@amalgm/shell 0.1.164-main.40070365614 → 0.1.164-main.40795482467

package/dist/apply-window-host.js

@@ -14,12 +14,12 @@
  * - Verify (#verify): one reread of real ground, its rows staged for the end;
  * - the durability point (apply-durability.ts), owed where the window placed
  *   its results, runs at idle or at the cap. */
-import { chmodSync, copyFileSync, lstatSync, readFileSync, readdirSync, readlinkSync, rmSync } from "node:fs";
-import { rm } from "node:fs/promises";
+import { chmodSync, copyFileSync, lstatSync, readFileSync, readdirSync, readlinkSync, rmSync, writeFileSync } from "node:fs";
+import { readFile, rm } from "node:fs/promises";
 import { basename, dirname, join, relative } from "node:path";
-import { CONTAINERS, buildEntityApplyEffects, isRefusal, portableFileMode, repositoryPayloadVersion, repositoryApplyTerritory, repositorySharesWorktreeStorage, resolvedPrefix, revealOrder } from "@amalgm/live";
+import { CONTAINERS, buildEntityApplyEffects, classifyFile, isRefusal, portableFileMode, resolvedPrefix, revealOrder } from "@amalgm/live";
 import { LOCAL_DIR_NAME } from "@amalgm/core/identity";
-import { applyControlRoot, displacedGitPath, displacedPath, enterControl, ensureApplyPrivate, judgeBoundRoot, stagedPath, windowControl } from "./apply-control.js";
+import { applyControlRoot, displacedGitPath, displacedPath, enterControl, ensureApplyPrivate, gitPartPath, judgeBoundRoot, readGitPart, stagedPath, windowControl } from "./apply-control.js";
 import { ApplyDurability } from "./apply-durability.js";
 import { keepRemainder, returnKept, topmostRemainder, vacateKept } from "./apply-kept.js";
 import { flushEach } from "./flush.js";
@@ -27,41 +27,46 @@ import { WindowCargo } from "./apply-window-cargo.js";
 import { boundEnter, enterStaging, prepareEnter, sealShows } from "./apply-enter-build.js";
 import { divideEnter, entersContainer, readEnterClosure } from "./apply-enter-plan.js";
 import { captureGitStorage, displaceGitStorage, keptStorageIsO } from "./apply-git-storage.js";
-import { GitCapture } from "./git-capture.js";
-import { ShownGround } from "./apply-showing.js";
+import { NOTHING_ON_DEMAND, ShownGround } from "./apply-showing.js";
 import { holds, moveWithoutReplacing, occupiedByOther, standing } from "./apply-spelling.js";
 import { ApplyWindowStore } from "./apply-window-store.js";
 import { heldCovers, isContainerType, meetsAny, placedByBinding, tryLstat, WindowGround } from "./apply-window-ground.js";
 import { containerGround, enterGround, leaveGround, receiptStats, readVerificationFacts, roomRows, verifiedRow } from "./apply-window-verify.js";
-import { RepositoryGround, repositoryArtifact, repositoryMembers } from "./apply-window-repository.js";
 import { boundAttempts, readEndedWindows, readWindow } from "./apply-window-rows.js";
 import { recoveryVerdict } from "./apply-window-recovery.js";
-import { relocateGroups, replaceAt, stageDirectory, takeSource } from "./apply-window-reveal.js";
+import { replaceAt, stageDirectory, takeSource } from "./apply-window-reveal.js";
 import { constructApplyAdapters } from "./construct-apply-host.js";
 import { ConstructLedger } from "./construct-ledger.js";
 import { contentCacheOwnership } from "./content-cache-ownership.js";
+import { captureContent } from "./content-capture-pool.js";
 import { stampAfterWrites } from "./content-clock.js";
 import { DerivedRelocationCycle, relocateDerived } from "./derived-relocation.js";
 import { ApplyOwnershipSnapshot, ownedObject, ownershipWait, sqliteApplyOwnership, windowFootprint } from "./detection/apply-ownership.js";
 import { settledCaptureOutcome } from "./detection/capture-outcome.js";
+import { cachedNotebook } from "./detection/repository-state.js";
 import { ensureDirBeneath } from "./filesystem.js";
 import { reflogKeys, repositoryGroundCones } from "./git-binding.js";
-import { observeLiteralPath } from "./git-literal-host.js";
-import { leafPayload, payloadFormat, sameCodec } from "./git-literal-read.js";
-import { planWorkingReveal, RepositoryGroundObstructed } from "./git-literal-replay.js";
-import { unsupportedGitOperation, UnsupportedGitOperationError } from "./git-operation-host.js";
-import { applyRepositoryFiles, hasGitMarker, cachedRepositoryIdentity, repositoryRevealRefusal } from "./git-repository-host.js";
-import { inspectGitWorktreeStorage } from "./git-worktree-host.js";
+import { hasGitMarker } from "./git/marker.js";
+import { groundGitOwners } from "./git/ground-owners.js";
+import { applyGit, GitApplyWait, gitStateIdOf } from "./git/rail.js";
 import { openGroundConnection } from "./ground-database.js";
 import { portableGroundRecord as portable } from "./ground-row.js";
-import { writeLinkTarget } from "./link-target.js";
+import { readLinkTarget, writeLinkTarget } from "./link-target.js";
 import { addressWitness, optionalLstat, PhysicalPathWitnesses } from "./physical-path-witness.js";
 import { HeldHeads, ReceivedStateUnavailableError } from "./received-state.js";
-import { revealStorageOf, revealStoragePhysical } from "./reveal-owner.js";
 import { sha256Hex } from "./sha256.js";
 import { closePhysically, closeSource, sourceProofs, witnessProof } from "./source-proof.js";
 import { physicalKey, sourceReusable, sourceSignature } from "./source-signature.js";
 import { awaitTurn } from "./turns.js";
+/** The immutable artifact a repository or structural result names, if any. */
+const resultArtifact = (plan) => plan.kind === "repo.git" ? plan.artifact : plan.kind === "structure" ? plan.resultArtifact : null;
+/** Apply cannot act on a repository yet (src/git/rail.ts). A worktree or
+ * submodule waits on the repository whose Git directory holds its own, whose
+ * Apply releases it; any other wait, on a change there, which Detect
+ * observes. */
+const gitWait = (intent, error) => ({ kind: "dependency", reason: error.message, waitFor: error.owner
+        ? { producer: "apply", entityIds: [error.owner] }
+        : { producer: "capability", entityIds: [intent.entityId] } });
 const objectOf = (path, stats) => ({ path, physicalKey: physicalKey(stats), signature: sourceSignature(stats) });
 /** The member's kind, from its plan. */
 const kindOf = (plan) => {
@@ -85,7 +90,6 @@ const kindOf = (plan) => {
 const declined = (reason) => ({ kind: "declined", reason });
 /** The receipts whose reveal can take a container from its address. */
 const DISPLACING = new Set(["leave", "leaf", "link", "reference"]);
-const isWait = (value) => "kind" in value && value.kind === "dependency";
 /** One persistent machine-effect owner for the Apply rail lifetime. */
 export class ApplyWindowHost {
     store;
@@ -103,14 +107,20 @@ export class ApplyWindowHost {
     #acquireGround;
     #onStage;
     #onWindowEnded;
+    #onDemand;
+    /** The units something opened, each answered once its line ends it, and
+     * the wake that rings that line. */
+    #opening = new Map();
     #now;
     #ground;
+    /** The repositories this machine holds, where worktrees and submodules
+     * find the Git directory that holds their own (src/git/home.ts). */
+    #gitOwners;
     #onDerivedRelocationStage;
     #prepared = new Map();
     #enterClosures = new Map();
     /** The ground the window in flight holds. */
     #held = null;
-    #repository;
     /** The Git storage manifest a final guard took before proving a repository
      * is O, for the receipt the same pass freezes. */
     #gitStorage = new Map();
@@ -123,10 +133,12 @@ export class ApplyWindowHost {
         // Read-only: the file's saver thread makes every write this host posts.
         this.#database = openGroundConnection(options.databaseFile);
         this.#now = options.now ?? Date.now;
+        this.#onDemand = { root: options.onDemand ?? NOTHING_ON_DEMAND.root, opened: uuid => this.#opening.has(uuid) };
         this.durability = new ApplyDurability({ databaseFile: options.databaseFile,
             ...(options.onBackgroundError ? { onError: options.onBackgroundError } : {}) });
         this.store = new ApplyWindowStore(this.#database, {
             now: this.#now,
+            onDemand: this.#onDemand,
             onEnded: (intent, members) => this.#ended(intent, members),
             // Not a failure: the line proves again at its next fair turn.
             onStale: (members, reason) => {
@@ -144,18 +156,12 @@ export class ApplyWindowHost {
             readAhead: (authorityId, after, limit) => this.store.readApplyAhead(authorityId, after, limit),
             fetch: async (wants) => { await this.#cargo.read(wants); },
         };
-        this.#heads = new HeldHeads(options.readGraphPage, cachedRepositoryIdentity(this.#cacheDir, artifacts => this.#cargo.read(artifacts.map(artifact => ({ artifact })))));
+        this.#heads = new HeldHeads(options.readGraphPage);
         this.#acquireGround = options.acquireGround;
         this.#onStage = options.onStage;
         this.#onWindowEnded = options.onWindowEnded;
         this.#ground = new WindowGround(this.#database);
-        this.#repository = new RepositoryGround(this.#ground, options.cacheDir, {
-            matches: (intent, record, path, plan) => this.#matches(intent, record, path, plan),
-            prepared: (intent, plan) => this.#ensurePrepared(intent, plan),
-            receiptOf: intent => this.#receiptOf(intent),
-            readOne: artifact => this.#cargo.readOne(artifact),
-            key: intent => this.#key(intent),
-        });
+        this.#gitOwners = groundGitOwners(this.#database);
         this.#onDerivedRelocationStage = options.onDerivedRelocationStage;
         // Every type in Live's alphabet binds both sockets or the registry
         // refuses to build. Filesystem entities reread their native ground;
@@ -255,11 +261,21 @@ export class ApplyWindowHost {
         });
     }
     // ---------------------------------------------------------------- prepare
+    /** A repository in an Enter that cannot be built yet, such as a linked
+     * worktree whose main checkout's Apply has yet to bring its objects,
+     * waits on it, so the window ends before it (journey.ts). */
     async #prepare(intent, plan) {
-        if (entersContainer(plan))
-            await this.#prepareEnter(intent, plan);
-        else
-            await this.#ensurePrepared(intent, plan);
+        try {
+            if (entersContainer(plan))
+                await this.#prepareEnter(intent, plan);
+            else
+                await this.#ensurePrepared(intent, plan);
+        }
+        catch (error) {
+            if (error instanceof GitApplyWait)
+                return gitWait(intent, error);
+            throw error;
+        }
     }
     async #ensurePrepared(intent, plan) {
         const key = this.#key(intent);
@@ -274,24 +290,12 @@ export class ApplyWindowHost {
         }
         this.#emit(intent, plan, "preparation-started");
         let prepared = {};
-        const repository = repositoryArtifact(plan);
-        if (repository) {
-            const chain = await this.#repository.chain(repository);
-            const latest = chain.links.at(-1).layout;
-            if (repositoryPayloadVersion(latest, sha256Hex) !== plan.target.payloadVersion
-                || (plan.kind === "repo.git" && (latest.stateId !== plan.stateId
-                    || latest.cardId !== plan.cardId || latest.checkpointId !== plan.checkpointId
-                    || latest.identityHash !== plan.identityHash
-                    || latest.parentTransportVersion !== plan.parentTransportVersion))) {
-                throw new Error("repository package does not describe the accepted complete result");
-            }
-            prepared = { repository: { ...chain, objectFormat: latest.card.objectFormat } };
-        }
-        else if (plan.kind === "file.text" || plan.kind === "file.binary" || plan.kind === "link") {
+        const artifact = resultArtifact(plan);
+        if (plan.kind === "file.text" || plan.kind === "file.binary" || plan.kind === "link") {
             prepared = { artifact: await this.#cargo.prepare(plan) };
         }
-        else if (plan.kind === "structure" && plan.resultArtifact) {
-            prepared = { artifact: await this.#cargo.sealed(plan.resultArtifact.contentHash) ?? await this.#cargo.readOne(plan.resultArtifact) };
+        else if (artifact) {
+            prepared = { artifact: await this.#cargo.sealed(artifact.contentHash) ?? await this.#cargo.readOne(artifact) };
         }
         this.#prepared.set(key, prepared);
         this.#emit(intent, plan, "cargo-verified");
@@ -329,8 +333,8 @@ export class ApplyWindowHost {
                     targetPath: context.targetPath },
                 clockRoot: this.#ground.bindingRoot(context),
                 databaseFile: this.#database.name,
-                cacheDir: this.#cacheDir,
                 bindingDir: this.#bindingDir,
+                held: this.#gitOwners,
                 readContent: artifacts => this.#cargo.read(artifacts.map(artifact => ({ artifact }))),
             });
             this.#emit(intent, plan, "cargo-verified");
@@ -342,7 +346,8 @@ export class ApplyWindowHost {
         const key = this.#key(intent);
         let closure = this.#enterClosures.get(key);
         if (!closure) {
-            closure = await readEnterClosure({ database: this.#database, intent, target: plan.target, heads: this.#heads });
+            closure = await readEnterClosure({ database: this.#database, intent, target: plan.target, heads: this.#heads,
+                unit: new ShownGround(this.#database, this.#onDemand).beneathOnDemand(plan.target) });
             this.#enterClosures.set(key, closure);
         }
         const division = await divideEnter(closure.records, plan.target.uuid, uuid => this.#ground.current(uuid) !== null);
@@ -353,7 +358,6 @@ export class ApplyWindowHost {
         this.#prepared.delete(key);
         this.#enterClosures.delete(key);
         this.#gitStorage.delete(key);
-        this.#repository.forget(key);
     }
     // ------------------------------------------------------------------ guard
     /** Only a final safe or already-target guard keeps its member in the window. */
@@ -373,7 +377,6 @@ export class ApplyWindowHost {
     async #inspectGround(intent, plan, stage) {
         const finalGuard = stage === "final";
         const key = this.#key(intent);
-        this.#repository.forget(key);
         this.#gitStorage.delete(key);
         try {
             if (finalGuard) {
@@ -387,7 +390,7 @@ export class ApplyWindowHost {
             }
             // The line judged this play from the tables, and Detect may have
             // changed them since: a play that no longer holds is judged again.
-            const judged = new ShownGround(this.#database).judge(plan.target);
+            const judged = new ShownGround(this.#database, this.#onDemand).judge(plan.target);
             if (judged !== plan.play) {
                 return { kind: "rejudge", reason: `The accepted result now plays ${judged} on this computer, not ${plan.play}.` };
             }
@@ -417,9 +420,6 @@ export class ApplyWindowHost {
                 .every(row => row === null || row === undefined || this.#ground.directoryAncestorsMatch(row, directories))) {
                 return replacedParent;
             }
-            let repositoryTargetMatches = false;
-            let repositoryRelocationsPending = false;
-            let repositoryIdentityMatches = true;
             // A reveal installs the repository's own `.git` where the entity
             // stands. A `.git` there that names no repository exists only on this
             // computer, so the reveal waits until the person removes or repairs it.
@@ -429,68 +429,18 @@ export class ApplyWindowHost {
                     blocker: { code: "local-ground-would-be-displaced", effect: "repository-reveal" },
                     reason: `${current.absolutePath} holds Git metadata that names no repository; only this computer has it.` };
             }
-            if (plan.target.type === "repo.git" || current?.type === "repo.git") {
-                for (const path of new Set([context.targetPath, current?.absolutePath].filter((path) => path !== undefined))) {
-                    if (!hasGitMarker(path))
-                        continue;
-                    const storage = await inspectGitWorktreeStorage(path);
-                    const unsupported = unsupportedGitOperation(storage.privateDirectory);
-                    if (unsupported) {
-                        return { kind: "dependency", reason: new UnsupportedGitOperationError(unsupported).message,
-                            waitFor: { producer: "capability", entityIds: [intent.entityId] } };
-                    }
-                    if (repositorySharesWorktreeStorage(storage)) {
-                        return { kind: "dependency",
-                            reason: "This checkout shares Git storage with another worktree. Apply requires an independent checkout.",
-                            waitFor: { producer: "capability", entityIds: [intent.entityId] },
-                        };
-                    }
-                }
-            }
-            if (entersContainer(plan)) {
+            if (entersContainer(plan) && finalGuard) {
+                // The build assumed the ground's division and its address. A build
+                // that no longer shows them is dropped and built again by the next
+                // attempt.
                 const { closure, division } = await this.#enterDivision(intent, plan);
-                if (finalGuard) {
-                    // The build assumed the ground's division, its address and its
-                    // relocation sources. A build that no longer shows them is dropped
-                    // and built again by the next attempt.
-                    const enter = this.#prepared.get(key)?.enter;
-                    if (!enter || !holds(enter.tree, enter.seal.root) || !sealShows(enter.seal, { target: plan.target,
-                        position: closure.position, leftOut: division.leftOut, targetPath: context.targetPath })) {
-                        this.#prepared.delete(key);
-                        return { kind: "retry", reason: "The entering tree no longer shows this computer's ground; it is built again." };
-                    }
-                    for (const group of this.#repository.enterRelocations(context.targetPath, enter)) {
-                        for (const row of group.rows) {
-                            if (!await this.#matches(intent, portable(row), row.absolutePath, plan)) {
-                                return { kind: "retry", reason: `repository relocation ${row.uuid} changed before Apply` };
-                            }
-                        }
-                    }
+                const enter = this.#prepared.get(key)?.enter;
+                if (!enter || !holds(enter.tree, enter.seal.root) || !sealShows(enter.seal, { target: plan.target,
+                    position: closure.position, leftOut: division.leftOut, targetPath: context.targetPath })) {
+                    this.#prepared.delete(key);
+                    return { kind: "retry", reason: "The entering tree no longer shows this computer's ground; it is built again." };
                 }
             }
-            else if (plan.target.type === "repo.git" && !leaving) {
-                const repository = (await this.#ensurePrepared(intent, plan)).repository;
-                if (!repository)
-                    throw new Error("repository Apply has no prepared transport identity");
-                // The result acts only on its territory, so ground another rail owns
-                // here never waits on that rail's later record (docs/entity-apply.md).
-                const territory = this.#repository.territory(intent, repository.identity, context.current);
-                const ground = current && tryLstat(current.absolutePath) ? current.absolutePath : context.targetPath;
-                const refused = await repositoryRevealRefusal(ground, root, repository.objectFormat, !hasGitMarker(ground));
-                if (refused)
-                    return { kind: "dependency", reason: refused, waitFor: { producer: "capability", entityIds: [intent.entityId] } };
-                const groups = this.#repository.relocations(context, territory.identity);
-                for (const group of groups) {
-                    for (const row of group.rows) {
-                        if (!await this.#matches(intent, portable(row), row.absolutePath, plan)) {
-                            return { kind: "retry", reason: `repository relocation ${row.uuid} changed before Apply` };
-                        }
-                    }
-                }
-                repositoryRelocationsPending = groups.length > 0;
-                repositoryIdentityMatches = this.#repository.identityMatches(intent, context.targetPath, repository.identity);
-                repositoryTargetMatches = current !== null && await this.#matches(intent, plan.target, context.targetPath, plan);
-            }
             // Identity comes from O, never a historical sharing address or byte
             // equality. A same-identity complete target can be adopted even when B
             // lags, provided no other physical effect remains. A Leave's target
@@ -501,10 +451,8 @@ export class ApplyWindowHost {
                 && physical.absolutePath === context.targetPath
                 && targetStats !== null && physicalKey(targetStats) === physical.physicalKey;
             if (targetIdentity
-                && repositoryIdentityMatches
-                && !repositoryRelocationsPending
                 && context.room.length === 0
-                && (repositoryTargetMatches || await this.#matches(intent, plan.target, context.targetPath, plan))
+                && await this.#matches(intent, plan.target, context.targetPath, plan)
                 && this.#ground.physicalDirectoriesMatch(physical, directories)) {
                 if (!this.#ground.directoriesStand(directories))
                     return replacedParent;
@@ -512,8 +460,6 @@ export class ApplyWindowHost {
                     const receipt = await this.#receipt(intent, plan, context, "already-target");
                     if (receipt === null)
                         return { kind: "local-change", reason: "The ground this member stands on changed after its guard." };
-                    if (isWait(receipt))
-                        return receipt;
                     this.store.stageReceipt(receipt);
                 }
                 return { kind: "already-target" };
@@ -532,13 +478,13 @@ export class ApplyWindowHost {
             // effect waits for Detect to see that ground leave or become shared.
             if (current && isContainerType(current.type) && tryLstat(current.absolutePath)
                 && (leaving || !isContainerType(plan.target.type))) {
-                const named = this.#repository.unsharedGitMetadata(current);
+                const named = this.#ground.unsharedGitWithin(current.absolutePath);
                 if (named.length > 0) {
                     return { kind: "dependency", waitFor: { producer: "detect", entityIds: named },
                         blocker: { code: "local-ground-would-be-displaced", effect: leaving ? "leave" : "replace-container" },
                         reason: `${current.absolutePath} holds local ground sharing never held; removing it would destroy that ground.` };
                 }
-                const publishing = this.#repository.pendingPublication(intent.authorityId, current);
+                const publishing = this.#ground.pendingWithin(intent.authorityId, current);
                 if (publishing.length > 0) {
                     return { kind: "dependency", waitFor: { producer: "send", entityIds: publishing },
                         reason: `${current.absolutePath} holds local results not yet sequenced; removing it would hide them.` };
@@ -548,9 +494,6 @@ export class ApplyWindowHost {
                 return { kind: "local-change", reason: "A required sibling relocation has unproved ground." };
             }
             let safe;
-            // The source already shows the target's exact package, every member
-            // where its map places it.
-            let showsTarget = false;
             if (!current) {
                 safe = !tryLstat(context.targetPath) ? { kind: "safe" } : await this.#occupiedDestination(intent, plan, context);
             }
@@ -575,58 +518,43 @@ export class ApplyWindowHost {
                     && (plan.target.type === "workspace" || plan.target.type === "folder") && hasGitMarker(current.absolutePath)) {
                     this.#gitStorage.set(key, await captureGitStorage(current.absolutePath));
                 }
-                // A repository's ground is safe when it shows what this computer
-                // expects of it (#showsExpected); anything else is a person's change.
-                const shared = current.type === "repo.git" ? this.#ground.shared(current.uuid) : undefined;
-                let shows;
-                if (shared?.status === "active" && shared.type === "repo.git") {
-                    const showing = await this.#repository.showsExpected(intent, plan, current, shared);
-                    shows = showing !== null;
-                    showsTarget = showing === "package" && plan.target.type === "repo.git"
-                        && shared.payloadVersion === plan.target.payloadVersion && shared.transportVersion === plan.target.transportVersion;
-                }
-                else {
-                    shows = await this.#matches(intent, portable(shared?.status === "active" ? shared : current), current.absolutePath, plan);
-                }
-                safe = shows && this.#ground.physicalDirectoriesMatch(current, directories) ? { kind: "safe" } : { kind: "local-change" };
+                // The ground is safe while it shows what this computer last observed
+                // there, its O row; anything else is a person's change, which Detect
+                // records before Apply looks again.
+                safe = await this.#matches(intent, portable(current), current.absolutePath, plan)
+                    && this.#ground.physicalDirectoriesMatch(current, directories) ? { kind: "safe" } : { kind: "local-change" };
             }
             if (safe.kind === "safe" && !this.#ground.directoriesStand(directories))
                 return replacedParent;
             if (safe.kind === "safe" && finalGuard) {
-                const receipt = await this.#receipt(intent, plan, context, "safe", showsTarget);
+                const receipt = await this.#receipt(intent, plan, context, "safe");
                 if (receipt === null)
                     return { kind: "local-change", reason: "The ground this member would reveal over changed after its guard." };
-                if (isWait(receipt))
-                    return receipt;
                 this.store.stageReceipt(receipt);
             }
             return safe;
         }
         catch (error) {
-            if (error instanceof UnsupportedGitOperationError) {
-                return { kind: "dependency", reason: error.message, waitFor: { producer: "capability", entityIds: [intent.entityId] } };
-            }
+            if (error instanceof GitApplyWait)
+                return gitWait(intent, error);
             // No kept graph head reaches the Enter's position yet: the line holds.
             if (error instanceof ReceivedStateUnavailableError)
                 return { kind: "dependency", reason: error.message };
             throw error;
         }
         finally {
-            if (!finalGuard) {
-                this.#repository.forget(key);
+            if (!finalGuard)
                 this.#emit(intent, plan, "preflight-finished");
-            }
         }
     }
     /**
      * The member's receipt, frozen from the ground its final guard proved:
      * its address, its binding root, the object it reveals over, the object it
-     * stages, the sibling moves that free its address, the ground a parcel or
-     * an Enter relocates, a repository reveal's plan, and where its history
-     * stood. Null when the source a person replaced since the guard: nothing
-     * binds for it. A dependency is a repository obstruction.
+     * stages, the sibling moves that free its address, and a former
+     * repository's Git storage. Null when a person replaced the source since
+     * the guard: nothing binds for it.
      */
-    async #receipt(intent, plan, context, look, showsTarget = false) {
+    async #receipt(intent, plan, context, look) {
         const key = this.#key(intent);
         const anchor = context.current ?? context.parent;
         if (!anchor)
@@ -645,11 +573,7 @@ export class ApplyWindowHost {
                 throw new Error("Apply room move has no physical identity");
             return { uuid: physical.uuid, source: from, destination, physicalKey: physical.physicalKey };
         });
-        const relocation = (group) => ({ uuid: group.sourceRoot.uuid,
-            source: group.sourceRoot.absolutePath, physicalKey: group.sourceRoot.physicalKey });
         let staged = null;
-        let repository = null;
-        let relocated = [];
         if (look === "safe") {
             if (kind === "leaf" || kind === "link" || kind === "reference") {
                 const path = await this.#stageResult(intent, plan, context, control);
@@ -660,43 +584,12 @@ export class ApplyWindowHost {
                 if (!enter)
                     throw new Error("container Enter binds without its prepared tree");
                 staged = objectOf(enter.tree, lstatSync(enter.tree, { bigint: true }));
-                relocated = this.#repository.enterRelocations(context.targetPath, enter).map(relocation);
-            }
-            else if (kind === "repository") {
-                const chain = prepared?.repository;
-                if (!chain)
-                    throw new Error("repository Apply has no prepared transport chain");
-                const basis = await this.#repository.revealBasis(context);
-                const kept = basis?.unstated ?? [];
-                let removals = { leaves: [], directories: [] }, standing = [];
-                if (context.current && sourceStats) {
-                    standing = this.#repository.elsewhere(context.current, chain.identity);
-                    try {
-                        removals = planWorkingReveal(context.current.absolutePath, repositoryApplyTerritory(chain.identity, standing), basis?.held ?? [], new Set(kept.map(entry => entry.path)));
-                    }
-                    catch (error) {
-                        if (!(error instanceof RepositoryGroundObstructed))
-                            throw error;
-                        return this.#repository.obstructed(context.current, error);
-                    }
-                }
-                const sourcePath = source?.path ?? null;
-                const storage = sourcePath === null || !hasGitMarker(sourcePath) ? null : revealStorageOf(sourcePath);
-                // Only a self-contained checkout moves whole: its own `.git`
-                // directory, nothing to remove around the package it shows, and no
-                // configured worktree, which would leave Git reading the old place.
-                const shown = showsTarget && sourcePath !== null && tryLstat(join(sourcePath, ".git"))?.isDirectory() === true
-                    && removals.leaves.length === 0 && removals.directories.length === 0
-                    && !(await new GitCapture(sourcePath).configuration()).has("core.worktree");
-                repository = { removals, standing, remainder: kept, storage: storage === null ? null : revealStoragePhysical(storage), shown };
-                relocated = this.#repository.relocations(context, repositoryApplyTerritory(chain.identity, standing).identity).map(relocation);
             }
         }
         return {
             intent, target: plan.target, kind, look, address: context.targetPath,
             root: { path: root.absolutePath, physicalKey: root.physicalKey }, control,
-            source, staged, room, relocated, repository,
-            gitStorage: this.#gitStorage.get(key) ?? null,
+            source, staged, room, gitStorage: this.#gitStorage.get(key) ?? null,
         };
     }
     /** A file or link result staged at its vacant private address, with its
@@ -769,12 +662,6 @@ export class ApplyWindowHost {
      * cones discovered after acquisition without proving them again. */
     async #hold(intent, plans) {
         const members = intent.members.map((member, index) => ({ intent: member, plan: plans[index] }));
-        // Immutable identity determines a repository's relocation cones. Load it
-        // before acquiring ground, including after restart with an empty cache.
-        for (const { intent: member, plan } of members) {
-            if (plan.target.type === "repo.git" && plan.kind !== "leave" && !entersContainer(plan))
-                await this.#ensurePrepared(member, plan);
-        }
         const cones = () => [...new Set(members.flatMap(({ intent: member, plan }) => this.#groundCones(member, plan)))];
         const reflogs = members.some(({ plan }) => plan.target.type === "repo.git" && !entersContainer(plan))
             ? () => members.flatMap(({ intent: member, plan }) => plan.target.type === "repo.git" && !entersContainer(plan)
@@ -812,9 +699,7 @@ export class ApplyWindowHost {
     /**
      * The visible addresses one member may read or replace: its target
      * address, the entity's current address when it moves, its room chain's
-     * sources and destinations, and for a repository or an Enter every
-     * materialized address its identity map relocates. A bound member's are
-     * its receipt's. A member current rows no longer place holds only its O
+     * sources and destinations. A bound member's are its receipt's. A member current rows no longer place holds only its O
      * address, and its guard then finds its play changed.
      */
     applyAddresses(intent, plan) {
@@ -837,12 +722,6 @@ export class ApplyWindowHost {
             addresses.add(source);
             addresses.add(destination);
         }
-        const prepared = this.#prepared.get(this.#key(intent));
-        const groups = prepared?.enter ? this.#repository.enterRelocations(context.targetPath, prepared.enter)
-            : plan.target.type === "repo.git" && prepared?.repository
-                ? this.#repository.relocations(context, this.#repository.territory(intent, prepared.repository.identity, context.current).identity) : [];
-        for (const group of groups)
-            addresses.add(group.sourceRoot.absolutePath);
         return [...addresses];
     }
     /** Called only after the requesting Watch cutoff settles. Outbox protection
@@ -872,9 +751,6 @@ export class ApplyWindowHost {
             const root = judgeBoundRoot(receipt.root);
             if (root !== "present")
                 return declined(`Materialized root ${receipt.root.path} is ${root}.`);
-            const key = this.#key(intent);
-            // The guard's readings describe ground this reveal is about to change.
-            this.#repository.forget(key);
             const { address, control, source } = receipt;
             await this.#makeRoom(receipt);
             const remainder = this.#remainder(intent, receipt);
@@ -894,7 +770,7 @@ export class ApplyWindowHost {
                 if (!moveWithoutReplacing(source.path, address))
                     return declined(`${address} holds another object.`);
             }
-            if (receipt.kind === "container") {
+            if (receipt.kind === "container" || receipt.kind === "repository") {
                 const at = standing(address);
                 if (at && (!at.isDirectory() || at.isSymbolicLink())) {
                     if (!replaceAt(receipt, stageDirectory(control, intent.entityId)))
@@ -911,30 +787,8 @@ export class ApplyWindowHost {
                     displaceGitStorage(displaced, address, receipt.gitStorage);
                 }
                 await this.#return(receipt.root.path, [{ uuid: intent.entityId, path: address }]);
-                return;
-            }
-            if (receipt.kind === "repository") {
-                if (!receipt.repository)
-                    throw new Error("repository Apply binds without its reveal plan");
-                // Optimistic equality: the source already showed this exact package,
-                // so the move above was the whole reveal. Verify reads it afresh.
-                if (receipt.repository.shown) {
-                    relocateGroups(receipt);
-                    return;
-                }
-                const chain = (await this.#ensurePrepared(intent, plan)).repository;
-                if (!chain)
-                    throw new Error("repository Apply has no prepared transport chain");
-                ensureDirBeneath(receipt.root.path, address, 0o755);
-                const staging = stagedPath(control, intent.entityId);
-                ensureApplyPrivate(control, dirname(staging));
-                const applied = await applyRepositoryFiles(address, chain, { kind: "working", root: receipt.root.path,
-                    removals: receipt.repository.removals, staging, standing: receipt.repository.standing,
-                    reveal: { attempt: intent.attemptId, storage: receipt.repository.storage },
-                    proven: this.#repository.proofs(address) });
-                // The reveal's readback is the reading Verify inherits.
-                this.#repository.remember(key, address, applied.reading);
-                relocateGroups(receipt);
+                if (receipt.kind === "repository")
+                    return await this.#revealGit(intent, plan, receipt);
                 return;
             }
             if (receipt.kind === "enter") {
@@ -947,7 +801,6 @@ export class ApplyWindowHost {
                     if (!replaceAt(receipt, staged.path))
                         return declined(`${address} holds another object.`);
                 }
-                relocateGroups(receipt);
                 const { seal } = (await this.#ensurePrepared(intent, plan)).enter;
                 await this.#return(receipt.root.path, seal.rows.filter(row => CONTAINERS.has(row.record.type))
                     .map(row => ({ uuid: row.record.uuid, path: join(address, ...row.relativePath.split("/").filter(Boolean)) })));
@@ -973,6 +826,46 @@ export class ApplyWindowHost {
             this.#emit(intent, plan, "reveal-finished");
         }
     }
+    /**
+     * A repository's Git part: its folder stands, and Git's own files are
+     * made to hold the target's state (src/git/rail.ts). The part marker says
+     * `started`, durably, before Git writes anything, so recovery knows a torn
+     * install is Apply's own; `ended` follows Git's read of the result. A
+     * folder that already shows the state, as a move or rename leaves it, is
+     * read and left alone. Its working-tree files are their own members.
+     */
+    async #revealGit(intent, plan, receipt) {
+        const target = plan.target.transportVersion, artifact = resultArtifact(plan);
+        if (!target || !artifact)
+            throw new Error(`repository ${intent.entityId} Apply names no Git artifact`);
+        const marker = gitPartPath(receipt.control, intent.entityId);
+        const before = this.#ground.current(intent.entityId);
+        const known = async () => before?.type === "repo.git" ? cachedNotebook(this.#cacheDir, before.transportVersion) : null;
+        try {
+            if (readGitPart(receipt.control, intent.entityId) === null) {
+                if (hasGitMarker(receipt.address)) {
+                    const shown = await gitStateIdOf(receipt.address, this.#gitOwners, async () => (await known())?.state ?? null);
+                    if ("stateId" in shown && shown.stateId === plan.target.payloadVersion)
+                        return;
+                }
+                ensureApplyPrivate(receipt.control, dirname(marker));
+                writeFileSync(marker, "started");
+                await flushEach([marker], [dirname(marker)]);
+            }
+            // The target and its parents, from the cache when its bytes prove
+            // their name, else the wire.
+            const source = async (version) => readFile((await this.#cargo.sealed(version)
+                ?? await this.#cargo.readOne({ ...artifact, contentHash: version })).file);
+            await applyGit(receipt.address, target, source, await known(), this.#gitOwners);
+        }
+        catch (error) {
+            if (error instanceof GitApplyWait)
+                return gitWait(intent, error);
+            throw error;
+        }
+        // Unflushed: a lost `ended` only runs the same install again.
+        writeFileSync(marker, "ended");
+    }
     /** The topmost local remainder beneath a container this Leave or leaf
      * displaces, before the reveal or after it; null when that ground is no
      * longer settled. */
@@ -1050,15 +943,14 @@ export class ApplyWindowHost {
                 && !await keptStorageIsO(displacedGitPath(receipt.control, intent.entityId), receipt.address, receipt.gitStorage)) {
                 return { kind: "local-change" };
             }
-            const judged = new ShownGround(this.#database).judge(plan.target);
+            const judged = new ShownGround(this.#database, this.#onDemand).judge(plan.target);
             if (judged !== plan.play) {
                 return { kind: "rejudge", reason: `The accepted result now plays ${judged} on this computer, not ${plan.play}.` };
             }
             const enter = receipt.kind === "enter" ? (await this.#ensurePrepared(intent, plan)).enter : undefined;
-            const identity = receipt.kind === "repository" ? (await this.#ensurePrepared(intent, plan)).repository?.identity : undefined;
             const [members, containers] = enter
                 ? [enter.seal.rows.map(row => row.record.uuid), enter.seal.rows.filter(row => CONTAINERS.has(row.record.type)).map(row => row.record.uuid)]
-                : repositoryMembers(identity ?? []);
+                : [[], []];
             const moved = receipt.room.map(move => move.uuid);
             const read = this.store.verificationRead(intent.attemptId, reader => {
                 readVerificationFacts(reader, plan.target, members, containers, moved);
@@ -1070,7 +962,6 @@ export class ApplyWindowHost {
             const context = this.#boundContext(receipt);
             // Every read Verify proves follows its root's content clock.
             const clock = await this.#clock(intent.attemptId, receipt.root.path);
-            await this.#repository.closeInherited(intent);
             let proof;
             let ground;
             if (receipt.kind === "leave") {
@@ -1087,8 +978,7 @@ export class ApplyWindowHost {
                 const matches = await this.#matches(intent, plan.target, receipt.address, plan, receipt.address, found => { proof = found; });
                 if (!matches)
                     return { kind: "local-change" };
-                ground = receipt.kind === "repository" ? await this.#repository.rows(intent, plan, context, proof, clock)
-                    : containerGround(this.#ground, plan.target, context, verifiedRow(this.#ground, plan.target, context, proof, clock));
+                ground = containerGround(this.#ground, plan.target, context, verifiedRow(this.#ground, plan.target, context, proof, clock));
             }
             const verification = proof.proof;
             const closed = { semantic: () => verification.semantic(), witnesses: [],
@@ -1098,6 +988,11 @@ export class ApplyWindowHost {
                 shared: [...ground.shared, ...room.shared] }, closed);
             return { kind: "match" };
         }
+        catch (error) {
+            if (error instanceof GitApplyWait)
+                return gitWait(intent, error);
+            throw error;
+        }
         finally {
             this.#emit(intent, plan, "verify-finished");
         }
@@ -1214,10 +1109,6 @@ export class ApplyWindowHost {
                     }
                 }
                 const verification = await adapter.verify.verify(member, plan);
-                // An ended Git part lets go of the ground its parcel recreated only
-                // once its result is proven; that ground lies outside the repository.
-                if (verification.kind === "match" && verdict === "revealed")
-                    relocateGroups(receipt);
                 if (verification.kind === "match")
                     outcomes.set(entityId, { kind: "materialized" });
                 else
@@ -1232,17 +1123,20 @@ export class ApplyWindowHost {
         return intent.members.map(member => outcomes.get(member.entityId) ?? { kind: "owed", reason: "not reached" });
     }
     /** Whether the ground at `at` shows what the member's final guard proved
-     * of its source (#guard), read the same way: the source's O row, and a
-     * repository's shared expectation. Its O row stands until the window ends. */
+     * of its source (#guard), read the same way: the source's O row, which
+     * stands until the window ends. A repository Git refuses shows nothing. */
     async #showsGuarded(intent, plan, at) {
         const current = this.#ground.current(intent.entityId);
         if (!current)
             return false;
-        const shared = current.type === "repo.git" ? this.#ground.shared(current.uuid) : undefined;
-        if (shared?.status === "active" && shared.type === "repo.git") {
-            return await this.#repository.showsExpected(intent, plan, current, shared, at) !== null;
+        try {
+            return await this.#matches(intent, portable(current), at, plan);
+        }
+        catch (error) {
+            if (error instanceof GitApplyWait)
+                return false;
+            throw error;
         }
-        return this.#matches(intent, portable(shared?.status === "active" ? shared : current), at, plan);
     }
     /** A window that never bound leaves nothing anyone owns: its preparation
      * and its control trees go. A bound window keeps both for #recover. */
@@ -1265,6 +1159,41 @@ export class ApplyWindowHost {
             await rm(control, { recursive: true, force: true });
         }
     }
+    /**
+     * Place one unit its root on demand lists (src/drive/): its line plays it
+     * as one ordinary Enter of that unit, through intent, guard, reveal and
+     * Verify, and the answer comes when the window holding it ends. `wake`
+     * rings the line once the unit is owed. One placement per unit is in
+     * flight: a second ask joins the first.
+     */
+    place(entityId, wake) {
+        return new Promise(answer => {
+            const joined = this.#opening.get(entityId);
+            this.#opening.set(entityId, joined
+                ? { answer: placement => { joined.answer(placement); answer(placement); }, wake: joined.wake }
+                : { answer, wake });
+            if (!joined)
+                this.#open(entityId);
+        });
+    }
+    /** Owe an opened unit to its line and ring it; answer at once when O
+     * already shows the unit or this computer never received it. */
+    #open(entityId) {
+        void this.store.openUnit(entityId).then(opened => {
+            if (opened === "owed")
+                return this.#opening.get(entityId)?.wake();
+            this.#answer(entityId, opened === "shown" ? { kind: "placed" } : { kind: "unknown" });
+        }, (error) => this.#answer(entityId, { kind: "failed", error }));
+    }
+    /** Stop placing a unit: its line lists it again unless its window bound. */
+    abandon(entityId) {
+        this.#opening.delete(entityId);
+    }
+    #answer(entityId, placement) {
+        const opening = this.#opening.get(entityId);
+        this.#opening.delete(entityId);
+        opening?.answer(placement);
+    }
     /** The end commit landed: the window's ground is no longer owned, and
      * every byte it revealed is owed to the durability point. */
     #ended(intent, members) {
@@ -1285,9 +1214,15 @@ export class ApplyWindowHost {
             }
             else if (member.outcome.kind === "settled") {
                 this.#onStage?.({ ...common, stage: "settled", settlement: member.outcome.settlement });
+                // A window judged before the unit opened listed it: owe it again.
+                if (member.outcome.settlement === "listed" && this.#opening.has(member.entityId))
+                    this.#open(member.entityId);
+                else
+                    this.#answer(member.entityId, { kind: "settled", settlement: member.outcome.settlement });
             }
             else {
                 this.#onStage?.({ ...common, stage: "retired", completion: "materialized" });
+                this.#answer(member.entityId, { kind: "placed" });
             }
             if (receipt)
                 this.#forgetPreparation(receipt.intent);
@@ -1316,8 +1251,6 @@ export class ApplyWindowHost {
                 directories.add(dirname(move.source));
                 directories.add(dirname(move.destination));
             }
-            for (const entry of receipt.relocated)
-                directories.add(dirname(entry.source));
             switch (receipt.kind) {
                 case "leaf":
                     files.add(receipt.address);
@@ -1373,35 +1306,36 @@ export class ApplyWindowHost {
         };
         if (!stats)
             return false;
-        if (["file.text", "file.binary", "link"].includes(record.type)) {
-            const expected = record.payloadVersion, format = expected ? payloadFormat(expected) : null;
-            if (!expected || (format !== "sha1" && format !== "sha256"))
-                throw new Error(`Apply matched ${record.uuid} with no literal payload`);
-            // A leaf this computer proved keeps its proof while the slot shows its
-            // exact signature, by the rule Detect reuses it (source-signature.ts):
-            // its bytes are not read again, and they answer for every payload
-            // their codec names. An object Apply just placed carries the change
-            // time of its rename, past every earlier stamp, so it is always read
-            // once, and that read becomes its row's proof.
-            const proven = this.#ground.atPath(path);
-            if (proven?.payloadVersion && sameCodec(proven.payloadVersion, expected) && sourceReusable(proven, stats)) {
-                if (proven.type !== record.type || proven.payloadVersion !== expected)
-                    return false;
+        if (record.type === "file.text" || record.type === "file.binary" || record.type === "link") {
+            const expected = record.payloadVersion;
+            if (!expected)
+                throw new Error(`Apply matched ${record.uuid} with no payload`);
+            const modeShown = record.type === "link" || record.fileMode === portableFileMode(record.type, Number(stats.mode));
+            const shown = async () => {
                 const witnesses = new PhysicalPathWitnesses();
                 witnesses.remember(dirname(path), optionalLstat(dirname(path)));
                 witnesses.remember(path, stats);
-                return (record.type === "link" || record.fileMode === portableFileMode(record.type, Number(stats.mode)))
-                    && await retain(stats, witnessProof([witnesses.seal()]));
+                return modeShown && retain(stats, witnessProof([witnesses.seal()]));
+            };
+            // A leaf this computer proved keeps its proof while the slot shows its
+            // exact signature, by the rule Detect reuses it (source-signature.ts):
+            // its bytes are not read again. An object Apply just placed carries
+            // the change time of its rename, past every earlier stamp, so it is
+            // always read once, and that read becomes its row's proof.
+            const proven = this.#ground.atPath(path);
+            if (proven?.payloadVersion && sourceReusable(proven, stats)) {
+                return proven.type === record.type && proven.payloadVersion === expected && shown();
             }
             const key = this.#key(intent);
             this.#contentReads.set(key, (this.#contentReads.get(key) ?? 0) + 1);
-            const { observation, witness } = await observeLiteralPath(dirname(path), basename(path), format, "apply");
-            if (observation.kind !== "leaf" || observation.leaf.type !== record.type)
+            // Read the way Detect reads it (src/detection/runtime.ts).
+            if (record.type === "link") {
+                return stats.isSymbolicLink() && sha256Hex(Buffer.from(readLinkTarget(path), "utf8")) === expected && shown();
+            }
+            if (!stats.isFile())
                 return false;
-            const leaf = observation.leaf;
-            return leafPayload(expected, format, leaf) === expected && (record.type === "link"
-                || record.fileMode === portableFileMode(record.type, Number(leaf.stats.mode)))
-                && await retain(leaf.stats, witnessProof([witness]));
+            const content = await captureContent(path, stats, null, { lane: "named" });
+            return classifyFile({ binary: content.binary }) === record.type && content.contentHash === expected && shown();
         }
         if (record.type === "reference") {
             if (!record.payloadVersion)
@@ -1415,16 +1349,14 @@ export class ApplyWindowHost {
         }
         const addressProof = witnessProof([addressWitness(path, stats)]);
         if (record.type === "repo.git") {
-            if (!stats.isDirectory() || !hasGitMarker(path))
-                return false;
-            const repository = await this.#repository.package(intent, plan, record);
-            const own = record.uuid === intent.entityId;
-            const territory = own ? this.#repository.territory(intent, repository.identity) : repositoryApplyTerritory(repository.identity, []);
-            const remainder = own ? this.#repository.allowance(intent, repository.identity) : [];
-            if (!remainder)
+            // A repository is its folder plus its Git directory's state, read
+            // without a Git process; its working-tree files are their own entities.
+            if (!stats.isDirectory() || stats.isSymbolicLink() || !hasGitMarker(path))
                 return false;
-            const observed = await this.#repository.showsPackage(intent, path, repository, territory, remainder);
-            return observed !== null && await retain(stats, addressProof, observed.proof);
+            const read = await gitStateIdOf(path, this.#gitOwners, async () => (await cachedNotebook(this.#cacheDir, record.transportVersion))?.state ?? null);
+            if ("unsupported" in read)
+                throw new GitApplyWait(`${path} holds ${read.unsupported}; Apply waits for it to change`);
+            return read.stateId === record.payloadVersion && retain(stats, addressProof);
         }
         if (!stats.isDirectory() || stats.isSymbolicLink())
             return false;