@amalgm/live 0.2.81-main.39107155915 → 0.2.81-main.39176188543

package/PURPOSE.md

@@ -230,12 +230,14 @@ or certify a new wire contract, cloud migration or cross-machine rollout.
     on that machine, while cloud reconciliation preserves every unmaterialized
     boundary. A fresh verified install may be Watch's initial baseline so the
     downloader's own writes are not reinterpreted as user edits.
-21. **A Git marker classifies its containing directory.** The presence of a
-    `.git` directory or file makes its containing directory `repo.git`; its
-    removal returns that same UUID to `workspace` or `folder`. Git command
-    availability governs Card + Checkpoint capture, never classification, and
-    `.git` itself is repository transport metadata that receives no entity
-    row. Each such directory starts a repository rail: ordinary worktree
+21. **A Git marker classifies its containing directory.** A `.git`
+    directory or file that Git can use, by Git's own structural test, makes
+    its containing directory `repo.git`; its removal, or a break Git itself
+    would refuse, returns that same UUID to `workspace` or `folder`, whose
+    children then travel as ordinary entities. Git command availability
+    governs Card + Checkpoint capture, never classification, and `.git`
+    itself, usable or not, is Git's metadata that receives no entity row.
+    Each repository directory starts a repository rail: ordinary worktree
     children retain local UUID rows and ride in their nearest repository state
     manifest, while a nested repository and the ancestry spine that reaches it
     remain cloud graph records with their own Card + Checkpoint transport. The
@@ -245,10 +247,16 @@ or certify a new wire contract, cloud migration or cross-machine rollout.
     never invents history beyond it. Every current graph a reader derives
     from a published snapshot and its later delivery tail passes through this
     same projection, and Add refuses a lookup that hands it a record the
-    projection would not publish before it moves any bytes. Leaving repository
-    territory first publishes every newly independent descendant while the
-    repository boundary still hides them, then publishes the boundary retype
-    alone; no authority prefix can expose a partial ordinary-file tree.
+    projection would not publish before it moves any bytes. Records follow
+    cause before effect: every accepted prefix must be reconstructible from
+    its accepted records and retained packages, without waiting for a later
+    record. Leaving repository territory publishes the boundary retype first,
+    then each newly independent descendant, whose retained latest statement
+    supplies its contents until its own record arrives; a repository that
+    stays a repository publishes after every record beneath it that crosses
+    its boundary. Every deletion is stated by the capture: by an ancestor's
+    Trash that still covers the entity, else by the new package of the live
+    repository that held it, else by the entity's own Trash record.
 22. **Transfer moves content; it never discovers state.** `upload` moves one
     already-registered immutable artifact toward cloud storage and `download`
     moves that same artifact toward a machine cache. Neither operation scans,
@@ -374,14 +382,14 @@ or certify a new wire contract, cloud migration or cross-machine rollout.
     costs its Card + Checkpoint scope. Only honestly ambiguous evidence enters
    complete reconciliation. Detect ends after the exact proposal and local
    truth are committed together; cloud publication belongs to Send.
-35. **The entity UUID is the ordered channel.** Cloud assigns a dense sequence
-   independently to each entity UUID across all machines. Unrelated entities
-   have no semantic order and may be sent concurrently; workspace or delivery
-   cursors may discover records but never decide which entity state wins. The
-   one graph-visibility barrier is not semantic ordering: any retype into a
-   container is sent alone after earlier descendant records are accepted,
-   because it may expose repository-owned ground; every observable prefix
-   therefore remains a complete graph.
+35. **The entity UUID is the ordered channel; each computer sends one line.**
+   Cloud assigns a dense sequence independently to each entity UUID across all
+   machines. Within each authority, a computer's records are accepted in its
+   local record order, so what others observe of that computer's work is always
+   a prefix of what it recorded: a retype that exposes repository-owned ground
+   follows the records written before it, and every observable prefix remains a
+   complete graph. That line orders delivery, not truth: neither it nor a
+   workspace or delivery cursor decides which entity state wins.
 36. **Receive owns the local inbox.** Every cloud-accepted record, including
    one originating on this computer, enters the inbox under
    `(entityId, globalSequence)`. Each entity has its own received-through
@@ -412,26 +420,28 @@ or certify a new wire contract, cloud migration or cross-machine rollout.
    after a final conflict-scoped guard, recoverable reveal, and the target type
    rereading exact truth. Lock and cargo attempts are finite and observable;
    their failure retains responsibility for retry rather than waiting forever.
-   A failed lane records its outcome and arms its bounded backoff when that
-   lane finishes, never when its work page or the wider drain finishes. Once
-   the deadline elapses, retry and fresh ordinary work share bounded fair
-   admission across every storage-page partition, so neither repeated failure
-   nor unrelated progress can starve the other. Retry eligibility is re-read
-   from current durable responsibility before admission; an omitted UUID
-   retires its process-local park instead of reviving stale page work. Newer input for its
-   entity may also release it, and a materialization dependency or conflict
-   may additionally be released only by another lane's progress; a wake it caused
-   itself can never re-run it. Parent and child UUIDs remain independent channels, but their
-   physical materialization respects current parcel ownership: a child whose
-   accepted parent is not yet a physical directory, or whose current ancestry
-   still places it inside a repository parcel it is leaving, waits unresolved
-   as a dependency without capture, error, or a filesystem effect. The
-   boundary retype releases that child; nested repositories and their visible
-   folder spine remain independent parcel boundaries. An accepted
-   destination already recorded as a different entity is a conflict, never a
-   local change to capture. The park timer and attempt count are process-local:
-   after restart, the durable intent is re-proved once and, if still blocked,
-   parks again from attempt one.
+   Each authority's accepted records apply in one line, in delivery order:
+   recovery work first, then the first unresolved materializable row, whose
+   target extends only over the adjacent content run of that same file or
+   link. A head with no intent and newer local work on its entity resolves at
+   once as superseded. A failed head keeps its durable intent, records its
+   outcome, and parks its whole line with bounded backoff while other
+   authorities' lines go on; waiting holds the queue position, never the
+   ground. The parked line runs again when its backoff elapses, its head
+   changes, newer local work appears for the head's entity, the producer its
+   dependency names releases it, or, for a conflict, another authority's line
+   progresses; a wake it caused itself can never re-run it. Parent and child
+   UUIDs remain independent channels. A result plays by what this computer
+   shows: one shown neither before nor after resolves in order with no
+   effect, so a child never waits for a parent this computer does not show.
+   Every file belongs to its nearest repository: a repository result acts
+   only on its territory, never on a nested repository's subtree or on ground
+   another rail owns here where its map disagrees, so it never waits on a
+   boundary. An accepted destination already recorded as
+   a different entity is a conflict, never a local change to capture. The park
+   timer and attempt count are process-local: after restart, the durable
+   intent is re-proved once and, if still blocked, parks again from attempt
+   one.
    A host proves current physical repository ground from Card + Checkpoint and
    the exact identity frontier sealed to that immutable transport. Compact
    machine evidence is accepted only when it reproduces the transport's
@@ -451,13 +461,16 @@ or certify a new wire contract, cloud migration or cross-machine rollout.
    retained immutable payload through the target type's adapter; a link is
    restored as literal link target text and only an ordinary file is restored
    through the ordinary-file adapter.
-   A missing active target below a still-present materialized root first
-   passes through one finite Detect boundary. Before reveal, a proven move or
-   settled local deletion becomes durable Trash work and supersedes the older Apply.
-   After reveal begins, the boundary may still preserve a concurrent move or
-   save, but Apply's own intermediate absence cannot authorize lifecycle; no
-   durable local result authorizes idempotent repair from the accepted result.
-   Only exact Verify may complete the intent. A missing materialization root
+   While an intent is unbound, a missing active target below a still-present
+   materialized root first passes through one finite Detect boundary. Before
+   reveal, a proven move or settled local deletion becomes durable Trash work
+   and supersedes the older Apply. An unbound intent whose target already
+   stood re-enters that boundary if the target later disappears; Apply's own
+   absence cannot authorize lifecycle, and when no durable local result
+   follows, idempotent repair reveals the accepted result, binding first.
+   Once bound, absence is read only through the receipt: a prefix of the
+   reveal resumes and anything else is a person's. Only exact Verify may
+   complete the intent. A missing materialization root
    remains a separate root-recovery responsibility; entity Apply never
    recreates it piecemeal.
    Text uses an exact-base splice with a complete snapshot fallback;
@@ -471,8 +484,9 @@ or certify a new wire contract, cloud migration or cross-machine rollout.
    target, protects that entity's working ground. The local complete result is
    still accepted normally and wins only when cloud assigns its later
    sequence; Apply never rebases, merges, stale-refuses, or rewrites it. A
-   reveal-time disk difference enters Detect and Record before incoming work
-   may touch the path.
+   disk difference found before reveal enters Detect and Record before
+   incoming work may touch the path; one found by an owned intent's receipt
+   read is returned home and left to Detect.
 41. **Verify, not a write syscall, commits Apply.** Applied Watch rings are
    retained. Only exact type-specific reread may advance resolved and
    materialized cursors, update the local notebook, mark Inbox history
@@ -485,12 +499,15 @@ or certify a new wire contract, cloud migration or cross-machine rollout.
    require old cargo, adopt a changed private survivor, or overwrite later
    observations. A phase alone does not prove whether physical effects exist:
    adopting an exact target may reach `revealed` without changing disk. Only
-   a bound receipt proves effect ownership. Recovery may cancel an obsolete
-   plan after accounting for every original effect and conditionally repairing
-   its intermediate physical addresses. Cancellation preserves sharing values
-   and leaves Inbox and materialization progress unresolved; a fresh intent
-   replans only after the old owner's cleanup. An unexplained effect keeps its
-   responsibility. Exact target Verify is still required to claim installation. For a
+   a bound receipt proves effect ownership. Shown bytes are attributed, never
+   guessed: Apply may drop private work for the newest record, but once it
+   binds recovery before its first visible effect it owns that ground until
+   it has read it once through the receipt. Its own complete result is
+   verified and projected in the commit that ends ownership; a prefix of its
+   own reveal resumes; anything else is the person's, returns to its home,
+   and is left to Detect. Cancellation preserves sharing values and resolves
+   nothing. The newest record then wins, never by releasing unread ground.
+   Exact target Verify is still required to claim installation. For a
    repository, Verify commits Card, Checkpoint, and the complete transported
    identity frontier as one notebook fact. The Watch observation caused by
    that reveal must compare equal to that same fact; it can never become a new
@@ -550,13 +567,15 @@ or certify a new wire contract, cloud migration or cross-machine rollout.
 48. **A slot collision changes materialization, never identity.** Mutation-time
     guards refuse a second local owner of one `(parentUUID, name)` slot, but a
     merged graph may contain identities created concurrently in that slot.
-    Every observer preserves every UUID and derives the same disk names from
-    the complete active sibling set: the lexicographically lowest UUID keeps
-    the bare name and later UUIDs take the next free Windows-style ` (n)`
-    suffix before a file-like extension. UUID order is a deterministic
-    machine-independent tiebreak, chronological only when the UUIDs are v7.
-    A derived name is never a mutation, version input, or portable rename;
-    whenever the sibling set changes, materialization is re-derived.
+    A Restore into an occupied name does the same. Every observer preserves
+    every UUID and derives the same disk names from the complete active
+    sibling set: the identity that arrived in the slot last, by the cloud's
+    acceptance order, takes the next free Windows-style ` (n)` suffix before a
+    file-like extension, and the earlier one keeps the bare name. Apply still
+    derives that order from lexicographic UUIDs; latest-arrival ordering is
+    unfinished there. A derived name is never a mutation, version input, or
+    portable rename; whenever the sibling set changes, materialization is
+    re-derived.
 49. **The executable bit is ordinary-file truth.** A text or binary file
     carries exactly one portable mode, `0644` or `0755`, and that mode is part
     of its canonical version. Detect records a mode-only change without
@@ -582,14 +601,18 @@ or certify a new wire contract, cloud migration or cross-machine rollout.
 ## Apply attribution boundary
 
 Detect describes observed user ground. A bound, nonterminal Apply recovery receipt
-owns only its original effect participants and address cones; a phase alone owns
-nothing. Detect defers dependent attribution and retains the Watch responsibility,
-while independent observations may commit. Ownership is rechecked at Record
-admission, including an originally empty answer. Terminal commit releases that
-ownership before private cleanup and wakes its original scopes. A capture blocked
-by its own receipt requests coherent cancellation; only proof of the original
-effects authorizes cancellation, and cancellation never resolves Inbox or advances
-verified state. Fresh intents have fresh host-minted attempt identities, even when
+owns only its original effect participants and address cones; a phase alone
+defers no Detect attribution, because an unbound revealed intent changed nothing
+on disk (it still Verifies before newer work). Detect defers dependent
+attribution and retains the Watch responsibility, while independent
+observations may commit. Ownership is rechecked at Record admission, including
+an originally empty answer. Terminal commit releases that ownership before
+private cleanup and wakes its original scopes. A bound intent never captures,
+so no capture is blocked by its own receipt: it ends only through its receipt
+read, and only that read's proof of a person's change authorizes cancelling
+it. Cancellation never resolves Inbox or advances verified state.
+Detect's self-blocked capture answer (`replan`) is therefore unreachable and
+awaits removal by its owner. Fresh intents have fresh host-minted attempt identities, even when
 the target and wall clock are identical, and run fresh preflight before new effects.
 Apply uses the same foreign-ownership rule at admission and terminal preparation;
 a dependent cancellation waits without resolving history or discarding evidence.

package/dist/apply/contracts.d.ts

@@ -5,7 +5,8 @@ import type { ChangeFacet, TextSplice } from '../detection/record-proposal.js';
 import type { AcceptedEntityRecord } from '../records/contracts.js';
 import type { ContentManifest } from '../contracts/content.js';
 import type { TransferArtifact } from '../transfer/artifacts.js';
-export declare const ENTITY_APPLY_INTENT_CONTRACT = "amalgm.entity-apply-intent@2";
+import { type ApplyPlay } from './showing.js';
+export declare const ENTITY_APPLY_INTENT_CONTRACT = "amalgm.entity-apply-intent@3";
 export type ApplyIntentPhase = 'declared' | 'prepared' | 'revealed';
 /** One crash-recovery responsibility. It is written before any machine effect. */
 export interface EntityApplyIntent {
@@ -19,6 +20,9 @@ export interface EntityApplyIntent {
     readonly targetMutationId: string;
     readonly targetState: string;
     readonly targetType: EntityType;
+    /** The play judged when the intent began. Recovery finishes it; it is
+     * never judged again while the intent stays open. */
+    readonly play: ApplyPlay;
     readonly phase: ApplyIntentPhase;
     readonly createdAt: number;
 }
@@ -27,23 +31,52 @@ export interface MaterializedOfficialState {
     readonly globalSequence: number;
     readonly record: CloudEntityRecord;
 }
-/** One entity's contiguous unresolved Inbox range. */
+/**
+ * The work at the head of one authority's line: one entity's unresolved
+ * Inbox records from its resolved position. Without an intent they run
+ * through the end of the entity's adjacent run in the line, the records no
+ * other unresolved record separates; with one, through the intent's target.
+ */
 export interface EntityApplyWork {
     readonly authorityId: string;
     readonly entityId: string;
+    /** The head's play: its open intent's, or judged at its position. */
+    readonly play: ApplyPlay;
     readonly resolvedThrough: number;
     readonly materialized: MaterializedOfficialState | null;
     readonly records: readonly AcceptedEntityRecord[];
     readonly intent: EntityApplyIntent | null;
+    /** True once the host durably bound this intent's recovery receipt. The host
+     * binds before any visible effect; from then the intent owns its ground
+     * until retirement and is never cancelled, even by newer local work. */
+    readonly effectsBound: boolean;
     /** A terminal decision owns cleanup even with no remaining Inbox or ground. */
     readonly retirement?: EntityApplyRetirement;
 }
-/** One stable page of unresolved entities. The cursor is opaque to Live. */
-export interface EntityApplyWorkPage {
-    readonly work: readonly EntityApplyWork[];
-    readonly nextCursor: string | null;
+/**
+ * The head of an authority's line. An open intent or retirement heads it.
+ * Otherwise the head is the first unresolved Inbox row in delivery order,
+ * judged at its position (settling.ts): a play is a head whose work is that
+ * entity's adjacent run; a settlement owes no effect and resolves where it
+ * sits. Nothing is ever read past: a later row plays only after every
+ * earlier row resolved.
+ */
+export type EntityApplyLineStep = {
+    readonly kind: 'head';
+    readonly work: EntityApplyWork;
+} | {
+    readonly kind: 'settle';
+    readonly entityId: string;
+    readonly deliverySequence: number;
 }
+/** No unresolved row is readable whole: the received prefix is resolved,
+ * or the first unresolved row waits for Receive to repair its entity's
+ * gap. Receive's commit wakes the line. */
+ | {
+    readonly kind: 'end';
+};
 interface ApplyPlanBase {
+    readonly play: ApplyPlay;
     readonly entityId: string;
     readonly fromSequence: number;
     readonly throughSequence: number;
@@ -98,9 +131,11 @@ export interface RepositoryApplyPlan extends ApplyPlanBase {
     readonly parentTransportVersion: string | null;
     readonly transportVersion: string;
 }
-export interface LifecycleApplyPlan extends ApplyPlanBase {
-    readonly kind: 'lifecycle';
-    readonly status: 'trashed' | 'deleted';
+/** The result stops showing here: trashed, deleted, moved under ground this
+ * computer does not show, or below a place that is no longer a shown
+ * container. Its subtree leaves this disk recoverably; nothing is fetched. */
+export interface LeaveApplyPlan extends ApplyPlanBase {
+    readonly kind: 'leave';
 }
 /** A construct payload stages exactly like a binary file. The product's
  * adapter reports `dependency` from guard while a UUID the payload names is
@@ -110,7 +145,7 @@ export interface ConstructApplyPlan extends ApplyPlanBase {
     readonly artifact: TransferArtifact;
     readonly manifest: ContentManifest;
 }
-export type EntityApplyPlan = TextApplyPlan | BinaryApplyPlan | LinkApplyPlan | StructureApplyPlan | ReferenceApplyPlan | RepositoryApplyPlan | LifecycleApplyPlan | ConstructApplyPlan;
+export type EntityApplyPlan = TextApplyPlan | BinaryApplyPlan | LinkApplyPlan | StructureApplyPlan | ReferenceApplyPlan | RepositoryApplyPlan | LeaveApplyPlan | ConstructApplyPlan;
 /** A concrete prerequisite and the component that can change it. `send`
  * names local results still waiting for their authority sequence. */
 export interface ApplyDependency {
@@ -118,11 +153,11 @@ export interface ApplyDependency {
     readonly entityIds: readonly string[];
 }
 /** A wait a person can see and resolve. It stays a dependency, never a
- * fault: the lane wakes on its producer's progress, not on backoff. A blocker
+ * fault: the line wakes on its producer's progress, not on backoff. A blocker
  * always names what releases it, so the current status can always show it. */
 export interface ApplyBlocker {
     readonly code: 'local-ground-would-be-displaced';
-    readonly effect: 'trash' | 'replace-container' | 'repository-reveal';
+    readonly effect: 'leave' | 'replace-container' | 'repository-reveal';
 }
 /** A named prerequisite that another component's progress can change. */
 export interface ApplyDependencyOutcome {
@@ -131,6 +166,25 @@ export interface ApplyDependencyOutcome {
     readonly waitFor?: ApplyDependency;
     readonly blocker?: ApplyBlocker;
 }
+/**
+ * Unbound only: under the ground lock, the play this head was judged at no
+ * longer holds, for example its place stopped showing or its workspace root
+ * is missing here. The host first makes durable the table fact the store
+ * judges by, such as the root being behind, so the next judgment sees it.
+ * The private intent retires cancelled and the line judges its head again.
+ */
+export interface ApplyRejudge {
+    readonly kind: 'rejudge';
+    readonly reason: string;
+}
+/** The reveal found a person's version in the target's place before binding
+ * anything. Nothing of this intent is shown; it cancels, and Detect records
+ * the person's version. */
+export interface ApplyDeclinedReveal {
+    readonly kind: 'declined';
+    readonly reason: string;
+}
+/** The named prerequisite a held line waits for. */
 export interface ApplyWait {
     readonly entityId: string;
     readonly reason: string;
@@ -138,21 +192,23 @@ export interface ApplyWait {
     readonly throughSequence: number;
     readonly blocker?: ApplyBlocker;
 }
-export type ApplyGuard = {
+export type ApplyGuard = 
+/** The effect may run. For a bound intent: the ground is a prefix of this
+ * intent's own reveal order, so the reveal resumes. */
+{
     readonly kind: 'safe';
-} | {
-    readonly kind: 'already-target';
 }
-/** The original receipt can reach a safe cancellation, but no longer
- * authorizes the current effect plan. Keep Inbox unresolved and replan only
- * after that cancellation and its cleanup commit. */
+/** Ground already holds the target. For a bound intent: the host recognized
+ * this intent's own complete effect from its recovery receipt. */
  | {
-    readonly kind: 'replan';
-    readonly reason: string;
+    readonly kind: 'already-target';
 }
 /** Ground differs from the last observation at this entity's own address,
  * or unrecorded ground holds the destination. Detect + Record can give that
- * ground identity, so the rail captures it before deciding anything. */
+ * ground identity, so the rail captures it before deciding anything. For a
+ * bound intent the ground is neither its own effect nor a prefix of it: it
+ * is a person's, and the rail cancels without capture so Detect records it
+ * once ownership ends. */
  | {
     readonly kind: 'local-change';
     readonly reason?: string;
@@ -162,43 +218,59 @@ export type ApplyGuard = {
  * removal becomes durable Trash work. After reveal, capture may
  * preserve a concurrent move or save but cannot authorize lifecycle from
  * Apply's own intermediate absence. A durable local result supersedes this
- * Apply; no result authorizes idempotent cloud repair. */
+ * Apply; no result authorizes idempotent cloud repair. A host never returns
+ * this for a bound intent: its receipt names the ground, so the read is
+ * always its own effect, a prefix of it, or a person's. */
  | {
     readonly kind: 'unsettled-ground';
     readonly reason?: string;
 }
-/** A prerequisite is not met yet: the accepted parent has not
- * materialized, a capability is missing, or the effect would displace local
- * remainder nothing else holds. The lane waits without capture or error and
- * is re-proved when the named producer's progress may have changed it. */
- | ApplyDependencyOutcome
-/** The destination is held by a different recorded entity. Capture can never
- * turn that into this entity's local work, so the lane parks: it re-runs
- * only when its input changes or another lane's progress may have moved the
- * occupant. The reason is evidence for the host. */
+/** A prerequisite whose release can arrive while the line waits: a
+ * person's action at this place, such as an unfinished Git operation or
+ * local remainder the effect would displace, Detect, Send, or a lock. The
+ * line holds without capture or error and is re-proved when the named
+ * producer's progress may have changed it. */
+ | ApplyDependencyOutcome | ApplyRejudge
+/** Ground this machine observes but sharing does not hold, such as ground
+ * its enrollment policy excludes, occupies the derived destination. Every
+ * shared sibling derives its own address, so no other recorded occupant is
+ * possible, and capture can never turn this one into this entity's local
+ * work. The line parks and reports the occupant: it re-runs only when its
+ * head changes, or when another authority's line progresses and may have
+ * moved the occupant. */
  | {
     readonly kind: 'conflict';
     readonly reason: string;
-} | {
+}
+/** Nothing is wrong, but ground is not yet settled enough to decide. The
+ * line re-proves after bounded backoff without a report. A fault throws
+ * instead, and the rail reports its cause under the same backoff. */
+ | {
     readonly kind: 'retry';
     readonly reason?: string;
 };
 export type ApplyVerification = {
     readonly kind: 'match';
-} | {
-    readonly kind: 'replan';
-    readonly reason: string;
-} | ApplyDependencyOutcome
-/** An active accepted target below a present materialized root is absent.
- * The rail re-enters the final guard and one lifecycle-protected Detect
- * boundary. A concurrent move or save remains local work; otherwise the
- * same intent idempotently reveals the official result. */
+} | ApplyDependencyOutcome | ApplyRejudge
+/** Unbound only: an active accepted target below a present materialized
+ * root is absent. The rail re-enters the final guard and one
+ * lifecycle-protected Detect boundary. A concurrent move or save remains
+ * local work; otherwise the same intent idempotently reveals the official
+ * result. A bound host reports local-change instead. */
  | {
     readonly kind: 'missing-target';
-} | {
+}
+/** Ground is not the exact target. Unbound, the rail captures it; bound, it
+ * is a person's and the rail cancels so Detect records it. */
+ | {
     readonly kind: 'local-change';
     readonly reason?: string;
-} | {
+}
+/** Nothing is wrong, but the target is not yet observable as complete, such
+ * as a product still converging on its accepted payload. The line re-proves
+ * after bounded backoff without a report. A fault, including a failed
+ * durability flush, throws instead, and the rail reports its cause. */
+ | {
     readonly kind: 'retry';
     readonly reason?: string;
 };
@@ -219,30 +291,25 @@ export interface EntityApplyRetirement {
 type MaybePromise<T> = T | Promise<T>;
 /** One prepared SQLite owner supplies these transactions for the rail lifetime. */
 export interface EntityApplyStorePort {
-    /** At most one item per entity across a stable cursor scan, existing intents
-     * first. Pagination prevents blocked UUIDs from starving unrelated work. */
-    readApplyWork(limit: number, afterCursor: string | null): MaybePromise<EntityApplyWorkPage>;
-    /** Re-read only these lanes for fair retry admission. Missing ids no longer
-     * own locally eligible Apply responsibility and are omitted. */
-    readApplyWorkForEntities(entityIds: readonly string[]): MaybePromise<readonly EntityApplyWork[]>;
-    /** True when a local Outbox row is still unsequenced or was accepted after
-     * `targetSequence`. An accepted local receipt remains protective until its
-     * own official position is selected by Apply. */
+    /** Every authority with an open intent or an unresolved Inbox record. */
+    readApplyAuthorities(): MaybePromise<readonly string[]>;
+    /** This authority's line head: an open intent or retirement first, else
+     * its first unresolved row judged at its position, else the end. Nothing
+     * is resolved by reading. */
+    readApplyLineStep(authorityId: string): MaybePromise<EntityApplyLineStep>;
+    /** Settle the head at `deliverySequence` and the settling heads right
+     * after it, in one bounded commit that judges each again (settling.ts) at
+     * its position against committed tables. Returns how many settled: none
+     * when that row no longer heads the line as a settlement, which the next
+     * read then shows. Materialization, observed rows, notebook rows, claims
+     * and ground stay unchanged. */
+    settle(authorityId: string, deliverySequence: number): MaybePromise<number>;
+    /** True when a local Outbox row's official position is unknown or after
+     * `targetSequence`. Its position is its acknowledgement, or the Inbox
+     * position of the same mutation when Receive holds it before Send stamps
+     * the receipt. An accepted local receipt remains protective until its own
+     * official position is selected by Apply. */
     hasLocalWorkAfter(authorityId: string, entityId: string, targetSequence: number): MaybePromise<boolean>;
-    /**
-     * Resolve this computer's own exact publication without any Apply effect.
-     * In one transaction, true only when no intent exists, Inbox work still
-     * starts at `work.resolvedThrough` and ends at `target`, the retained Outbox
-     * receipt `isExactOwnAcceptance` of `target`, no local work follows it, and
-     * the local sharing basis still holds `target.resultState`, and the host
-     * proves its ground sits at the derived address with no sibling relocation
-     * owed. Then the range through `target` resolves and materialization
-     * evidence is unchanged.
-     * Otherwise nothing is written and the ordinary Apply journey decides.
-     * The rail offers a page's lanes together, so calls for different entities
-     * overlap.
-     */
-    resolveOwnPublication(work: EntityApplyWork, target: AcceptedEntityRecord): MaybePromise<boolean>;
     beginIntent(intent: EntityApplyIntent): MaybePromise<void>;
     setIntentPhase(intent: EntityApplyIntent): MaybePromise<void>;
     cancelIntent(intent: EntityApplyIntent): MaybePromise<EntityApplyRetirement>;
@@ -257,8 +324,9 @@ export interface EntityApplySocket {
     prepare(intent: EntityApplyIntent, plan: EntityApplyPlan): Promise<void>;
     /** Compare ground with the last local observation before preparation and again before reveal. */
     guard(intent: EntityApplyIntent, plan: EntityApplyPlan): Promise<ApplyGuard>;
-    /** Final effect admission can discover an owner through a physical alias. */
-    reveal(intent: EntityApplyIntent, plan: EntityApplyPlan): Promise<void | ApplyDependencyOutcome>;
+    /** Final effect admission can discover an owner through a physical alias,
+     * or decline before binding when a person's version replaced the ground. */
+    reveal(intent: EntityApplyIntent, plan: EntityApplyPlan): Promise<void | ApplyDependencyOutcome | ApplyDeclinedReveal>;
     /** Prove and stage a finite cleanup description without deleting recovery.
      * The store consumes this proof together with the requested terminal outcome.
      * Another effect owner can defer this boundary using the normal dependency. */
@@ -299,8 +367,11 @@ export type LocalCaptureResult = {
  */
 export interface EntityApplyEffectsPort {
     adapterFor(type: EntityType): OperationalEntityApplyAdapter;
-    /** Resume only the recorded cleanup; never require current ground or cargo. */
-    cleanup(retirement: EntityApplyRetirement): Promise<void>;
+    /** Resume only the recorded cleanup; never require the entity's current
+     * ground or cargo. Its private objects lie in one materialized root: while
+     * that root is unavailable the cleanup names it and waits, and the
+     * retirement keeps heading its line. */
+    cleanup(retirement: EntityApplyRetirement): Promise<void | ApplyDependencyOutcome>;
     /** Await the named observation. Local-only differences retain the Apply
      * intent and must never be treated as safely recorded bytes. After reveal,
      * the host protects the target from lifecycle inference while preserving
@@ -325,8 +396,8 @@ export interface EntityApplyRailOptions {
     readonly schedule: EntityApplySchedulePort;
     readonly sha256Hex: Sha256Hex;
     readonly now: () => number;
+    /** How many authority lines run at once. One line is always sequential. */
     readonly concurrency?: number;
-    readonly workLimit?: number;
     readonly onWaiting?: (wait: ApplyWait) => void;
     readonly onBackgroundError?: (error: unknown) => void;
 }
@@ -337,8 +408,17 @@ export declare function createApplyIntent(input: {
     readonly entityId: string;
     readonly fromSequence: number;
     readonly target: AcceptedEntityRecord;
+    readonly play: ApplyPlay;
     readonly createdAt: number;
 }): EntityApplyIntent;
+/**
+ * The one ownership law. Once an intent is revealed or its effects are bound,
+ * it owns its ground and ends only on evidence of that ground: a receipt read
+ * when bound, or for a revealed intent without effects its unbound Verify or
+ * a later durable local result. Anything else is private preparation, which
+ * newer work or a covering verified baseline may drop without a read.
+ */
+export declare function applyIntentOwned(intent: EntityApplyIntent, effectsBound: boolean): boolean;
 export declare function advanceApplyIntent(intent: EntityApplyIntent, phase: Exclude<ApplyIntentPhase, 'declared'>): EntityApplyIntent;
 export {};
 //# sourceMappingURL=contracts.d.ts.map