the same reconciliation');
+  assert.equal(kit.evidence.dirty(), true);
+
+  // The consumer heals; the SAME reconciliation the retries were attempting
+  // now succeeds — no event content was needed, observer-store truth held it.
+  broken = false;
+  assert.equal(kit.evidence.flushIfDirty(), true, 'the retry recovers with nothing lost');
+  assert.equal(kit.evidence.dirty(), false);
+  const root = rootOf(kit.registry);
+  const file = kit.registry.activeAt(root.uuid, 'a.txt');
+  assert.ok(file, 'the file the events hinted at was reconciled from store truth');
+  assert.equal(file.type, 'file.text');
+});
+
+test('startup performs the identical reconciliation: a fresh process rebinds with zero commits', () => {
+  const dir = fs.mkdtempSync(path.join(tempRoot, 'restart-'));
+  const dbPath = path.join(dir, 'registry.db');
+  const sentinelPath = path.join(dir, 'registry.epoch');
+
+  const first = makeIntake('restart-a', { registryDb: new Database(dbPath), sentinelPath });
+  fs.writeFileSync(path.join(first.dir, 'keep.txt'), 'kept');
+  fs.mkdirSync(path.join(first.dir, 'sub'));
+  fs.writeFileSync(path.join(first.dir, 'sub', 'deep.txt'), 'deep');
+  const rootId = first.enroll();
+  first.evidence.reconcile();
+  const rootUuid = rootOf(first.registry).uuid;
+  const keepUuid = first.registry.activeAt(rootUuid, 'keep.txt').uuid;
+
+  // "Restart": a new registry over the same durable database and sentinel,
+  // a new evidence layer over the same durable memory — same observer
+  // store. Startup reconciliation must find every claim already true and
+  // commit NOTHING: the records already say everything disk still says.
+  const reborn = [];
+  const db2 = new Database(dbPath);
+  const registry2 = createRegistry({
+    db: db2, sentinelPath, emit: (event) => reborn.push(event),
+  });
+  const evidence2 = createEvidence({
+    observer: first.observer, registry: registry2, rootId,
+    memory: createEvidenceMemory(db2),
+    classify: () => 'file.text',
+  });
+  evidence2.reconcile();
+  assert.deepEqual(reborn, [], 'startup reconciliation over unchanged truth is silence');
+  assert.equal(rootOf(registry2).uuid, rootUuid, 'the root uuid survived the restart');
+  assert.equal(registry2.activeAt(rootUuid, 'keep.txt').uuid, keepUuid,
+    'file uuids survived the restart — bindings are evidence, records are identity');
+  const keepChannel = first.observer.filesForRoot(first.observer.listRoots()[0].rootId)
+    .find((row) => row.relPath === 'keep.txt').fileId;
+  assert.equal(evidence2.boundUuid(keepChannel), keepUuid,
+    'the durable binding carried the channel\'s claim across the restart');
+});
+
+test('folder identity survives restart: the durable dir binding carries a rename made after reopen', () => {
+  const dir = fs.mkdtempSync(path.join(tempRoot, 'dir-restart-'));
+  const dbPath = path.join(dir, 'registry.db');
+  const sentinelPath = path.join(dir, 'registry.epoch');
+
+  const first = makeIntake('dir-restart-a', { registryDb: new Database(dbPath), sentinelPath });
+  fs.mkdirSync(path.join(first.dir, 'shelf'));
+  fs.writeFileSync(path.join(first.dir, 'shelf', 'book.txt'), 'book');
+  const rootId = first.enroll();
+  first.evidence.reconcile();
+  const rootUuid = rootOf(first.registry).uuid;
+  const shelfUuid = first.registry.activeAt(rootUuid, 'shelf').uuid;
+
+  // "Restart", then a directory rename: the binding restored from the
+  // database — not process memory — must move the SAME folder record.
+  const reborn = [];
+  const db2 = new Database(dbPath);
+  const registry2 = createRegistry({ db: db2, sentinelPath, emit: (event) => reborn.push(event) });
+  const evidence2 = createEvidence({
+    observer: first.observer, registry: registry2, rootId,
+    memory: createEvidenceMemory(db2),
+    classify: () => 'file.text',
+  });
+  evidence2.reconcile();
+  assert.deepEqual(reborn, [], 'startup over unchanged truth is silence — dir bindings included');
+
+  fs.renameSync(path.join(first.dir, 'shelf'), path.join(first.dir, 'case'));
+  first.observer.scanNow(rootId);
+  evidence2.reconcile();
+  assert.equal(registry2.activeAt(rootUuid, 'case').uuid, shelfUuid,
+    'the durable dir binding carried the folder\'s identity across the restart');
+  assert.equal(reborn.filter((event) => event.type === 'entity.committed').length, 1,
+    'one move, one commit — the file under it stayed silent');
+});
+
+test('a contest survives restart: the durable binding, not process memory, carries the claim', () => {
+  const dir = fs.mkdtempSync(path.join(tempRoot, 'contest-restart-'));
+  const dbPath = path.join(dir, 'registry.db');
+  const sentinelPath = path.join(dir, 'registry.epoch');
+
+  // Process one: two files, then b.txt departs — its record keeps the slot.
+  const first = makeIntake('contest-a', { registryDb: new Database(dbPath), sentinelPath });
+  fs.writeFileSync(path.join(first.dir, 'a.txt'), 'alpha');
+  fs.writeFileSync(path.join(first.dir, 'b.txt'), 'beta');
+  const rootId = first.enroll();
+  first.evidence.reconcile();
+  const rootUuid = rootOf(first.registry).uuid;
+  const uuidA = first.registry.activeAt(rootUuid, 'a.txt').uuid;
+  const recordB = first.registry.activeAt(rootUuid, 'b.txt');
+  fs.rmSync(path.join(first.dir, 'b.txt'));
+  first.observer.scanNow(rootId);
+  first.evidence.reconcile();
+
+  // While the process is down, the physical a.txt lands on b.txt's slot.
+  fs.renameSync(path.join(first.dir, 'a.txt'), path.join(first.dir, 'b.txt'));
+
+  // Process two: same registry database, same durable evidence memory,
+  // same observer store. Startup must DERIVE the contest from the durable
+  // binding — with process-memory bindings this exact path silently hands
+  // the contested ground to the slot's owner.
+  const reborn = [];
+  const db2 = new Database(dbPath);
+  const registry2 = createRegistry({ db: db2, sentinelPath, emit: (event) => reborn.push(event) });
+  const evidence2 = createEvidence({
+    observer: first.observer, registry: registry2, rootId,
+    memory: createEvidenceMemory(db2),
+    classify: () => 'file.text',
+  });
+  first.observer.scanNow(rootId);
+  evidence2.reconcile();
+  assert.deepEqual(reborn, [], 'a contest commits nothing — not even across a restart');
+  assert.deepEqual([...evidence2.divergence().keys()], ['b.txt'],
+    'the contested ground is derived, reported, and assigned to nobody');
+  assert.deepEqual(registry2.activeAt(rootUuid, 'b.txt'), recordB,
+    'the slot\'s owner is byte-for-byte untouched — it never absorbed the arriving bytes');
+  assert.equal(registry2.activeAt(rootUuid, 'a.txt').uuid, uuidA,
+    'the claimant\'s record never moved');
+});
+
+test('losing the observer store never resolves a contest: forgetting cannot authorize assignment', () => {
+  const dir = fs.mkdtempSync(path.join(tempRoot, 'contest-wipe-'));
+  const dbPath = path.join(dir, 'registry.db');
+  const sentinelPath = path.join(dir, 'registry.epoch');
+
+  // A full contest, established and reported.
+  const first = makeIntake('contest-w', { registryDb: new Database(dbPath), sentinelPath });
+  fs.writeFileSync(path.join(first.dir, 'a.txt'), 'alpha');
+  fs.writeFileSync(path.join(first.dir, 'b.txt'), 'beta');
+  const rootId = first.enroll();
+  first.evidence.reconcile();
+  const rootUuid = rootOf(first.registry).uuid;
+  const recordB = first.registry.activeAt(rootUuid, 'b.txt');
+  fs.rmSync(path.join(first.dir, 'b.txt'));
+  first.observer.scanNow(rootId);
+  first.evidence.reconcile();
+  fs.renameSync(path.join(first.dir, 'a.txt'), path.join(first.dir, 'b.txt'));
+  first.observer.scanNow(rootId);
+  first.evidence.reconcile();
+  assert.deepEqual([...first.evidence.divergence().keys()], ['b.txt']);
+
+  // The observer store is LOST: a brand-new observer re-mints every
+  // channel — including the root's, and the root channel is the bound
+  // WITNESS. Losing evidence does not resolve ambiguity: the intake
+  // refuses the unknown witness loudly, commits nothing, and the durable
+  // marker keeps the contest exactly where it was. Forgetting cannot
+  // authorize assignment — the forgetter is never even heard.
+  const reborn = [];
+  const db2 = new Database(dbPath);
+  const registry2 = createRegistry({ db: db2, sentinelPath, emit: (event) => reborn.push(event) });
+  const observer2 = createObserver({ db: new Database(':memory:'), emit: () => {} });
+  const rebornRootId = observer2.enrollRoot(first.dir).rootId;
+  const evidence2 = createEvidence({
+    observer: observer2, registry: registry2, rootId: rebornRootId,
+    memory: createEvidenceMemory(db2),
+    classify: () => 'file.text',
+  });
+  assert.throws(() => evidence2.reconcile(), /identity evidence lost/,
+    'a fresh observer store over surviving records is loss, never a fresh start');
+  assert.deepEqual(reborn, [], 'forgetting commits nothing');
+  assert.deepEqual(db2.prepare('SELECT rel_path FROM contested_ground').all(), [{ rel_path: 'b.txt' }],
+    'the durable marker holds the contest through the loss');
+  assert.deepEqual(registry2.activeAt(rootUuid, 'b.txt'), recordB,
+    'the slot\'s owner never absorbs — not even when Amalgm forgot why the ground was contested');
+});
+
+test('identity evidence is durable or its loss is explicit: a lost observer store convicts, never mints', () => {
+  const dir = fs.mkdtempSync(path.join(tempRoot, 'witness-'));
+  const dbPath = path.join(dir, 'registry.db');
+  const sentinelPath = path.join(dir, 'registry.epoch');
+
+  const first = makeIntake('witness-a', { registryDb: new Database(dbPath), sentinelPath });
+  fs.mkdirSync(path.join(first.dir, 'alpha'));
+  fs.writeFileSync(path.join(first.dir, 'alpha', 'note.txt'), 'hello');
+  const rootId = first.enroll();
+  first.evidence.reconcile();
+  const rootUuid = rootOf(first.registry).uuid;
+  const alphaUuid = first.registry.activeAt(rootUuid, 'alpha').uuid;
+
+  // Down: the observer database is gone, and the folder moves while
+  // nobody watched. The one witness that could prove alpha and beta are
+  // the same folder no longer exists — and nothing may guess.
+  fs.renameSync(path.join(first.dir, 'alpha'), path.join(first.dir, 'beta'));
+  const reborn = [];
+  const db2 = new Database(dbPath);
+  const registry2 = createRegistry({ db: db2, sentinelPath, emit: (event) => reborn.push(event) });
+  const observer2 = createObserver({ db: new Database(':memory:'), emit: () => {} });
+  const rebornRootId = observer2.enrollRoot(first.dir).rootId;
+  const evidence2 = createEvidence({
+    observer: observer2, registry: registry2, rootId: rebornRootId,
+    memory: createEvidenceMemory(db2), classify: () => 'file.text',
+  });
+  assert.throws(() => evidence2.reconcile(), /identity evidence lost/,
+    'an unknown observer root while bindings still claim these records is loss');
+  assert.equal(evidence2.dirty(), true, 'the intake stays dirty: loud and unresolved, never absorbed');
+  assert.deepEqual(reborn, [], 'no record was minted, moved, or trashed over the surviving registry');
+  assert.equal(registry2.activeAt(rootUuid, 'alpha').uuid, alphaUuid, 'the folder record holds its identity');
+  assert.ok(!registry2.activeAt(rootUuid, 'beta'), 'no replacement was minted at the new address');
+
+  // A TRUE fresh start — no prior claim on the root record — seats a new
+  // witness without ceremony.
+  const kit = makeIntake('witness-fresh');
+  fs.writeFileSync(path.join(kit.dir, 'a.txt'), 'a');
+  kit.enroll();
+  kit.evidence.reconcile();
+  assert.ok(kit.registry.activeAt(rootOf(kit.registry).uuid, 'a.txt'), 'a fresh start is not loss');
+});
+
+test('the loss gate runs before any canonical proposal: conviction leaves the root record untouched', () => {
+  const dir = fs.mkdtempSync(path.join(tempRoot, 'gate-'));
+  const dbPath = path.join(dir, 'registry.db');
+  const sentinelPath = path.join(dir, 'registry.epoch');
+
+  const first = makeIntake('gate-a', { registryDb: new Database(dbPath), sentinelPath });
+  fs.writeFileSync(path.join(first.dir, 'a.txt'), 'alpha');
+  const rootId = first.enroll();
+  first.evidence.reconcile();
+  assert.equal(rootOf(first.registry).type, 'workspace');
+
+  // Down: the observer store is gone AND `git init` ran. The fresh
+  // observer truthfully reports repo ground — but it cannot prove it is
+  // the witness, so even the root's own lens transition may not land on
+  // its word. Loss convicts BEFORE the first proposal, never between two.
+  fs.mkdirSync(path.join(first.dir, '.git'));
+  fs.writeFileSync(path.join(first.dir, '.git', 'HEAD'), 'ref: refs/heads/main');
+  const reborn = [];
+  const db2 = new Database(dbPath);
+  const registry2 = createRegistry({ db: db2, sentinelPath, emit: (event) => reborn.push(event) });
+  const observer2 = createObserver({ db: new Database(':memory:'), emit: () => {} });
+  const rebornRootId = observer2.enrollRoot(first.dir).rootId;
+  const evidence2 = createEvidence({
+    observer: observer2, registry: registry2, rootId: rebornRootId,
+    memory: createEvidenceMemory(db2), classify: () => 'file.text',
+  });
+  assert.throws(() => evidence2.reconcile(), /identity evidence lost/,
+    'the unknown witness convicts even while its ground report is true');
+  assert.deepEqual(reborn, [], 'conviction happened before the first proposal — zero commits');
+  assert.equal(rootOf(registry2).type, 'workspace',
+    'the root record did not transition on the word of evidence that cannot prove who it is');
+});
+
+// The link-record exam — pointer-as-payload, derived resolution, honest
+// death — lives in tests/registration.test.js now: resolution is owned by
+// the registration boundary (the layer that can see every tree), so the
+// exam runs against the composed system it actually describes.
+
+test('a slot survives file ↔ link replacement: reconnection is identity, and the kind transitions with the ground', () => {
+  const kit = makeIntake('link-flip');
+  fs.writeFileSync(path.join(kit.dir, 'config'), 'inline');
+  fs.writeFileSync(path.join(kit.dir, 'real.conf'), 'real');
+  const rootId = kit.enroll();
+  kit.evidence.reconcile();
+  const rootUuid = rootOf(kit.registry).uuid;
+  const uuid = kit.registry.activeAt(rootUuid, 'config').uuid;
+
+  // The file is replaced by a pointer at its own address.
+  fs.rmSync(path.join(kit.dir, 'config'));
+  fs.symlinkSync('real.conf', path.join(kit.dir, 'config'));
+  kit.observer.scanNow(rootId);
+  kit.evidence.reconcile();
+  let record = kit.registry.activeAt(rootUuid, 'config');
+  assert.equal(record.uuid, uuid, 'the slot reconnected the same entity');
+  assert.equal(record.type, 'link', 'and the record transitioned with its ground');
+
+  // And back: the pointer is replaced by bytes again.
+  fs.unlinkSync(path.join(kit.dir, 'config'));
+  fs.writeFileSync(path.join(kit.dir, 'config'), 'inline again');
+  kit.observer.scanNow(rootId);
+  kit.evidence.reconcile();
+  record = kit.registry.activeAt(rootUuid, 'config');
+  assert.equal(record.uuid, uuid, 'identity survives the round trip');
+  assert.equal(record.type, 'file.text');
+});
+
+test('one contest, one row: a contested subtree stores its root marker only — coverage is arithmetic', () => {
+  const kit = makeIntake('contest-rows');
+  fs.mkdirSync(path.join(kit.dir, 'a'));
+  kit.enroll();
+  kit.evidence.reconcile();
+  fs.rmSync(path.join(kit.dir, 'a'), { recursive: true }); // the owner parks
+  kit.observer.scanNow();
+  kit.evidence.reconcile();
+
+  fs.mkdirSync(path.join(kit.dir, 'c', 'sub'), { recursive: true });
+  fs.writeFileSync(path.join(kit.dir, 'c', 'f.txt'), 'body');
+  kit.observer.scanNow();
+  kit.evidence.reconcile();
+  fs.renameSync(path.join(kit.dir, 'c'), path.join(kit.dir, 'a')); // the subtree arrives on the parked slot
+  kit.observer.scanNow();
+  kit.evidence.reconcile();
+
+  assert.deepEqual(kit.db.prepare('SELECT rel_path, kind FROM contested_ground').all(),
+    [{ rel_path: 'a', kind: 'dir' }],
+    'however large the subtree, the contest is one durable marker at its root');
+  assert.deepEqual([...kit.evidence.divergence().keys()].sort(), ['a', 'a/f.txt', 'a/sub'],
+    'the report still covers every path under the contest, derived by prefix');
+
+  fs.renameSync(path.join(kit.dir, 'a'), path.join(kit.dir, 'd')); // the ground leaves: resolution
+  kit.observer.scanNow();
+  kit.evidence.reconcile();
+  assert.equal(kit.db.prepare('SELECT count(*) AS n FROM contested_ground').get().n, 0);
+  assert.equal(kit.evidence.divergence().size, 0);
+});
+
+test('a failed durable write is retried, never believed: memory changes only after the database', () => {
+  let hiccups = 1;
+  const kit = makeIntake('flaky', {
+    wrapMemory: (real) => ({
+      ...real,
+      bind: (scopeId, channelId, uuid) => {
+        if (hiccups > 0) { hiccups -= 1; throw new Error('durable write hiccup'); }
+        return real.bind(scopeId, channelId, uuid);
+      },
+    }),
+  });
+  fs.writeFileSync(path.join(kit.dir, 'a.txt'), 'alpha');
+  kit.enroll();
+  assert.throws(() => kit.evidence.reconcile(), /durable write hiccup/);
+  assert.equal(kit.evidence.dirty(), true, 'a failed durable write leaves the intake dirty, never silently bound');
+  assert.equal(kit.regEvents.filter((event) => event.type === 'entity.committed').length, 0,
+    'nothing rings until its truth commits: the rolled-back birth was never announced');
+
+  // The retry re-derives from observer truth and re-attempts the SAME
+  // durable write. Cache-first ordering would have believed the first
+  // attempt, skipped the write forever, and lost the claim at the next
+  // restart while reconciliation finished clean.
+  kit.evidence.reconcile();
+  assert.equal(kit.evidence.dirty(), false);
+  const rootUuid = rootOf(kit.registry).uuid;
+  const children = kit.registry.children(rootUuid);
+  assert.equal(children.length, 1, 'the retry reconnected the already-born record — no second birth');
+  const observerRoot = kit.observer.listRoots()[0];
+  const channel = kit.observer.filesForRoot(observerRoot.rootId)
+    .find((row) => row.relPath === 'a.txt').fileId;
+  assert.deepEqual(createEvidenceMemory(kit.db).bindings(observerRoot.rootId), [
+    { channelId: observerRoot.rootId, uuid: rootUuid },
+    { channelId: channel, uuid: children[0].uuid },
+  ], 'the retried writes landed durably — the witness and the claim both survive a restart');
+  assert.ok(kit.regEvents.some((event) => event.type === 'entity.committed'
+    && event.record.uuid === rootUuid),
+  'the committed bell rang once the birth actually held');
+});
+
+test('nothing rings until its truth commits: bells wait for the outermost commit, and a rollback silences them', () => {
+  const events = [];
+  const db = new Database(':memory:');
+  const registry = createRegistry({ db, emit: (event) => events.push(event), ephemeral: true });
+
+  // A rollback silences what it rolled back: the phantom is never announced.
+  assert.throws(() => registry.transaction(() => {
+    registry.enrollRoot({ type: 'workspace', name: 'phantom' });
+    throw new Error('torn');
+  }), /torn/);
+  assert.equal(registry.roots().length, 0);
+  assert.equal(events.length, 0, 'no bell for a record the database never held');
+
+  // A commit rings everything it held — after the truth is durable.
+  const born = registry.transaction(() => registry.enrollRoot({ type: 'workspace', name: 'real' }));
+  assert.deepEqual(events.map((event) => event.type), ['entity.committed']);
+  assert.equal(events[0].record.uuid, born.uuid);
+
+  // Nested: a caught inner savepoint's failure silences ONLY its own bells.
+  registry.transaction(() => {
+    registry.create({ type: 'folder', parentUUID: born.uuid, name: 'kept' });
+    try {
+      registry.transaction(() => {
+        registry.create({ type: 'folder', parentUUID: born.uuid, name: 'gone' });
+        throw new Error('inner torn');
+      });
+    } catch { /* the savepoint rolled back */ }
+  });
+  assert.deepEqual(events.slice(1).map((event) => event.record.name), ['kept'],
+    'the inner bell died with its savepoint; the outer rang at commit');
+  assert.equal(registry.activeAt(born.uuid, 'gone'), null);
+});
+
+test('dropped evidence tables are loss, not first init: nothing silently recreates them', () => {
+  const db = new Database(':memory:');
+  createRegistry({ db, emit: () => {}, ephemeral: true });
+  createEvidenceMemory(db);
+  db.exec('DROP TABLE channel_bindings; DROP TABLE contested_ground');
+
+  // Before this law, CREATE IF NOT EXISTS quietly replaced the dropped
+  // tables and reported no bindings and no contests — an empty memory that
+  // would resolve every open contest by forgetting it.
+  assert.throws(() => createEvidenceMemory(db),
+    /evidence memory lost: channel_bindings, contested_ground missing/);
+  assert.throws(() => createRegistry({ db, emit: () => {}, ephemeral: true }),
+    /registry corrupt: channel_bindings, contested_ground gone/);
+});
+
+test('evidence memory from another registry\'s database is refused by epoch', () => {
+  const dbA = new Database(':memory:');
+  const registryA = createRegistry({ db: dbA, emit: () => {}, ephemeral: true });
+  const dbB = new Database(':memory:');
+  createRegistry({ db: dbB, emit: () => {}, ephemeral: true });
+  assert.throws(
+    () => createEvidence({
+      observer: {}, registry: registryA, rootId: 'nowhere',
+      memory: createEvidenceMemory(dbB), classify: () => 'file.text',
+    }),
+    /evidence memory epoch .* is not this registry's/,
+    'cross-database wiring is the misassignment family, refused at construction');
+});