accept refuses in a namespace without a policy #84

Source: Session A close-out §3 question 2, option (b) (docs/sessions/2026-10-session-a.md), ruled 2 October 2026: "2 (a) with D5 (c) now, and (b) as an issue after Session B." Reasoning: docs/signing-rulings-2026-10-d5-d9.md, "Session A close-out §3", row 2. Size: M. Depends on: Session B complete (#70 with D5 (c), the position rule). Must land: after Session B.

Why

Under D5 (c) an act before its namespace's first policy is not role-checked, and verify names such namespaces as unchecked. That keeps the repository's existing acceptances valid, but it also leaves a path for new acceptances in an ungoverned namespace to stay unsigned and unchecked for good. The end state is that a new acceptance needs a policy.

What to build

• accept (both forms, ledger-cli/src/commands/sign.rs) refuses in a namespace with no policy, naming ledger init --namespace <ns> as the remedy. Today decision_authority (ledger-core/src/author/acceptance_ops.rs) returns Ok(None) there.
• Decide in the PR whether revoke follows (revoking a pre-policy acceptance in an ungoverned namespace).
• Pre-policy acts that already landed stand (D5 (c)); this changes the verb, not history.

Fixture migration

Every test and fixture that accepts without a policy changes:

• ledger-cli/tests/{verbs,accept_group,diff,merge,interactive,keys}.rs;
• ledger-cli/tests/gate.rs mod blame;
• ledger-core/src/author/*tests.rs and ledger-core/src/batch_tests.rs.

The PR states how many changed and how: init --namespace plus a grant of the accept role, or a shared harness step. The checked-in fixture stores under ledger-cli/tests/fixtures/ are files, not verbs, and are unaffected unless the PR says otherwise.

Tests

• accept in an ungoverned namespace refuses, writes nothing.
• accept after init --namespace and a grant succeeds.
• Earlier, pre-policy acceptances still verify.