Detect the flat layout in history; refuse it without the legacy capability (issue 2)

[Hafeok]

Closes #145 (PRD §6 issue 2; rulings 82 and 97; AC-82). Step 2 of the namespace layout and authority session, stacked on #154 (issue 1), as the dependency column says.

What lands. Before reading history, a verifier looks for the flat paths of revision v1.8 on the first-parent line of the verified commit and, when given, the base (layout::flat_history). Run without the legacy capability (ledger verify --no-legacy-layout) it refuses such a repository with exit 2, naming the first flat commit, and never reports it conformant. With the capability, which the reference implementation has, the three readers ruling 97 leaves to git follow each tracked file along its lineage (its namespaced path and the flat path of the same kind and name), told apart by path and never a commit by its layout:

• L007 judges a flat file the re-layout deleted through the file it became, by entity, with ruling 58's format: comparison along the same lineage; a flat file that went nowhere stays a removal. Rename detection is off in every landing query so a move reads as a delete and an add.
• L009's pickaxe names both paths, so the introducing commit is the original, never the move.
• The base overlay reads a flat base for the re-layout's own pull request; a flat change-set is homed by the namespace its entities name, a flat sidecar by the entity it signs.

Landing positions read the namespaced paths only, as the session instruction says. That is sound because no committed store with flat history holds an authority record: every first-parent revision of this repository was scanned (no grants, key_bindings, policies, grant_acceptances, unavailabilities or availabilities list in any flat log file, and no deletion in the flat log).

Tests (ledger-cli/tests/legacy_layout.rs, each failing before the change): a flat store re-laid out in one commit by a non-acceptor verifies conformant with blame on; an entity dropped by the move is L007 by entity; a flat file removed rather than moved stays L007; a format: raised past the need across the move is L007; without the capability a flat history is refused with exit 2 naming the first flat commit, on the base too; a v1.9 history needs no capability; the overlay reads a flat base. layout gains unit tests for the flat classifier, the counterpart and the detection. AC-82's first bullet over this repository's own history is #10's, which re-lays the store out.

Protocol. LP-3.35 loses its not-implemented mark; LP-8.30 gains the re-layout exception; LP-8.32 the lineage; Appendix B row; the v1.9 Appendix C note gains its history paragraph. No class added, no digest moves.

This repository's own store is still flat, so ledger verify --export is still refused on this branch (one red step, as on #154); the issue 10 PR, stacked on this one, re-lays the store out and is green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GgRcHXmnAu43hChNxhnqxU

---

Generated by Claude Code

[Hafeok]

CI, standing down, as the description says. The check job fails at ledger verify --export: at this commit the loader refuses the repository's own flat store (187 [SCHEMA] findings naming the flat paths, LP-3.34) and the two exports then speak namespaces the log does not. That is the step this PR and #154 are red on by design: the store moves in #156 (issue 10), which is green, and the series is meant to merge in order. Nothing else is wrong on this step; the full suite, clippy and the quality scripts pass.

Once the store moves, the contract-surface gate (ddd diff-contracts) will also hold this PR for its exposed-surface changes in landing.rs, layout.rs, revision.rs and verify/history.rs, as it holds #157–#162. The remedy is ddd bind <base>..HEAD under .ddd/seams/, which the session's instructions forbid me to run; see the close-out, ledger/sessions/2026-10-namespace-layout-authority.md.

---

Generated by Claude Code