Refuse an entity outside its directory's namespace, including revocation targets (issue 3)

[Hafeok]

Closes #146 — PRD ledger/prd/namespace-independence-prd.md §6 issue 3 (§3.7; ruling 45; AC-45).

Stacked on #156 (issue 10): the diff against main includes #154, #155 and #156. Review the last commit alone, 61bd97ed.

What lands

A file's namespace is its directory (LP-3.34), so every entity under ns/<ns>/ belongs to <ns>. The new verify::belonging stage makes each one that does not a SCHEMA fault naming the entity:

• a decision id of another namespace; a version or an acceptance of such a decision;
• a binding or a policy whose namespace is another;
• a revocation of an acceptance or a grant filed under another directory (the second half of N12, with ruling 49's duplicate-id fault);
• a grant acceptance or an interval naming a grant filed elsewhere; an availability ending an interval filed elsewhere;
• a sidecar under a namespace other than its entity's.

A record whose target is not filed is already a fault (authority::references) and is left to that finding. A change-set the writer can home nowhere carries an empty namespace and is judged by the finding that says why, not here. No class is added. The writer side of LP-3.33 (homing a change-set by its one namespace, refusing a mixed one) already landed in #154 and is cited, not rebuilt.

verify::verify had its landing-free file checks moved into file_findings so the function stays under the 40-line gate.

Tests (AC-45)

Each failed before the change.

• ledger-core/src/verify/belonging_tests.rs: a decision, its version and its acceptance of another namespace each named; a binding, a policy and a revocation target of another namespace named; an unhomed candidate not judged here.
• ledger-cli/tests/belonging.rs: a decision of B under A; an acceptance of B under A; a revocation under A of B's acceptance (and the same revocation under B in its place, conformant); B's opening change-set under A, its policy and binding each named.
• One existing unit-test store (genesis_role_tests) had homed a fixture.ledger policy under a hafeok.ledger file; its policy now names the file's namespace.

Protocol

LP-3.33 loses its not-implemented mark and its note on the implemented format; LP-8.8 gains the clause; Appendix B row; Appendix C note "An entity outside its namespace's directory is refused". No digest moves; CANONICAL_FORM stays v1; no committed file in this repository is mixed (0 of 187).

Checks

cargo build, cargo t, cargo clippy --workspace -- -D warnings -D clippy::unwrap_used, the quality scripts, and ledger verify --export on this repository (same output as on main: 284 entries, 93 decisions, 3 awaiting, 2 notices, exports matching).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GgRcHXmnAu43hChNxhnqxU

---

Generated by Claude Code

[Hafeok]

CI, standing down on one step. The check job fails at the contract-surface gate (ddd diff-contracts <base>..HEAD): 2 undischarged exposed-surface changes, both this PR's — verify/belonging.rs#findings added and verify/mod.rs#belonging added. Every other step of check passed (build, tests, clippy, ledger verify --export, ddd validate).

The remedy the gate names is ddd bind claude/great-feynman-zcdsdd-step-10-repository-store..HEAD (with --verdict), which files seam declarations under .ddd/seams/. The session's instructions forbid me to edit .ddd/, and a declaration's verdict_knowledge is the author's judgment, so I am not filing them. Please run ddd bind on this branch and push, or tell me to. Recorded in the close-out, ledger/sessions/2026-10-namespace-layout-authority.md.

---

Generated by Claude Code