Refuse orphan state without Domain Store authority

crates/lazaret-host-coordinator/src/state_maintenance.rs

@@ -10,7 +10,7 @@ use lazaret_core::records::{
 pub use lazaret_state_anchor::StateAnchorEntryKind;
 use lazaret_state_anchor::{
     StateAnchorEntry, StateAnchorInspection, StateAnchorLayout, StateAnchorResetScope,
-    require_no_orphan_reset_quarantine,
+    require_no_orphan_reset_quarantine, require_state_anchor_absent,
 };
 
 use crate::domain_store::{HostCoordinatorDomainStore, StateResetIntentV1, StateResetScopeV1};
@@ -44,6 +44,22 @@ pub struct DomainStateReport {
     pub anchors: Vec<StateAnchorReport>,
 }
 
+/// Returns an empty report only after proving that no physical State Anchor exists.
+///
+/// # Errors
+/// Refuses changed authority, links, inaccessible paths, or any persistent or runtime anchor.
+pub fn inspect_absent_domain_state(
+    configuration: &ResolvedDomainConfiguration,
+) -> Result<DomainStateReport, StateMaintenanceError> {
+    require_state_anchor_absent(configuration).map_err(failure)?;
+    Ok(report(
+        configuration,
+        &StateAnchorInspection {
+            entries: Vec::new(),
+        },
+    ))
+}
+
 /// Recovers a durable reset before any maintenance observer or runtime mount can expose state.
 ///
 /// # Errors