@agentshouse/kit 0.1.0-alpha.4 → 0.1.0-alpha.40

package/src/working-copy.js

@@ -0,0 +1,1274 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readdir, readFile, realpath, rename, rm, stat } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { readBindings } from "./binding.js";
+import {
+  KIT_DOOR_BATCH_PATH,
+  KIT_DOOR_DISCOVER_PATH,
+  KIT_DOOR_ENUMERATE_PATH,
+  KIT_DOOR_REVISIONS_PATH,
+  KIT_WORKING_COPY_SELECTION_PATH,
+  ROOM_REFERENCE,
+  WORKING_COPIES_HOME,
+  WORKING_COPY_BRANCH,
+  WORKING_COPY_PRIVATE_HOMES,
+  WORKING_COPY_RECEIVED_REF,
+  WORKING_COPY_ROOM_HOMES,
+  WORKING_COPY_VERSION,
+} from "./contract.js";
+import { runGit } from "./git.js";
+import { operationId } from "./operation.js";
+import { formatCommandError, houseAnswered, houseFailed, KitRefusal } from "./refusal.js";
+import { readNote, writeNote, writeText } from "./state.js";
+import { bootstrapBundle, discoveryOf, door, withSession } from "./sync.js";
+import { isGeneratedProvenance, sidecarPath, structuredOrReplace } from "./sync-library.js";
+import { locate, removeReplicaFile, writeReplicaFile } from "./sync-state.js";
+import { exclusively } from "./tasks.js";
+
+const COMMITTER_NAME = "House Kit";
+const COMMITTER_EMAIL = "house-kit@localhost";
+const COMMITTER = `${COMMITTER_NAME} <${COMMITTER_EMAIL}>`;
+const GIT_FAILED = "kit_working_copy_git_failed";
+
+function rejected(detail = null) {
+  return new KitRefusal("kit_working_copy_rejected", detail);
+}
+
+function stateHome(directory) {
+  return join(directory, "state", "working-copies");
+}
+
+function statePath(directory, scope) {
+  if (scope.kind === "private") return join(stateHome(directory), "private.json");
+  if (!ROOM_REFERENCE.test(scope.ref)) throw new KitRefusal("kit_state_name_invalid", scope.ref);
+  return join(stateHome(directory), "rooms", `${scope.ref}.json`);
+}
+
+function repositoryPath(base, scope) {
+  const root = join(base, WORKING_COPIES_HOME);
+  return scope.kind === "private" ? join(root, "private") : join(root, "rooms", scope.ref);
+}
+
+function housePath(scope) {
+  return scope.kind === "private" ? "/private" : `/rooms/${scope.handle}`;
+}
+
+function sameScope(copy, scope) {
+  return copy.scope === scope.kind && (scope.kind === "private" || copy.room_ref === scope.ref);
+}
+
+function selectedScope(room) {
+  if (
+    typeof room?.room_ref !== "string" ||
+    !ROOM_REFERENCE.test(room.room_ref) ||
+    (room.room_handle !== null && (typeof room.room_handle !== "string" || room.room_handle === ""))
+  ) {
+    throw rejected("selection");
+  }
+  return { kind: "room", ref: room.room_ref, handle: room.room_handle };
+}
+
+async function savedSelection(session, signal) {
+  const answer = await door(session, KIT_WORKING_COPY_SELECTION_PATH, {}, signal);
+  const copy = answer?.working_copy;
+  if (copy === null) return [];
+  if (!Array.isArray(copy?.rooms) || typeof copy.private !== "boolean") throw rejected("selection");
+  return [
+    ...copy.rooms.map(selectedScope),
+    ...(copy.private ? [{ kind: "private", ref: null, handle: null }] : []),
+  ];
+}
+
+function selectedPrefixes(scope) {
+  const homes = scope.kind === "private" ? WORKING_COPY_PRIVATE_HOMES : WORKING_COPY_ROOM_HOMES;
+  return homes.map((home) => `${housePath(scope)}/${home}`);
+}
+
+function receivedFiles(view) {
+  const manifest = view?.manifest;
+  if (
+    !Array.isArray(manifest?.files) ||
+    !Array.isArray(view.contents) ||
+    typeof manifest.anchor !== "string" ||
+    typeof manifest.position !== "string" ||
+    typeof manifest.log_epoch !== "string"
+  ) {
+    throw rejected("bootstrap");
+  }
+  const contents = new Map();
+  for (const entry of view.contents) {
+    if (typeof entry?.path !== "string" || typeof entry.content !== "string") throw rejected("bootstrap");
+    contents.set(entry.path, entry.content);
+  }
+  return manifest.files.map((file) => {
+    const content = contents.get(file?.path);
+    if (
+      content === undefined ||
+      typeof file.revision !== "string" ||
+      typeof file.sha256 !== "string" ||
+      typeof file.writable !== "boolean"
+    ) {
+      throw rejected("bootstrap");
+    }
+    return {
+      path: file.path,
+      revision: file.revision,
+      sha256: file.sha256,
+      writable: file.writable,
+      content,
+      provenance: typeof file.provenance === "string" ? file.provenance : null,
+    };
+  });
+}
+
+async function readScope(session, scope, signal) {
+  const prefixes = selectedPrefixes(scope);
+  const discovery = discoveryOf(await door(session, KIT_DOOR_DISCOVER_PATH, { prefixes }, signal));
+  const bundle = await bootstrapBundle(session, prefixes, signal);
+  if (bundle.scopes.length === 0) throw new KitRefusal("kit_working_copy_unavailable", housePath(scope));
+  if (bundle.scopes.length !== 1) throw rejected("bootstrap");
+  const [view] = bundle.scopes;
+  const files = receivedFiles(view);
+  const authority = discovery.authorities.find(
+    (entry) => entry?.room_ref === view.manifest.anchor,
+  );
+  if (
+    authority === undefined ||
+    !Array.isArray(authority.protected_paths) ||
+    !Array.isArray(authority.operations?.write) ||
+    (scope.kind === "room" && view.manifest.anchor !== scope.ref)
+  ) {
+    throw rejected("discover");
+  }
+  return {
+    anchor: view.manifest.anchor,
+    position: view.manifest.position,
+    logEpoch: view.manifest.log_epoch,
+    protectedPaths: authority.protected_paths,
+    declared: declaration(authority),
+    files,
+  };
+}
+
+function declaration(authority) {
+  return { write: authority.operations.write, protected: authority.protected_paths };
+}
+
+function importData(text) {
+  const bytes = Buffer.from(text, "utf8");
+  return [Buffer.from(`data ${bytes.length}\n`), bytes, Buffer.from("\n")];
+}
+
+function quotedPath(path) {
+  return `"${path.replace(/[\\"]/g, "\\$&").replace(/\n/g, "\\n")}"`;
+}
+
+function importCommit(message, parents) {
+  return [
+    Buffer.from(`committer ${COMMITTER} ${Math.floor(Date.now() / 1000)} +0000\n`),
+    ...importData(message),
+    ...parents.map((parent, index) => Buffer.from(`${index === 0 ? "from" : "merge"} ${parent}\n`)),
+  ];
+}
+
+function importFile(path, content) {
+  if (content === null) return [Buffer.from(`D ${quotedPath(path)}\n`)];
+  return [Buffer.from(`M 100644 inline ${quotedPath(path)}\n`), ...importData(content)];
+}
+
+async function importReceived(repository, { message, parents, files, whole = false, acknowledging = null }, signal) {
+  const stream = [];
+  const merged = [...parents];
+  if (acknowledging !== null && acknowledging.edits.length === 0) merged.push(acknowledging.commit);
+  if (acknowledging !== null && acknowledging.edits.length > 0) {
+    stream.push(
+      Buffer.from(`commit ${WORKING_COPY_RECEIVED_REF}\nmark :1\n`),
+      ...importCommit(`House accepted ${acknowledging.commit}`, [acknowledging.commit]),
+      ...acknowledging.edits.flatMap((edit) => importFile(edit.path, edit.content)),
+      Buffer.from("\n"),
+    );
+    merged.push(":1");
+  }
+  stream.push(
+    Buffer.from(`commit ${WORKING_COPY_RECEIVED_REF}\n`),
+    ...importCommit(message, merged),
+    ...(whole ? [Buffer.from("deleteall\n")] : []),
+    ...files.flatMap((file) => importFile(file.path, file.content)),
+    Buffer.from("\n"),
+  );
+  await runGit(repository, ["fast-import", "--quiet", "--force"], {
+    input: Buffer.concat(stream),
+    signal,
+    failure: GIT_FAILED,
+  });
+  const received = await commitOf(repository, WORKING_COPY_RECEIVED_REF, signal);
+  if (acknowledging === null) return { received, acknowledged: null };
+  const acknowledged =
+    acknowledging.edits.length === 0 ? acknowledging.commit : await commitOf(repository, `${received}^2`, signal);
+  return { received, acknowledged };
+}
+
+async function commitOf(repository, name, signal) {
+  const commit = await runGit(repository, ["rev-parse", "--verify", `${name}^{commit}`], {
+    capture: true,
+    signal,
+    failure: GIT_FAILED,
+  });
+  return commit.toString("utf8").trim();
+}
+
+async function remembered(repository, revisions, commit, files, signal, acknowledged = false) {
+  const tree = await treeOf(repository, commit, signal);
+  const next = { ...revisions };
+  for (const { path, revision } of files) {
+    const entry = tree.get(path);
+    if (entry === undefined || revision === null) continue;
+    const seen = next[path]?.[entry.object] ?? [];
+    if (acknowledged || seen.at(-1)?.revision !== revision) {
+      next[path] = { ...next[path], [entry.object]: [...seen, { commit, revision }] };
+    }
+  }
+  return next;
+}
+
+async function revisionAt(copy, path, entry, base, signal) {
+  const seen = entry === undefined ? [] : (copy.revisions[path]?.[entry.object] ?? []);
+  for (const known of seen.toReversed()) {
+    if (seen.length === 1 || (await contains(copy.repository, known.commit, base, signal))) return known.revision;
+  }
+  return undefined;
+}
+
+function readOnlyContents(read) {
+  const contents = new Map();
+  for (const file of read.files) {
+    if (!file.writable) contents.set(file.path, file.content);
+    if (file.provenance !== null) contents.set(sidecarPath(file.path), file.provenance);
+  }
+  return contents;
+}
+
+async function present(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+async function trackedPaths(repository, signal) {
+  const listed = await runGit(repository, ["ls-files", "-z"], { capture: true, signal, failure: GIT_FAILED });
+  return new Set(listed.toString("utf8").split("\0").filter((path) => path !== ""));
+}
+
+async function replaceReadOnly(repository, held, written, removed, signal) {
+  const tracked = await trackedPaths(repository, signal);
+  const holding = new Set(held);
+  for (const path of removed) {
+    if (!held.has(path)) continue;
+    if (!tracked.has(path)) await removeReplicaFile(repository, "", path);
+    holding.delete(path);
+  }
+  for (const [path, content] of written) {
+    if (tracked.has(path)) continue;
+    const target = locate(repository, "", path);
+    if (!held.has(path) && (await present(target))) continue;
+    await writeReplicaFile(target, content, signal);
+    holding.add(path);
+  }
+  return [...holding];
+}
+
+function covers(path, prefix) {
+  return path === prefix || path.startsWith(`${prefix}/`);
+}
+
+function ignorePattern(path) {
+  return `/${path.replace(/[\\*?[]/g, "\\$&").replace(/ +$/, (spaces) => spaces.replace(/ /g, "\\ "))}`;
+}
+
+function ignoreGroups(read) {
+  const writable = read.files.filter((file) => file.writable).map((file) => file.path);
+  const readOnly = read.files.filter((file) => !file.writable).map((file) => file.path);
+  const whole = read.protectedPaths.filter((path) => !writable.some((file) => covers(file, path)));
+  const protectedPath = (path) => read.protectedPaths.some((prefix) => covers(path, prefix));
+  const house = [
+    ...whole,
+    ...readOnly.filter((path) => protectedPath(path) && !whole.some((prefix) => covers(path, prefix))),
+  ];
+  const granted = readOnly.filter((path) => !protectedPath(path));
+  return { house: house.map(ignorePattern), granted: granted.map(ignorePattern) };
+}
+
+async function writeIgnoreRules(repository, read, signal) {
+  const { house, granted } = ignoreGroups(read);
+  const gitignore = [
+    "# House Kit writes this file and .ignore. The paths below are read-only House",
+    "# content: Git does not track them, and House refuses a change to them even",
+    "# when this file is edited or a path is force-added.",
+    "/.gitignore",
+    "/.ignore",
+    "_provenance",
+    "",
+    "# House maintains or protects these paths.",
+    ...house,
+    "",
+    "# Your current House grant does not allow writing these paths.",
+    ...granted,
+    "",
+  ];
+  const ignore = [
+    "# House Kit writes this file so native search still reads the read-only House",
+    "# content that .gitignore keeps out of Git.",
+    "!_provenance",
+    ...[...house, ...granted].map((pattern) => `!${pattern}`),
+    "",
+  ];
+  await ruled(join(repository, ".gitignore"), gitignore.join("\n"), signal);
+  await ruled(join(repository, ".ignore"), ignore.join("\n"), signal);
+}
+
+async function ruled(path, rules, signal) {
+  if ((await readFile(path, "utf8").catch(() => null)) !== rules) await writeText(path, rules, signal, 0o644);
+}
+
+function manifest(read, commit, readOnly) {
+  return { commit, position: read.position, log_epoch: read.logEpoch, read_only: readOnly, declared: read.declared };
+}
+
+function copyPath(directory, copy) {
+  return statePath(directory, { kind: copy.scope, ref: copy.room_ref });
+}
+
+async function writeCopy(directory, copy, signal) {
+  await writeNote(copyPath(directory, copy), copy, signal);
+}
+
+async function readCopy(path) {
+  const copy = await readNote(path, null);
+  return copy?.version === WORKING_COPY_VERSION ? copy : null;
+}
+
+async function heldCopies(directory) {
+  const rooms = join(stateHome(directory), "rooms");
+  let names = [];
+  try {
+    names = await readdir(rooms);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw new KitRefusal("kit_state_unreadable", rooms);
+  }
+  const held = [];
+  for (const name of names.filter((entry) => entry.endsWith(".json")).sort()) {
+    held.push(await readCopy(join(rooms, name)));
+  }
+  held.push(await readCopy(statePath(directory, { kind: "private" })));
+  return held.filter((copy) => copy !== null);
+}
+
+function received(scope, read, parents) {
+  const files = read.files.filter((file) => file.writable);
+  return { message: `House ${housePath(scope)} at position ${read.position}`, parents, files, whole: true };
+}
+
+async function materialize(context, scope, signal) {
+  const read = await readScope(context.session, scope, signal);
+  const identity = { kind: scope.kind, ref: read.anchor };
+  const repository = repositoryPath(context.launchBase, identity);
+  if (await present(repository)) throw new KitRefusal("kit_working_copy_unmanaged", repository);
+  const staging = join(dirname(repository), `.${randomUUID()}.staging`);
+  await mkdir(staging, { recursive: true });
+  const imported = received(scope, read, []);
+  let commit;
+  let revisions;
+  let readOnly;
+  try {
+    await runGit(staging, ["init", "-q", "-b", WORKING_COPY_BRANCH], { signal, failure: GIT_FAILED });
+    commit = (await importReceived(staging, imported, signal)).received;
+    revisions = await remembered(staging, {}, commit, imported.files, signal);
+    await runGit(staging, ["update-ref", `refs/heads/${WORKING_COPY_BRANCH}`, commit], {
+      signal,
+      failure: GIT_FAILED,
+    });
+    await runGit(staging, ["read-tree", "-m", "-u", "HEAD"], { signal, failure: GIT_FAILED });
+    readOnly = await replaceReadOnly(staging, new Set(), readOnlyContents(read), [], signal);
+    await writeIgnoreRules(staging, read, signal);
+    await rename(staging, repository);
+  } catch (error) {
+    await rm(staging, { recursive: true, force: true });
+    throw error;
+  }
+  await writeCopy(context.directory, {
+    version: WORKING_COPY_VERSION,
+    scope: scope.kind,
+    room_ref: read.anchor,
+    room_handle: scope.handle,
+    repository,
+    active: true,
+    received: manifest(read, commit, readOnly),
+    revisions,
+  });
+}
+
+async function receive(context, copy, scope, signal) {
+  const read = await readScope(context.session, scope, signal);
+  if (read.anchor !== copy.room_ref) throw rejected("bootstrap");
+  const imported = received(scope, read, [copy.received.commit]);
+  const commit = (await importReceived(copy.repository, imported, signal)).received;
+  const next = readOnlyContents(read);
+  const held = copy.received.read_only;
+  const removed = held.filter((path) => !next.has(path));
+  const readOnly = await replaceReadOnly(copy.repository, new Set(held), next, removed, signal);
+  await writeIgnoreRules(copy.repository, read, signal);
+  return {
+    ...copy,
+    received: manifest(read, commit, readOnly),
+    revisions: await remembered(copy.repository, copy.revisions, commit, imported.files, signal),
+  };
+}
+
+async function refresh(context, copy, scope, signal) {
+  if (!(await present(copy.repository))) {
+    await rm(copyPath(context.directory, copy), { force: true });
+    await materialize(context, scope, signal);
+    return;
+  }
+  const next = await receive(context, copy, scope, signal);
+  await writeCopy(context.directory, { ...next, room_handle: scope.handle, active: true }, signal);
+}
+
+function scopeRefused(error) {
+  return error instanceof KitRefusal && (houseAnswered(error) || error.code.startsWith("kit_working_copy_"));
+}
+
+function declaredWritable(path, authority) {
+  const deepest = (scopes) =>
+    Math.max(-1, ...scopes.filter((scope) => scope === "" || covers(path, scope)).map((scope) => scope.length));
+  return deepest(authority.operations.write) > deepest(authority.protected_paths);
+}
+
+async function incorporated(copy, view, authority, signal) {
+  const tree = await treeOf(copy.repository, copy.received.commit, signal);
+  const held = new Set(copy.received.read_only);
+  const files = [];
+  const written = new Map();
+  const removed = [];
+  for (const change of view.changes) {
+    const gone = change.removed === true;
+    if (tree.has(change.path) || (!gone && !held.has(change.path) && declaredWritable(change.path, authority))) {
+      files.push({ path: change.path, revision: gone ? null : change.revision, content: gone ? null : change.content });
+    } else if (gone) {
+      removed.push(change.path, sidecarPath(change.path));
+    } else {
+      written.set(change.path, change.content);
+      if (typeof change.provenance === "string") written.set(sidecarPath(change.path), change.provenance);
+    }
+  }
+  const message = `House ${housePath(scopeOf(copy))} at position ${view.position}`;
+  const commit =
+    files.length === 0
+      ? copy.received.commit
+      : (await importReceived(copy.repository, { message, parents: [copy.received.commit], files }, signal)).received;
+  const readOnly = await replaceReadOnly(copy.repository, held, written, removed, signal);
+  if (view.changes.length > 0) {
+    const listed = [
+      ...[...(await treeOf(copy.repository, commit, signal)).keys()].map((path) => ({ path, writable: true })),
+      ...readOnly.filter((path) => !isGeneratedProvenance(path)).map((path) => ({ path, writable: false })),
+    ].sort((left, right) => (left.path < right.path ? -1 : 1));
+    await writeIgnoreRules(copy.repository, { files: listed, protectedPaths: authority.protected_paths }, signal);
+  }
+  return {
+    ...copy,
+    received: { ...copy.received, commit, position: view.position, log_epoch: view.log_epoch, read_only: readOnly },
+    revisions: await remembered(copy.repository, copy.revisions, commit, files, signal),
+  };
+}
+
+async function deliver(context, path, authority, signal) {
+  if (
+    typeof authority.position !== "string" ||
+    typeof authority.log_epoch !== "string" ||
+    !Array.isArray(authority.protected_paths) ||
+    !Array.isArray(authority.operations?.write)
+  ) {
+    throw rejected("discover");
+  }
+  let copy = await readCopy(path);
+  if (copy?.active && JSON.stringify(copy.received.declared) !== JSON.stringify(declaration(authority))) {
+    await writeCopy(context.directory, await receive(context, copy, scopeOf(copy), signal), signal);
+    return false;
+  }
+  while (
+    copy?.active &&
+    (copy.received.log_epoch !== authority.log_epoch || BigInt(copy.received.position) < BigInt(authority.position))
+  ) {
+    const since = { position: copy.received.position, log_epoch: copy.received.log_epoch };
+    let view;
+    try {
+      view = await enumerated(context, copy, since, signal);
+    } catch (error) {
+      if (error.code === "replica_behind") return true;
+      if (error.code !== "position_expired") throw error;
+      await writeCopy(context.directory, await receive(context, copy, scopeOf(copy), signal), signal);
+      return false;
+    }
+    if (view.position === since.position) return false;
+    copy = await incorporated(copy, view, authority, signal);
+    await writeCopy(context.directory, copy, signal);
+  }
+  return false;
+}
+
+async function delivering(context, signal) {
+  const copies = (await heldCopies(context.directory)).filter((copy) => copy.active);
+  if (copies.length === 0) return { refused: [], lost: false, behind: false };
+  const prefixes = copies.flatMap((copy) => selectedPrefixes(scopeOf(copy)));
+  const discovery = discoveryOf(await door(context.session, KIT_DOOR_DISCOVER_PATH, { prefixes }, signal));
+  const refused = [];
+  let lost = false;
+  let behind = false;
+  for (const copy of copies) {
+    const at = housePath(scopeOf(copy));
+    const authority = discovery.authorities.find((entry) => entry?.room_ref === copy.room_ref);
+    if (authority === undefined) {
+      lost = true;
+      continue;
+    }
+    if (authority.managed_replication !== "admitted") {
+      refused.push({ path: at, code: "operation_denied" });
+      continue;
+    }
+    const path = copyPath(context.directory, copy);
+    try {
+      if (await exclusively(path, () => deliver(context, path, authority, signal))) behind = true;
+    } catch (error) {
+      if (!scopeRefused(error)) throw error;
+      refused.push({ path: at, code: error.code });
+    }
+  }
+  return { refused, lost, behind };
+}
+
+function deliveredOutcome(refused, behind) {
+  return behind ? { refused, behind } : { refused };
+}
+
+export async function deliverWorkingCopies(context, signal) {
+  const delivered = await delivering(context, signal);
+  return delivered.lost
+    ? applyWorkingCopies(context, signal)
+    : deliveredOutcome(delivered.refused, delivered.behind);
+}
+
+function streamChange(entry) {
+  if (entry?.kind === "removed") return { path: entry.path, removed: true };
+  return { path: entry?.path, revision: entry?.revision, content: entry?.text, provenance: entry?.provenance };
+}
+
+function followsOn(copy, frame, since, changes) {
+  const { received } = copy;
+  return (
+    since !== null &&
+    received.log_epoch === frame.log_epoch &&
+    BigInt(received.position) >= BigInt(since) &&
+    !unreadableChanges(changes)
+  );
+}
+
+async function carriedEntries(context, path, frame, since, signal) {
+  const copy = await readCopy(path);
+  if (!copy?.active) return true;
+  const { received } = copy;
+  if (received.log_epoch === frame.log_epoch && BigInt(frame.position) <= BigInt(received.position)) return true;
+  const homes = copy.scope === "private" ? WORKING_COPY_PRIVATE_HOMES : WORKING_COPY_ROOM_HOMES;
+  const changes = frame.entries
+    .map(streamChange)
+    .filter((change) => typeof change.path !== "string" || homes.some((home) => covers(change.path, home)));
+  if (!followsOn(copy, frame, since, changes)) return false;
+  const view = { changes, position: frame.position, log_epoch: frame.log_epoch };
+  const authority = { operations: { write: received.declared.write }, protected_paths: received.declared.protected };
+  await writeCopy(context.directory, await incorporated(copy, view, authority, signal), signal);
+  return true;
+}
+
+export async function receiveWorkingCopyEntries(context, frame, since, signal) {
+  if (
+    typeof frame.authority !== "string" ||
+    typeof frame.log_epoch !== "string" ||
+    !/^[0-9]+$/.test(frame.position) ||
+    !Array.isArray(frame.entries) ||
+    (since !== null && !/^[0-9]+$/.test(since))
+  ) {
+    return false;
+  }
+  const copy = (await heldCopies(context.directory)).find(
+    (held) => held.active && held.room_ref === frame.authority,
+  );
+  if (copy === undefined) return true;
+  const path = copyPath(context.directory, copy);
+  return exclusively(path, () => carriedEntries(context, path, frame, since, signal));
+}
+
+export async function applyWorkingCopies(context, signal) {
+  const selected = (await savedSelection(context.session, signal)).filter(
+    (scope) => scope.kind === "private" || scope.handle !== null,
+  );
+  for (const held of await heldCopies(context.directory)) {
+    if (!held.active || selected.some((scope) => sameScope(held, scope))) continue;
+    const path = copyPath(context.directory, held);
+    await exclusively(path, async () => {
+      const copy = await readCopy(path);
+      if (copy !== null) await writeCopy(context.directory, { ...copy, active: false }, signal);
+    });
+  }
+  const refused = [];
+  for (const scope of selected) {
+    const path = statePath(context.directory, scope);
+    try {
+      await exclusively(path, async () => {
+        const copy = await readCopy(path);
+        if (copy === null) await materialize(context, scope, signal);
+        else if (!copy.active) await refresh(context, copy, scope, signal);
+        else if (copy.room_handle !== scope.handle) {
+          await writeCopy(context.directory, { ...copy, room_handle: scope.handle }, signal);
+        }
+      });
+    } catch (error) {
+      if (!scopeRefused(error)) throw error;
+      refused.push({ path: housePath(scope), code: error.code });
+    }
+  }
+  const delivered = await delivering(context, signal);
+  return deliveredOutcome([...refused, ...delivered.refused], delivered.behind);
+}
+
+export async function workingCopyPaths(directory) {
+  return (await heldCopies(directory))
+    .filter((copy) => copy.active)
+    .map((copy) => ({
+      path: housePath({ kind: copy.scope, handle: copy.room_handle }),
+      repository: copy.repository,
+    }))
+    .sort((left, right) => (left.path < right.path ? -1 : 1));
+}
+
+function scopeOf(copy) {
+  return { kind: copy.scope, ref: copy.room_ref, handle: copy.room_handle };
+}
+
+function without(copy) {
+  const { push, ...settled } = copy;
+  return settled;
+}
+
+function lines(output) {
+  return output.toString("utf8").split("\n").filter((line) => line !== "");
+}
+
+function succeeded(git) {
+  return git.then(
+    () => true,
+    () => false,
+  );
+}
+
+function contains(repository, ancestor, descendant, signal) {
+  return succeeded(
+    runGit(repository, ["merge-base", "--is-ancestor", ancestor, descendant], { signal, failure: GIT_FAILED }),
+  );
+}
+
+async function located(cwd, signal) {
+  const [common, worktree] = lines(
+    await runGit(cwd, ["rev-parse", "--path-format=absolute", "--git-common-dir", "--show-toplevel"], {
+      capture: true,
+      signal,
+      failure: "kit_working_copy_unresolved",
+    }),
+  );
+  return { repository: await realpath(dirname(common)), worktree };
+}
+
+async function heldAt(directory, repository) {
+  for (const copy of await heldCopies(directory)) {
+    if ((await realpath(copy.repository).catch(() => null)) === repository) return copy;
+  }
+  return null;
+}
+
+async function copyAt(directory, repository) {
+  const copy = await heldAt(directory, repository);
+  if (copy === null) throw new KitRefusal("kit_working_copy_not_found", repository);
+  return copy;
+}
+
+async function treeOf(repository, commit, signal) {
+  const listed = await runGit(repository, ["ls-tree", "-r", "-z", commit], {
+    capture: true,
+    signal,
+    failure: GIT_FAILED,
+  });
+  const tree = new Map();
+  for (const entry of listed.toString("utf8").split("\0").filter((line) => line !== "")) {
+    const tab = entry.indexOf("\t");
+    const [, type, object] = entry.slice(0, tab).split(" ");
+    tree.set(entry.slice(tab + 1), { type, object });
+  }
+  return tree;
+}
+
+async function blobText(repository, entry, path, signal) {
+  if (entry === undefined) return null;
+  if (entry.type !== "blob") throw new KitRefusal("kit_working_copy_not_text", path);
+  const bytes = await runGit(repository, ["cat-file", "blob", entry.object], {
+    capture: true,
+    signal,
+    failure: GIT_FAILED,
+  });
+  try {
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+  } catch {
+    throw new KitRefusal("kit_working_copy_not_text", path);
+  }
+}
+
+async function trustedBase(copy, commit, signal) {
+  const git = (args) => runGit(copy.repository, args, { capture: true, signal, failure: GIT_FAILED });
+  const house = new Set(
+    lines(await git(["rev-list", "--first-parent", "--parents", copy.received.commit])).flatMap((line) => {
+      const [received, , acknowledged] = line.split(" ");
+      return acknowledged === undefined ? [received] : [received, acknowledged];
+    }),
+  );
+  const base = lines(await git(["rev-list", "--topo-order", commit])).find((ancestor) => house.has(ancestor));
+  if (base !== undefined) return base;
+  throw new KitRefusal(
+    "kit_working_copy_base_unknown",
+    `${commit} contains no House state; merge or rebase onto ${WORKING_COPY_RECEIVED_REF}`,
+  );
+}
+
+function withMoves(copy, moves) {
+  const { moves: held, ...rest } = copy;
+  return moves.length === 0 ? rest : { ...rest, moves };
+}
+
+function carries(before, after, from, to) {
+  return before.has(from) && !after.has(from) && after.has(to) && !before.has(to);
+}
+
+function retainedMoves(chains, worktree, moves, touched) {
+  const kept = chains.flatMap((chain) => {
+    if (chain.at(-1).worktree !== worktree || !touched.has(chain.at(-1).path)) return [chain];
+    const committed = chain
+      .filter((position, at) => at === 0 || position.commits !== undefined)
+      .map(({ path, commits }) => (commits === undefined ? { path } : { path, commits }));
+    return committed.length > 1 ? [committed] : [];
+  });
+  return moves.reduce((held, { from, to }) => {
+    const extended =
+      held.find((chain) => chain.at(-1).path === from && [undefined, worktree].includes(chain.at(-1).worktree)) ?? [{ path: from }];
+    return [...held.filter((chain) => chain !== extended), [...extended, { path: to, worktree }]];
+  }, kept);
+}
+
+async function reachedFrom(repository, chains, commit, signal) {
+  const reached = new Set();
+  for (const candidate of new Set(chains.flat().flatMap((position) => position.commits ?? []))) {
+    if (await contains(repository, candidate, commit, signal)) reached.add(candidate);
+  }
+  return reached;
+}
+
+function reaches(position, reached) {
+  return (position.commits ?? []).some((commit) => reached.has(commit));
+}
+
+async function rewrittenMoves(repository, chains, worktree, [tip, next], { tying, touched }, signal) {
+  const held = await reachedFrom(repository, chains, tip, signal);
+  const kept = await reachedFrom(repository, chains, next, signal);
+  const left = (position) => reaches(position, held) && !reaches(position, kept);
+  if (!tying) {
+    return chains.map((chain) =>
+      touched.has(chain.at(-1).path) ? chain : chain.map((position) => (left(position) ? { ...position, worktree } : position)),
+    );
+  }
+  const starts = chains.map((chain) =>
+    chain.findLastIndex((position, at) => at === 0 || reaches(position, kept) || (position.worktree !== worktree && !left(position))),
+  );
+  if (chains.every((chain, index) => starts[index] === chain.length - 1)) return chains;
+  const base = await runGit(repository, ["merge-base", tip, next], { capture: true, signal, failure: GIT_FAILED }).then(lines, () => []);
+  const before = base.length === 0 ? new Map() : await treeOf(repository, base[0], signal);
+  const after = await treeOf(repository, next, signal);
+  return chains.map((chain, index) => {
+    const start = starts[index];
+    if (start === chain.length - 1 || !carries(before, after, chain[start].path, chain.at(-1).path)) return chain;
+    const tied = chain.slice(start + 1).map(({ path, commits = [] }) => ({ path, commits: [...commits, next] }));
+    return [...chain.slice(0, start + 1), ...tied];
+  });
+}
+
+function reachedPart(chain, reached) {
+  const at = chain.findIndex((position, index) => index > 0 && !reaches(position, reached));
+  return at < 0 ? chain : chain.slice(0, at);
+}
+
+function remainingMoves(chains, reached) {
+  return chains.flatMap((chain) => {
+    const [{ path }, ...rest] = chain.slice(reachedPart(chain, reached).length - 1);
+    return rest.length > 0 ? [[{ path }, ...rest]] : [];
+  });
+}
+
+function reportedMoves(moves) {
+  if (
+    !Array.isArray(moves) ||
+    moves.some((move) => typeof move?.from !== "string" || typeof move.to !== "string" || move.from === move.to)
+  ) {
+    throw new KitRefusal("kit_house_arguments_invalid", "moves");
+  }
+  return moves.map(({ from, to }) => ({ from, to }));
+}
+
+function reportedStrings(values, name) {
+  if (!Array.isArray(values) || values.some((value) => typeof value !== "string")) {
+    throw new KitRefusal("kit_house_arguments_invalid", name);
+  }
+  return values;
+}
+
+export async function recordIndexChange(context, request, signal) {
+  if (typeof request?.cwd !== "string") throw new KitRefusal("kit_house_arguments_invalid", "cwd");
+  const moves = reportedMoves(request.moves);
+  const touched = new Set([
+    ...reportedStrings(request.gone, "gone"),
+    ...reportedStrings(request.arrived, "arrived"),
+    ...moves.map((move) => move.to),
+  ]);
+  const commit = reportedStrings(request.commit, "commit");
+  const rewrite = commit.length === 2 && ["commit", "rebase", "reset"].includes(request.command);
+  const at = await located(request.cwd, signal);
+  const held = await heldAt(context.directory, at.repository);
+  if (held === null) return;
+  const path = copyPath(context.directory, held);
+  await exclusively(path, async () => {
+    const copy = await readCopy(path);
+    if (copy === null || (copy.moves === undefined && moves.length === 0)) return;
+    const retained = retainedMoves(copy.moves ?? [], at.worktree, moves, touched);
+    const kept = rewrite
+      ? await rewrittenMoves(copy.repository, retained, at.worktree, commit, { tying: request.command !== "reset", touched }, signal)
+      : retained;
+    await writeCopy(context.directory, withMoves(copy, kept), signal);
+  });
+}
+
+function renamed(chains, reached, before, after) {
+  const pairs = chains.flatMap((chain) => {
+    const paths = reachedPart(chain, reached).map(({ path }) => path);
+    const from = paths.findIndex((path) => before.has(path));
+    const to = paths.findLastIndex((path) => after.has(path));
+    return to > from && carries(before, after, paths[from], paths[to]) ? [[paths[from], paths[to]]] : [];
+  });
+  return new Map(pairs.filter(([from, to]) => pairs.filter((pair) => pair[0] === from || pair[1] === to).length === 1));
+}
+
+async function relocated(copy, root, [from, to], [prior, next], house, signal) {
+  const base = await revisionAt(copy, from, prior, house, signal);
+  const rename = { op: "rename", path: `${root}/${from}`, to: `${root}/${to}`, base };
+  if (prior.object === next.object) return [rename];
+  return [rename, { op: "replace", path: `${root}/${to}`, base, content: await blobText(copy.repository, next, to, signal) }];
+}
+
+async function derived(copy, base, commit, signal) {
+  const root = housePath(scopeOf(copy));
+  const before = await treeOf(copy.repository, base, signal);
+  const after = await treeOf(copy.repository, commit, signal);
+  const moved = renamed(copy.moves ?? [], await reachedFrom(copy.repository, copy.moves ?? [], commit, signal), before, after);
+  const arrived = new Set(moved.values());
+  const changes = [];
+  for (const path of [...new Set([...before.keys(), ...after.keys()])].sort()) {
+    if (arrived.has(path)) continue;
+    const prior = before.get(path);
+    if (moved.has(path)) {
+      const to = moved.get(path);
+      changes.push(...(await relocated(copy, root, [path, to], [prior, after.get(to)], base, signal)));
+      continue;
+    }
+    const next = after.get(path);
+    if (prior?.object === next?.object) continue;
+    const target = `${root}/${path}`;
+    const revision = await revisionAt(copy, path, prior, base, signal);
+    if (next === undefined) {
+      changes.push({ op: "remove", path: target, base: revision });
+      continue;
+    }
+    const content = await blobText(copy.repository, next, path, signal);
+    if (prior === undefined) {
+      changes.push({ op: "create", path: target, content });
+      continue;
+    }
+    const recorded = { content: await blobText(copy.repository, prior, path, signal), revision };
+    changes.push(...structuredOrReplace(root, path, recorded, content));
+  }
+  return changes;
+}
+
+async function revisionText(session, { path, revision }, signal) {
+  const page = await door(session, KIT_DOOR_REVISIONS_PATH, { path, revision }, signal);
+  const content = page?.revisions?.find((entry) => entry?.revision === revision)?.content;
+  if (typeof content !== "string") throw new KitRefusal("kit_working_copy_result_unreadable", `${path} at ${revision}`);
+  return content;
+}
+
+async function materials(context, copy, entries, signal) {
+  const root = housePath(scopeOf(copy));
+  const files = [];
+  for (const entry of entries) {
+    const content = entry.content === undefined ? await revisionText(context.session, entry, signal) : entry.content;
+    files.push({ path: entry.path.slice(root.length + 1), revision: entry.revision, content });
+  }
+  return files;
+}
+
+async function recorded(copy, files, message, acknowledging, signal) {
+  const imported = await importReceived(
+    copy.repository,
+    { message, parents: [copy.received.commit], files, acknowledging },
+    signal,
+  );
+  return {
+    copy: {
+      ...copy,
+      received: { ...copy.received, commit: imported.received, ...(acknowledging === null ? {} : copy.push.from) },
+      revisions: await remembered(
+        copy.repository,
+        copy.revisions,
+        imported.acknowledged ?? imported.received,
+        files,
+        signal,
+        imported.acknowledged !== null,
+      ),
+    },
+    acknowledged: imported.acknowledged,
+  };
+}
+
+function pushedPaths(changes) {
+  return new Set(changes.flatMap((change) => (change.op === "rename" ? [change.path, change.to] : [change.path])));
+}
+
+export function uploadedPaths(changes) {
+  return [...pushedPaths(changes)].sort();
+}
+
+function unreadableChanges(changes) {
+  return changes.some(
+    (change) =>
+      typeof change?.path !== "string" ||
+      (change.removed !== true && (typeof change.content !== "string" || typeof change.revision !== "string")),
+  );
+}
+
+async function enumerated(context, copy, since, signal) {
+  const answer = await door(
+    context.session,
+    KIT_DOOR_ENUMERATE_PATH,
+    { prefixes: selectedPrefixes(scopeOf(copy)), positions: [{ authority: copy.room_ref, ...since }] },
+    signal,
+  );
+  const view = answer?.authorities?.find((entry) => entry?.authority === copy.room_ref);
+  if (
+    !Array.isArray(view?.changes) ||
+    typeof view.position !== "string" ||
+    typeof view.log_epoch !== "string" ||
+    unreadableChanges(view.changes)
+  ) {
+    throw rejected("enumerate");
+  }
+  return view;
+}
+
+async function referrers(context, copy, selected, signal) {
+  const { push } = copy;
+  const root = housePath(scopeOf(copy));
+  const destinations = push.changes.filter((change) => change.op === "rename").map((change) => change.to);
+  if (destinations.length === 0) return [];
+  const changed = new Map();
+  let since = push.since;
+  while (!destinations.every((path) => changed.has(path))) {
+    const view = await enumerated(context, copy, since, signal);
+    for (const change of view.changes) changed.set(`${root}/${change.path}`, change);
+    if (view.position === since.position) {
+      throw new KitRefusal("kit_working_copy_result_unreadable", destinations.filter((path) => !changed.has(path)).join(", "));
+    }
+    since = { position: view.position, log_epoch: view.log_epoch };
+  }
+  const pushed = pushedPaths(push.changes);
+  return [...changed.entries()]
+    .filter(([path, change]) => !pushed.has(path) && selected.has(change.path))
+    .map(([path, change]) =>
+      change.removed === true
+        ? { path, revision: null, content: null }
+        : { path, revision: change.revision, content: change.content },
+    );
+}
+
+async function housePosition(context, copy, signal) {
+  const discovery = discoveryOf(
+    await door(context.session, KIT_DOOR_DISCOVER_PATH, { prefixes: selectedPrefixes(scopeOf(copy)) }, signal),
+  );
+  const authority = discovery.authorities.find((entry) => entry?.room_ref === copy.room_ref);
+  if (typeof authority?.position !== "string" || typeof authority.log_epoch !== "string") throw rejected("discover");
+  return { position: authority.position, log_epoch: authority.log_epoch };
+}
+
+function short(commit) {
+  return commit.slice(0, 12);
+}
+
+async function acknowledge(context, copy, signal) {
+  const { push } = copy;
+  const selected = await treeOf(copy.repository, push.commit, signal);
+  const files = await materials(context, copy, [...push.written, ...(await referrers(context, copy, selected, signal))], signal);
+  const edits = [];
+  for (const file of files) {
+    if ((await blobText(copy.repository, selected.get(file.path), file.path, signal)) !== file.content) edits.push(file);
+  }
+  const { copy: next, acknowledged } = await recorded(
+    copy,
+    files,
+    `House ${housePath(scopeOf(copy))} with ${push.commit} accepted`,
+    { commit: push.commit, edits },
+    signal,
+  );
+  const remaining = remainingMoves(copy.moves ?? [], await reachedFrom(copy.repository, copy.moves ?? [], push.commit, signal));
+  return { ...withMoves(next, remaining), push: { ...push, acknowledged } };
+}
+
+async function integrated(copy, signal) {
+  const { commit, acknowledged, worktree, branch } = copy.push;
+  const accepted = `House accepted ${short(commit)}`;
+  if (acknowledged === commit) return { done: true, text: `${accepted}.` };
+  const pending = (reason) => ({
+    done: false,
+    text: `${accepted}; local integration is pending (${reason}): ${acknowledged} holds House's result.`,
+  });
+  const git = (args) => runGit(worktree, args, { capture: true, signal, failure: GIT_FAILED });
+  const head = await git(["symbolic-ref", "-q", "HEAD"]).then(
+    (output) => lines(output)[0],
+    () => null,
+  );
+  if (branch === null || head !== branch) return pending("the branch changed");
+  const tip = lines(await git(["rev-parse", "HEAD"]))[0];
+  const name = branch.replace(/^refs\/heads\//, "");
+  if (await contains(worktree, acknowledged, tip, signal)) return { done: true, text: `${accepted}; ${name} holds it.` };
+  if (!(await contains(worktree, commit, tip, signal))) return pending("the branch changed");
+  if (lines(await git(["status", "--porcelain", "--untracked-files=no"])).length > 0) {
+    return pending("uncommitted changes");
+  }
+  if (tip === commit) {
+    if (!(await succeeded(git(["merge", "--ff-only", "-q", acknowledged])))) return pending("a conflict");
+  } else if (
+    !(await succeeded(
+      git(["-c", `user.name=${COMMITTER_NAME}`, "-c", `user.email=${COMMITTER_EMAIL}`, "rebase", "-q", "--onto", acknowledged, commit]),
+    ))
+  ) {
+    await git(["rebase", "--abort"]).catch(() => undefined);
+    return pending("a conflict");
+  }
+  const current = lines(await git(["rev-parse", "HEAD"]))[0];
+  const moves = await rewrittenMoves(copy.repository, copy.moves ?? [], worktree, [tip, current], { tying: true }, signal);
+  return { done: true, text: `${accepted}; ${name} is at ${short(current)}.`, moves };
+}
+
+async function finish(context, copy, signal) {
+  try {
+    let acknowledged = copy;
+    if (copy.push.acknowledged === undefined) {
+      acknowledged = await acknowledge(context, copy, signal);
+      await writeCopy(context.directory, acknowledged, signal);
+    }
+    const outcome = await integrated(acknowledged, signal);
+    const moves = outcome.moves ?? acknowledged.moves ?? [];
+    if (outcome.done) await writeCopy(context.directory, without(withMoves(acknowledged, moves)), signal);
+    return { refused: false, text: outcome.text };
+  } catch (error) {
+    return {
+      refused: false,
+      text: `House accepted ${short(copy.push.commit)}; local integration is pending (${formatCommandError(error)}); run house git push again to finish it.`,
+    };
+  }
+}
+
+function sameCaller(left, right) {
+  return left.session === right.session && left.owner === right.owner;
+}
+
+function definite(error) {
+  return (
+    error instanceof KitRefusal &&
+    error.code !== "kit_command_cancelled" &&
+    !houseFailed(error) &&
+    !(error.status >= 500)
+  );
+}
+
+async function orphaned(context, copy, signal) {
+  const held = copy.push.caller.session;
+  const live = (binding) => binding.session === held && binding.stopped === null && binding.reported === null;
+  if (held === undefined || (await readBindings(context.directory)).some(live)) {
+    throw new KitRefusal("kit_working_copy_push_pending", "another caller's push awaits its recovery");
+  }
+  await writeCopy(context.directory, await receive(context, without(copy), scopeOf(copy), signal), signal);
+  throw new KitRefusal(
+    "kit_working_copy_push_unrecoverable",
+    `the Session that pushed ended before its outcome arrived; ${WORKING_COPY_RECEIVED_REF} holds House's current state`,
+  );
+}
+
+async function expired(context, copy, text, signal) {
+  const { push } = copy;
+  const root = housePath(scopeOf(copy));
+  const confirmed = await receive(context, without(copy), scopeOf(copy), signal);
+  const house = await treeOf(copy.repository, confirmed.received.commit, signal);
+  const selected = await treeOf(copy.repository, push.commit, signal);
+  const paths = [...pushedPaths(push.changes)].map((path) => path.slice(root.length + 1));
+  if (paths.some((path) => house.get(path)?.object !== selected.get(path)?.object)) {
+    await writeCopy(context.directory, confirmed, signal);
+    return {
+      refused: true,
+      text: `${text}\nHouse does not hold ${short(push.commit)}; run house git push again to submit it as a new operation.`,
+    };
+  }
+  const written = [];
+  for (const path of paths) {
+    const entry = house.get(path);
+    written.push({
+      path: `${root}/${path}`,
+      revision: entry === undefined ? null : await revisionAt(confirmed, path, entry, confirmed.received.commit, signal),
+      content: await blobText(copy.repository, entry, path, signal),
+    });
+  }
+  const from = { position: confirmed.received.position, log_epoch: confirmed.received.log_epoch };
+  const accepted = { ...confirmed, push: { ...push, state: "accepted", written, from } };
+  await writeCopy(context.directory, accepted, signal);
+  return finish(context, accepted, signal);
+}
+
+async function settle(context, copy, caller, signal, restaged = false) {
+  const { push } = copy;
+  if (!sameCaller(push.caller, caller.binding)) return orphaned(context, copy, signal);
+  let staged = push.upload !== undefined;
+  const retain = async (upload) => {
+    staged = true;
+    await writeCopy(context.directory, { ...copy, push: { ...push, upload } }, signal);
+  };
+  let answer;
+  try {
+    const { operation_id, changes, upload } = push;
+    answer = await caller.submit({ operation_id, changes, ...(upload === undefined ? {} : { upload }) }, signal, retain);
+  } catch (error) {
+    if (!definite(error)) {
+      throw new KitRefusal("kit_working_copy_push_uncertain", "run house git push again to recover its outcome");
+    }
+    const current = error.payload?.error?.current;
+    answer = { refused: { code: error.code, text: formatCommandError(error), current: Array.isArray(current) ? current : null } };
+  }
+  const { refused } = answer;
+  if (refused?.code === "upload_unavailable" && staged && !restaged) {
+    const { upload, ...unstaged } = push;
+    const cleared = { ...copy, push: unstaged };
+    await writeCopy(context.directory, cleared, signal);
+    return settle(context, cleared, caller, signal, true);
+  }
+  if (refused?.code === "operation_expired") return expired(context, copy, refused.text, signal);
+  if (refused === null) {
+    const pushed = pushedPaths(push.changes);
+    const written = answer.written.filter((entry) => pushed.has(entry.path));
+    const accepted = { ...copy, push: { ...push, state: "accepted", written } };
+    await writeCopy(context.directory, accepted, signal);
+    return finish(context, accepted, signal);
+  }
+  const settled = without(copy);
+  await writeCopy(context.directory, settled, signal);
+  if (refused.current === null) return { refused: true, text: refused.text };
+  try {
+    const files = await materials(context, settled, refused.current, signal);
+    const message = `House ${housePath(scopeOf(settled))} current where ${short(push.commit)} was refused`;
+    await writeCopy(context.directory, (await recorded(settled, files, message, null, signal)).copy, signal);
+    return { refused: true, text: refused.text };
+  } catch (error) {
+    return { refused: true, text: `${refused.text}\n${WORKING_COPY_RECEIVED_REF} is unchanged: ${formatCommandError(error)}` };
+  }
+}
+
+async function pushed(context, path, at, selector, caller, signal) {
+  let copy = await readCopy(path);
+  if (copy.push?.state === "submitted") return settle(context, copy, caller, signal);
+  const commit = (
+    await runGit(at.worktree, ["rev-parse", "--verify", "--quiet", "--end-of-options", `${selector}^{commit}`], {
+      capture: true,
+      signal,
+      failure: "kit_working_copy_commit_unknown",
+    })
+  )
+    .toString("utf8")
+    .trim();
+  if (copy.push !== undefined) {
+    const held = copy.push.acknowledged;
+    if (held === undefined || !(await contains(copy.repository, held, commit, signal))) {
+      return finish(context, copy, signal);
+    }
+    copy = without(copy);
+    await writeCopy(context.directory, copy, signal);
+  }
+  if (!copy.active) throw new KitRefusal("kit_working_copy_inactive", housePath(scopeOf(copy)));
+  const changes = await derived(copy, await trustedBase(copy, commit, signal), commit, signal);
+  if (changes.length === 0) return { refused: false, text: `Nothing to submit: ${short(commit)} matches House.` };
+  const branch = await runGit(at.worktree, ["symbolic-ref", "-q", "HEAD"], { capture: true, signal, failure: GIT_FAILED })
+    .then((output) => lines(output)[0], () => null);
+  const since = changes.some((change) => change.op === "rename") ? await housePosition(context, copy, signal) : null;
+  const submitted = {
+    ...copy,
+    push: {
+      state: "submitted",
+      caller: caller.binding,
+      operation_id: operationId(),
+      changes,
+      commit,
+      from: { position: copy.received.position, log_epoch: copy.received.log_epoch },
+      worktree: at.worktree,
+      branch,
+      ...(since === null ? {} : { since }),
+    },
+  };
+  await writeCopy(context.directory, submitted, signal);
+  return settle(context, submitted, caller, signal);
+}
+
+export async function pushWorkingCopy(context, request, caller, signal) {
+  if (typeof request?.cwd !== "string" || typeof request.commit !== "string") {
+    throw new KitRefusal("kit_house_arguments_invalid", "cwd and commit");
+  }
+  const at = await located(request.cwd, signal);
+  const path = copyPath(context.directory, await copyAt(context.directory, at.repository));
+  return exclusively(path, () => pushed(context, path, at, request.commit, caller, signal));
+}
+
+export function ownerCaller(session) {
+  return {
+    binding: { owner: true },
+    async submit(body, signal) {
+      return { refused: null, written: (await door(session, KIT_DOOR_BATCH_PATH, body, signal)).contents };
+    },
+  };
+}
+
+export function ownerPush(options, request, dependencies = {}) {
+  return withSession(options, dependencies, (session, signal) =>
+    session.resident === undefined
+      ? pushWorkingCopy({ directory: options.directory, session }, request, ownerCaller(session), signal)
+      : session.push(request, signal),
+  );
+}