@amalgm/shell 0.1.164-preview.36061234379 → 0.1.164-preview.36809057014

package/dist/git-repository-host.js

@@ -1,343 +1,213 @@
 import { createHash } from "node:crypto";
-import { spawn } from "node:child_process";
-import { chmodSync, closeSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readSync, readlinkSync, rmSync, symlinkSync, statSync, writeFileSync, } from "node:fs";
+import { closeSync, createReadStream, existsSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, rmSync, writeFileSync, } from "node:fs";
+import { mkdtemp, open, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { Transform } from "node:stream";
-import { pipeline } from "node:stream/promises";
-import { REPOSITORY_CARD_VERSION, applyRepositoryIdentity, classifyFile, decodeRepositoryTransport, deriveCardId, deriveCheckpointId, deriveStateId, encodeRepositoryTransport, inspectRepositoryTransport, planRepositoryIdentity, repositoryIdentityHash, repositoryTransportMetadataBytes, } from "@amalgm/live";
-import { gitText, runGit, runGitToFile, tryGit, tryGitText, } from "./git-command.js";
+import { applyRepositoryIdentity, assertRepositoryTransportTruth, deriveCardId, deriveCheckpointId, deriveStateId, encodeRepositoryTransport, inspectRepositoryTransport, ITEMS_PER_BOUNDARY, repositoryIdentityDelta, repositoryIdentityHash, repositoryIdentityMap, repositoryPayloadVersion, repositoryTransportMetadataBytes, } from "@amalgm/live";
+import { gitHost, gitText, runGit } from "./git-command.js";
+import { busyMarker, gitOperationWitness, mergeOperation, REVEAL_MARKER } from "./git-operation-host.js";
 import { atomicWrite } from "./filesystem.js";
+import { repositoryIdentityMapSteps } from "./repository-identity-steps.js";
+import { CaptureSourceChangedError, hashContentFile, writeCacheHint } from "./content-cache-host.js";
+import { literalRepositoryIdentity, literalRepositoryIdentityMapSteps, collectLiteralRepositoryView, observeLiteralPaths, } from "./git-literal-host.js";
+import { leafPayload } from "./git-literal-read.js";
+import { PrivateGitView } from "./git-private-view.js";
+import { installLiteralCheckpoint } from "./git-literal-replay.js";
+import { prepareLiteralCheckpoint } from "./git-checkpoint-preparation.js";
+import { checkpointReads, constructLiteralCheckpoint } from "./git-checkpoint-construction.js";
+import { PhysicalPathWitnesses } from "./physical-path-witness.js";
 import { recordFileDurability } from "./durability-barrier.js";
-const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-const BUSY_MARKERS = [
-    "rebase-merge",
-    "rebase-apply",
-    "CHERRY_PICK_HEAD",
-    "REVERT_HEAD",
-];
+import { GitCapture } from "./git-capture.js";
+import { stashList } from "./git-card.js";
+import { eachInTurns, finishStepsInTurns, turnBoundary } from "./turns.js";
+import { looseRefs } from "./git-ref-store.js";
+import { gitStorageDirectory } from "./git-binding.js";
+import { admissionProof, closeSource, sourceProofs, witnessProof } from "./source-proof.js";
+import { physicalKey, sourceSignature } from "./source-signature.js";
 const sha256Hex = (input) => createHash("sha256").update(input).digest("hex");
 const bufferView = (bytes) => Buffer.isBuffer(bytes)
     ? bytes
     : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-/** Classification observes only the filesystem marker. Git command health
- * belongs to Card + Checkpoint capture and cannot demote repository ground. */
-export function hasGitMarker(directory) {
+/** What one lstat of a `.git` entry says. */
+export const gitMarker = (marker) => ({ physicalKey: physicalKey(marker),
+    kind: marker.isDirectory() ? "directory" : marker.isFile() ? "file" : "other" });
+/** The `.git` entry as it stands now; null when absent. */
+export function observeGitMarker(directory) {
     try {
-        const marker = lstatSync(join(directory, ".git"));
-        return marker.isDirectory() || marker.isFile();
+        return gitMarker(lstatSync(join(directory, ".git"), { bigint: true }));
     }
     catch (error) {
         const code = error.code;
         if (code === "ENOENT" || code === "ENOTDIR")
-            return false;
+            return null;
         throw error;
     }
 }
-/** Every durable ref except Amalgm's private import namespace and
- * `refs/stash`, whose value names only the top of a stack that lives in the
- * reflog; the stack travels whole through `stashList`. */
-function refList(repository) {
-    const output = tryGitText(repository, ["for-each-ref", "--format=%(refname) %(objectname)", "refs"]);
-    if (!output)
-        return [];
-    return output.split("\n").map((line) => {
-        const separator = line.lastIndexOf(" ");
-        return { name: line.slice(0, separator), commit: line.slice(separator + 1) };
-    }).filter((ref) => ref.name !== "refs/stash" && !ref.name.startsWith("refs/amalgm-import/"))
-        .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
-}
-/** The stash stack newest first, exactly as Git's reflog holds it. `%gs` is
- * the reflog subject after Git's own whitespace normalization, so storing a
- * captured message reads back unchanged. */
-function stashList(repository) {
-    const output = gitText(repository, ["stash", "list", "--format=%H%x00%gs"]);
-    if (!output)
-        return [];
-    return output.split("\n").map((line) => {
-        const separator = line.indexOf("\0");
-        return { commit: line.slice(0, separator), message: line.slice(separator + 1) };
-    });
-}
-function remoteList(repository) {
-    const output = tryGitText(repository, ["config", "--get-regexp", "^remote\\..*\\.url$"]);
-    if (!output)
-        return [];
-    return output.split("\n").map((line) => {
-        const separator = line.indexOf(" ");
-        return { name: line.slice(7, separator - 4), url: line.slice(separator + 1) };
-    }).sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
-}
-/** A shallow boundary is required to interpret the repository's object graph.
- * It travels with the Git parcel, but does not change the semantic Card id. */
-function shallowBoundary(repository) {
-    const file = resolve(repository, gitText(repository, ["rev-parse", "--git-path", "shallow"]));
-    if (!existsSync(file))
-        return [];
-    const commits = readFileSync(file, "utf8").split(/\r?\n/).filter(Boolean).sort();
-    if (commits.some((commit) => !/^[0-9a-f]{40,64}$/.test(commit))) {
-        throw new Error("repository has an invalid shallow boundary");
-    }
-    return commits;
-}
+/** Classification observes only the filesystem marker. Git command health
+ * belongs to Card + Checkpoint capture and cannot demote repository ground. */
+export const marksRepository = (marker) => marker !== null && marker.kind !== "other";
+export const hasGitMarker = (directory) => marksRepository(observeGitMarker(directory));
+/** The nested repositories a reading of `identity`'s repository must not enter. */
 export function nestedRepositoryPaths(identity) {
     return identity
         .filter((entry) => entry.type === "repo.git")
         .map((entry) => entry.path)
         .sort();
 }
-function pathWithinRepositoryBoundary(path, boundaries) {
-    const candidate = path.endsWith("/") ? path.slice(0, -1) : path;
-    return boundaries.some((boundary) => candidate === boundary || candidate.startsWith(`${boundary}/`));
-}
-function worktreePathspec(boundaries, excludedPaths = []) {
-    return boundaries.length === 0 && excludedPaths.length === 0
-        ? []
-        : [
-            "--", ".",
-            ...boundaries.flatMap((path) => [`:(exclude)${path}`, `:(exclude)${path}/**`]),
-            ...excludedPaths.map((path) => `:(exclude,literal)${path}`),
-        ];
-}
-function portableWorktreePath(path) {
-    return path.length > 0 && !path.startsWith("/") && !path.includes("\0")
-        && path.split("/").every((part) => part !== "" && part !== "." && part !== "..");
-}
-function worktreeLeaf(repository, path) {
-    if (!portableWorktreePath(path))
-        throw new Error(`repository has an unsafe conflicted path: ${path}`);
-    const absolutePath = join(repository, path);
-    try {
-        const stats = lstatSync(absolutePath);
-        if (stats.isSymbolicLink()) {
-            const content = Buffer.from(readlinkSync(absolutePath), "utf8");
-            return { mode: "120000", content, sha256: sha256Hex(content) };
-        }
-        if (stats.isDirectory())
-            return null;
-        const content = readFileSync(absolutePath);
-        return {
-            mode: stats.mode & 0o111 ? "100755" : "100644",
-            content,
-            sha256: sha256Hex(content),
-        };
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    }
-}
-function unmergedPaths(repository) {
-    const fields = runGit(repository, ["ls-files", "--unmerged", "-z"])
-        .toString("utf8").split("\0").filter(Boolean);
-    const grouped = new Map();
-    for (const field of fields) {
-        const separator = field.indexOf("\t");
-        const [mode, objectId, rawStage] = field.slice(0, separator).split(" ");
-        const path = field.slice(separator + 1);
-        const stage = Number(rawStage);
-        if (separator < 0 || !mode || !/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(objectId ?? "")
-            || ![1, 2, 3].includes(stage) || !portableWorktreePath(path)) {
-            throw new Error("Git returned an invalid unmerged index entry");
-        }
-        const entries = grouped.get(path) ?? [];
-        if (entries.some((entry) => entry.stage === stage)) {
-            throw new Error(`Git returned a duplicate unmerged index stage: ${path}`);
-        }
-        entries.push({ mode, objectId: objectId, stage: stage });
-        grouped.set(path, entries);
-    }
-    return [...grouped.entries()]
-        .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
-        .map(([path, stages]) => ({
-        path,
-        stages: stages.sort((left, right) => left.stage - right.stage),
-        worktree: worktreeLeaf(repository, path),
-    }));
-}
-function optionalGitFile(repository, name) {
-    try {
-        return readFileSync(join(gitDirectory(repository), name));
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return Buffer.alloc(0);
-        throw error;
-    }
-}
-function mergeOperation(repository) {
-    const heads = optionalGitFile(repository, "MERGE_HEAD").toString("utf8")
-        .split(/\r?\n/).filter(Boolean);
-    if (heads.length === 0)
-        return null;
-    if (heads.some((head) => !/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(head))) {
-        throw new Error("repository has an invalid MERGE_HEAD");
-    }
-    return {
-        kind: "merge",
-        heads,
-        message: optionalGitFile(repository, "MERGE_MSG"),
-        mode: optionalGitFile(repository, "MERGE_MODE"),
-    };
-}
-function untrackedFiles(repository, nestedRepositories) {
-    // Git ignore is not Amalgm enrollment policy. Every on-disk worktree leaf
-    // travels unless the registered root's .amalgmignore excludes it.
-    const output = runGit(repository, ["ls-files", "--others", "-z"])
-        .toString("utf8");
-    return output.split("\0").filter(Boolean).sort().flatMap((relativePath) => {
-        if (pathWithinRepositoryBoundary(relativePath, nestedRepositories))
-            return [];
-        if (relativePath.endsWith("/"))
-            return [];
-        const absolutePath = join(repository, relativePath);
-        try {
-            const stats = lstatSync(absolutePath);
-            if (stats.isSymbolicLink()) {
-                const content = Buffer.from(readlinkSync(absolutePath), "utf8");
-                return [{ path: relativePath, mode: "120000", content, sha256: sha256Hex(content) }];
-            }
-            if (stats.isDirectory())
-                return [];
-            const content = readFileSync(absolutePath);
-            return [{
-                    path: relativePath,
-                    mode: stats.mode & 0o111 ? "100755" : "100644",
-                    content,
-                    sha256: sha256Hex(content),
-                }];
-        }
-        catch (error) {
-            if (error.code === "ENOENT")
-                return [];
-            throw error;
-        }
-    });
-}
 /** The common `.git` directory needs no Git invocation; a `.git` file
  * (worktree, submodule) is resolved by Git itself. */
-function gitDirectory(repository) {
-    const common = join(repository, ".git");
-    try {
-        if (lstatSync(common).isDirectory())
-            return common;
-    }
-    catch {
-        // Resolved below.
-    }
-    return resolve(repository, gitText(repository, ["rev-parse", "--git-dir"]));
-}
-/** An Amalgm reveal rewrites a repository in place over several Git
- * invocations. Like MERGE_HEAD, this file in the Git directory says the
- * repository is mid-operation: capture refuses it (so Detect never records a
- * torn moment as truth, and retries once it settles), while the reveal that
- * owns it resumes from whatever state an interruption left behind. */
-const REVEAL_MARKER = "amalgm-reveal";
+const gitDirectory = (repository) => gitStorageDirectory(repository).directory;
 export function markRepositoryReveal(repository) {
     writeFileSync(join(gitDirectory(repository), REVEAL_MARKER), "");
 }
 export function repositoryRevealInProgress(repository) {
     return hasGitMarker(repository) && existsSync(join(gitDirectory(repository), REVEAL_MARKER));
 }
-function busyMarker(repository, ownReveal) {
-    const directory = gitDirectory(repository);
-    return [...BUSY_MARKERS, ...(ownReveal ? [] : [REVEAL_MARKER])]
-        .find((marker) => existsSync(join(directory, marker))) ?? null;
-}
 const CAPTURE_ATTEMPTS = 3;
-/** Card and Checkpoint are read by several Git invocations. One record must
- * describe one repository moment, so the Checkpoint diffs against the commit
- * resolved at the start and the whole capture is retried when HEAD moves
- * underneath it rather than committing a torn, unreproducible state. */
-function captureState(repository, nestedRepositories = [], ownReveal = false) {
-    let moved = null;
-    for (let attempt = 0; attempt < CAPTURE_ATTEMPTS; attempt += 1) {
-        const state = captureStateOnce(repository, nestedRepositories, ownReveal);
-        const branch = tryGitText(repository, ["symbolic-ref", "-q", "--short", "HEAD"]);
-        const commit = tryGitText(repository, ["rev-parse", "-q", "--verify", "HEAD"]);
-        if (branch === state.card.head.branch && commit === state.card.head.commit)
-            return state;
-        moved = `${state.card.head.branch ?? "detached"}@${state.card.head.commit ?? "none"}`
-            + ` -> ${branch ?? "detached"}@${commit ?? "none"}`;
-    }
-    throw new Error(`repository HEAD kept moving during capture: ${moved}`);
-}
-function captureStateOnce(repository, nestedRepositories, ownReveal) {
-    const busy = busyMarker(repository, ownReveal);
+/** The first attempt uses the caller's capture; a source that moved while
+ * it was read is asked again from a fresh one. */
+async function retrySourceChange(capture, operation) {
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            return await operation(attempt === 0 ? capture : new GitCapture(capture.repository));
+        }
+        catch (error) {
+            if (!(error instanceof CaptureSourceChangedError) || attempt + 1 >= CAPTURE_ATTEMPTS)
+                throw error;
+        }
+    }
+}
+/** One collected repository moment with its unclosed source. Detect retains
+ * the proof and closes it once, at the admission that trusts it; Apply's
+ * readback closes it itself. */
+async function collectState(capture, nestedRepositories, lane, proven, ownReveal = false) {
+    const directory = gitDirectory(capture.repository);
+    // A busy repository is unsettled, never a fault: it reads again once the
+    // operation that owns the marker ends.
+    const busy = busyMarker(directory, ownReveal);
     if (busy)
-        throw new Error(`repository is busy: ${busy}`);
-    const branch = tryGitText(repository, ["symbolic-ref", "-q", "--short", "HEAD"]);
-    const commit = tryGitText(repository, ["rev-parse", "-q", "--verify", "HEAD"]);
-    const shallow = shallowBoundary(repository);
-    const unmerged = unmergedPaths(repository);
-    const operation = mergeOperation(repository);
-    const checkpointPathspec = worktreePathspec(nestedRepositories, unmerged.map((entry) => entry.path));
-    const card = {
-        version: REPOSITORY_CARD_VERSION,
-        head: { branch, commit, detached: branch === null && commit !== null },
-        refs: refList(repository),
-        stash: stashList(repository),
-        remotes: remoteList(repository),
-        ...(shallow.length > 0 ? { shallow } : {}),
-    };
+        throw new CaptureSourceChangedError(`repository is busy: ${busy}`);
+    const configuration = await capture.configuration();
+    const { value: card, proof: cardProof } = await capture.card();
+    const operation = mergeOperation(directory);
+    const view = await collectLiteralRepositoryView(capture, card.head.commit, nestedRepositories, lane, proven);
     const checkpoint = {
-        baseCommit: commit,
-        branch,
-        stagedPatch: runGit(repository, [
-            "diff", "--cached", "--binary", "--full-index", commit ?? EMPTY_TREE,
-            ...checkpointPathspec,
-        ]),
-        unstagedPatch: runGit(repository, [
-            "diff", "--binary", "--full-index", ...checkpointPathspec,
-        ]),
-        unmerged,
-        operation,
-        untracked: untrackedFiles(repository, nestedRepositories),
+        baseCommit: card.head.commit, branch: card.head.branch,
+        stagedPatch: view.stagedPatch, unstagedPatch: view.unstagedPatch,
+        unmerged: view.unmerged, untracked: view.untracked, operation,
     };
     const cardId = deriveCardId(card, sha256Hex);
     const checkpointId = deriveCheckpointId(checkpoint, sha256Hex);
-    return {
-        stateId: deriveStateId(cardId, checkpointId, sha256Hex),
-        cardId,
-        checkpointId,
-        card,
-        checkpoint,
-        pack: null,
-    };
+    // Operation and busy markers are native files in the observed Git
+    // directory, so admission re-reads them with the other physical witnesses.
+    const markers = witnessProof([gitOperationWitness(directory, ownReveal, operation)]);
+    const proof = sourceProofs([cardProof, configuration, markers, view.proof]);
+    return { capture, state: { stateId: deriveStateId(cardId, checkpointId, sha256Hex),
+            cardId, checkpointId, card, checkpoint, pack: null }, view, configuration, proof };
+}
+/** Physical observation for publication. Selection and package sealing have
+ * not happened; the caller retains this source proof, unclosed, and its
+ * admission closes it once. */
+export function observeRepositoryForPublication(capture, identity, lane, proven) {
+    return retrySourceChange(capture, attempt => collectState(attempt, nestedRepositoryPaths(identity), lane, proven));
+}
+/** Seal an observation when publication selected every observed member. No
+ * second Git/worktree observation is necessary; the original proof still
+ * closes once, at admission. */
+export async function captureObservedRepository(observed, identity, observedIdentity, prior, previousIdentity) {
+    return sealRepository(observed, await selectedLiteralIdentity(identity, observed.view, observedIdentity), prior, previousIdentity);
+}
+/** The literal identity of the selected members. Publication usually selects
+ * exactly the observed members, whose literal map the observation already
+ * derived: equal paths and UUIDs, where a leaf's type and payload come from
+ * the same view and every other entry must match as recorded. */
+async function selectedLiteralIdentity(selected, view, observed) {
+    const derived = () => finishStepsInTurns(literalRepositoryIdentityMapSteps(selected, view));
+    if (selected.length !== observed.entries.length)
+        return derived();
+    const byPath = new Map();
+    await eachInTurns(observed.entries, entry => byPath.set(entry.path, entry));
+    let visited = 0;
+    for (const entry of selected) {
+        const other = byPath.get(entry.path);
+        if (other?.uuid !== entry.uuid || !(view.leaves.has(entry.path)
+            || (other.type === entry.type && (other.payloadVersion ?? null) === (entry.payloadVersion ?? null))))
+            return derived();
+        if (++visited % ITEMS_PER_BOUNDARY === 0)
+            await turnBoundary();
+    }
+    return observed;
+}
+/** The same Card + Checkpoint without the untracked names a caller accounts
+ * for separately. */
+function withoutUntracked(state, omitted) {
+    const checkpoint = { ...state.checkpoint, untracked: state.checkpoint.untracked.filter(file => !omitted(file.path)) };
+    const checkpointId = deriveCheckpointId(checkpoint, sha256Hex);
+    return { ...state, checkpoint, checkpointId, stateId: deriveStateId(state.cardId, checkpointId, sha256Hex) };
 }
 const cardTips = (card) => [...new Set([
         ...(card.head.commit ? [card.head.commit] : []),
-        ...card.refs.map((ref) => ref.commit),
+        ...card.refs.flatMap((ref) => ref.kind === "direct" ? [ref.commit] : []),
         ...card.stash.map((entry) => entry.commit),
     ])];
-/** Produce the same native thin-pack work as send-pack: current wants minus
+/** The commits a state names: its Card tips and an unfinished merge's heads. */
+const stateCommits = (state) => [...new Set([...cardTips(state.card), ...(state.checkpoint.operation?.heads ?? [])])];
+/** Every object a state's pack delivers: its commits and each conflict
+ * stage. A gitlink records a commit owned by the nested repository, which
+ * the outer repository preserves as an opaque index value but never packs. */
+const stateWants = (state) => [...new Set([...stateCommits(state),
+        ...state.checkpoint.unmerged.flatMap((entry) => entry.stages
+            .filter((stage) => stage.mode !== "160000").map((stage) => stage.objectId))])];
+/** The previous boundaries the receiver holds: those its tips reach under
+ * the horizon it received. */
+async function receiverHolds(binding, horizon, tips, boundaries) {
+    const receiver = await PrivateGitView.open(binding, horizon);
+    try {
+        return [...(await receiver.reached(tips, boundaries)).keys()];
+    }
+    finally {
+        await receiver.close();
+    }
+}
+/** Produce the same native thin-pack work as upload-pack: current wants minus
  * receiver haves. Ref updates and Amalgm metadata remain outside the pack. */
-function nativePack(repository, current, previous) {
-    const wants = [...new Set([
-            ...cardTips(current.card),
-            // A gitlink records a commit owned by the nested repository. The outer
-            // repository preserves that opaque index value but can never pack it.
-            ...current.checkpoint.unmerged.flatMap((entry) => entry.stages
-                .filter((stage) => stage.mode !== "160000")
-                .map((stage) => stage.objectId)),
-            ...(current.checkpoint.operation?.heads ?? []),
-        ])];
+async function nativePack(binding, current, previous) {
+    const commits = stateCommits(current);
+    const wants = stateWants(current);
     if (wants.length === 0)
         return null;
-    const haves = (previous ? cardTips(previous) : []).filter((commit) => tryGit(repository, ["cat-file", "-e", `${commit}^{object}`]) !== null);
-    const revisions = Buffer.from([
-        ...wants,
-        ...haves.map((commit) => `^${commit}`),
-        "",
-    ].join("\n"), "utf8");
-    const scratch = mkdtempSync(join(tmpdir(), "amalgm-repo-pack-"));
+    const scratch = await mkdtemp(join(tmpdir(), "amalgm-repo-pack-"));
     const file = join(scratch, "repository.pack");
     try {
-        runGitToFile(repository, [
-            "pack-objects", "--stdout", "--revs", "--thin", "--delta-base-offset",
-        ], revisions, file);
-        const bytes = readFileSync(file);
+        const view = await PrivateGitView.open(binding, current.card.shallow);
+        try {
+            // The receiver holds each previous tip's closure under the previous
+            // horizon. A previous boundary this horizon moved past (Git's
+            // unshallow) is a commit it holds, if at all, without its parents. As
+            // upload-pack does, every traversal stops at those boundaries, so the
+            // haves subtract only what the receiver holds; each one this state
+            // reaches wants its parents, so the history newly exposed beneath it
+            // travels; and each one the receiver holds is an edge, so its tree
+            // never travels again.
+            const boundary = new Set(current.card.shallow ?? []);
+            const received = previous?.shallow ?? [];
+            const unshallowed = received.filter(commit => !boundary.has(commit));
+            const haves = previous ? await view.present(cardTips(previous)) : [];
+            const [exposed, held] = unshallowed.length ? await Promise.all([
+                view.reached(commits, unshallowed).then(found => [...found.values()].flat()),
+                receiverHolds(binding, received, haves, unshallowed),
+            ]) : [[], []];
+            const revisions = Buffer.from([
+                ...unshallowed.map(commit => `--shallow ${commit}`),
+                ...new Set([...wants, ...exposed]),
+                ...[...haves, ...held].map(commit => `^${commit}`), "",
+            ].join("\n"), "utf8");
+            await view.exportPack(revisions, file, received.length > 0);
+        }
+        finally {
+            await view.close();
+        }
+        const bytes = await readFile(file);
         if (bytes.byteLength < 12 || bytes.subarray(0, 4).toString("ascii") !== "PACK") {
             throw new Error("Git produced an invalid repository pack");
         }
@@ -346,73 +216,248 @@ function nativePack(repository, current, previous) {
         return { bytes, sha256: sha256Hex(bytes) };
     }
     finally {
-        rmSync(scratch, { recursive: true, force: true });
-    }
-}
-function identityFromCheckpoint(identity, state) {
-    const untracked = new Map(state.checkpoint.untracked.map((entry) => [entry.path, entry]));
-    return identity.map((entry) => {
-        const current = untracked.get(entry.path);
-        if (!current)
-            return entry;
-        const type = current.mode === "120000"
-            ? "link"
-            : classifyFile({
-                binary: current.content === null
-                    ? entry.type === "file.binary"
-                    : Buffer.from(current.content).includes(0),
-            });
-        return { ...entry, type, payloadVersion: current.sha256 };
-    });
+        await rm(scratch, { recursive: true, force: true });
+    }
 }
-export function observeRepository(repository, identity) {
-    const { stateId, card } = captureState(repository, nestedRepositoryPaths(identity));
-    return { stateId, card };
+/** Content-addressed cache bytes are evidence, not ground. A cached head that
+ * cannot prove the row's declared state is a cache miss, never a Detect fault. */
+export async function readPriorRepositoryTransport(cacheDir, row) {
+    if (row?.type !== "repo.git" || !row.payloadVersion || !row.transportVersion)
+        return null;
+    const file = join(cacheDir, `${row.transportVersion}.bin`);
+    try {
+        const layout = await inspectRepositoryTransportFile(file);
+        if (repositoryPayloadVersion(layout, sha256Hex) === row.payloadVersion) {
+            return { stateId: layout.stateId, transportVersion: row.transportVersion, card: layout.card, identityHash: layout.identityHash };
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        // An unreadable envelope is the same miss.
+    }
+    await rm(file, { force: true });
+    return null;
+}
+export function pairRepositoryObservation(uuid, directory, observed, identityHash) {
+    const payloadVersion = repositoryPayloadVersion({ stateId: observed.state.stateId, identityHash }, sha256Hex);
+    return observationPair(uuid, directory, payloadVersion, observed.configuration, observed.view.sourceBinding, observed.proof);
+}
+/** The one pairing formula: a configuration stamp names the complete observed
+ * payload and the repository directory the Git binding resolved. */
+function observationPair(uuid, directory, payloadVersion, configuration, binding, proof) {
+    // The binding's first identity is the checkout's exact `device:inode:mode`.
+    const [device, inode, mode] = binding.identities[0].split(":");
+    return Object.freeze({ uuid, absolutePath: directory, payloadVersion,
+        gitConfigurationObservation: configuration.stamp(uuid, payloadVersion, binding),
+        physicalKey: `${device}:${inode}`, filesystemMode: Number(mode), proof });
+}
+export function readRepository(repository, boundaries, lane, ownReveal = false) {
+    return retrySourceChange(new GitCapture(repository), attempt => readRepositoryAttempt(attempt, boundaries, lane, ownReveal));
+}
+const repositoryDirectoryStats = (path) => {
+    const stat = lstatSync(path, { bigint: true });
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new CaptureSourceChangedError("repository directory changed kind");
+    return stat;
+};
+const repositoryDirectoryWitness = (path) => {
+    return sourceSignature(repositoryDirectoryStats(path));
+};
+/** Keep only witnesses; a cached Apply comparison must not retain patches,
+ * untracked contents, conflict contents or the construction view's closure. */
+function repositoryNamespaceProof(source, witnesses) {
+    const ordered = [...witnesses].sort(([a], [b]) => a.length - b.length);
+    const check = (directory, witness) => {
+        if (repositoryDirectoryWitness(directory) !== witness) {
+            throw new CaptureSourceChangedError("repository namespace changed before reuse");
+        }
+    };
+    return sourceProofs([source, admissionProof(() => {
+            for (const [directory, witness] of ordered)
+                check(directory, witness);
+            for (let index = ordered.length - 1; index >= 0; index -= 1)
+                check(...ordered[index]);
+        })]);
+}
+async function readRepositoryAttempt(capture, boundaries, lane, ownReveal) {
+    const repository = capture.repository;
+    const { state, view, configuration, proof: source } = await collectState(capture, boundaries, lane, null, ownReveal);
+    const members = new Map();
+    const directoryWitnesses = new Map();
+    const walk = (directory, stats, prefix) => {
+        directoryWitnesses.set(directory, sourceSignature(stats));
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            if ([".git", ".amalgm"].includes(entry.name.toLowerCase()))
+                continue;
+            const path = prefix ? `${prefix}/${entry.name}` : entry.name;
+            const absolute = join(directory, entry.name);
+            if (boundaries.includes(path))
+                members.set(path, { kind: "boundary", directory: entry.isDirectory() });
+            else if (!entry.isDirectory())
+                members.set(path, { kind: "leaf" });
+            else if (hasGitMarker(absolute))
+                members.set(path, { kind: "repository" });
+            else {
+                const child = repositoryDirectoryStats(absolute);
+                members.set(path, { kind: "directory", stats: child });
+                walk(absolute, child, path);
+            }
+        }
+    };
+    walk(repository, repositoryDirectoryStats(repository), "");
+    const proof = repositoryNamespaceProof(source, directoryWitnesses);
+    await closeSource(proof);
+    return { repository, boundaries: [...boundaries], state, view, configuration, members, proof };
+}
+/** Judge one reading against one identity and the remainder it may keep.
+ * Remainder is accounted one member at a time, never by an excluded
+ * ancestor: it must keep its type and stay outside Git's index. */
+export function judgeRepository(reading, identity, remainder) {
+    if (reading.boundaries.join("\0") !== nestedRepositoryPaths(identity).join("\0")) {
+        throw new Error("repository reading is judged only under the boundaries it read");
+    }
+    const { state, view, configuration, members, proof } = reading;
+    const expected = new Map(identity.map(entry => [entry.path, entry]));
+    const kept = new Map(remainder.map(entry => [entry.path, entry]));
+    const indexed = new Set(view.index.map(entry => entry.path));
+    const keptStats = new Map();
+    let identityMatches = true;
+    for (const [path, member] of members) {
+        if (member.kind === "boundary") {
+            if (!member.directory)
+                identityMatches = false;
+            continue;
+        }
+        const wanted = expected.get(path) ?? kept.get(path);
+        if (!wanted || (kept.has(path) && indexed.has(path)))
+            identityMatches = false;
+        if (member.kind === "repository")
+            identityMatches = false;
+        else if (member.kind === "directory") {
+            if (wanted?.type !== "folder")
+                identityMatches = false;
+            else if (kept.has(path))
+                keptStats.set(path, member.stats);
+        }
+        else if (!view.leaves.has(path))
+            identityMatches = false;
+        else if (kept.has(path)) {
+            const leaf = view.leaves.get(path);
+            if (leaf.type !== wanted.type)
+                identityMatches = false;
+            else
+                keptStats.set(path, leaf.stats);
+        }
+    }
+    if (identity.some(entry => entry.type !== "repo.git" && !members.has(entry.path)))
+        identityMatches = false;
+    const observedIdentity = literalRepositoryIdentity(identity, view);
+    const expectedState = remainder.length === 0 ? state : withoutUntracked(state, path => !expected.has(path));
+    const observedRemainder = literalRepositoryIdentity(remainder.filter(entry => keptStats.has(entry.path)), view);
+    const observedPayload = repositoryPayloadVersion({ stateId: state.stateId,
+        identityHash: repositoryIdentityHash([...observedIdentity, ...observedRemainder], sha256Hex) }, sha256Hex);
+    const binding = view.sourceBinding;
+    return { stateId: expectedState.stateId, identityHash: repositoryIdentityHash(observedIdentity, sha256Hex),
+        identityMatches, observedPayload,
+        remainder: observedRemainder.map(entry => ({ entry, stats: keptStats.get(entry.path) })),
+        proof,
+        pair: (uuid, directory) => observationPair(uuid, directory, observedPayload, configuration, binding, proof) };
 }
 /** One observed repository moment reproduces one immutable transport exactly
- * when its state, Card and identity map all agree with it. */
+ * when its complete Git state and identity map agree with it. */
 export function repositoryObservationMatches(observed, identity, prior) {
-    return repositoryObservationMatchesState(observed, prior)
-        && prior.identityHash === planRepositoryIdentity(identity, null, sha256Hex).identityHash;
-}
-/** Card + Checkpoint are the complete physical Git state. Callers that must
- * also prove the transport's entity frontier use repositoryObservationMatches. */
-export function repositoryObservationMatchesState(observed, prior) {
     return observed.stateId === prior.stateId
-        && JSON.stringify(prior.card) === JSON.stringify(observed.card);
+        && observed.identityMatches
+        && observed.identityHash === prior.identityHash
+        && prior.identityHash === repositoryIdentityMap(identity, sha256Hex).identityHash;
+}
+const ordinaryMember = (entry) => ["file.text", "file.binary", "link"].includes(entry.type);
+/** Compile the selected working files over the observed native Git history,
+ * index and continuation. Retained members keep their advertised content
+ * witnesses; immutable byte sources never become physical stat evidence.
+ * Every other selected member is read once, on a content thread, and must
+ * reproduce the type and payload its entry declares. */
+export async function captureSelectedRepository(observed, identity, retained, lane, prior, previousIdentity) {
+    const repository = observed.capture.repository;
+    const selected = new Map(identity.map(entry => [entry.path, entry]));
+    if (selected.size !== identity.length)
+        throw new Error("selected repository contains duplicate paths");
+    const examined = new Set();
+    const indexed = new Set(observed.view.index.map(entry => entry.path));
+    const boundaries = nestedRepositoryPaths(identity);
+    const additionalPaths = identity.filter(entry => ordinaryMember(entry) && !indexed.has(entry.path)).map(entry => entry.path);
+    const reads = (await checkpointReads(observed.view.index, boundaries, additionalPaths)).filter(({ path }) => {
+        const entry = selected.get(path);
+        return entry !== undefined && ordinaryMember(entry) && !retained.has(path);
+    });
+    const current = await observeLiteralPaths(repository, observed.view.format, reads, new PhysicalPathWitnesses(), lane);
+    const view = await PrivateGitView.open(observed.view.sourceBinding, observed.state.card.shallow);
+    let constructed;
+    try {
+        constructed = await constructLiteralCheckpoint({
+            view, index: observed.view.index, commit: observed.state.card.head.commit, boundaries, additionalPaths,
+            read: path => {
+                const entry = selected.get(path);
+                if (!entry || !ordinaryMember(entry))
+                    return null;
+                const observation = current.get(path);
+                const leaf = retained.get(path) ?? (observation?.kind === "leaf" ? observation.leaf : null);
+                if (!leaf)
+                    throw new Error(`selected observed repository member is unavailable: ${path}`);
+                const payload = leafPayload(entry.payloadVersion, view.format, leaf);
+                if (entry.type !== leaf.type || entry.payloadVersion !== payload) {
+                    throw new Error(`selected repository source does not reproduce its member: ${path}`);
+                }
+                examined.add(path);
+                return leaf;
+            },
+        });
+        if (identity.some(entry => ordinaryMember(entry) && !examined.has(entry.path))) {
+            throw new Error("selected ordinary member overlaps an opaque Git owner");
+        }
+    }
+    finally {
+        await view.close();
+    }
+    const checkpoint = { ...observed.state.checkpoint, ...constructed };
+    const checkpointId = deriveCheckpointId(checkpoint, sha256Hex);
+    const state = { ...observed.state, checkpoint, checkpointId,
+        stateId: deriveStateId(observed.state.cardId, checkpointId, sha256Hex) };
+    return sealRepository({ ...observed, state }, await finishStepsInTurns(repositoryIdentityMapSteps(identity)), prior, previousIdentity);
 }
-/** Capture one semantic repository state. A chainable capture packs only Git
- * objects absent from its parent and only changed identity-map paths. */
-export function captureRepository(repository, identity, prior, previousIdentity = null) {
-    const state = captureState(repository, nestedRepositoryPaths(identity));
-    const capturedIdentity = identityFromCheckpoint(identity, state);
-    if (prior && repositoryObservationMatches(state, capturedIdentity, prior)) {
-        return { ...prior, state, identity: capturedIdentity, bytes: null };
+async function sealRepository(observed, identity, prior, previousIdentity) {
+    const { capture, state, view, configuration, proof } = observed;
+    if (prior && state.stateId === prior.stateId && identity.identityHash === prior.identityHash) {
+        return { ...prior, capture, state, view, configuration, identity, bytes: null, proof };
     }
     // A repository delta extends the immutable parent transport, never the
     // machine's mutable SQLite projection. Detect may already have recorded a
     // child move before the enclosing repository capture runs. If the proposed
     // base does not reproduce the parent's declared identity map, seal one
     // self-contained transport instead of emitting a lying delta.
-    const chainable = prior !== null && previousIdentity !== null
-        && repositoryIdentityHash(previousIdentity, sha256Hex) === prior.identityHash;
-    const identityPlan = planRepositoryIdentity(capturedIdentity, chainable ? previousIdentity : null, sha256Hex);
+    const previous = prior !== null && previousIdentity?.identityHash === prior.identityHash ? previousIdentity : null;
     const captured = {
         ...state,
-        pack: nativePack(repository, state, chainable ? prior.card : null),
+        pack: await nativePack(view.sourceBinding, state, previous ? prior.card : null),
     };
     const bytes = bufferView(encodeRepositoryTransport(captured, {
-        parentTransportVersion: chainable ? prior.transportVersion : null,
-        ...identityPlan,
+        parentTransportVersion: previous ? prior.transportVersion : null,
+        identityHash: identity.identityHash,
+        identityDelta: repositoryIdentityDelta(identity, previous?.entries ?? null),
     }));
     return {
+        capture,
         state: captured,
-        identity: capturedIdentity,
+        view,
+        configuration,
+        identity,
         stateId: captured.stateId,
         transportVersion: sha256Hex(bytes),
         card: captured.card,
-        identityHash: identityPlan.identityHash,
+        identityHash: identity.identityHash,
         bytes,
+        proof,
     };
 }
 // Git closes immutable objects after making them read-only. Its own writer
@@ -422,15 +467,16 @@ export function captureRepository(repository, identity, prior, previousIdentity
 // user configuration. The final staging barrier still owns every other file.
 const DURABLE_GIT_ARGS = ["-c", "core.fsync=all", "-c", "core.fsyncMethod=fsync"];
 function runDurableGit(repository, args, input) {
-    return runGit(repository, [...DURABLE_GIT_ARGS, ...args], input);
+    return runGit(repository, [...DURABLE_GIT_ARGS, ...args], { input, purpose: "apply" });
 }
 /** Only these immutable object components are flushed by Git's writer
  * contract. Other files, including pack retention markers, remain the final
  * barrier's responsibility. The object directory comes from its owner, Git.
  * Scan only fresh materialization; incremental Apply never walks old packs. */
-function gitObjectFiles(repository) {
-    const objects = resolve(repository, gitText(repository, ["rev-parse", "--git-path", "objects"]));
-    const hashLength = gitText(repository, ["rev-parse", "--show-object-format"]) === "sha256" ? 64 : 40;
+async function gitObjectFiles(repository) {
+    const binding = { purpose: "binding" };
+    const objects = resolve(repository, await gitText(repository, ["rev-parse", "--git-path", "objects"], binding));
+    const hashLength = await gitText(repository, ["rev-parse", "--show-object-format"], binding) === "sha256" ? 64 : 40;
     const loose = new RegExp(`^[0-9a-f]{${hashLength - 2}}$`);
     const packed = new RegExp(`^pack-[0-9a-f]{${hashLength}}\\.(pack|idx|rev)$`);
     const files = [];
@@ -445,105 +491,77 @@ function gitObjectFiles(repository) {
     }
     return files;
 }
-function newlyDurableGitObjects(repository, priorFiles) {
-    return priorFiles === null ? [] : gitObjectFiles(repository)
+async function newlyDurableGitObjects(repository, priorFiles) {
+    return priorFiles === null ? [] : (await gitObjectFiles(repository))
         .filter((file) => !priorFiles.has(file)).map(recordFileDurability);
 }
-function installShallowBoundary(repository, commits) {
-    if (commits.length === 0)
+async function installShallowBoundary(repository, commits) {
+    const file = resolve(repository, await gitText(repository, ["rev-parse", "--git-path", "shallow"], { purpose: "binding" }));
+    if (commits.length === 0) {
+        rmSync(file, { force: true });
         return;
-    const file = resolve(repository, gitText(repository, ["rev-parse", "--git-path", "shallow"]));
+    }
     mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, `${[...commits].sort().join("\n")}\n`);
-}
-/** One ref transaction: every Card ref at its commit, every other ref gone.
- * The Card's ref set was validated once when the transport was decoded, and
- * `update-ref` itself refuses malformed names and missing objects. */
-function forceRefs(repository, state) {
-    const keep = new Set(state.card.refs.map((ref) => ref.name));
-    const existing = tryGitText(repository, [
-        "for-each-ref", "--format=%(refname)", "refs",
-    ]);
+    // Renamed over as a new inode, never written in place.
+    atomicWrite(file, `${[...commits].sort().join("\n")}\n`, 0o644);
+}
+/** Card refs replace the stored ref set in two steps, because Git 2.39's
+ * `update-ref --stdin` has no symbolic verb. One transaction writes every
+ * direct value and deletes every stored ref the Card lacks. Card names are
+ * literal, so no update or delete may follow a symbolic ref (a clone's
+ * `refs/remotes/origin/HEAD` would otherwise write `origin/main` twice), and
+ * only the command-line flag covers every command; `option no-deref` covers
+ * one. Each differing symbolic relationship is then set by name. The stored
+ * set includes the loose store, since for-each-ref omits a dangling or cyclic
+ * symbolic ref that must still go. Rerunning both steps is idempotent. */
+async function forceRefs(repository, state) {
+    const wanted = new Set(state.card.refs.map((ref) => ref.name));
+    const listed = await gitText(repository, ["for-each-ref", "--format=%(refname)", "refs"], { purpose: "apply" });
+    const stored = looseRefs(repository);
     const commands = [
-        ...state.card.refs.map((ref) => `update ${ref.name} ${ref.commit}`),
-        ...(existing ?? "").split("\n")
-            .filter((ref) => ref && ref !== "refs/stash" && !keep.has(ref))
-            .map((ref) => `delete ${ref}`),
+        ...state.card.refs.flatMap((ref) => ref.kind === "direct" ? [`update ${ref.name} ${ref.commit}`] : []),
+        ...[...new Set([...(listed ? listed.split("\n") : []), ...stored.keys()])]
+            .filter((name) => name !== "refs/stash" && !wanted.has(name))
+            .map((name) => `delete ${name}`),
         "",
     ];
-    runDurableGit(repository, ["update-ref", "--stdin"], Buffer.from(commands.join("\n"), "utf8"));
+    await runDurableGit(repository, ["update-ref", "--no-deref", "--stdin"], Buffer.from(commands.join("\n"), "utf8"));
+    for (const ref of state.card.refs) {
+        if (ref.kind !== "symbolic")
+            continue;
+        const current = stored.get(ref.name)?.();
+        if (current?.kind === "symbolic" && current.target === ref.target)
+            continue;
+        await runDurableGit(repository, ["symbolic-ref", ref.name, ref.target]);
+    }
 }
 /** Git keeps the stash stack only in the `refs/stash` reflog, so a differing
  * stack is rebuilt by value: drop the ref and its log, then store every entry
  * oldest first. An equal stack is left untouched. */
-function forceStash(repository, state) {
+async function forceStash(repository, state) {
     const wanted = state.card.stash;
-    const current = stashList(repository);
+    const current = await stashList(repository);
     if (current.length === wanted.length && current.every((entry, index) => entry.commit === wanted[index].commit && entry.message === wanted[index].message)) {
         return;
     }
-    runDurableGit(repository, ["update-ref", "-d", "refs/stash"]);
+    await runDurableGit(repository, ["update-ref", "-d", "refs/stash"]);
     for (let index = wanted.length - 1; index >= 0; index -= 1) {
         const entry = wanted[index];
-        runDurableGit(repository, ["stash", "store", `--message=${entry.message}`, entry.commit]);
+        await runDurableGit(repository, ["stash", "store", `--message=${entry.message}`, entry.commit]);
     }
 }
-function forceHead(repository, state) {
+async function forceHead(repository, state) {
     const { head } = state.card;
-    if (head.commit === null) {
-        if (!head.branch)
-            throw new Error("unborn repository state has no branch");
-        runDurableGit(repository, ["symbolic-ref", "HEAD", `refs/heads/${head.branch}`]);
-        runDurableGit(repository, ["read-tree", "--empty"]);
-        runDurableGit(repository, ["clean", "-fdq"]);
-        return;
-    }
-    if (head.branch === null) {
-        runDurableGit(repository, ["-c", "advice.detachedHead=false", "checkout", "--force", "--quiet", "--detach", head.commit]);
+    if (head.branch !== null) {
+        await runDurableGit(repository, ["symbolic-ref", "HEAD", `refs/heads/${head.branch}`]);
     }
-    else {
-        runDurableGit(repository, ["symbolic-ref", "HEAD", `refs/heads/${head.branch}`]);
-        runDurableGit(repository, ["reset", "--hard", "--quiet"]);
-    }
-    runDurableGit(repository, ["clean", "-fdq"]);
-}
-function writeCheckpointLeaf(repository, path, leaf) {
-    const absolutePath = join(repository, path);
-    if (leaf === null) {
-        rmSync(absolutePath, { recursive: true, force: true });
-        return;
-    }
-    if (leaf.content === null)
-        throw new Error(`repository transport omitted conflict content for ${path}`);
-    mkdirSync(dirname(absolutePath), { recursive: true });
-    if (leaf.mode === "120000") {
-        rmSync(absolutePath, { force: true });
-        symlinkSync(Buffer.from(leaf.content).toString("utf8"), absolutePath);
-        return;
+    else if (head.commit !== null) {
+        await runDurableGit(repository, ["update-ref", "--no-deref", "HEAD", head.commit]);
     }
-    writeFileSync(absolutePath, leaf.content);
-    chmodSync(absolutePath, leaf.mode === "100755" ? 0o755 : 0o644);
+    else
+        throw new Error("unborn repository state has no branch");
 }
-function installUnmergedIndex(repository, entries) {
-    if (entries.length === 0)
-        return;
-    const objectFormat = gitText(repository, ["rev-parse", "--show-object-format"]);
-    const zero = "0".repeat(objectFormat === "sha256" ? 64 : 40);
-    const records = entries.flatMap((entry) => [
-        `0 ${zero}\t${entry.path}`,
-        ...entry.stages.map((stage) => `${stage.mode} ${stage.objectId} ${stage.stage}\t${entry.path}`),
-    ]);
-    runDurableGit(repository, ["update-index", "-z", "--index-info"], Buffer.from(`${records.join("\0")}\0`, "utf8"));
-    for (const entry of entries) {
-        // A conflict made only of gitlink stages belongs to the nested repository
-        // rail. The parent owns the opaque index entries, but never creates,
-        // replaces, or removes that nested worktree.
-        if (entry.stages.every((stage) => stage.mode === "160000"))
-            continue;
-        writeCheckpointLeaf(repository, entry.path, entry.worktree);
-    }
-}
-function installMergeOperation(repository, operation) {
+async function installMergeOperation(repository, operation) {
     const directory = gitDirectory(repository);
     for (const file of ["MERGE_HEAD", "MERGE_MSG", "MERGE_MODE"]) {
         rmSync(join(directory, file), { force: true });
@@ -554,120 +572,34 @@ function installMergeOperation(repository, operation) {
     writeFileSync(join(directory, "MERGE_MSG"), operation.message);
     writeFileSync(join(directory, "MERGE_MODE"), operation.mode);
 }
-function applyCheckpoint(repository, state) {
-    if (state.checkpoint.stagedPatch.length > 0) {
-        runDurableGit(repository, ["apply", "--index", "--binary", "--whitespace=nowarn"], state.checkpoint.stagedPatch);
-    }
-    if (state.checkpoint.unstagedPatch.length > 0) {
-        runDurableGit(repository, ["apply", "--binary", "--whitespace=nowarn"], state.checkpoint.unstagedPatch);
-    }
-    installUnmergedIndex(repository, state.checkpoint.unmerged);
-    installMergeOperation(repository, state.checkpoint.operation);
-    for (const file of state.checkpoint.untracked) {
-        if (file.content === null)
-            throw new Error(`repository transport omitted untracked content for ${file.path}`);
-        const absolutePath = join(repository, file.path);
-        mkdirSync(dirname(absolutePath), { recursive: true });
-        if (file.mode === "120000") {
-            rmSync(absolutePath, { force: true });
-            symlinkSync(Buffer.from(file.content).toString("utf8"), absolutePath);
-        }
-        else {
-            writeFileSync(absolutePath, file.content);
-            chmodSync(absolutePath, file.mode === "100755" ? 0o755 : 0o644);
-        }
-    }
-}
-function importPack(repository, state) {
-    if (!state.pack)
-        return;
-    if (sha256Hex(state.pack.bytes) !== state.pack.sha256) {
-        throw new Error("repository Git pack checksum mismatch");
-    }
-    runDurableGit(repository, [
-        "index-pack", "--stdin", "--fix-thin", "--keep=amalgm repository transport",
-    ], state.pack.bytes);
-}
-function initializeMaterializedRepository(repository) {
+async function initializeMaterializedRepository(repository, format) {
     // Older Git accepts unknown -c keys without implementing their contract.
     // The writer acknowledgement requires core.fsync/core.fsyncMethod, which
     // became available in Git 2.36; admit that capability before any Git writes.
-    const version = gitText(repository, ["--version"]);
+    const { version } = gitHost();
     const parsed = /^git version (\d+)\.(\d+)\.(\d+)(?:[.\s-]|$)/.exec(version);
     if (!parsed || Number(parsed[1]) < 2 || (Number(parsed[1]) === 2 && Number(parsed[2]) < 36)) {
         throw new Error(`Git 2.36 or newer is required for durable repository materialization; found ${version}`);
     }
-    runDurableGit(repository, ["init", "--quiet"]);
-    // A Card is Git object truth. The receiver's global Windows preference
-    // cannot rewrite those bytes during materialization.
-    runDurableGit(repository, ["config", "core.autocrlf", "false"]);
+    if (hasGitMarker(repository) && await gitText(repository, ["rev-parse", "--show-object-format"], { purpose: "binding" }) !== format) {
+        throw new Error("repository object format differs from accepted state");
+    }
+    await runDurableGit(repository, ["init", "--quiet", `--object-format=${format}`, "--template="]);
 }
-function forceRemotes(repository, remotes) {
-    const existing = (tryGitText(repository, ["remote"]) ?? "").split("\n").filter(Boolean);
+async function forceRemotes(repository, remotes) {
+    const existing = (await gitText(repository, ["remote"], { purpose: "apply" })).split("\n").filter(Boolean);
     const wanted = new Map(remotes.map((remote) => [remote.name, remote.url]));
     for (const name of existing) {
         if (!wanted.has(name))
-            runDurableGit(repository, ["remote", "remove", name]);
+            await runDurableGit(repository, ["remote", "remove", name]);
     }
     for (const [name, url] of wanted) {
         if (existing.includes(name))
-            runDurableGit(repository, ["remote", "set-url", name, url]);
+            await runDurableGit(repository, ["remote", "set-url", name, url]);
         else
-            runDurableGit(repository, ["remote", "add", name, url]);
+            await runDurableGit(repository, ["remote", "add", name, url]);
     }
 }
-/** Materialize a complete transport chain and then re-derive its semantic
- * state. The oldest node must be self-contained; every later node must name
- * the exact predecessor whose Git objects and identity map it extends. */
-export function applyRepository(repository, chain) {
-    if (chain.length === 0)
-        throw new Error("repository transport chain is empty");
-    const transports = [];
-    let priorVersion = null;
-    let identity = null;
-    for (const bytes of chain) {
-        const state = decodeRepositoryTransport(bytes);
-        if (state.parentTransportVersion !== priorVersion) {
-            throw new Error("repository transport chain is discontinuous");
-        }
-        identity = applyRepositoryIdentity(identity, state, sha256Hex);
-        transports.push(state);
-        priorVersion = sha256Hex(bytes);
-    }
-    const state = transports.at(-1);
-    mkdirSync(repository, { recursive: true });
-    const fresh = !hasGitMarker(repository);
-    initializeMaterializedRepository(repository);
-    // An init template may carry pre-existing objects. Git has not necessarily
-    // written them, so their presence cannot become a durability acknowledgement.
-    const priorFiles = fresh ? new Set(gitObjectFiles(repository)) : null;
-    markRepositoryReveal(repository);
-    forceRemotes(repository, state.card.remotes);
-    for (const transport of transports)
-        importPack(repository, transport);
-    installShallowBoundary(repository, state.card.shallow ?? []);
-    forceRefs(repository, state);
-    forceStash(repository, state);
-    forceHead(repository, state);
-    applyCheckpoint(repository, state);
-    const proof = captureState(repository, nestedRepositoryPaths(identity), true);
-    if (proof.cardId !== state.cardId || proof.checkpointId !== state.checkpointId) {
-        throw new Error("materialized repository does not reproduce its declared state");
-    }
-    if (JSON.stringify(proof.card.shallow ?? []) !== JSON.stringify(state.card.shallow ?? [])) {
-        throw new Error("materialized repository does not reproduce its shallow boundary");
-    }
-    rmSync(join(gitDirectory(repository), REVEAL_MARKER), { force: true });
-    return {
-        stateId: state.stateId,
-        cardId: state.cardId,
-        checkpointId: state.checkpointId,
-        card: state.card,
-        transportVersion: priorVersion,
-        identity: identity,
-        durableFiles: newlyDurableGitObjects(repository, priorFiles),
-    };
-}
 function readExact(file, offset, bytes) {
     const result = Buffer.allocUnsafe(bytes);
     const descriptor = openSync(file, "r");
@@ -685,40 +617,75 @@ function readExact(file, offset, bytes) {
         closeSync(descriptor);
     }
 }
-export function inspectRepositoryTransportFile(file) {
-    const totalBytes = statSync(file).size;
-    const prefix = readExact(file, 0, 12);
-    const metadataBytes = repositoryTransportMetadataBytes(prefix);
-    return inspectRepositoryTransport(readExact(file, 0, metadataBytes), totalBytes);
+/** A transport's layout from its header alone; the pack and Checkpoint
+ * bytes it locates are never read. */
+export async function inspectRepositoryTransportFile(file) {
+    const handle = await open(file, "r");
+    try {
+        const { size } = await handle.stat();
+        const head = async (bytes) => {
+            const result = Buffer.allocUnsafe(bytes);
+            for (let cursor = 0; cursor < bytes;) {
+                const { bytesRead } = await handle.read(result, cursor, bytes - cursor, cursor);
+                if (bytesRead === 0)
+                    throw new Error("repository transport file is truncated");
+                cursor += bytesRead;
+            }
+            return result;
+        };
+        return inspectRepositoryTransport(await head(repositoryTransportMetadataBytes(await head(12))), size);
+    }
+    finally {
+        await handle.close();
+    }
 }
 const REPOSITORY_IDENTITY_CACHE_CONTRACT = "amalgm.repository-identity-cache.v1";
 const repositoryIdentityCacheFile = (cacheDir, transportVersion) => join(cacheDir, "repository-identities", `${transportVersion}.json`);
+/** Identity frontiers this process has proven, by immutable transport. A
+ * transport names exactly one map, so a proven frontier never goes stale; the
+ * bound, in entries, only limits memory. The newest frontier always stays. */
+const provenFrontiers = new Map();
+const PROVEN_FRONTIER_ENTRIES = 100_000;
+let provenFrontierEntries = 0;
+function rememberFrontier(transportVersion, identity) {
+    const known = provenFrontiers.get(transportVersion);
+    if (known)
+        provenFrontierEntries -= known.entries.length;
+    provenFrontiers.delete(transportVersion);
+    provenFrontiers.set(transportVersion, identity);
+    provenFrontierEntries += identity.entries.length;
+    for (const [version, frontier] of provenFrontiers) {
+        if (provenFrontierEntries <= PROVEN_FRONTIER_ENTRIES || version === transportVersion)
+            break;
+        provenFrontiers.delete(version);
+        provenFrontierEntries -= frontier.entries.length;
+    }
+}
 /** Seal the compact full identity frontier beside the current transport. The
  * evidence is disposable, but its content is accepted only when its hash
  * equals the immutable transport header that names it. */
-export function sealCachedRepositoryIdentity(cacheDir, transportVersion, identity, identityHash) {
-    const planned = planRepositoryIdentity(identity, null, sha256Hex);
-    if (planned.identityHash !== identityHash) {
+export async function sealCachedRepositoryIdentity(cacheDir, transportVersion, identity, identityHash) {
+    if (identity.identityHash !== identityHash) {
         throw new Error("repository identity evidence does not match its transport");
     }
-    const file = repositoryIdentityCacheFile(cacheDir, transportVersion);
-    atomicWrite(file, JSON.stringify({
+    rememberFrontier(transportVersion, identity);
+    await writeCacheHint(cacheDir, repositoryIdentityCacheFile(cacheDir, transportVersion), Buffer.from(JSON.stringify({
         contract: REPOSITORY_IDENTITY_CACHE_CONTRACT,
         transportVersion,
         identityHash,
-        identity: planned.identityDelta.upsert,
-    }));
+        identity: identity.entries,
+    }), "utf8"));
 }
-function readSealedRepositoryIdentity(cacheDir, transportVersion, identityHash) {
+async function readSealedRepositoryIdentity(cacheDir, transportVersion, identityHash) {
     try {
-        const value = JSON.parse(readFileSync(repositoryIdentityCacheFile(cacheDir, transportVersion), "utf8"));
+        const value = JSON.parse(await readFile(repositoryIdentityCacheFile(cacheDir, transportVersion), "utf8"));
         if (value.contract !== REPOSITORY_IDENTITY_CACHE_CONTRACT
             || value.transportVersion !== transportVersion
             || value.identityHash !== identityHash
             || !Array.isArray(value.identity))
             return null;
-        const planned = planRepositoryIdentity(value.identity, null, sha256Hex);
-        return planned.identityHash === identityHash ? planned.identityDelta.upsert : null;
+        const identity = await finishStepsInTurns(repositoryIdentityMapSteps(value.identity));
+        return identity.identityHash === identityHash ? identity : null;
     }
     catch {
         return null;
@@ -728,12 +695,17 @@ function readSealedRepositoryIdentity(cacheDir, transportVersion, identityHash)
  * repository transport. Compact sealed evidence survives ancestor-pack
  * pruning; without it, a complete cached chain is replayed once and seals the
  * frontier. No mutable entity row can substitute for either proof. */
-export function readCachedRepositoryIdentity(cacheDir, transportVersion) {
+export async function readCachedRepositoryIdentity(cacheDir, transportVersion) {
+    const proven = provenFrontiers.get(transportVersion);
+    if (proven)
+        return proven;
     try {
-        const current = inspectRepositoryTransportFile(join(cacheDir, `${transportVersion}.bin`));
-        const sealed = readSealedRepositoryIdentity(cacheDir, transportVersion, current.identityHash);
-        if (sealed)
+        const current = await inspectRepositoryTransportFile(join(cacheDir, `${transportVersion}.bin`));
+        const sealed = await readSealedRepositoryIdentity(cacheDir, transportVersion, current.identityHash);
+        if (sealed) {
+            rememberFrontier(transportVersion, sealed);
             return sealed;
+        }
         const reversed = [];
         const versions = new Set();
         let version = transportVersion;
@@ -741,10 +713,7 @@ export function readCachedRepositoryIdentity(cacheDir, transportVersion) {
             if (versions.has(version))
                 return null;
             versions.add(version);
-            const file = join(cacheDir, `${version}.bin`);
-            if (!existsSync(file))
-                return null;
-            const layout = inspectRepositoryTransportFile(file);
+            const layout = await inspectRepositoryTransportFile(join(cacheDir, `${version}.bin`));
             reversed.push({ version, layout });
             version = layout.parentTransportVersion;
         }
@@ -756,61 +725,42 @@ export function readCachedRepositoryIdentity(cacheDir, transportVersion) {
             identity = applyRepositoryIdentity(identity, node.layout, sha256Hex);
             parent = node.version;
         }
-        const result = identity ?? [];
-        sealCachedRepositoryIdentity(cacheDir, transportVersion, result, current.identityHash);
+        // Each applied node proved its declared map, the last one this header's.
+        const result = { entries: identity ?? [], identityHash: current.identityHash };
+        await sealCachedRepositoryIdentity(cacheDir, transportVersion, result, current.identityHash);
         return result;
     }
     catch {
         return null;
     }
 }
+async function* hashed(source, hash) {
+    for await (const chunk of source) {
+        hash.update(chunk);
+        yield chunk;
+    }
+}
 async function importPackFile(repository, file, pack) {
     const hash = createHash("sha256");
-    const witness = new Transform({
-        transform(chunk, _encoding, callback) {
-            hash.update(chunk);
-            callback(null, chunk);
-        },
-    });
-    const child = spawn("git", [
-        ...DURABLE_GIT_ARGS,
-        "index-pack", "--stdin", "--fix-thin", "--keep=amalgm repository transport",
-    ], {
-        cwd: repository,
-        stdio: ["pipe", "ignore", "pipe"],
-        env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_TEST_FSYNC: "1" },
-    });
-    const stderr = [];
-    child.stderr.on("data", (chunk) => stderr.push(chunk));
-    const completed = new Promise((resolveChild, rejectChild) => {
-        child.once("error", rejectChild);
-        child.once("close", (code) => {
-            if (code === 0)
-                resolveChild();
-            else
-                rejectChild(new Error(`git index-pack failed${stderr.length
-                    ? `: ${Buffer.concat(stderr).toString("utf8").trim()}` : ""}`));
-        });
-    });
     const source = createReadStream(file, {
         start: pack.range.offset,
         end: pack.range.offset + pack.range.bytes - 1,
     });
-    await Promise.all([pipeline(source, witness, child.stdin), completed]);
+    await runDurableGit(repository, ["index-pack", "--stdin", "--fix-thin", "--keep=amalgm repository transport"], hashed(source, hash));
     if (hash.digest("hex") !== pack.sha256)
         throw new Error("repository Git pack checksum mismatch");
 }
-/** Every transport's tips are present once its pack has landed, and each pack
- * closes over its parent's tips. Walking the chain from the newest node, the
- * first one whose tips the repository already holds ends what must be
+/** A transport's pack delivers every object its state wants, and each pack
+ * closes over its parent's wants. Walking the chain from the newest node,
+ * the first whose wants the repository already holds ends what must be
  * imported: only the ranges after it are absent. */
-function firstAbsentTransport(repository, transports) {
+async function firstAbsentTransport(repository, transports) {
     for (let index = transports.length - 1; index >= 0; index -= 1) {
-        const tips = cardTips(transports[index].layout.card);
-        if (tips.length === 0)
+        const wants = stateWants(transports[index].layout);
+        if (wants.length === 0)
             return index + 1;
-        const report = runGit(repository, ["cat-file", "--batch-check=%(objectname) %(objecttype)"], Buffer.from(`${tips.join("\n")}\n`, "utf8")).toString("utf8");
-        if (!report.split("\n").some((line) => line.endsWith(" missing")))
+        const report = await runGit(repository, ["cat-file", "--batch-check=%(objectname) %(objecttype)"], { input: Buffer.from(`${wants.join("\n")}\n`, "utf8"), purpose: "apply" });
+        if (!report.toString("utf8").split("\n").some((line) => line.endsWith(" missing")))
             return index + 1;
     }
     return 0;
@@ -818,72 +768,69 @@ function firstAbsentTransport(repository, transports) {
 function readRange(file, range) {
     return range.bytes === 0 ? Buffer.alloc(0) : readExact(file, range.offset, range.bytes);
 }
-function applyCheckpointFile(repository, file, checkpoint) {
-    const staged = readRange(file, checkpoint.stagedPatch);
-    if (staged.length > 0) {
-        runDurableGit(repository, ["apply", "--index", "--binary", "--whitespace=nowarn"], staged);
-    }
-    const unstaged = readRange(file, checkpoint.unstagedPatch);
-    if (unstaged.length > 0) {
-        runDurableGit(repository, ["apply", "--binary", "--whitespace=nowarn"], unstaged);
-    }
-    const unmerged = checkpoint.unmerged.map((entry) => {
-        if (entry.worktree?.content === null) {
-            throw new Error(`repository transport omitted conflict content for ${entry.path}`);
-        }
-        const content = entry.worktree === null
-            ? null
-            : readRange(file, entry.worktree.content);
-        if (content !== null && sha256Hex(content) !== entry.worktree?.sha256) {
-            throw new Error(`repository conflict content checksum mismatch for ${entry.path}`);
-        }
-        return {
-            path: entry.path,
-            stages: entry.stages,
-            worktree: entry.worktree === null ? null : {
-                mode: entry.worktree.mode,
-                sha256: entry.worktree.sha256,
-                content,
+/** A lazy byte view lets the portable validator govern file-backed replay
+ * without buffering the Git pack or all Checkpoint contents at once. Packs
+ * are hash-verified separately by the streaming importer before state writes. */
+function repositoryTransportFromFile(file, layout) {
+    return {
+        ...layout, pack: null,
+        checkpoint: {
+            ...layout.checkpoint,
+            stagedPatch: readRange(file, layout.checkpoint.stagedPatch),
+            unstagedPatch: readRange(file, layout.checkpoint.unstagedPatch),
+            untracked: layout.checkpoint.untracked.map(entry => ({ ...entry,
+                get content() { return entry.content === null ? null : readRange(file, entry.content); },
+            })),
+            unmerged: layout.checkpoint.unmerged.map(entry => ({ ...entry,
+                worktree: entry.worktree === null ? null : { ...entry.worktree,
+                    get content() { return entry.worktree.content === null ? null : readRange(file, entry.worktree.content); },
+                },
+            })),
+            operation: layout.checkpoint.operation === null ? null : {
+                ...layout.checkpoint.operation,
+                message: readRange(file, layout.checkpoint.operation.message),
+                mode: readRange(file, layout.checkpoint.operation.mode),
             },
-        };
-    });
-    installUnmergedIndex(repository, unmerged);
-    installMergeOperation(repository, checkpoint.operation === null ? null : {
-        kind: checkpoint.operation.kind,
-        heads: checkpoint.operation.heads,
-        message: readRange(file, checkpoint.operation.message),
-        mode: readRange(file, checkpoint.operation.mode),
+        },
+    };
+}
+function checkpointFileSource(file, checkpoint) {
+    const content = (range) => {
+        if (range === null)
+            throw new Error("repository transport omitted checkpoint content");
+        return readRange(file, range);
+    };
+    return {
+        baseCommit: checkpoint.baseCommit,
+        stagedPatch: readRange(file, checkpoint.stagedPatch),
+        unstagedPatch: readRange(file, checkpoint.unstagedPatch),
+        untracked: checkpoint.untracked.map(entry => ({ ...entry, read: () => content(entry.content) })),
+        unmerged: checkpoint.unmerged.map(entry => ({ ...entry,
+            worktree: entry.worktree === null ? null : { ...entry.worktree, path: entry.path,
+                read: () => content(entry.worktree.content) },
+        })),
+    };
+}
+async function applyCheckpointFile(repository, file, checkpoint, identity, ground, installMetadata) {
+    await installLiteralCheckpoint(repository, checkpointFileSource(file, checkpoint), identity, ground, installMetadata);
+    await installMergeOperation(repository, checkpoint.operation === null ? null : {
+        kind: checkpoint.operation.kind, heads: checkpoint.operation.heads,
+        message: readRange(file, checkpoint.operation.message), mode: readRange(file, checkpoint.operation.mode),
     });
-    for (const entry of checkpoint.untracked) {
-        if (entry.content === null) {
-            throw new Error(`repository transport omitted untracked content for ${entry.path}`);
-        }
-        const content = readRange(file, entry.content);
-        if (sha256Hex(content) !== entry.sha256) {
-            throw new Error(`repository untracked content checksum mismatch for ${entry.path}`);
-        }
-        const absolutePath = join(repository, entry.path);
-        mkdirSync(dirname(absolutePath), { recursive: true });
-        if (entry.mode === "120000") {
-            rmSync(absolutePath, { force: true });
-            symlinkSync(content.toString("utf8"), absolutePath);
-        }
-        else {
-            writeFileSync(absolutePath, content);
-            chmodSync(absolutePath, entry.mode === "100755" ? 0o755 : 0o644);
-        }
-    }
 }
-/** Apply sealed repository artifacts by streaming each Git range directly
- * into index-pack. Download already verified each complete transport hash. */
-export async function applyRepositoryFiles(repository, chain) {
+/** Shared immutable chain validation for retained contents and installation. */
+async function readRepositoryChain(chain) {
     if (chain.length === 0)
         throw new Error("repository transport chain is empty");
     const transports = [];
     let priorVersion = null;
     let identity = null;
     for (const sealed of chain) {
-        const layout = inspectRepositoryTransportFile(sealed.file);
+        if (await hashContentFile(sealed.file) !== sealed.transportVersion) {
+            throw new Error("repository transport failed its immutable hash");
+        }
+        const layout = await inspectRepositoryTransportFile(sealed.file);
+        assertRepositoryTransportTruth(repositoryTransportFromFile(sealed.file, layout), sha256Hex);
         if (layout.parentTransportVersion !== priorVersion) {
             throw new Error("repository transport chain is discontinuous");
         }
@@ -892,40 +839,76 @@ export async function applyRepositoryFiles(repository, chain) {
         priorVersion = sealed.transportVersion;
     }
     const latest = transports.at(-1);
+    return { transports, latest, identity: identity, transportVersion: priorVersion };
+}
+/** Recover retained working bytes from their immutable transport chain. This
+ * owns private Git objects only; it never checks out files or touches the live
+ * repository, its index, refs, or metadata. The caller must close the result. */
+export async function prepareRepositoryFiles(chain) {
+    const { transports, latest, identity } = await readRepositoryChain(chain);
+    const scratch = await mkdtemp(join(tmpdir(), "amalgm-retained-repository-"));
+    let checkpoint;
+    try {
+        await runGit(scratch, ["init", "--quiet", `--object-format=${latest.layout.card.objectFormat}`, "--template="], { purpose: "apply" });
+        for (const transport of transports) {
+            if (transport.layout.pack)
+                await importPackFile(scratch, transport.file, transport.layout.pack);
+        }
+        checkpoint = await prepareLiteralCheckpoint(scratch, checkpointFileSource(latest.file, latest.layout.checkpoint), identity);
+        return {
+            layout: latest.layout, identity, checkpoint,
+            close: async () => { await checkpoint.close(); await rm(scratch, { recursive: true, force: true }); },
+        };
+    }
+    catch (error) {
+        await checkpoint?.close();
+        await rm(scratch, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** Apply sealed repository artifacts by streaming each Git range directly
+ * into index-pack. Download already verified each complete transport hash. */
+export async function applyRepositoryFiles(repository, chain, ground) {
+    const { transports, latest, identity, transportVersion } = await readRepositoryChain(chain);
     const state = latest.layout;
     mkdirSync(repository, { recursive: true });
     const fresh = !hasGitMarker(repository);
-    const firstMissing = fresh ? 0 : firstAbsentTransport(repository, transports);
-    initializeMaterializedRepository(repository);
-    const priorFiles = fresh ? new Set(gitObjectFiles(repository)) : null;
-    markRepositoryReveal(repository);
-    forceRemotes(repository, state.card.remotes);
-    for (const transport of transports.slice(firstMissing)) {
+    await initializeMaterializedRepository(repository, state.card.objectFormat);
+    // An init template may carry pre-existing objects. Git has not necessarily
+    // written them, so their presence cannot become a durability acknowledgement.
+    const priorFiles = fresh ? new Set(await gitObjectFiles(repository)) : null;
+    const absent = fresh ? 0 : await firstAbsentTransport(repository, transports);
+    for (const transport of transports.slice(absent)) {
         if (transport.layout.pack) {
             await importPackFile(repository, transport.file, transport.layout.pack);
         }
     }
-    installShallowBoundary(repository, state.card.shallow ?? []);
-    forceRefs(repository, state);
-    forceStash(repository, state);
-    forceHead(repository, state);
-    applyCheckpointFile(repository, latest.file, state.checkpoint);
-    const proof = captureState(repository, nestedRepositoryPaths(identity), true);
+    await applyCheckpointFile(repository, latest.file, state.checkpoint, identity, ground, async () => {
+        markRepositoryReveal(repository);
+        await installShallowBoundary(repository, state.card.shallow ?? []);
+        await forceRemotes(repository, state.card.remotes);
+        await forceRefs(repository, state);
+        await forceStash(repository, state);
+        await forceHead(repository, state);
+    });
+    // A target proof only: kept remainder is accounted by Verify, not here.
+    const kept = ground.kind === "working" ? ground.remainder : new Set();
+    // The readback closes before its reveal marker retires.
+    const reading = await readRepository(repository, nestedRepositoryPaths(identity), "apply", true);
+    const proof = withoutUntracked(reading.state, path => kept.has(path));
     if (proof.cardId !== state.cardId || proof.checkpointId !== state.checkpointId) {
         throw new Error("materialized repository does not reproduce its declared state");
     }
-    if (JSON.stringify(proof.card.shallow ?? []) !== JSON.stringify(state.card.shallow ?? [])) {
-        throw new Error("materialized repository does not reproduce its shallow boundary");
-    }
     rmSync(join(gitDirectory(repository), REVEAL_MARKER), { force: true });
     return {
         stateId: state.stateId,
         cardId: state.cardId,
         checkpointId: state.checkpointId,
         card: state.card,
-        transportVersion: priorVersion,
-        identity: identity,
-        durableFiles: newlyDurableGitObjects(repository, priorFiles),
+        transportVersion,
+        identity,
+        durableFiles: await newlyDurableGitObjects(repository, priorFiles),
+        reading,
     };
 }
 //# sourceMappingURL=git-repository-host.js.map