wowbagger 0.1.0-alpha.9 → 0.5.0

package/src/claim-coordinator.js

@@ -5,6 +5,7 @@ import {
   appendClaimEntry,
   assertClaimJournalCapacity,
   claimJournalPath,
+  isClaimJournalCapacityError,
   claimReconcileLogPath,
   replayClaimJournal,
   writeReconcileLog,
@@ -14,34 +15,69 @@ import { readBack } from './claim-operations.js';
 import { reconcileClaimJournal } from './claim-publication.js';
 import { claimStorePath, resolveVerifiedGitCommonDir, withClaimLock } from './claim-store.js';
 import { readNamespace } from './namespace.js';
+import {
+  assertUniqueWorktreeIdentity,
+  ensureWorktreeIdentity,
+  identityDiagnosticDetails,
+} from './worktree-identity.js';
 
-export async function withLegacyMutationFence(ledgerDirectory, itemId, command, write) {
+export async function withLegacyMutationFence(
+  ledgerDirectory,
+  itemId,
+  command,
+  write,
+  { responseCommand = command } = {},
+) {
   let gitCommonDir;
   try {
     gitCommonDir = await resolveVerifiedGitCommonDir(ledgerDirectory, { failClosed: true });
   } catch {
-    return claimStoreUnavailable(command, 'git-verification-failed');
+    return claimStoreUnavailable(responseCommand, 'git-verification-failed');
   }
   const namespace = gitCommonDir ? await readNamespace(ledgerDirectory) : null;
   const capability = resolveWorkClaimCapability({ gitCommonDir, namespace });
   if (!capability.claim_protected_publication) return write();
 
+  // A create is the one mutation that reads an identity it was not given: it
+  // allocates the ledger's next number from the items this checkout holds. Its
+  // reconciliation therefore stays target-scoped like every other mutation, and
+  // gains one extra barrier below, for the coordinated items this working
+  // ledger cannot see at all.
+  const create = command === 'create-v1';
   const storePath = claimStorePath(gitCommonDir, namespace);
   const journalPath = claimJournalPath(gitCommonDir, namespace);
   let intent = null;
   try {
     return await withClaimLock(storePath, async () => {
+      // The writer's own identity must exist before anything it does can be
+      // attributed, so it is established under the same lock that serializes
+      // the journal, ahead of reconciliation and of any intent append. Its own
+      // file is judged first, so bytes this worktree owns keep reporting as its
+      // own invalid identity rather than as an unreadable roster.
+      const currentWorktreeId = await ensureWorktreeIdentity({ ledgerDirectory, gitCommonDir });
+      // Then the domain: a UUID two live worktrees answer to attributes
+      // nothing, so nothing may be written from it.
+      await assertUniqueWorktreeIdentity({ ledgerDirectory });
       const replayed = await replayClaimJournal(journalPath, namespace);
       const reconciled = await reconcileClaimJournal({
         ledgerDirectory,
         gitCommonDir,
         namespace,
         replayed,
+        currentWorktreeId,
         physicalNow: new Date().toISOString(),
         targetItemId: itemId,
+        writeLogOnUnsafe: false,
+        writeLogWhenEmpty: !create,
       });
-      if (reconciled.unsafe) {
-        return claimStoreUnavailable(command, 'publication-reconciliation-required', {
+      // The extra create barrier promised above rides on the same refusal: a
+      // coordinated item this checkout does not hold carries a number nobody
+      // here can read, so the next number this create would allocate may be one
+      // a sibling worktree already published. A stale revision of an item that
+      // is present hides no number: an item's number is immutable, so target
+      // scoping above still lets that create through.
+      if (reconciled.unsafe || (create && reconciled.missingCoordinatedItems.length > 0)) {
+        return claimStoreUnavailable(responseCommand, 'publication-reconciliation-required', {
           findings: reconciled.findings,
         });
       }
@@ -52,10 +88,10 @@ export async function withLegacyMutationFence(ledgerDirectory, itemId, command,
       const projected = [...reconciled.entries];
       const record = reconciled.state.claims.find((entry) => entry.item_id === itemId)
         ?? { item_id: itemId, last_epoch: '0', active: null };
-      const mustRefuse = command === 'create-v1'
+      const mustRefuse = create
         ? record.last_epoch !== '0'
         : record.active !== null && observedAt < record.active.expires_at;
-      if (mustRefuse) return legacyRefusal(command, namespace, itemId, observedAt, record);
+      if (mustRefuse) return legacyRefusal(responseCommand, namespace, itemId, observedAt, record);
 
       const authorize = async (expectedRevision, candidateRevision, itemPath) => {
         const attemptId = randomUUID();
@@ -68,6 +104,7 @@ export async function withLegacyMutationFence(ledgerDirectory, itemId, command,
           expected_revision: expectedRevision,
           candidate_revision: candidateRevision,
           item_path: itemPath,
+          writer_worktree_id: currentWorktreeId,
           observed_at: observedAt,
         };
         const terminalEntry = {
@@ -78,6 +115,7 @@ export async function withLegacyMutationFence(ledgerDirectory, itemId, command,
           command,
           committed_revision: candidateRevision,
           item_path: itemPath,
+          writer_worktree_id: currentWorktreeId,
           observed_at: observedAt,
         };
         const abortEntry = {
@@ -85,6 +123,7 @@ export async function withLegacyMutationFence(ledgerDirectory, itemId, command,
           attempt_id: attemptId,
           ledger_namespace: namespace,
           item_id: itemId,
+          ...(create ? { command } : {}),
           observed_revision: expectedRevision,
           observed_at: observedAt,
         };
@@ -108,7 +147,7 @@ export async function withLegacyMutationFence(ledgerDirectory, itemId, command,
         outcome = await write(authorize, reconciled.ledger);
       } catch (error) {
         if (intent) {
-          return claimStoreUnavailable(command, 'legacy-mutation-outcome-unknown', {
+          return claimStoreUnavailable(responseCommand, 'legacy-mutation-outcome-unknown', {
             attempt_id: intent.attempt_id,
             candidate_revision: intent.candidate_revision,
           }, 'unknown');
@@ -125,7 +164,7 @@ export async function withLegacyMutationFence(ledgerDirectory, itemId, command,
           ? outcome.item?.revision
           : outcome.error?.details?.revision;
         if (committedRevision !== intent.candidate_revision) {
-          return claimStoreUnavailable(command, 'legacy-mutation-outcome-unknown', {
+          return claimStoreUnavailable(responseCommand, 'legacy-mutation-outcome-unknown', {
             attempt_id: intent.attempt_id,
             candidate_revision: intent.candidate_revision,
           }, 'unknown');
@@ -140,9 +179,10 @@ export async function withLegacyMutationFence(ledgerDirectory, itemId, command,
             committed_revision: committedRevision,
             observed_at: observedAt,
             item_path: intent.item_path,
+            writer_worktree_id: currentWorktreeId,
           }));
         } catch {
-          return claimStoreUnavailable(command, 'legacy-mutation-record-failed', {
+          return claimStoreUnavailable(responseCommand, 'legacy-mutation-record-failed', {
             attempt_id: intent.attempt_id,
             committed_revision: committedRevision,
           }, 'unknown');
@@ -154,11 +194,12 @@ export async function withLegacyMutationFence(ledgerDirectory, itemId, command,
             attempt_id: intent.attempt_id,
             ledger_namespace: namespace,
             item_id: itemId,
+            ...(create ? { command } : {}),
             observed_revision: intent.expected_revision,
             observed_at: observedAt,
           }));
         } catch {
-          return claimStoreUnavailable(command, 'legacy-mutation-record-failed');
+          return claimStoreUnavailable(responseCommand, 'legacy-mutation-record-failed');
         }
       }
       try {
@@ -182,9 +223,17 @@ export async function withLegacyMutationFence(ledgerDirectory, itemId, command,
         : outcome;
     });
   } catch (error) {
-    return claimStoreUnavailable(command, error?.code === 'CLAIM_LOCK_HELD'
+    const reason = error?.code === 'CLAIM_LOCK_HELD'
       ? 'claim-store-locked'
-      : 'claim-store-unreadable', {}, intent ? 'unknown' : 'unchanged');
+      : !intent && isClaimJournalCapacityError(error)
+        ? 'journal-capacity-exceeded'
+        : 'claim-store-unreadable';
+    return claimStoreUnavailable(
+      responseCommand,
+      reason,
+      identityDiagnosticDetails(error),
+      intent ? 'unknown' : 'unchanged',
+    );
   }
 }
 

package/src/claim-journal.js

@@ -2,6 +2,7 @@ import { constants } from 'node:fs';
 import { lstat, mkdir, open, readFile, stat } from 'node:fs/promises';
 import path from 'node:path';
 import { validateClaimRequest } from './claim-request.js';
+import { isCalendarDate } from './validate.js';
 
 import { advanceClockFloor, claimAcquire, claimRelease, claimRenew } from './claim-operations.js';
 import { emptyClaimState } from './claim-store.js';
@@ -19,12 +20,33 @@ const JOURNAL_ENTRY_TYPES = new Set([
   'publish-finalization',
   'publish-intent',
   'revision-adoption',
+  'number-repair-intent',
+  'number-repair-final',
 ]);
+// Every command the legacy mutation fence journals.
+const LEGACY_MUTATION_COMMANDS = new Set(['patch-v1', 'transition-v1', 'create-v1']);
 // The reconciliation log is a tracked derived artifact. Entry types that every
 // invocation appends, including refusals and read-only verification, stay out
 // of it so a mutation that changes nothing leaves the working tree unchanged.
 const UNPROJECTED_ENTRY_TYPES = new Set(['clock', 'publish-finalization']);
 
+// The one place that answers whether the reconciliation log carries an entry.
+export function isProjectedJournalEntry(entry) {
+  return !UNPROJECTED_ENTRY_TYPES.has(entry.type);
+}
+
+export function isClaimJournalCapacityError(error) {
+  const seen = new Set();
+  for (let current = error; current && typeof current === 'object'; current = current.cause) {
+    if (seen.has(current)) return false;
+    seen.add(current);
+    if (current.code === 'CLAIM_JOURNAL_CAPACITY'
+      || current.reason === 'journal-capacity-exceeded') {
+      return true;
+    }
+  }
+  return false;
+}
 export function claimJournalPath(commonDir, namespace) {
   return path.join(commonDir, 'wowbagger', namespace, 'journal.ndjson');
 }
@@ -66,6 +88,10 @@ export async function assertClaimJournalCapacity(journalPath, plannedEntries) {
 
 export async function replayClaimJournal(journalPath, namespace) {
   const entries = await readJournalEntries(journalPath, namespace);
+  return { state: replayClaimEntries(entries, namespace), entries };
+}
+
+export function replayClaimEntries(entries, namespace) {
   let state = emptyClaimState(namespace);
   const operations = { acquire: claimAcquire, release: claimRelease, renew: claimRenew };
   for (const entry of entries) {
@@ -75,11 +101,11 @@ export async function replayClaimJournal(journalPath, namespace) {
       state = operations[entry.command](state, entry.request, entry.physical_now).state;
     }
   }
-  return { state, entries };
+  return state;
 }
 
 export async function writeReconcileLog(logPath, namespace, entries) {
-  const mergeableEntries = entries.filter((entry) => !UNPROJECTED_ENTRY_TYPES.has(entry.type));
+  const mergeableEntries = entries.filter(isProjectedJournalEntry);
   const content = [
     `# Wowbagger reconciliation log \`${namespace}\``,
     '',
@@ -91,7 +117,8 @@ export async function writeReconcileLog(logPath, namespace, entries) {
     '',
   ].join('\n');
   if (Buffer.byteLength(content) > MAX_RECONCILE_LOG_BYTES) throw journalCapacityExceeded();
-  await mkdir(path.dirname(logPath), { recursive: true });
+  const directory = path.dirname(logPath);
+  await ensureDirectoryNoFollow(directory);
   const handle = await openNoFollow(logPath,
     constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC);
   try {
@@ -102,6 +129,53 @@ export async function writeReconcileLog(logPath, namespace, entries) {
   }
 }
 
+export function parseReconcileLog(source, namespace) {
+  const lines = source.toString('utf8').split('\n');
+  const start = lines.indexOf('```jsonl');
+  if (start < 0) return [];
+  const end = lines.indexOf('```', start + 1);
+  if (end < 0) return { error: { code: 'ambiguous-journal', reason: 'unterminated-jsonl-block' } };
+  const entries = [];
+  for (const line of lines.slice(start + 1, end)) {
+    if (line.trim() === '') continue;
+    try {
+      const entry = JSON.parse(line);
+      if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
+        return { error: { code: 'ambiguous-journal', reason: 'entry-not-object' } };
+      }
+      if (Object.hasOwn(entry, 'seq') && !validSequence(entry.seq)) {
+        return { error: { code: 'ambiguous-journal', reason: 'sequence-out-of-range' } };
+      }
+      const entryNamespace = entry.ledger_namespace
+        ?? entry.request?.ledger_namespace
+        ?? entry.fence?.ledger_namespace;
+      if (entryNamespace !== undefined && entryNamespace !== namespace) {
+        return { error: { code: 'ambiguous-journal', reason: 'namespace-mismatch' } };
+      }
+      entries.push(entry);
+    } catch {
+      return { error: { code: 'ambiguous-journal', reason: 'entry-not-json' } };
+    }
+  }
+  return entries;
+}
+
+async function ensureDirectoryNoFollow(directory) {
+  let info;
+  try {
+    info = await lstat(directory);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+    await mkdir(directory);
+    info = await lstat(directory);
+  }
+  if (!info.isDirectory() || info.isSymbolicLink()) {
+    const error = new Error(`refusing non-directory reconciliation path ${directory}`);
+    error.code = 'ELOOP';
+    throw error;
+  }
+}
+
 // O_NOFOLLOW is undefined on win32, so the no-follow guarantee falls back to
 // an lstat immediately before the open. The TOCTOU window that leaves is the
 // platform's best available answer; the thrown code stays ELOOP so every
@@ -137,6 +211,9 @@ async function readJournalEntries(journalPath, namespace = null) {
   const lines = source.split('\n').filter(Boolean);
   if (lines.length > MAX_JOURNAL_ENTRIES) throw journalCapacityExceeded();
   const entries = lines.map((line) => JSON.parse(line));
+  const createAttempts = new Map();
+  const repairIntents = new Map();
+  const repairFinals = new Set();
   for (let index = 0; index < entries.length; index += 1) {
     if (!Number.isSafeInteger(entries[index]?.seq) || entries[index].seq !== index + 1) {
       throw journalInvalid('non-contiguous-sequence');
@@ -147,6 +224,12 @@ async function readJournalEntries(journalPath, namespace = null) {
     if (!validJournalEntry(entries[index], namespace)) {
       throw journalInvalid('invalid-entry');
     }
+    if (!validCreateResolution(entries[index], createAttempts)) {
+      throw journalInvalid('invalid-entry');
+    }
+    if (!validRepairResolution(entries[index], repairIntents, repairFinals)) {
+      throw journalInvalid('invalid-entry');
+    }
   }
   return entries;
 }
@@ -220,6 +303,13 @@ function journalInvalid(reason) {
   return error;
 }
 
+// A committed sequence outside the journal's own capacity names no reachable
+// journal position, so it fails closed here rather than reaching hydration,
+// which would otherwise fill every absent position below it.
+function validSequence(seq) {
+  return Number.isSafeInteger(seq) && seq >= 1 && seq <= MAX_JOURNAL_ENTRIES;
+}
+
 function validJournalEntry(entry, namespace) {
   if (entry.type === 'clock') {
     return typeof entry.now === 'string' && typeof entry.floor === 'string';
@@ -235,10 +325,14 @@ function validJournalEntry(entry, namespace) {
       && typeof entry.ledger_namespace === 'string'
       && (namespace === null || entry.ledger_namespace === namespace)
       && typeof entry.item_id === 'string'
-      && ['patch-v1', 'transition-v1'].includes(entry.command)
-      && typeof entry.expected_revision === 'string'
+      && LEGACY_MUTATION_COMMANDS.has(entry.command)
+      && (entry.command === 'create-v1'
+        ? entry.expected_revision === null
+        : typeof entry.expected_revision === 'string')
       && typeof entry.candidate_revision === 'string'
       && (!Object.hasOwn(entry, 'item_path') || typeof entry.item_path === 'string')
+      && (!Object.hasOwn(entry, 'writer_worktree_id')
+        || typeof entry.writer_worktree_id === 'string')
       && typeof entry.observed_at === 'string';
   }
   if (entry.type === 'legacy-mutation') {
@@ -246,17 +340,27 @@ function validJournalEntry(entry, namespace) {
       && typeof entry.ledger_namespace === 'string'
       && (namespace === null || entry.ledger_namespace === namespace)
       && typeof entry.item_id === 'string'
-      && ['patch-v1', 'transition-v1'].includes(entry.command)
+      && LEGACY_MUTATION_COMMANDS.has(entry.command)
       && typeof entry.committed_revision === 'string'
       && (!Object.hasOwn(entry, 'item_path') || typeof entry.item_path === 'string')
+      && (!Object.hasOwn(entry, 'writer_worktree_id')
+        || typeof entry.writer_worktree_id === 'string')
       && typeof entry.observed_at === 'string';
   }
   if (entry.type === 'legacy-mutation-abort') {
+    // A create abort names no predecessor revision, so the absence of one is
+    // its evidence. Patch and transition aborts keep their exact legacy shape
+    // and never carry a command.
+    const validAbortRevision = (
+      !Object.hasOwn(entry, 'command') && typeof entry.observed_revision === 'string'
+    ) || (
+      entry.command === 'create-v1' && entry.observed_revision === null
+    );
     return typeof entry.attempt_id === 'string'
       && typeof entry.ledger_namespace === 'string'
       && (namespace === null || entry.ledger_namespace === namespace)
       && typeof entry.item_id === 'string'
-      && typeof entry.observed_revision === 'string'
+      && validAbortRevision
       && typeof entry.observed_at === 'string';
   }
   if (entry.type === 'revision-adoption') {
@@ -271,6 +375,12 @@ function validJournalEntry(entry, namespace) {
       && typeof entry.git_commit === 'string'
       && (!Object.hasOwn(entry, 'item_path') || typeof entry.item_path === 'string');
   }
+  if (entry.type === 'number-repair-intent') {
+    return validRepairIntent(entry, namespace);
+  }
+  if (entry.type === 'number-repair-final') {
+    return validRepairFinal(entry, namespace);
+  }
   if (entry.type === 'publish-intent') {
     return typeof entry.operation_id === 'string'
       && typeof entry.operation_digest === 'string'
@@ -278,6 +388,8 @@ function validJournalEntry(entry, namespace) {
       && typeof entry.expected_revision === 'string'
       && typeof entry.candidate_sha256 === 'string'
       && (!Object.hasOwn(entry, 'item_path') || typeof entry.item_path === 'string')
+      && (!Object.hasOwn(entry, 'writer_worktree_id')
+        || typeof entry.writer_worktree_id === 'string')
       && isRecord(entry.fence)
       && (namespace === null || entry.fence.ledger_namespace === namespace)
       && entry.fence.item_id === entry.item_id;
@@ -288,6 +400,8 @@ function validJournalEntry(entry, namespace) {
       && typeof entry.ledger_namespace === 'string'
       && (namespace === null || entry.ledger_namespace === namespace)
       && typeof entry.item_id === 'string'
+      && (!Object.hasOwn(entry, 'writer_worktree_id')
+        || typeof entry.writer_worktree_id === 'string')
       && validPublicationOutcome(entry);
   }
   return typeof entry.operation_id === 'string'
@@ -296,6 +410,97 @@ function validJournalEntry(entry, namespace) {
     && typeof entry.git_commit === 'string';
 }
 
+const REPAIR_ID = /^nr_\d{8}_\d{4}$/;
+const REPAIR_ITEM_ID = /^wb_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const REPAIR_REVISION = /^sha256:[0-9a-f]{64}$/;
+const REPAIR_STAGING_ID = /^[A-Za-z0-9_-]{1,80}$/;
+
+function validRepairIntent(entry, namespace) {
+  return REPAIR_ID.test(entry.repair_id)
+    && typeof entry.ledger_namespace === 'string'
+    && (namespace === null || entry.ledger_namespace === namespace)
+    && REPAIR_REVISION.test(entry.ledger_snapshot_revision)
+    && isCalendarDate(entry.date)
+    && REPAIR_STAGING_ID.test(entry.staging_id)
+    && validRepairItems(entry.items, { includeExpected: true });
+}
+
+function validRepairFinal(entry, namespace) {
+  return REPAIR_ID.test(entry.repair_id)
+    && typeof entry.ledger_namespace === 'string'
+    && (namespace === null || entry.ledger_namespace === namespace)
+    && REPAIR_STAGING_ID.test(entry.staging_id)
+    && typeof entry.observed_at === 'string'
+    && validRepairItems(entry.items, { includeCommitted: true });
+}
+
+function validRepairItems(items, options) {
+  if (!Array.isArray(items) || items.length === 0) return false;
+  const seen = new Set();
+  for (const item of items) {
+    if (!isRecord(item)
+      || !REPAIR_ITEM_ID.test(item.item_id)
+      || seen.has(item.item_id)
+      || typeof item.item_path !== 'string'
+      || !REPAIR_REVISION.test(item.candidate_revision)) {
+      return false;
+    }
+    if (options.includeExpected
+      && (!REPAIR_REVISION.test(item.expected_revision)
+        || !Number.isSafeInteger(item.expected_number)
+        || item.expected_number < 1
+        || !Number.isSafeInteger(item.replacement_number)
+        || item.replacement_number < 1)) {
+      return false;
+    }
+    if (options.includeCommitted && !REPAIR_REVISION.test(item.committed_revision)) return false;
+    seen.add(item.item_id);
+  }
+  return true;
+}
+
+function validRepairResolution(entry, intents, finals) {
+  if (entry.type === 'number-repair-intent') {
+    if (intents.has(entry.repair_id)) return false;
+    intents.set(entry.repair_id, entry);
+    return true;
+  }
+  if (entry.type !== 'number-repair-final') return true;
+  const intent = intents.get(entry.repair_id);
+  if (!intent || finals.has(entry.repair_id) || intent.staging_id !== entry.staging_id) return false;
+  const expected = new Map(intent.items.map((item) => [item.item_id, item.candidate_revision]));
+  if (entry.items.length !== expected.size) return false;
+  for (const item of entry.items) {
+    if (expected.get(item.item_id) !== item.candidate_revision) return false;
+  }
+  finals.add(entry.repair_id);
+  return true;
+}
+
+// A journal-fenced create is only meaningful as a pair: the terminal that ends
+// an attempt must name the intent that opened it, so a standalone create
+// terminal names no authorized attempt and fails closed. Patch and transition
+// entries remain valid standing alone, so only create-v1 attempts are tracked.
+function validCreateResolution(entry, attempts) {
+  if (entry.command !== 'create-v1') return true;
+  if (entry.type === 'legacy-mutation-intent') {
+    attempts.set(entry.attempt_id, entry);
+    return true;
+  }
+  if (entry.type !== 'legacy-mutation' && entry.type !== 'legacy-mutation-abort') return true;
+  const intent = attempts.get(entry.attempt_id);
+  if (intent === undefined || intent.item_id !== entry.item_id) return false;
+  // A committed create publishes exactly the revision its intent proposed; an
+  // aborted one publishes none.
+  if (entry.type === 'legacy-mutation' && intent.candidate_revision !== entry.committed_revision) {
+    return false;
+  }
+  // One attempt resolves once, so the intent is consumed here and a repeated
+  // resolution finds no open attempt to end.
+  attempts.delete(entry.attempt_id);
+  return true;
+}
+
 function isRecord(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value);
 }

package/src/claim-prospective.js

@@ -2,6 +2,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
 import { parseLedgerItemSource } from './ledger.js';
+import { parseReconcileLog } from './claim-journal.js';
 import { readGitTreeFile, readGitTreeLedger } from './git-reconciliation.js';
 import { revisionFor } from './mutation.js';
 
@@ -69,34 +70,6 @@ export function checkProspectiveLedger({ namespace, items, entries, parents, can
   return { ok: true };
 }
 
-export function parseReconcileLog(bytes, namespace) {
-  const lines = bytes.toString('utf8').split('\n');
-  const start = lines.indexOf('```jsonl');
-  if (start < 0) return [];
-  const end = lines.indexOf('```', start + 1);
-  if (end < 0) return { error: { code: 'ambiguous-journal', reason: 'unterminated-jsonl-block' } };
-  const entries = [];
-  for (const line of lines.slice(start + 1, end)) {
-    if (line.trim() === '') continue;
-    try {
-      const entry = JSON.parse(line);
-      if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
-        return { error: { code: 'ambiguous-journal', reason: 'entry-not-object' } };
-      }
-      entries.push(entry);
-    } catch {
-      return { error: { code: 'ambiguous-journal', reason: 'entry-not-json' } };
-    }
-  }
-  const namespaceIssue = entries.find((entry) => {
-    const entryNamespace = entry.ledger_namespace
-      ?? entry.request?.ledger_namespace
-      ?? entry.fence?.ledger_namespace;
-    return entryNamespace !== undefined && entryNamespace !== namespace;
-  });
-  return entries;
-}
-
 export async function checkProspectiveMerge({ ledgerDirectory, namespace, baseRef, headRef }) {
   const root = (await gitText(ledgerDirectory, ['rev-parse', '--show-toplevel'])).trim();
   const base = (await gitText(root, ['rev-parse', '--verify', baseRef])).trim();