devrites 7.3.1 → 7.3.2

package/engine/internal/install/preflight.go

@@ -14,7 +14,6 @@ import (
 	"strings"
 
 	"github.com/devrites/devrites/internal/hostpack"
-	"github.com/devrites/devrites/internal/safepath"
 )
 
 func (r *runner) preflightInstall() error {
@@ -46,10 +45,15 @@ func (r *runner) preflightInstall() error {
 			return err
 		}
 		if !snapshot.missing && r.isPinnedAlias(rel) {
-			// scripts/pin.sh aliases are not in the payload; carry them
-			// forward (hashed) so prune keeps them and uninstall removes them.
+			// Carry pins without adopting edits; only legacy pins need a baseline.
+			if record.Hash == "" {
+				record.Hash = snapshot.hash
+			}
+			if kind := managedConflict(record, snapshot); kind != "" && !r.opts.Force {
+				conflicts = append(conflicts, fmt.Sprintf("%s: %s", kind, rel))
+			}
 			r.addManifest(rel)
-			r.addInstallRecord(rel, snapshot.hash)
+			r.addInstallRecord(rel, record.Hash)
 			continue
 		}
 		if !snapshot.missing {
@@ -101,23 +105,33 @@ func (r *runner) preflightMerges() error {
 		if _, _, err := r.markerMergeNext(m.merge); err != nil {
 			return fmt.Errorf("merge %s: %w", m.merge.TargetRel, err)
 		}
+		if err := r.preflightMarkerOwnership(m.merge.TargetRel, m.merge.MarkerRel, m.merge.MarkerText); err != nil {
+			return err
+		}
 	}
 	if r.opts.WithCodex {
 		if _, err := r.codexConfigNext(); err != nil {
 			return fmt.Errorf("merge %s: %w", hostpack.CodexConfigMerge.TargetRel, err)
 		}
+		merge := hostpack.CodexConfigMerge
+		if err := r.preflightMarkerOwnership(merge.TargetRel, merge.MarkerRel, merge.MarkerText); err != nil {
+			return err
+		}
 	}
 	_, settings, err := r.claudeSettingsNext()
 	if err != nil {
 		return fmt.Errorf("seed claude settings: %w", err)
 	}
-	marker := hostpack.ClaudeSettingsMerge.MarkerRel
+	merge := hostpack.ClaudeSettingsMerge
+	return r.preflightMarkerOwnership(merge.TargetRel, merge.MarkerRel, claudeSettingsMarkerText(r.pendingClaudeSettingsOwnership(settings)))
+}
+
+func (r *runner) preflightMarkerOwnership(target, marker, text string) error {
 	if snapshot := r.preflight[marker]; !snapshot.missing && !r.opts.Force {
 		if _, managed := r.prev[marker]; !managed {
-			text := claudeSettingsMarkerText(r.pendingClaudeSettingsOwnership(settings)) + "\n"
-			sum := sha256.Sum256([]byte(text))
+			sum := sha256.Sum256([]byte(text + "\n"))
 			if snapshot.hash != fmt.Sprintf("sha256:%x", sum[:]) {
-				return fmt.Errorf("cannot merge %s without owning %s; use --force to replace the marker", hostpack.ClaudeSettingsMerge.TargetRel, marker)
+				return fmt.Errorf("cannot merge %s without owning %s; use --force to replace the marker", target, marker)
 			}
 		}
 	}
@@ -249,10 +263,17 @@ func (r *runner) installMergeTargets() []string {
 
 func (r *runner) rememberPath(rel string) (pathSnapshot, error) {
 	rel = filepath.ToSlash(rel)
+	if r.targetInfo == nil {
+		info, err := os.Stat(r.target)
+		if err != nil {
+			return pathSnapshot{}, err
+		}
+		r.targetInfo = info
+	}
 	if snapshot, ok := r.preflight[rel]; ok {
 		return snapshot, nil
 	}
-	snapshot, err := inspectManagedPath(r.target, rel)
+	snapshot, err := r.inspectManagedPath(rel)
 	if err != nil {
 		return pathSnapshot{}, err
 	}
@@ -264,7 +285,7 @@ func (r *runner) rememberPath(rel string) (pathSnapshot, error) {
 // verified write (marker merge, strip). Needed when several managed merges
 // share one target such as AGENTS.md.
 func (r *runner) refreshPreflight(rel string) error {
-	snap, err := inspectManagedPath(r.target, rel)
+	snap, err := r.inspectManagedPath(rel)
 	if err != nil {
 		return err
 	}
@@ -273,12 +294,15 @@ func (r *runner) refreshPreflight(rel string) error {
 }
 
 func (r *runner) recheckPath(rel string) error {
+	if err := r.checkTargetIdentity(); err != nil {
+		return err
+	}
 	rel = filepath.ToSlash(rel)
 	before, ok := r.preflight[rel]
 	if !ok {
 		return fmt.Errorf("path %s was not preflighted", rel)
 	}
-	now, err := inspectManagedPath(r.target, rel)
+	now, err := r.inspectManagedPath(rel)
 	if err != nil {
 		return err
 	}
@@ -287,6 +311,9 @@ func (r *runner) recheckPath(rel string) error {
 	}
 	if afterRecheckPath != nil {
 		afterRecheckPath(rel)
+		if err := r.checkTargetIdentity(); err != nil {
+			return err
+		}
 	}
 	return nil
 }
@@ -295,20 +322,35 @@ func (r *runner) recheckPath(rel string) error {
 // recheck and the write that follows it.
 var afterRecheckPath func(rel string)
 
+func (r *runner) inspectManagedPath(rel string) (pathSnapshot, error) {
+	if r.targetRoot != nil {
+		return inspectManagedPathIn(r.targetRoot, rel)
+	}
+	return inspectManagedPath(r.target, rel)
+}
+
 func inspectManagedPath(target, rel string) (pathSnapshot, error) {
+	root, err := os.OpenRoot(target)
+	if err != nil {
+		return pathSnapshot{}, err
+	}
+	defer func() { _ = root.Close() }()
+	return inspectManagedPathIn(root, rel)
+}
+
+func inspectManagedPathIn(root *os.Root, rel string) (pathSnapshot, error) {
 	native := filepath.FromSlash(rel)
 	if !filepath.IsLocal(native) {
 		return pathSnapshot{}, fmt.Errorf("refusing unsafe managed path %q", rel)
 	}
-	dest := filepath.Join(target, native)
-	if !safepath.WithinResolved(dest, target) {
-		return pathSnapshot{}, fmt.Errorf("refusing managed path outside target: %s", rel)
+	if root == nil {
+		return pathSnapshot{}, fmt.Errorf("install target is not open")
 	}
-	walk := target
+	walk := ""
 	parts := strings.Split(native, string(filepath.Separator))
 	for _, part := range parts {
 		walk = filepath.Join(walk, part)
-		info, err := os.Lstat(walk)
+		info, err := root.Lstat(walk)
 		if os.IsNotExist(err) {
 			return pathSnapshot{missing: true}, nil
 		}
@@ -319,7 +361,7 @@ func inspectManagedPath(target, rel string) (pathSnapshot, error) {
 			return pathSnapshot{}, fmt.Errorf("refusing symlink or junction in managed path: %s", rel)
 		}
 	}
-	info, err := os.Lstat(dest)
+	info, err := root.Lstat(native)
 	if os.IsNotExist(err) {
 		return pathSnapshot{missing: true}, nil
 	}
@@ -329,8 +371,7 @@ func inspectManagedPath(target, rel string) (pathSnapshot, error) {
 	if !info.Mode().IsRegular() {
 		return pathSnapshot{}, fmt.Errorf("refusing non-regular managed path: %s", rel)
 	}
-	// #nosec G304 -- managed path snapshot; regular-file check above
-	f, err := os.Open(dest)
+	f, err := root.Open(native)
 	if err != nil {
 		return pathSnapshot{}, fmt.Errorf("read managed path %s: %w", rel, err)
 	}

package/engine/internal/install/uninstall.go

@@ -12,13 +12,20 @@ import (
 
 func (r *runner) uninstall() error {
 	mf := filepath.Join(r.target, ManifestName)
-	entries, err := readManifestList(mf)
+	data, err := r.readConfined(mf)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("read manifest %s: %w", mf, err)
+	}
+	_, entries, err := parseManifestData(data)
 	if err != nil {
 		return err
 	}
 	if len(entries) == 0 {
 		return fmt.Errorf("no DevRites manifest at %s - nothing to uninstall", mf)
 	}
+	if err := r.preflightBinaryRemoval(); err != nil {
+		return err
+	}
 	fmt.Fprintln(r.opts.Stdout, "DevRites uninstaller")
 	fmt.Fprintf(r.opts.Stdout, "  target  : %s\n", r.target)
 	fmt.Fprintf(r.opts.Stdout, "  manifest: %s\n", mf)
@@ -99,6 +106,15 @@ func (r *runner) uninstall() error {
 			r.stats.missing++
 		}
 	}
+	if !r.opts.DryRun {
+		for _, d := range dirs {
+			r.pruneEmptyDirs(d)
+		}
+	}
+	// Keep ownership available for a retry if the external binary cannot be removed.
+	if err := r.removeBinary(); err != nil {
+		return fmt.Errorf("remove engine binary: %w", err)
+	}
 	if r.opts.DryRun {
 		fmt.Fprintf(r.opts.Stdout, "  [remove] %s\n", ManifestName)
 	} else {
@@ -106,13 +122,7 @@ func (r *runner) uninstall() error {
 			return err
 		}
 		_ = r.removeConfined(mf)
-		dirs = append(dirs, filepath.Dir(mf))
-		for _, d := range dirs {
-			pruneEmptyDirs(d, r.target)
-		}
-	}
-	if err := r.removeBinary(); err != nil {
-		return fmt.Errorf("remove engine binary: %w", err)
+		r.pruneEmptyDirs(filepath.Dir(mf))
 	}
 	fmt.Fprintln(r.opts.Stdout)
 	if r.opts.DryRun {
@@ -141,7 +151,7 @@ func (r *runner) dryRunStripMarker(tree map[string][]byte, merge hostpack.Manage
 	write := func(data []byte) error { tree[path] = data; return nil }
 	remove := func() error { tree[path] = nil; return nil }
 	if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel {
-		return stripHooksWith(path, write, remove)
+		return r.stripHooksWith(path, write, remove)
 	}
 	if merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
 		return r.stripClaudeSettingsWith(path, write, remove)

package/engine/internal/install/update.go

@@ -9,7 +9,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/devrites/devrites/internal/hostpack"
 	"github.com/devrites/devrites/internal/release"
 )
 
@@ -65,9 +64,6 @@ func runUpdate(opts Options) error {
 	if err != nil {
 		return fmt.Errorf("resolve payload %s: %w", opts.PayloadDir, err)
 	}
-	if err := hostpack.ValidatePayload(os.DirFS(payload), true, true, true, true, true); err != nil {
-		return fmt.Errorf("local update payload under %s is invalid: %w", payload, err)
-	}
 	installFlags := manifestHeader(mf, "devrites-flags")
 	next := DefaultOptions(ModeInstall)
 	next.Stdout = opts.Stdout

package/engine/internal/lib/claims.go

@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -17,6 +18,7 @@ import (
 
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/parallel"
+	"github.com/devrites/devrites/internal/safepath"
 	"github.com/devrites/devrites/internal/state"
 )
 
@@ -262,6 +264,137 @@ func claimPathsOverlap(a, b string) bool {
 	return a == b || strings.HasPrefix(a, b+"/") || strings.HasPrefix(b, a+"/")
 }
 
+// Retained writer ownership belongs to the repository ledger, not a session or
+// TTL. Caller holds its lock; workspace moves use the same lock.
+func retainedWriterConflicts(root string, latest map[string]*claimRecord, paths []string, probe holderProbe) ([]*claimRecord, error) {
+	var conflicts []*claimRecord
+	var physical []string
+	seen := map[string]bool{}
+	for _, parent := range []string{"work", "archive"} {
+		base := filepath.Join(root, parent)
+		if parent == "archive" {
+			var err error
+			base, err = devritespaths.ArchiveDirChecked(root)
+			if err != nil {
+				return nil, err
+			}
+		}
+		if info, err := os.Lstat(base); os.IsNotExist(err) {
+			continue
+		} else if err != nil {
+			return nil, err
+		} else if !info.IsDir() {
+			return nil, fmt.Errorf("claim: workspace collection %s is not a canonical directory", base)
+		}
+		entries, err := os.ReadDir(base)
+		if err != nil {
+			return nil, err
+		}
+		for _, entry := range entries {
+			if entry.Type().IsRegular() {
+				continue
+			}
+			var dir string
+			if parent == "work" {
+				dir, err = devritespaths.ExistingCanonicalFeatureDirChecked(root, entry.Name())
+			} else {
+				dir, err = devritespaths.ExistingArchivedFeatureDirChecked(root, entry.Name())
+			}
+			if err != nil {
+				return nil, err
+			}
+			path := filepath.Join(dir, "dispatch.json")
+			if info, err := os.Lstat(path); os.IsNotExist(err) {
+				continue
+			} else if err != nil {
+				return nil, err
+			} else if !info.Mode().IsRegular() {
+				return nil, fmt.Errorf("claim: %s is not a regular dispatch ledger", path)
+			}
+			f, _, err := loadDispatchFile(path)
+			if err != nil {
+				return nil, fmt.Errorf("%s: %w", path, err)
+			}
+			for name, w := range f.Waves {
+				// A declared claim is write intent regardless of the host role label.
+				if w.State != "abandoned" || w.Claim == "" {
+					continue
+				}
+				rec := latest[w.Claim]
+				if rec == nil || (w.ClaimSession != "" && w.ClaimSession != rec.Session) {
+					return nil, fmt.Errorf("abandoned writer wave %s/%s has unknown claim %q", entry.Name(), name, w.Claim)
+				}
+				if rec.Released || seen[rec.ID] {
+					continue
+				}
+				seen[rec.ID] = true
+				if retainedWriterGone(probe, rec) {
+					continue
+				}
+				held, err := normalizeClaimPaths(rec.Paths)
+				if err != nil {
+					return nil, fmt.Errorf("abandoned writer claim %s has invalid paths: %w", rec.ID, err)
+				}
+				if physical == nil {
+					physical, err = physicalClaimPaths(root, paths)
+					if err != nil {
+						return nil, err
+					}
+				}
+				held, err = physicalClaimPaths(root, held)
+				if err != nil {
+					return nil, err
+				}
+				if slices.ContainsFunc(held, func(h string) bool {
+					return slices.ContainsFunc(physical, func(p string) bool { return claimPathsOverlap(h, p) })
+				}) {
+					conflicts = append(conflicts, rec)
+				}
+			}
+		}
+	}
+	return conflicts, nil
+}
+
+func retainedWriterGone(probe holderProbe, rec *claimRecord) bool {
+	valid := func(p claimProc) bool {
+		_, err := time.Parse(time.RFC3339, p.Start)
+		return p.PID > 1 && err == nil
+	}
+	if rec.Holder != nil {
+		if !valid(*rec.Holder) {
+			return false
+		}
+	} else {
+		for _, anchor := range rec.Anchors {
+			if !valid(anchor) {
+				return false
+			}
+		}
+	}
+	return probe.gone(rec)
+}
+
+func physicalClaimPaths(root string, paths []string) ([]string, error) {
+	project := root
+	if filepath.Base(root) == devritespaths.DevritesRootName {
+		project = filepath.Dir(root)
+	}
+	out := make([]string, 0, len(paths))
+	for _, path := range paths {
+		normalized, err := parallel.NormalizePath(path)
+		if err != nil {
+			return nil, err
+		}
+		resolved, err := safepath.ResolveExisting(filepath.Join(project, filepath.FromSlash(normalized)))
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, filepath.ToSlash(resolved))
+	}
+	return out, nil
+}
+
 // An unreadable line may be a live claim, so the conflict gates refuse to
 // answer rather than report a path free.
 const unparsedLedgerMsg = "claim: %d unparsed ledger line(s); cannot rule out a conflict, repair the claims ledger\n"
@@ -340,7 +473,7 @@ func addClaimTargets(root, session, reason string, ttl int, raw, workspaces []st
 	// sessions cannot both pass the check and claim the same path.
 	id, code := "", 0
 	if err := state.WithLock(path+".lock", func() error {
-		id, code = claimAddLocked(path, session, reason, ttl, paths, stdout, stderr)
+		id, code = claimAddLocked(path, session, reason, ttl, paths, paths, stdout, stderr)
 		return nil
 	}); err != nil {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
@@ -349,7 +482,7 @@ func addClaimTargets(root, session, reason string, ttl int, raw, workspaces []st
 	return id, code
 }
 
-func claimAddLocked(path, session, reason string, ttl int, paths []string, stdout, stderr io.Writer) (string, int) {
+func claimAddLocked(path, session, reason string, ttl int, paths, admissionPaths []string, stdout, stderr io.Writer) (string, int) {
 	latest, order, bad, err := readClaims(path)
 	if err != nil {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
@@ -361,6 +494,15 @@ func claimAddLocked(path, session, reason string, ttl int, paths []string, stdou
 	}
 	now := time.Now().UTC()
 	probe := newHolderProbe()
+	retained, err := retainedWriterConflicts(filepath.Dir(path), latest, admissionPaths, probe)
+	if err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return "", 3
+	}
+	if len(retained) > 0 {
+		printConflicts(stderr, retained)
+		return "", 3
+	}
 	conflicts := claimConflicts(probe.withoutGone(liveClaims(latest, order, now)), session, paths)
 	if len(conflicts) > 0 {
 		printConflicts(stderr, conflicts)
@@ -413,6 +555,8 @@ func claimRelease(root string, args []string, stdout, stderr io.Writer) int {
 	return 0
 }
 
+var errClaimAlreadyReleased = errors.New("already released")
+
 // releaseClaim marks session's claim id released and returns its path count.
 func releaseClaim(root, session, id string) (int, error) {
 	path := claimsPath(root)
@@ -428,7 +572,7 @@ func releaseClaim(root, session, id string) (int, error) {
 		return 0, fmt.Errorf("%q belongs to session %q, not %q", id, rec.Session, session)
 	}
 	if rec.Released {
-		return 0, fmt.Errorf("%q already released", id)
+		return 0, fmt.Errorf("%q %w", id, errClaimAlreadyReleased)
 	}
 	released := *rec
 	released.Released = true
@@ -523,6 +667,18 @@ func claimCheck(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
 		return 2
 	}
+	code := 0
+	if err := state.WithLock(claimsPath(root)+".lock", func() error {
+		code = claimCheckLocked(root, session, paths, stdout, stderr)
+		return nil
+	}); err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return 2
+	}
+	return code
+}
+
+func claimCheckLocked(root, session string, paths []string, stdout, stderr io.Writer) int {
 	latest, order, bad, err := readClaims(claimsPath(root))
 	if err != nil {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
@@ -532,7 +688,17 @@ func claimCheck(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, unparsedLedgerMsg, bad)
 		return 2
 	}
-	conflicts := claimConflicts(newHolderProbe().withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
+	probe := newHolderProbe()
+	retained, err := retainedWriterConflicts(root, latest, paths, probe)
+	if err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return 2
+	}
+	if len(retained) > 0 {
+		printConflicts(stdout, retained)
+		return 3
+	}
+	conflicts := claimConflicts(probe.withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
 	if len(conflicts) > 0 {
 		printConflicts(stdout, conflicts)
 		return 3

package/engine/internal/lib/claims_holder.go

@@ -8,6 +8,8 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/devrites/devrites/internal/hostpack"
 )
 
 // claimAnchorAge separates a claiming session's long-lived host processes from
@@ -27,13 +29,6 @@ type procInfo struct {
 	comm  string
 }
 
-// shells outlive the agent sessions they launch (a terminal pane, a
-// multiplexer's login shell), so a shell never stands for the holder.
-var shells = map[string]bool{
-	"sh": true, "bash": true, "zsh": true, "fish": true, "dash": true, "ksh": true,
-	"tcsh": true, "csh": true, "nu": true, "pwsh": true, "powershell": true, "cmd": true,
-}
-
 // processTable lists running processes keyed by pid, or nil when the host
 // cannot say. Tests replace it.
 var processTable = psProcessTable
@@ -95,9 +90,12 @@ func newHolderProbe() holderProbe {
 	return holderProbe{table: table, host: host, self: lineage(table, os.Getppid())}
 }
 
-// anchors returns the caller's ancestors that started more than
-// claimAnchorAge before now: the session's host processes.
+// anchors retains long-lived ancestry only for an identified session.
+// Unknown writers must not be released merely because their launchers exit.
 func (p holderProbe) anchors(now time.Time) []claimProc {
+	if p.holder(now) == nil {
+		return nil
+	}
 	var out []claimProc
 	for _, proc := range p.self {
 		start, err := time.Parse(time.RFC3339, proc.Start)
@@ -108,13 +106,12 @@ func (p holderProbe) anchors(now time.Time) []claimProc {
 	return out
 }
 
-// holder returns the nearest anchor that is not a shell: the agent session
-// process that owns the claim. A shell or terminal multiplexer above it can
-// outlive the session, so only the session's own exit proves release.
-func (p holderProbe) holder(now time.Time) *claimProc {
-	for _, proc := range p.anchors(now) {
-		name := strings.TrimPrefix(filepath.Base(p.table[proc.PID].comm), "-")
-		if name != "" && !shells[name] {
+// holder identifies the native session independently of its age or wrappers.
+// Only native executable identities prove a session; generic runtimes do not.
+func (p holderProbe) holder(_ time.Time) *claimProc {
+	for _, proc := range p.self {
+		switch filepath.Base(p.table[proc.PID].comm) {
+		case "claude", "codex", hostpack.PiSettings.Host, hostpack.OmpConfig.Host, "devin", "dsh":
 			return &proc
 		}
 	}

package/engine/internal/lib/closeout.go

@@ -7,30 +7,27 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
-	"runtime"
+	"strings"
 
 	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/gate"
+	"github.com/devrites/devrites/internal/notes"
 	"github.com/devrites/devrites/internal/parallel"
 	"github.com/devrites/devrites/internal/state"
 )
 
-// releaseLockBeforeRename drops the feature lock before the workspace rename on
-// Windows, which refuses to rename a directory while the lock file inside it is
-// open. renameWorkspace is the rename; both are variables so tests can inject the
-// platform decision and observe the lock at the moment of the rename.
-var (
-	releaseLockBeforeRename = runtime.GOOS == "windows"
-	renameWorkspace         = os.Rename
-)
+// renameWorkspace lets tests observe exclusion at the archive boundary.
+var renameWorkspace = os.Rename
 
-// CloseOut retires a shipped feature: it moves the feature directory into the
-// archive and, when the feature is still the active one, clears the ACTIVE cursor
-// so the next /rite-spec starts clean. The workspace is relocated, never deleted:
-// the audit trail is preserved under archive/<slug>.
+// CloseOut physically archives a workspace, including owner-authorized nonfinal
+// exits. Seal, Ship, Done, and shipped/sealed/done statuses must first satisfy
+// the final gates and retained prerequisites. The workspace is relocated, never
+// deleted: the audit trail is preserved under archive/<slug>.
 //
 // args is `<slug>`; root is the already-resolved .devrites directory. Exit codes:
 //
 //	0  archived (ACTIVE cleared if it pointed here)
+//	3  final prerequisites or a retained parallel lease block archiving
 //	4  no slug given, or the feature has no workspace
 //	5  an archive already exists at the destination: refuse to clobber it
 func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
@@ -70,14 +67,8 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 		return 5
 	}
 
-	// Hold the per-feature lock across the rename and the ACTIVE clear, as
-	// dispatch and the parallel lease ops do across their load-modify-save. A
-	// writer already holding the lock finishes its save before the rename, so
-	// that save is archived. On unix a writer queued behind this close-out
-	// acquires a lock file that now lives in the archive; state.WithFeatureLock
-	// reports state.ErrWorkspaceMoved and the writer does not run, so it cannot
-	// re-create work/<slug>. Windows cannot rename a directory that holds an
-	// open file, so there the lock is released just before the rename.
+	// Hold the stable feature lock through verification, rename, ACTIVE clear,
+	// and rollback so queued writers cannot revive an archived workspace.
 	code := 1
 	if err := parallel.WithControlLock(dv, func() error {
 		leased, err := parallel.WorkspaceLeased(dv, slug)
@@ -89,9 +80,11 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 			code = 3
 			return nil
 		}
-		return state.WithFeatureLockRelease(dv, slug, func(release func()) error {
-			code = closeOutLocked(release, work, arch, archiveDir, archDisplay, active, slug, stdout, stderr)
-			return nil
+		return state.WithFeatureLock(dv, slug, func() error {
+			return state.WithLock(claimsPath(dv)+".lock", func() error {
+				code = closeOutLocked(work, arch, archiveDir, archDisplay, active, slug, stdout, stderr)
+				return nil
+			})
 		})
 	}); err != nil {
 		fmt.Fprintf(stderr, "state close: %v\n", err)
@@ -103,7 +96,41 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 // closeOutLocked performs the rename and the conditional ACTIVE clear. It runs
 // under the feature lock held by CloseOut and reports an exit code rather than
 // an error, preserving CloseOut's documented exit codes.
-func closeOutLocked(release func(), work, arch, archiveDir, archDisplay, active, slug string, stdout, stderr io.Writer) int {
+func closeOutLocked(work, arch, archiveDir, archDisplay, active, slug string, stdout, stderr io.Writer) int {
+	root := filepath.Dir(active)
+	ledger, err := readWorkspaceArtifact(root, slug, "state.md")
+	if err != nil {
+		fmt.Fprintf(stderr, "state close: BLOCKED: %v\n", err)
+		return 3
+	}
+	lines := strings.Split(string(ledger), "\n")
+	phase, _ := state.CursorField(lines, "phase")
+	status, _ := state.CursorField(lines, "status")
+	phase = string(state.CanonicalPhase(phase))
+	final := phase == string(state.PhaseSeal) || phase == string(state.PhaseShip) || phase == string(state.PhaseDone) ||
+		status == "sealed" || status == "shipped" || status == "done"
+	if final {
+		result, err := gate.Check(gate.Seal, root, slug)
+		if err != nil {
+			fmt.Fprintf(stderr, "state close: BLOCKED: %v\n", err)
+			return 3
+		}
+		if result.Blocked {
+			fmt.Fprint(stdout, result.Render())
+			return 3
+		}
+		if err := VerifyReleaseUnion(root, slug); err != nil {
+			fmt.Fprintf(stderr, "state close: BLOCKED: release-union: %v\n", err)
+			return 3
+		}
+		if err := CheckFinalPrerequisites(root, slug); err != nil {
+			fmt.Fprintf(stderr, "state close: BLOCKED: final-prerequisites: %v\n", err)
+			return 3
+		}
+		if EvidenceFresh(root, []string{slug}, stdout, stderr) != 0 || !notes.SealCheck(root, slug, stdout) {
+			return 3
+		}
+	}
 	activeSlug, err := devritespaths.PhysicalActiveSlug(filepath.Dir(active))
 	if err != nil {
 		fmt.Fprintf(stderr, "state close: invalid ACTIVE cursor: %v\n", err)
@@ -115,9 +142,6 @@ func closeOutLocked(release func(), work, arch, archiveDir, archDisplay, active,
 		fmt.Fprintf(stderr, "state close: cannot create archive dir: %v\n", err)
 		return 1
 	}
-	if releaseLockBeforeRename {
-		release()
-	}
 	if err := renameWorkspace(work, arch); err != nil {
 		fmt.Fprintf(stderr, "state close: cannot archive %s -> %s: %v\n", work, arch, err)
 		return 1