[Deep-Sixed]

Closes #39.

Problem

The migration invalidates a committed record whose bundle is neither on disk nor in the archive, and invalidating is permanent. But that evidence may simply never have been archived (a ledger from before the archive existed), and the files can still be on disk.

Changes

• The migration says why. Its error now reads evidence missing (neither on disk nor archived) or evidence mismatched (anything else: changed, unsafe, unreadable).
• python -m stele.ledger.reverify <db> <archive> <record_id> --artifact-dir DIR (reverify_record() in stele/ledger/reverify.py) seals such a record again. It is an explicit operator step, never part of migration.
• What it accepts. All of these must hold, otherwise it refuses and changes nothing:
  • the record was invalidated by the migration for missing evidence: its error says so, and its only event is the migration's import. A record that an operator or a replay invalidated has a record.invalidated event, so it stays invalidated even if its note copies the migration's wording;
  • it has no deliveries (invalidating withdrew the delivered data);
  • the files hash to the recorded manifest, archived exactly as sealing does. A changed, missing or extra file leaves the record invalidated.
• The history stays. On success the record is sealed again, its error cleared, and a chained record.reverified event is written in the same transaction. verify_ledger replays it as sealed, so the ledger still verifies.

Records migrated before this change carry the old, unlabelled error. They are never restored automatically: the reason isn't recorded, so the restore refuses them. This is deliberate and covered by a test; an operator can still invalidate-and-record fresh evidence under a new run.

Tests

tests/test_reverify.py, 16 tests:

• the migration labels missing vs mismatched evidence;
• a restore from the record's own directory and from another one, with the chain and the ledger verifying afterwards, and the record usable with its files gone again;
• refusals that leave the record untouched: mismatched evidence (even with the right files back), changed / missing / extra files, an operator's invalidation that copies the migration's wording, the old unlabelled error text, a record with a delivery, and records that aren't invalidated;
• the CLI.

Full suite: 895 passed, 97 skipped. ruff is clean. Docs: docs/ledger.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_013p3FU6gUJ1MGinnmEgvHsm

---

Generated by Claude Code