@amalgm/shell 0.1.164-main.39109658056 → 0.1.164-main.39172889515

package/PURPOSE.md

@@ -51,13 +51,16 @@ now is inaccessible, not wrong: its durable intent still owns the ground bound
 there while its receipt, kept in that binding's control tree, waits unread. A
 binding proved to be another object is unsafe. Neither poisons unrelated roots.
 One preimage association represents source roots (including leaves) and descendant
-directories. Primary and collateral renames use one placement checker; cancellation
-repairs only proved O addresses under their actual binding, never B or accepted
-history. Admission and receipt binding share one SQLite write transaction, including
-physical aliases whose pathname leases do not overlap. Private unbound receipt
+directories. Every Apply move, of a primary, a room sibling or a tidy, is one no-replace
+move that puts ground first and rows after. Retirement, materialized or cancelled, places
+each participant's rows in both inventories where its object stands, under its
+actual binding and the basis that read them; it changes addresses only, never a
+sharing result or accepted history. Admission and receipt binding share one
+SQLite write transaction, including physical aliases whose pathname leases do
+not overlap. Private unbound receipt
 files grant no effects and cannot be adopted as earlier effect evidence.
 Controlled full-ideal checks cover these recovery paths, including a stopped
-primary rename and a second Apply targeting a still-owned collateral participant.
+primary rename and a second Apply targeting a still-owned room sibling.
 Complete native and multi-machine convergence remain unproved.
 
 ## Operating axioms
@@ -648,24 +651,49 @@ after adoption.
     root whose own directory entry changed. If the directory at that address
     is still the same device, inode, and filesystem creation generation its
     content handle was opened on, that handle already covers everything inside
-    and the ring adds nothing; missing ground, a lost handle, or a replaced
-    directory retires the handle and re-establishes coverage. The blind
-    interval could hide an effect through an alias in any root, so every root
-    is put completely in question. On macOS
-    each handle is its own FSEvents stream through Amalgm's own binding
+    and the ring adds nothing; a lost handle or a replaced directory retires
+    the handle and re-establishes coverage. The blind interval could hide an
+    effect through an alias in any root, so every root is put completely in
+    question. Ground that left is not lost coverage (Live's absence law):
+    every binding is declared at its physical address, and a declared root
+    that is missing, obstructed, or unreadable holds no handle, degrades
+    nothing, and is heard returning by its nearest listable ancestor's
+    address handle, while every other root keeps recording; a returning root
+    is caught up whole. Detect treats a root standing on another device than
+    it was bound on as unavailable too (`RootOffDevice`), while one re-created
+    on its bound device is the same workspace, read whole and compared (Live's
+    deletion law). Watch, the binding inventory, and Detect's domain
+    check ask one presence question (`presentDirectory`), so they never
+    disagree about which roots are there. The route Git takes from a
+    checkout to storage outside every root (each link it follows and each
+    directory it leaves by `..`, a gitfile it reads, the storage, its
+    `commondir` file, a linked worktree's common directory), resolved
+    physically as Git resolves it up to the first name Git cannot pass, is
+    declared to Watch as dependencies of
+    the root holding the checkout (`watching/git-storage.ts`): a storage
+    directory gets its own content and parent address handles, any other
+    name is heard at its parent's address handle filtered to its own change, every
+    ring is forwarded to `<checkout>/.git`, and absence or replacement rings
+    that path without degrading coverage. The route is read again when
+    repository membership changes and when a finished Detect pass read ground
+    holding the checkout. A checkout whose route Git cannot use yet keeps
+    declaring it as far as it reaches, so a repair anywhere on it is heard;
+    the walks that read it report it. On macOS each handle
+    is its own FSEvents stream through Amalgm's own binding
     (`native/fsevents/`), which asks for per-file events delivered without
     coalescing delay, so a ring reaches Detect at the platform floor and
     opening or closing one never interrupts another; Node's own watcher serves
     every handle in the process from one stream that it recreates, resuming
     from the present, on every change, and loses the events in between.
-    Initialization failure or handle death is reported as degraded, retains
-    full-root suspicion, and retries independently of Detect; it can never be
-    reported as active coverage. A Linux descendant directory the tree cannot
-    enter is not lost coverage: its parent hears it. One that vanished needs
-    no handle. One this process may not read keeps any handle it already had,
-    and Detect names that ground unavailable, until an event on its name asks
-    again; entering it then ends an interval no handle heard, so its whole
-    root is put in question. Only the root's own failure is lost coverage.
+    Initialization failure or handle death on present ground is reported as
+    degraded, retains full-root suspicion, and retries independently of Detect;
+    it can never be reported as active coverage. A Linux descendant directory
+    the tree cannot enter is not lost coverage: its parent hears it. One that
+    vanished needs no handle. One this process may not read keeps any handle it
+    already had, and Detect names that ground unavailable, until an event on
+    its name asks again; entering it then ends an interval no handle heard, so
+    its whole root is put in question. Only the root's own failure is lost
+    coverage.
 
 17. **Independent content may travel concurrently; authority remains atomic.**
     The host bounds parallel uploads for small immutable objects and processes
@@ -673,22 +701,29 @@ after adoption.
     memory. The registry head advances only after every referenced object is
     durably acknowledged.
 
-18. **A Git repository travels through Git.** Filesystem marker presence
-    classifies `repo.git` independently of whether Git commands succeed; a Git
-    failure defers cloud publication for that materialized root but never
-    demotes the entity, admits `.git` as ordinary ground, or prevents the
-    watching runtime and unrelated roots from becoming ready. The host asks Git to pack the declared
-    refs against the authority's known object frontier and asks Git to index
-    received packs. Every directory with a `.git` directory or file begins its
-    own repository rail. Ordinary children keep their UUID rows locally and
-    ride in the nearest repository state metadata; a nested repository and its
-    ancestry spine remain in the cloud graph, carry their own Card + Checkpoint,
-    and materialize after their enclosing repository. The enclosing Card keeps
-    its own Gitlink and index truth, but its Checkpoint excludes the nested
-    worktree because that state belongs exclusively to the nested rail. Its
-    enclosing identity entry carries only path, UUID, and type—never the nested
-    repository's payload head. A shallow boundary travels with that metadata
-    and is installed before Git reads the imported objects.
+18. **A Git repository travels through Git.** A `.git` that passes Git's own
+    structural test, read natively without running Git (`namesGitRepository`:
+    its storage holds a valid HEAD and its common directory holds `objects` and
+    `refs`; a `.git` link is followed, as Git follows it), classifies
+    `repo.git`, and the same test draws each nested boundary inside a
+    repository's capture. One Git would refuse is no repository: its
+    directory is a folder or workspace on the same UUID whose children travel
+    as ordinary entities until Git can use it again. `.git` itself, usable or
+    not, is never an entity. Past that test, a Git failure defers cloud
+    publication for that materialized root but never demotes the entity or
+    prevents the watching runtime and unrelated roots from becoming ready. The
+    host asks Git to pack the declared refs against the authority's known
+    object frontier and asks Git to index received packs. Every directory whose
+    `.git` Git can use begins its own repository rail. Ordinary children keep
+    their UUID rows locally and ride in the nearest repository state metadata;
+    a nested repository and its ancestry spine remain in the cloud graph, carry
+    their own Card + Checkpoint, and materialize after their enclosing
+    repository. The enclosing Card keeps its own Gitlink and index truth, but
+    its Checkpoint excludes the nested worktree because that state belongs
+    exclusively to the nested rail. Its enclosing identity entry carries only
+    path, UUID, and type—never the nested repository's payload head. A shallow
+    boundary travels with that metadata and is installed before Git reads the
+    imported objects.
 
 19. **Live owns transfer; Shell owns transfer effects.** `@amalgm/live`
     decides which entity types have artifacts, which chunks are missing, when
@@ -793,10 +828,19 @@ after adoption.
     private repository without source remote configuration. Checkpoint decoding
     and member verification have one private preparation owner, separate from
     index installation and working-file effects. Replay consumes and closes that
-    preparation; it does not maintain a second package validator. Sparse directory
-    entries currently cause an explicit unsupported-index refusal, never an
-    incomplete index or an alternate-enabled index writer; the native decoder
-    refuses them before any Git process could expand them. A form Git never
+    preparation; it does not maintain a second package validator. A sparse
+    index's folder entries, each one tree outside the cone, are read as Git
+    writes them and are their files' meaning. Git is never handed a sparse
+    index beside borrowed objects: Git expands one by writing every tree it
+    expands, and writing an object Git already holds refreshes the source
+    file's time, so the read would ring the repository's own Watch and each
+    capture would cause the next. Inventory that needs those files asks one
+    Git tree reader over borrowed objects, and Git lists untracked names over
+    the full index written from them in private storage, borrowing no
+    objects. Any stderr fails either read, because Git reports a tree or a
+    folder it cannot read yet exits 0 without it, and Shell's Git is asked for
+    no advice. No incomplete inventory escapes, and no source index or object
+    is written. A form Git never
     writes, or a required extension Git would not understand, is refused
     rather than guessed. A zero split link has no shared-base dependency.
     Fast reuse closes the complete metadata/namespace proof, whose index
@@ -1080,7 +1124,12 @@ after adoption.
     parent and name operations with that grammar, preserving `\\` as a literal
     character, and only then resolves those components with the host platform's
     path semantics for a filesystem effect. Durable records never rewrite or
-    mix separators accidentally.
+    mix separators accidentally. A link's target text is portable grammar
+    too, as in Git: it travels with `/`, and only a Windows host converts it,
+    `/` to `\` when writing a link and `\` back to `/` when reading one
+    (`src/link-target.ts`). A target with no Windows spelling, such as a
+    literal `\` or a drive-less absolute path, cannot be reproduced there.
+    Bindings and managed references are machine-local paths and stay native.
 
 37. **Git materialization reproduces Card bytes independently of machine
     preferences.** A repository created by Add disables receiver-global line
@@ -1622,7 +1671,11 @@ after adoption.
     them and never creates, replaces, or removes that nested worktree. Paused
     rebase, cherry-pick, and revert state is not yet represented
     by the current contract and refuses explicitly rather than being mistaken
-    for transient work or flattened into a clean stage-zero entry.
+    for transient work or flattened into a clean stage-zero entry. Unchanged
+    ground answers that refusal every time, so Detect withholds only that
+    repository's unit and asks again only when its ground, Git storage
+    included, rings; no timer repeats the read. A fault likewise withholds
+    only its own repository's unit, and the pass retries it on its timer.
 
     Scheduling never extends source evidence. A suspended walk retains its
     physical identity basis, rechecks it before repository reuse or capture,
@@ -1650,12 +1703,16 @@ after adoption.
 
 74. **Same-slot records keep identity and derive distinct disk addresses.**
     Shell never rewrites a portable name to settle concurrent identities.
-    Cold materialization and Apply derive the same UUID-ordered suffixes from
-    the complete active sibling set; Detect recognizes both the portable name
-    and that exact derived name as the same record. A sibling-set change
-    relocates affected materializations while holding every source and
-    destination cone, with row addresses committed before disk movement so a
-    crash can only re-prove the same portable identities.
+    Cold materialization, Apply and the placement tidy derive the same
+    UUID-ordered suffixes from the complete active sibling set; Detect
+    recognizes both the portable name and that exact derived name as the same
+    record. A reveal moves only the siblings standing in its target's derived
+    address. Every other sibling-set consequence is a placement note, written
+    in the transaction that changed the slot, which the placement tidy pays
+    off the Apply line. Each such move is one no-replace move, ground first
+    and rows after, never onto an address the observation inventory records
+    for another, so a crash leaves at most one move whose destination was
+    free and Detect re-proves the same portable identities.
 
 75. **Ground storage has one initializer and one visible generation per root.**
     A ground file's migration and its process epoch run once per file per

package/dist/accepted-tail.d.ts

@@ -1,7 +1,8 @@
 /**
  * The accepted tail: the latest authority-accepted result of every entity
  * delivered in (M, N], read in one SQLite transaction together with the local
- * delivery cursor N and its history floor.
+ * delivery cursor and its history floor. N is the cursor, or an earlier
+ * position the cursor has passed.
  *
  * The Inbox holds every authority record above the floor through the cursor.
  * A tail may begin only at or above that floor: below it this machine never
@@ -18,9 +19,10 @@ export declare class AcceptedHistoryUnavailableError extends Error {
 export interface AcceptedTail {
     /** M: the base the tail folds onto. */
     readonly after: number;
-    /** N: the local gap-free authority cursor the tail runs through. */
+    /** N: the position the tail runs through, never past the local gap-free
+     * authority cursor. */
     readonly through: number;
     /** The latest accepted result per entity in (after, through]. */
     readonly results: readonly CloudEntityRecord[];
 }
-export declare function readAcceptedTail(database: Database.Database, authorityId: string, after: number): AcceptedTail;
+export declare function readAcceptedTail(database: Database.Database, authorityId: string, after: number, until?: number): AcceptedTail;

package/dist/accepted-tail.js

@@ -9,14 +9,17 @@ export class AcceptedHistoryUnavailableError extends Error {
         this.name = "AcceptedHistoryUnavailableError";
     }
 }
-export function readAcceptedTail(database, authorityId, after) {
+export function readAcceptedTail(database, authorityId, after, until) {
     return database.transaction(() => {
         const cursor = database.prepare(`
       SELECT received_through AS through, history_floor AS floor
         FROM authority_delivery_cursors WHERE authority_id = ?
     `).get(authorityId);
-        const through = cursor?.through ?? 0;
+        const received = cursor?.through ?? 0;
+        const through = until ?? received;
         const floor = cursor?.floor ?? 0;
+        if (received < through)
+            throw new Error(`local delivery cursor ${received} has not reached ${through}`);
         if (through < after) {
             throw new Error("local delivery cursor is behind the active snapshot watermark");
         }

package/dist/accepted-tail.js.map

@@ -1 +1 @@
-{"version":3,"file":"accepted-tail.js","sourceRoot":"","sources":["../src/accepted-tail.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,0BAA0B,EAA0B,MAAM,cAAc,CAAC;AAElF,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC;IAAwB;IAA7C,YAAqB,KAAa,EAAW,KAAa;QACxD,KAAK,CAAC,mCAAmC,KAAK,qCAAqC,KAAK,EAAE,CAAC,CAAC;QADzE,UAAK,GAAL,KAAK,CAAQ;QAAW,UAAK,GAAL,KAAK,CAAQ;QAExD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAWD,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,WAAmB,EACnB,KAAa;IAEb,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAiB,EAAE;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;;;KAG/B,CAAC,CAAC,GAAG,CAAC,WAAW,CAAmD,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,KAAK,GAAG,KAAK;YAAE,MAAM,IAAI,+BAA+B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;QACpD,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;;;;KAI7C,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAqC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;YACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC3D,CAAC,CAAC,EAAE,CAAC;AACP,CAAC"}
+{"version":3,"file":"accepted-tail.js","sourceRoot":"","sources":["../src/accepted-tail.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,0BAA0B,EAA0B,MAAM,cAAc,CAAC;AAElF,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACnC;IAAwB;IAA7C,YAAqB,KAAa,EAAW,KAAa;QACxD,KAAK,CAAC,mCAAmC,KAAK,qCAAqC,KAAK,EAAE,CAAC,CAAC;QADzE,UAAK,GAAL,KAAK,CAAQ;QAAW,UAAK,GAAL,KAAK,CAAQ;QAExD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAYD,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,WAAmB,EACnB,KAAa,EACb,KAAc;IAEd,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAiB,EAAE;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;;;KAG/B,CAAC,CAAC,GAAG,CAAC,WAAW,CAAmD,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,IAAI,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;QACjC,IAAI,QAAQ,GAAG,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,oBAAoB,OAAO,EAAE,CAAC,CAAC;QACxG,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,KAAK,GAAG,KAAK;YAAE,MAAM,IAAI,+BAA+B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;QACpD,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;;;;KAI7C,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAqC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;YACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC3D,CAAC,CAAC,EAAE,CAAC;AACP,CAAC"}

package/dist/apply-bound-ground.d.ts

@@ -0,0 +1,109 @@
+import { type ApplyPreimage, type ApplyRecovery } from "./apply-recovery.js";
+export type BoundGroundEffect = "complete" | "prefix" | "foreign";
+/** The host's exact readings, each judged as the receipt's intent judges.
+ * Ground the host refuses to read is ground Apply never produces, so it
+ * matches nothing. */
+export interface BoundGroundPort {
+    /** Whether `path` holds exactly the target, read as if it stood at the target address. */
+    matchesTarget(path: string): Promise<boolean>;
+    /** Whether `path` holds `preimage`'s complete ground unchanged. */
+    matchesPreimage(preimage: ApplyPreimage, path: string): Promise<boolean>;
+    /** Whether the present target's materialized parent stands at the target address's parent. */
+    parentStands(): boolean;
+}
+export type ReceiptMove = ApplyRecovery["moves"][number];
+/** The private names one bound intent may hold beneath its control tree. */
+export declare const displacedPath: (control: string) => string;
+export declare const appliedPath: (control: string) => string;
+export declare const relocatedPath: (control: string, uuid: string) => string;
+/** The private names whose directory entries a bound intent's moves change.
+ * Both terminal commits flush their parents with the receipt's addresses. */
+export declare const controlEntries: (recovery: ApplyRecovery, control: string) => readonly string[];
+/**
+ * The receipt's sibling moves still to perform, in an order that performs
+ * them, and those a person blocked. Each makes room for the target, so none
+ * waits for the target to leave its source.
+ *
+ * - A move is a candidate while its source holds the sibling's own anchor. A
+ *   sibling at neither address was moved by a person, and Detect owns it.
+ * - A candidate is kept when no spelling of its destination finds an object,
+ *   or the object found leaves first: the sibling itself, or an earlier kept
+ *   sibling.
+ * - Any other candidate is blocked: an object Apply never moves stands where
+ *   the sibling must go. A blocked move is released; the sibling keeps its
+ *   address.
+ */
+export declare function pendingMoves(recovery: ApplyRecovery): {
+    kept: readonly ReceiptMove[];
+    blocked: readonly ReceiptMove[];
+};
+/** Whether a repository relocation group still stands at its source, its own
+ * object, not yet moved aside. Each group moves into the control tree once
+ * the reveal has recreated it from the parcel, proved again right before its
+ * move; retirement then proves it unchanged (releaseChangedRelocations). */
+export declare function relocationPending(entry: ApplyRecovery["relocated"][number], control: string): boolean;
+/** The receipt's repository relocation groups still pending. */
+export declare function pendingRelocated(recovery: ApplyRecovery, control: string): ApplyRecovery["relocated"];
+/** The rules in order; the first that decides is the answer. */
+export declare function classifyBoundGround(recovery: ApplyRecovery, control: string, port: BoundGroundPort): Promise<BoundGroundEffect>;
+/** Whether the source stands where the reveal's own steps may have left it:
+ * at its home, at the target, or displaced. A source anywhere else was
+ * replaced or removed by a person after the final guard, so the reveal acts
+ * on none of its ground and Verify finds the person's version. A create has
+ * no source, and its address is judged by the reveal's own install. */
+export declare function sourceStands(recovery: ApplyRecovery, control: string): boolean;
+/**
+ * Cancellation keeps every local version without replacing other ground.
+ * The person's version is home-bound when the reveal moved it away from its
+ * home (the source's address, or the target's for a create): a changed
+ * displaced source, or a source still at home. The reveal is then undone in
+ * reverse order, so that version stands at its home before the intent
+ * retires. Otherwise the person's version stands where the reveal put it,
+ * the reveal's own moves stand with it, and one interrupted between its link
+ * and its unlink finishes.
+ *
+ * 1. The primary. A person's write that reached a name the address still
+ *    holds stays there, and the private name goes. An unchanged displaced
+ *    source is no person's version; retirement deletes it. A present result
+ *    leaves its address into `applied` before it is judged, so no write can
+ *    reach it between the judgment and the move; only an exact target stays
+ *    aside, and anything else returns to the address it left as a second
+ *    local version. A primary between its link and its unlink keeps its home
+ *    name, where a person's write through either name stands.
+ * 2. The person's version returns home.
+ * 3. The siblings that left the target's address before it, once the primary
+ *    has left it again.
+ *
+ * Once it begins returning a version, every retry continues that return:
+ * the displaced name holds only the source (the reveal never displaces
+ * another object), so a returned source stands at its home, and a result
+ * held aside in `applied` stays there until retirement. Only a person who
+ * replaces the returned version at home before a crashed retry ends that
+ * evidence (docs/entity-apply.md, Returned version replaced). Every move only
+ * fills a vacant address beneath a standing parent, so a sibling whose
+ * address a person took keeps where it stands, and Detect owns it. A
+ * version that cannot return (a second local version, or a home a person
+ * filled or whose parent they removed) stays where it is, and recovery
+ * throws for explicit repair with every version kept. Each step skips what
+ * an interrupted attempt already did. Cancellation then flushes the
+ * receipt's whole footprint, so a retry that finds a move already done
+ * still flushes it before the intent can retire.
+ */
+export declare function restoreBoundLocal(recovery: ApplyRecovery, control: string, port: BoundGroundPort): Promise<void>;
+/**
+ * Displaced Git storage a person changed is the person's version: it returns
+ * as the marker of the folder whose storage it was, under the same law as
+ * every other return, and Detect records it once the intent retires. The
+ * receipt's manifest stays, so a crash before the cancelled commit reads the
+ * returned storage against it and is foreign again. Unchanged storage stays
+ * for retirement to delete. Cancellation calls this after restoreBoundLocal,
+ * which may have returned the folder home.
+ */
+export declare function releaseChangedGitStorage(recovery: ApplyRecovery, control: string): Promise<void>;
+/**
+ * A relocation group a person changed, before or after the reveal moved it
+ * aside, is the person's version: it returns to its own address and Detect
+ * records it once the intent retires. Only unchanged groups stay for
+ * retirement to delete. Either retirement calls this before its proof.
+ */
+export declare function releaseChangedRelocations(recovery: ApplyRecovery, control: string, port: BoundGroundPort): Promise<void>;