@amalgm/shell 0.1.164-preview.36072132286 → 0.1.164-preview.36809057014

package/PURPOSE.md

@@ -10,6 +10,56 @@ At the completed brick/mortar boundary, compatible bricks advance through indepe
 remains the mortar; publishing a brick must not require publishing unchanged
 Shell code.
 
+## Detect and Apply attribution
+
+An originating machine may resolve its own accepted publication without
+claiming that every local byte matches the shared result. The proof is the
+exact acknowledged Outbox record, its authoritative Inbox position, and the
+still-current admission attached to the sharing baseline. A new sharing
+decision invalidates the previous admission even if it returns to equal values;
+a metadata refresh does not. Covered member changes invalidate their repository
+owner's admission, while an independent nested repository head does not change
+the outer repository's placement. This outcome preserves physical observation,
+the sharing baseline, and the last verified materialization. Existing effect
+recovery must finish before this shortcut can resolve history. This boundary
+is being implemented; the full native Apply examination has not passed it yet.
+
+One read-only view of bound, nonterminal Apply recovery receipts protects original
+participants and source/destination cones during Detect. Root and path coverage
+remain distinct from ownership: the walk leaves each owned cone unread inside its
+root and admits the root's independent units; only a cone containing the root, or
+Register and first-login declaration, defer the whole root. No deferred row is
+refreshed, erased, or admitted through ignore policy. Register and declaration
+recheck exact ownership answers, including absence, alongside the physical and
+SQLite basis; a unit walk relies on its lease, which every later Apply effect
+crosses under its ground hold.
+Terminal commit wakes original receipt scopes before private cleanup. A self-owned
+capture enters original-effect cancellation; a foreign-owned capture releases its
+attempt and waits on the named Apply producer. Neither means the edit was recorded.
+Fresh Apply attempt UUIDs prevent delayed proof from acting on a replacement intent.
+Apply admission and terminal preparation obey that same ownership predicate;
+matching bytes do not release another attempt's recovery responsibility. Original
+participants retain protection at their currently attributed addresses. An
+unfinished Apply holds only its own root: identity continuity is root-local, so
+an object it owns is named within its binding, and an inode number it freed that
+the filesystem gives another root's file holds nothing back there. Detect's
+identity candidates are likewise one root's rows at an object, and a shared
+object joins admission units only within one root; an object's names across
+roots are hard-link aliases, examined each in its own root. Capture
+completion waits only on its actual Watch roots. A binding that cannot be reached
+now is inaccessible, not wrong: its durable intent still owns the ground bound
+there while its receipt, kept in that binding's control tree, waits unread. A
+binding proved to be another object is unsafe. Neither poisons unrelated roots.
+One preimage association represents source roots (including leaves) and descendant
+directories. Primary and collateral renames use one placement checker; cancellation
+repairs only proved O addresses under their actual binding, never B or accepted
+history. Admission and receipt binding share one SQLite write transaction, including
+physical aliases whose pathname leases do not overlap. Private unbound receipt
+files grant no effects and cannot be adopted as earlier effect evidence.
+Controlled full-ideal checks cover these recovery paths, including a stopped
+primary rename and a second Apply targeting a still-owned collateral participant.
+Complete native and multi-machine convergence remain unproved.
+
 ## Operating axioms
 
 For outgoing email, Shell supplies its source computer and home directory to
@@ -33,9 +83,10 @@ migration is out of scope because no existing Engine users need it.
 - **O2 — Failure stays with its owner.** A failed workload degrades its own
   capability and declared dependants without restarting its parent or unrelated
   capabilities.
-- **O3 — Recovery has an end.** Automatic process recovery reaches sustained
-  health or a durable parked state within a finite attempt budget that parent
-  restarts and elapsed backoff cannot replenish.
+- **O3 — The runtime is always on.** Only an operator stop ends it. Every
+  other exit is a crash, and a crash is retried forever after a delay capped
+  at five minutes; a slow runtime is alive, and only sustained silence ends a
+  generation. An update is a trial: the last good release is home.
 - **O4 — Health observation stays available.** Local control and liveness
   perform bounded work independently of product readiness, cloud connectivity,
   and workload size.
@@ -52,6 +103,140 @@ gap to resolve at its owning SDK, not a reason to perpetuate the violation.
 
 ## Axioms
 
+Detect observes physical truth so local files keep their identity whether or not
+sharing policy selects them. Record admits only a coherent selected result;
+Send retries that immutable promise. Physical associations and the sharing
+baseline are distinct inventories, with one permanent UUID domain. The physical
+index retains last-proven-positive associations. Unresolved disappearance keeps
+that association until a complete examination distinguishes a move from removal;
+proved removal releases it, while nonreused UUID revisions and shared history
+remain. An absent row never proves disk absence. Watch/coverage and Add/Apply
+intents own uncertainty; no parallel absent-entity inventory is introduced.
+Every Detect lane now reads physical identity from this index and compares changes
+against the separate sharing baseline. Sharing rows never supply a missing
+physical address or inode association. One explicit
+ground store derives affected dependency keys from actual before/after writes;
+a transaction advances each affected key once and no-op writes advance none.
+An unrelated content edit cannot invalidate another entity's structural basis.
+Every database fact used by one observation must remain jointly valid at
+admission, alongside its closing source proof. An adaptive observer may add a
+previously unread dependency in a short read transaction; it never renews an
+existing dependency token. Admission closes the read set and checks every token
+and complete query predicate together before any write. Apply
+invalidates old observation permission before changing bytes, while its intent
+retains ownership of incomplete effects. Every Detect lane implements selection
+before Record; native completion with excluded local Git state remains open.
+`ground-store.ts` now owns all projection writes and atomic slot permutations.
+`ground-basis.ts` records short coherent original read receipts, with per-UUID
+revisions that survive row removal. Broad Record checks both physical and sharing
+bases. The named lane now accumulates indexed path, candidate, ancestor and
+subtree receipts before closing the read set. Bound Apply receipts protect physical
+attribution. Snapshot callbacks cannot write through the same connection, and repeated reads
+retain their first dependency token. Scoped creation requires a never-used UUID;
+a missing historical UUID needs its own original expectation. Failed
+batches roll back even if their caller catches an individual placement error.
+A shared content edit does not invalidate a separate parent's namespace proof.
+Optional examination evidence preserves each admission batch's original and final
+ground rows and exact appended records after its outer commit, including B-only
+changes. It never reconstructs a prior admission from later database state and
+never becomes another product journal or admission dependency.
+An observation owns every capture it starts until that read settles. Capture
+admission backpressures the walk at its fixed concurrency; failure stops new
+admission and drains already started work before the attempt returns. The same
+capture owner serves Register without changing its enrollment or upload journey.
+Independent read failures survive draining; source churn cannot hide an I/O error.
+Publication ownership never erases known sharing lineage. A child leaving a Git
+parcel requires complete standalone cargo and one record even when unchanged;
+its selected parent transition and required records commit together.
+A pending logical root must have an observed physical coverage owner before
+broad reconciliation can settle it; a missing owner is requested for the next
+held pass without consuming the nested responsibility.
+A named observation retains its physical source evidence until Record; reading
+another file or sealing a repository cannot make an earlier unvalidated read
+safe. Closing proof checks only the retained paths and ancestry, and retains
+owned values rather than caller-mutable Stats objects. Re-proving unchanged
+content retains its already sufficient content-read timestamp; access time alone
+is not a projection mutation or an invalidation of another observation.
+
+Each admission closes an original source proof once at its final requested
+position; distinct proof owners and the physical opening/closing bracket remain
+separate. Later phases must recheck the same original evidence. A retained Git
+reuse proof rereads semantic config and stash, then closes all its original
+file, absence, namespace and invocation witnesses. It never replaces a failed
+original with a newly equal digest. Optional seal eligibility may fail without
+discarding independently proved full capture; required reuse failure refuses
+admission. No working-file content or parcel is retained by this proof owner.
+Ongoing broad collection may prepare a provisional reuse decision without an
+intermediate complete close. Its enclosing root and Record boundaries must close
+the retained proof, including zero-record passes. Standalone observations,
+optional seal writes and cold journeys retain their closed contracts.
+
+Missing Git metadata keeps the first proved missing entry beneath its original
+physical parent. A missing suffix needs no invented directories. If that entry
+appears, the original proof rejects even when a deeper entry remains absent;
+closing never discovers a replacement reason for absence. Obstructions and read
+errors are not absence, and an obstruction's bytes need not be read. Repository
+availability and storage association remain separate binding obligations.
+
+A repository's O row may carry one local configuration-observation stamp.
+It binds the original value-bearing Git answer, invocation and physical binding
+to that UUID and actual observed payload; it is neither shared state nor cargo.
+The same captured configuration supplies Card remotes, so adjacent unrelated
+reads cannot certify a false pair. GroundStore commits the pair atomically. Fresh installation is an explicit
+repository-observation input; ordinary serialized rows may retain a still-valid
+stamp or clear it, but cannot manufacture a new observation by changing a hash.
+A parcel-reuse seal must compare its original configuration and semantic stash
+answers with those that produced the captured result before closing. Two
+independently successful observations never prove that pair. Initial native
+binding acquisition closes once against the subsequently captured prerequisites;
+later ordinary-layout closes retain those original inputs. Routing only compares this
+original O fact with current configuration and never refreshes it. Unknown, changed or unsupported proof retains complete repository
+responsibility, including disappearance of the last configuration contribution.
+Broad parcel reuse compares its freshly proved configuration and native binding
+against the original O stamp too. Other Git state and storage/alias proofs remain separate. Cold journeys may
+leave the fact unknown; B, received packages and acknowledgements cannot supply it.
+
+Apply's capture result distinguishes a completed observation from local-only
+changes and unresolved evidence. Live separately checks durable Outbox protection.
+Local-only work retains the intent and waits for a named Detect change before
+further effects; observing bytes never constitutes a backup. A matching target
+permits Verify only when its physical identity is established and no other
+effect remains. Every remaining effect passes the same local-work, preimage
+and destination checks under the complete ground scope. An interrupted effect
+owns a recovery obligation, never arbitrary later edits at its address. Recovery
+cannot be retired until its retained versions have an explicit safe disposition.
+Startup may settle history through an explicitly installed snapshot watermark;
+equality with a sharing row never manufactures a current materialization proof.
+The exact Apply outcome commits before private recovery deletion. The same
+intent then owns only a finite cleanup description; restart dispatches that
+responsibility without current O or old cargo. Cleanup hashes survivors with
+bounded streaming buffers, rejects replacements and unexpected objects, makes
+removal durable, and acknowledges only the matching nonreused terminal token.
+Collision recovery records original UUID-to-address moves and refuses retirement
+while rows and disk disagree. Repository Verify emits only its owned frontier;
+independent nested heads and observed/shared projections remain separate.
+Verify retains the metadata and closing witness from the content read itself,
+and an original database basis collected before deriving its output. Terminal
+commit rejects changed evidence and releases only the failed attempt's lease.
+Directory identity survives content equality: a replaced directory or ancestor
+must be reconciled before adoption or overwrite. Private preimages retain those
+directory identities too. Construct Verify hands its product result to the same
+terminal owner with an explicit absence of filesystem cleanup responsibilities.
+An immutable Apply receipt bounds every resumed effect. A changed forward plan
+does not enlarge that authority: reconcile an explained intermediate physical
+placement against its original basis, commit that correction with cancellation,
+retain newer sharing values and unresolved Inbox, then replan on the same rail.
+Recovery enters through the recorded cones before depending on a new parent or
+package. Every original effect still needs a disposition; unexplained ground
+retains its owner. Exact-target adoption may reach `revealed` without effects;
+that phase alone cannot suppress a later local edit. The current recovery
+cutover has controlled full-ideal evidence, including actual named Detect during
+row-before-rename recovery. The scoped receipt reader, deferred coverage and
+post-terminal wake are integrated as described above; the complete native and
+multi-machine examinations remain open.
+These Apply guard laws and the ignore publication host integration are being
+completed; component evidence is not a full-host pass.
+
 Sync has one persistent machine setting: paused or enabled. An absent setting
 keeps the existing enabled behavior; pausing persists an explicit choice.
 It lives outside package generations and changes only by explicit command.
@@ -77,7 +262,8 @@ authority, and Channels sends carry the trusted originating session identity.
 Until the owner saves Email defaults, Channels suggests them from this
 computer's last-used preferences; Shell offers them back only when the agent
 is installed here, resolves with that model, and can send, keeping the
-suggested folder only if it exists here and otherwise the agent's own.
+suggested folder only if it exists here and otherwise the agent's own, else the
+Workspaces folder.
 
 Registry acceptance and public installability are separate states; publication
 waits for the exact examined bytes to become readable before recording success.
@@ -94,6 +280,10 @@ Core's snapshot/event projection together, including when Files has no cloud rai
 One folder remains a direct link; a named group remembers its selected child;
 neither registration nor removal copies, moves, or deletes the linked contents.
 The machine workspace root exists before an unscoped chat can use it as its cwd.
+It is the one default folder: agent runs, automation steps, terminals and Email
+start there when nothing else is chosen, and a run started there also receives
+every registered folder outside it as an additional directory. Shell gives Chat
+the same folder, so a chat whose chosen folder is gone starts there instead.
 Installed machines keep these local links and their event tail in machine state.
 The registry file is authoritative. Replacement validates the complete registry,
 flushes private temporary bytes and atomically renames them; a failed write cannot
@@ -110,6 +300,9 @@ A materialized row proves local observation, not completed official delivery.
 An independent later observation starts from a settled basis only after earlier
 mutations are accepted, their matching Inbox records resolve, and Apply releases
 their intents; finite observation flushes do not promise global delivery silence.
+Shutdown can interrupt an Apply-requested observation, but cannot report that
+observation settled. Its exact Watch generation must be proved before the
+capture returns successfully; otherwise the existing intent remains unresolved.
 Apply retry reads revisit only the requested entities through indexed lookups
 and the same current eligibility rule used by paged discovery; page position
 cannot prevent a due entity from being reconsidered.
@@ -184,19 +377,25 @@ Every control mutation carries the expected user, binding and owner generation;
 the receiving controller verifies that identity before performing the mutation.
 Authenticating a response after an effect cannot authorize that effect.
 Layer 1 keeps one usable runtime available while the OS session can execute.
-Core supplies its retry allowance, backoff and health timings; Shell records
-each launch in a durable SQLite journal before spawning. Neither elapsed time,
-controller replacement nor repeated service starts grants another attempt.
-Only sustained ready IPC health or an explicit `service retry` resets the
-allowance. Exhaustion parks the child while its controller retains ownership,
-status and stop/retry control; intentional shutdown never launches a replacement.
+One always-on policy (`src/service/policy.ts`) governs the copied launcher, the
+controller and the Windows action alike: only an operator stop ends the runtime,
+and every other exit restarts after a doubling delay capped at five minutes,
+forever. Shell records each launch in a durable SQLite journal before spawning,
+so controller replacement and repeated service starts neither reset the delay
+nor make anyone wait twice; sustained ready IPC health, an explicit
+`service retry` or an authorized update resets it. Any answer to an outstanding
+health question proves life however late it arrives; only a long run of on-time
+checks left unanswered ends a generation. Intentional shutdown never launches a
+replacement, and every stop records its reason.
 Native registration belongs to the current OS account even when the installation
 uses another data home. Windows Task Scheduler owns a hidden action in that
-account's logged-in session; the action owns controller exit recovery using
-Core's restart policy. Scheduler launch retries alone cannot recover a program
-that started successfully and then exited.
-The stable bootstrap retains a bounded result for each controller launch role,
-including failures before the controller can open its own log.
+account's logged-in session; the action owns controller exit recovery using the
+same policy. Scheduler launch retries alone cannot recover a program that
+started successfully and then exited.
+The copied launcher retains a bounded result and stop reason for each controller
+launch role, including failures before the controller can open its own log. It
+upgrades itself: a launcher that finds a newer revision installed exits at its
+next launch boundary so the OS starts the new one.
 Before launching any controller, the Windows action joins its own unnamed,
 non-inheritable, kill-on-close Job Object; every descendant remains inside that
 lifetime boundary, and only action termination releases its owning handle.
@@ -211,6 +410,23 @@ Native Watch opens the OS-resolved physical directory; portable or short-name
 aliases cannot become a second path grammar inside a kernel handle.
 Persistent SQLite handles use the OS namespace for the selected file, including
 Windows extended paths; a host API's legacy path limit cannot select another file.
+That namespaced name is the file's one name: every registry keyed by a ground
+file uses the name its connections report, so no spelling selects a second
+owner. Releasing a ground file settles only once no thread of the process holds
+it, so the final checkpoint is part of closing and Windows can remove it after.
+Git's environment is read with the platform's own name rules; Windows names are
+case-insensitive, so `Path` is PATH and an inherited `git_dir` is still Git's.
+Each requests F_FULLFSYNC where the platform has it, because a plain macOS fsync
+can leave a commit in the drive's cache. Every write to a ground file is a
+named save run by that file's one saver thread (`src/ground-saver.ts`): saves
+posted while a commit flushes form the next batch, each in its own savepoint,
+committed once at synchronous=FULL. A save settles only once the drive holds
+it, so Send submits only durable Outbox rows; the main thread's ground
+connections only read, so it never waits for the drive. Detect reports the
+journal, synchronous and fullfsync settings the saver committed under.
+Whatever launches the runtime process names the Node flags of
+`src/runtime-node-flags.ts`: a bounded young generation keeps each of the main
+thread's garbage-collection pauses to a few milliseconds.
 Durability acknowledgements require the native flush to succeed through a handle
 with the access it requires; a failed flush cannot become a successful install
 or materialization. Each writer owns the durability of the files it creates.
@@ -372,9 +588,10 @@ links and groups persist as one validated registry replacement before events are
 published. Disk remains authoritative after a failed persistence acknowledgement;
 corrupt and unsupported documents are refused, never replaced with defaults.
 Each streamed response owns its source through completion or client disconnect.
-Installation format 3 reads prior direct-link and group records and the Chat
-journal with durable turn usage. Its receipt advances before any product opens
-writable state; format-1 and format-2 runtimes cannot recover after adoption.
+The installation format, declared once as `RUNTIME_FORMAT`, reads every earlier
+direct-link, group, and Chat journal record. Its receipt advances before any
+product opens writable state; a runtime built for an older format cannot recover
+after adoption.
 
 14a. **Automations CLI is one service-owned command surface.** Shell discovers
     the selected signed-in runtime, supplies its loopback admission credential,
@@ -407,10 +624,11 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     cloud, and Watch work use the established owners rather than constructing a
     second lifecycle. Register waits through graph reconciliation, healthy
     coverage, capture of every repository parcel, immutable upload, and
-    graph-head commit before it returns. An uncapturable repository may settle
-    its local type and identity evidence, but Register fails and retains its
-    durable declaration; no graph containing a `repo.git` without its verified
-    Card + Checkpoint transport can become the cloud head. The
+    graph-head commit before it returns. An uncapturable repository refuses
+    Register, which then admits and journals nothing; Live's binding and
+    reference stay durable, so a retry declares the same workspace. No graph
+    containing a `repo.git` without its verified Card + Checkpoint transport
+    can become the cloud head. The
     watcher established after authoritative materialization remains the one
     ongoing watcher; the CLI never creates and immediately closes a second
     Watch lifecycle. Closing an unchanged watcher does not invent a full scan. A
@@ -428,15 +646,23 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     is still the same device, inode, and filesystem creation generation its
     content handle was opened on, that handle already covers everything inside
     and the ring adds nothing; missing ground, a lost handle, or a replaced
-    directory retires the handle, re-establishes coverage, and puts the
-    complete root in question. On macOS
-    each handle is its own FSEvents stream through the `fsevents` binding, so
+    directory retires the handle and re-establishes coverage. The blind
+    interval could hide an effect through an alias in any root, so every root
+    is put completely in question. On macOS
+    each handle is its own FSEvents stream through Amalgm's own binding
+    (`native/fsevents/`), which asks for per-file events delivered without
+    coalescing delay, so a ring reaches Detect at the platform floor and
     opening or closing one never interrupts another; Node's own watcher serves
     every handle in the process from one stream that it recreates, resuming
     from the present, on every change, and loses the events in between.
     Initialization failure or handle death is reported as degraded, retains
     full-root suspicion, and retries independently of Detect; it can never be
-    reported as active coverage.
+    reported as active coverage. A Linux descendant directory the tree cannot
+    enter is not lost coverage: its parent hears it. One that vanished needs
+    no handle. One this process may not read keeps any handle it already had,
+    and Detect names that ground unavailable, until an event on its name asks
+    again; entering it then ends an interval no handle heard, so its whole
+    root is put in question. Only the root's own failure is lost coverage.
 
 17. **Independent content may travel concurrently; authority remains atomic.**
     The host bounds parallel uploads for small immutable objects and processes
@@ -496,20 +722,79 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     Hashes, manifests, caches, and R2 protection always prove the exact decoded
     bytes; incompressible input travels unchanged.
 
-21. **Watch events preserve suspicion until proof.** Watch records only the
-    producing handle plus an optional relative path: a named event preserves
-    that hint and a nameless or invalid event widens to the complete covered
-    root. It does not read `.amalgmignore`, inspect `.git`, classify a file, or
+21. **Watch events preserve suspicion until proof.** Watch preserves the
+    producing handle, optional path, and native evidence that widens its scope.
+    A named event preserves that hint; loss or possible hardlink effects require
+    one examination across every configured materialization root. Such a shared
+    obligation settles only when every participating root completes against the
+    same frozen Watch generation and binding set. Unavailable ground remains
+    pending; a changed binding set requires a new complete examination. Native
+    event IDs are diagnostics, never identities or settlement cutoffs. Unexpected
+    coverage loss retains one episode through repeated reopen failures; its
+    qualifying observation starts only after replacement coverage is healthy.
+    Detect waits on the existing recovery wake while coverage is unavailable.
+    A later coverage loss invalidates an in-flight recovery proof. Ordinary
+    unnamed notifications retain complete covered-root suspicion. Watch does not
+    read `.amalgmignore`, inspect `.git`, classify a file, or
     infer create, move, rename, and delete semantics. Detect reads live policy
     and repository evidence when it observes the suspicion. Only Core's fixed
-    `.amalgm/` control subtree is structurally outside Files ground and may be
-    dropped at the host callback boundary. A scan settles only the generations
+    `.amalgm/` control subtree is structurally outside Files ground. Its named
+    notices may be dropped only after native scope ambiguity has been preserved.
+    A scan settles only the generations
     it observed, so an event received during that scan remains pending.
-
-22. **Git supplies clean repository evidence.** Registration obtains clean
-    tracked leaf identity and text/binary classification from Git's index,
-    attributes, and object database. It reads worktree bytes only for dirty or
-    untracked leaves. Git ignore never becomes Amalgm enrollment policy.
+    An object's change is a change at every one of its names: a committed name
+    whose object changed, or which left an object with another name, rings each
+    other name the inventory holds for it, in any root, unless that alias is
+    already recorded at the committed stat. Native alias evidence names the
+    objects a name held (the FSEvents file ID is the inode); each such object
+    rings every name the inventory holds for it before the cut is proved, and
+    a hint whose objects are unknown rings the domain. Each alias is read as
+    its own name in its own root; bytes and identities never propagate between
+    names.
+
+22. **Physical bytes supply worktree evidence.** Git's index describes stored
+    blobs, not necessarily the files on disk. Shell derives a worktree leaf's
+    type and payload from the same stable byte observation; any NUL means
+    binary, including beyond Git's preview window. Index flags, attributes
+    and checkout conversions cannot suppress that observation or choose its
+    type. A Git object identity is reusable only with proof of raw byte
+    equality. Checkpoint replay preserves those exact bytes independently of
+    receiver settings. Git ignore never becomes Amalgm Detect policy.
+    Observation cannot alter Git object timestamps either: source object
+    alternates are read-only inputs, and every object-writing command runs
+    with private storage alone. Patch writers copy only their required base
+    blobs into that private storage first.
+    Indexed and untracked inventory share one native-index observation, read
+    without a Git process and versioned by what capture means by an index:
+    its stage listing, exactly what `git ls-files --stage -z` writes
+    (`src/git-index-format.ts`). Capture asks nothing else of an index, so a
+    refresh that re-stamps stat data, a version change, or entries moving
+    between a split index and its shared base leave every answer drawn from
+    it standing; the witness keeps the bytes it decoded and decodes again
+    only when they differ. Git lists untracked names over copied index bytes,
+    and repository/storage bindings remain valid through closing capture. One Git binding owner retains the original effective
+    invocation and lexical/resolved directory associations. It re-resolves
+    through Git at each bracket; one framed batch replaces four commands, with
+    scalar fallback preserving embedded or trailing newlines. No incomplete
+    config-source list can authorize cached location reuse. Special index files are refused with nonblocking, no-follow
+    reads. Only the shared base a split index names is read, from the Git
+    directory before the index's own as Git reads it, and its checksum must
+    match the link. Observation never freshens a shared base; that timestamp
+    refresh remains Git's own work. Thin-pack export reads borrowed objects through the
+    private repository without source remote configuration. Checkpoint decoding
+    and member verification have one private preparation owner, separate from
+    index installation and working-file effects. Replay consumes and closes that
+    preparation; it does not maintain a second package validator. Sparse directory
+    entries currently cause an explicit unsupported-index refusal, never an
+    incomplete index or an alternate-enabled index writer; the native decoder
+    refuses them before any Git process could expand them. A form Git never
+    writes, or a required extension Git would not understand, is refused
+    rather than guessed. A zero split link has no shared-base dependency.
+    Fast reuse closes the complete metadata/namespace proof, whose index
+    member is its meaning; its presence tags distinguish absent files from
+    all possible bytes.
+    Shared registration inspection closes its physical and boundary witnesses
+    against that same native-index basis.
 
 23. **Cold add never rereads a repository graph.** Download verifies and
     seals each content-addressed transport to a file, streams its Git pack
@@ -524,6 +809,19 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     entity identity. Missing, corrupt, or obsolete cache bytes are removed and
     recomputed from authoritative local ground; they never become a legacy
     compatibility requirement and never prevent the machine from resuming.
+    A cache name appears only over durable bytes: every writer makes a staged
+    file durable before renaming it into place, so an existing name already
+    holds that immutable object and a rename over it replaces identical
+    durable bytes. Staged cargo becomes durable in groups: its bytes are
+    written through to the device, and one barrier covers every writer that
+    staged before the barrier began (on macOS, one drive flush), so a burst of
+    captures never waits for one full flush per file. A barrier stalls the
+    staging still in flight, so a pass that captures a set names it together
+    once the whole set has staged, as Git batches object writes behind one
+    flush: one barrier per pass, and none while its reads run. Before Record admits
+    captured cargo it flushes the cache directories off the event loop only
+    when a required name is not yet known durable; a crash can lose an
+    unrecorded name, never leave a Record naming torn bytes.
     A pending Send consults its capture-derived manifest and the authority's
     immutable inventory before opening local cargo: after upload succeeded but
     before its acknowledgement became durable, complete cloud cargo is enough
@@ -533,7 +831,9 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     the entity's existing bytes. When the negotiated wire supports it and all
     declared cargo is bounded, Shell supplies the cached manifest and blocks to
     Live for the same submit frame; otherwise it uses the ordinary missing-block
-    effect. The cloud, not Shell, owns the final seal-before-number decision.
+    effect. A cached manifest is read off the main thread and is only a hint:
+    an absent or invalid one takes the ordinary obtain-or-derive path, and the
+    cache use that protects it lasts until the read finishes. The cloud, not Shell, owns the final seal-before-number decision.
     Cache bytes remain only while an unresolved durable operation names their
     content head or while the current verified text or repository head is the
     one exact base for that entity's next delta. Once Send acceptance is
@@ -649,27 +949,42 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     older Detect transaction settles first and any newer Watch generation
     waits until adoption finishes. Register
     and Watch enumerate the same durable binding inventory, so a missed
-    notification for rendering the portable reference cannot make either the
-    reference row or its declared external
-    boundary disappear from registration. Registering an enclosing parent
-    reuses every known descendant UUID and rewrites containment/root projection atomically;
-    overlapping registrations never create a second identity family.
+    notification for rendering the portable reference cannot lose a
+    declaration. A bound root that no Register has committed is held: it is
+    covered but stays `catching-up`, and Detect neither walks nor shares it
+    or its reference until Register declares it again under the same UUID.
+    Register admits exactly its declaration — the walked workspace, its
+    reference, and any core ancestor the accepted view lacks — beside one
+    journal row, and nothing else.
+    Registering ground that encloses workspaces this machine already
+    materializes absorbs each one the authority holds as its own active root.
+    Every identity is kept. Only the absorbed root's own record changes: its
+    parentUUID and name become where the enclosing walk found it, and a
+    `workspace` becomes a `folder`. The head drops that root in the same
+    commit. Absorbed ground rides as the accepted graph and the sharing
+    baseline already hold it, so local work there stays owed to ordinary
+    Detect, and it is held with the enclosing workspace until the authority
+    accepts that declaration; a refusal keeps both held until Register runs
+    again. Enclosed ground that is still held, was never accepted, is accepted
+    inside a root the new ground does not enclose, or is not active refuses
+    Register. Ground inside a materialized workspace is refused, because that
+    graph already holds it. Overlapping registrations never create a second
+    identity family.
     Register success is scoped to the selected workspace's SQLite row, its
     exact durable reference row, immutable content, cloud-head membership for
-    both identities, and healthy coverage; merely finding a previously
-    discovered nested target is not completed registration. It never waits for
-    unrelated Watch traffic across the machine to become silent.
-    Registration consumes the suspicion created when Watch reconciles the new
-    durable root. Its cold proof reads only core reference ground and the one
-    physical coverage family containing that boundary; it never enumerates,
-    scans, or reprojects unrelated existing roots. Any unrelated suspicion
-    remains ordinary ongoing work of the same host.
-    Re-declaring a workspace already present in local identity and the cloud
-    head is therefore an idempotent proof, not a second Detect scan; Watch
-    continues to own subsequent content changes. Ending any cold command
-    rearms a Watch generation that arrived while that command temporarily
-    suppressed Detect; a successful idempotent proof cannot strand pending
-    suspicion.
+    both identities, and healthy coverage. It never waits for unrelated Watch
+    traffic across the machine to become silent.
+    Register's one walk of the workspace consumes the complete suspicion of
+    its new coverage. The core records it declares derive from their two
+    addresses; it never enumerates, scans, or reprojects core or unrelated
+    existing roots. Any unrelated suspicion remains ordinary ongoing work of
+    the same host.
+    Re-declaring a workspace the accepted view already holds as its own root
+    publishes no head and walks nothing: it proves cargo closure (31) and
+    returns, and Watch continues to own subsequent content changes. Ending
+    any cold command rearms a Watch generation that arrived while that
+    command temporarily suppressed Detect; a successful idempotent proof
+    cannot strand pending suspicion.
 31. **A cold graph publication proves cargo closure under the current
     contract.** A replacement of the selected complete logical roots is one
     atomic cloud operation; unrelated roots already held by authority are
@@ -679,14 +994,16 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     content sealed only under a prior content contract, whose namespace the
     current readers never touch. Only the authority's durable seal for the
     exact (resource, content hash, current content contract) proves an
-    artifact's cargo. Before advancing the head — and before answering an
-    idempotent re-declaration — the machine asks the authority which of its
-    locally materialized content heads are sealed under the current contract
-    and uploads exactly the remainder, so Register re-establishes cargo
-    closure before returning even when the graph itself is unchanged. The
-    finite publication journal retains this exact upload subset across
-    retries. This remains true when the local materialization boundary has a
-    portable parent outside the local projection.
+    artifact's cargo. Before advancing the head, the machine asks the
+    authority which content heads the declaration names are sealed under the
+    current contract and uploads exactly the remainder; every one is sealed
+    before its journal row exists, so a replay carries only graph pages.
+    Before answering an idempotent re-declaration, it asks the same of every
+    content head the accepted workspace names and re-ships each lacking one
+    that its cache or ground still holds exactly. One overtaken here already
+    travels as its own Record; the stage names how many it could not restore.
+    This remains true when the local materialization boundary has a portable
+    parent outside the local projection.
 
 32. **Coverage precedes recovery, and coverage is not currency.** On process
     start Watch first opens the same durable root topology, then Detect closes
@@ -740,12 +1057,12 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
 35. **Container membership is version input, never cargo.** A workspace or
     folder derives its logical version from the UUIDs and names of active
     direct children, while its portable and notebook `payloadVersion` remains
-    null. Shell normalizes that boundary before Detect and after every Apply
-    projection transaction. An independently ordered container receipt may
-    therefore create, move, or rename its address, but it can never overwrite
-    membership already established by child UUID rows or emit a second
-    container mutation for that derivation. Local adapter evidence can never
-    masquerade as a transferable content head.
+    null. Every Shell writer stores only the derived version, and Live's cloud
+    codec refuses a container payload. An independently ordered container
+    receipt may therefore create, move, or rename its address, but it can never
+    overwrite membership already established by child UUID rows or emit a
+    second container mutation for that derivation. Local adapter evidence can
+    never masquerade as a transferable content head.
 
 36. **Portable path grammar becomes a native path only at the host boundary.**
     Core and Live describe path components with `/`; Shell performs portable
@@ -786,7 +1103,24 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     every covered root suspect, retires native Watch handles, and then performs
     one final Detect/Record pass. Native events cannot make shutdown unbounded;
     changes after the cutoff remain inside the blind interval that startup
-    catch-up is required to close.
+    catch-up is required to close. Neither can a writer that keeps changing
+    ground: the final pass reads again only a racy listing, whose wait is
+    bounded, and reports any root whose ground still moved as incomplete,
+    never as a wait. A systemic fault fails shutdown after teardown; ground
+    that cannot be read is unsettled, not a fault. Otherwise an incomplete
+    answer names every cause that applies, each on its own: the unfinished
+    Apply intents that own ground, the roots still moving, the roots that
+    could not be read and the roots Git refused. An intent whose binding
+    cannot be reached is named with that binding as unreadable ground; a
+    binding proved to be another object fails shutdown, and the old intent
+    never acts on it. One cause never erases another, and the answer does
+    not depend on the order in which lanes parked. Network delivery is not
+    part of the cutoff. Apply's last flush and Send's last delivery share one
+    finite network budget; once it is spent, closing the wire cancels what is
+    still in flight, Apply keeps its durable intent, and shutdown reports the
+    records still saved locally, naming those sent without an answer. It
+    never calls them synchronized: they send again under the same mutation
+    identity when Files next starts.
 
 43. **Record commits evidence before Watch settles.** The host reconciles a
     Watch generation against one last-verified detection notebook, writes the
@@ -806,42 +1140,36 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     observes fresh truth; stale evidence can never overwrite proof or create an
     outgoing echo.
 
-44. **One Detect job proves one finite Watch generation, root by root.** A
-    scheduled pass or explicit flush observes and settles only the generations
-    it froze before reading truth, and it observes only roots with pending
-    suspicion. A root that no callback rang costs nothing: no walk, no
-    notebook plan, no repository inspection, no ground coordination. Each rung
-    root is first proved on its own named lane and settled as soon as its
-    transaction is durable; only a root the named lane declines widens to
-    reconciliation, and only that root. Metadata noise inside one repository
-    root is proved inside that root. Two facts alone can pull an unobserved
-    root into a pass: core ground missing a portable reference for a binding,
-    and a bound root that has never produced a row. Large walks yield the
-    event loop periodically so the wire, Receive, and Apply keep running while
-    a root is proved; a ring during that yield remains a later generation. An explicit flush waits until the cutoff it created is
-    settled even when it first joins an older in-flight Detect job. Neither
-    success nor failure from that older job decides the later cutoff. A ring
-    received during that read remains pending and owns a later bounded pass;
-    no caller waits for the operating system
-    to become globally silent. This keeps duplicate or continuous native
-    callbacks from making an otherwise complete Record operation unbounded
-    without dropping any suspicion.
-
-45. **Named Detect is independent of workspace size.** Shell holds one
-    prepared SQLite owner for the live Detect runtime. A named path uses one
-    indexed row, its parent chain, one stat, changed bytes when required, and
-    one transaction. Structural work widens only to the affected subtree;
-    repository work widens only to its Card + Checkpoint territory. A named
-    disappearance is ambiguous between deletion and a move whose destination
-    event has not arrived, so Detect widens that materialized root before
-    removing its physical identity evidence. A destination-only event that
-    carries a known inode across a repository boundary widens for the same
-    reason: old and new addresses must reconcile in one identity pass.
-    Git's transient lock files (`index.lock`, `HEAD.lock`, ref locks) are
-    settlement evidence, not repository state: while a named lock still
-    exists, that root remains unsettled and retries without inspecting Git or
-    reading the worktree. Once the lock disappears, Detect captures Card +
-    Checkpoint once even if the OS emitted no second filename callback. Shell's
+44. **One Detect job owns finite original Watch cutoffs.** A pass settles
+    only the generations it froze before reading truth. Later notifications
+    remain pending even when they arrive during a yielding walk. Named work
+    uses its closed dependency scope; identity ambiguity, lost attribution or
+    coverage recovery can require a complete materialization domain. That
+    cohort admits and settles only as a whole. Independent periodic freshness
+    is a separate reason to examine silent roots, never a fabricated native
+    notification. An explicit flush retains its original completion boundary
+    across older in-flight work and later recurrence. No caller waits for the
+    operating system to become globally silent.
+
+45. **Detect scope follows its proof dependencies.** Shell holds one
+    prepared SQLite owner for Detect. A qualified named observation uses
+    indexed identity, original parent/sibling context, physical witnesses and
+    changed bytes. It widens when those facts cannot close attribution; an
+    edit through a vanished alias reaches the object's remaining names through
+    the object native evidence saw, even when no row ever occupied that path,
+    and widens only when that object is unknown. Old and new addresses reconcile
+    under the same complete identity law. Ordinary structural changes still
+    use broad reconciliation; constant-time named work is not a current claim.
+    Git lock filenames (`index.lock`, `HEAD.lock`, ref locks) are notices,
+    not repository state or proof that reading is unsafe. Detect reads the
+    committed index and current physical bytes and closes their normal source
+    witnesses even while a lock exists. A lock says only when a rung lane
+    reads: a writer lock younger than 750 ms (the one-second Git budget less
+    an ordinary read's 250 ms) holds its repository as moving ground until the
+    lock's release rings or the lock stops holding, and the held lane parks
+    for exactly that deadline. Moving evidence without a known deadline
+    retries after 250 ms. A stale lock therefore cannot prevent completion
+    and is never deleted by observation. Shell's
     own background Git reads disable optional locks so observation never rings
     itself merely by refreshing the index.
     Nameless, invalid, startup, and
@@ -878,15 +1206,17 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     crash-recoverable snapshot publication has its own finite local table.
     Detect records never enter it, and snapshot rows never enter the entity
     outbox. The superseded mixed mutation journal does not remain as a third
-    queue or compatibility path. A journal row has exactly three meanings.
+    queue or compatibility path. Each row owns exactly one declaration, named
+    by its workspace, and has exactly three meanings.
     `pending` and unsubmitted is a local publication intent the authority has
     never seen; if its captured ground moves it may be deleted and re-derived,
-    and a newer complete snapshot may supersede it. `pending` and submitted
-    has an unknown authority outcome — the same mutation id retries until the
-    authority answers, because it may already be accepted with only the
-    acknowledgement lost, and nothing may supersede it. `rejected` means the
-    authority conclusively refused that mutation; it is never replayed and a
-    newer complete snapshot may replace it transactionally (last write wins).
+    and a newer declaration of the same workspace may supersede it. `pending`
+    and submitted has an unknown authority outcome — the same mutation id
+    retries before any lookup reads the head, because it may already be
+    accepted with only the acknowledgement lost, and nothing may supersede
+    it. `rejected` means the authority conclusively refused that mutation; it
+    is never replayed and the next Register of that workspace folds its
+    declaration again beside a new row, transactionally (last write wins).
     The submitted boundary is durable before the first commit frame leaves.
     A permanent refusal therefore cannot wedge Register, stale local capture
     cannot publish old bytes, and an unacknowledged acceptance always recovers
@@ -968,9 +1298,12 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     result, replay, or immutable cargo remains a real local change. Watch stays
     active throughout, and its Apply-created ring settles to notebook equality
     without an outgoing echo. The Inbox may know cloud-only entities that this
-    machine does not materialize: core-ground Apply consults the current
-    portable enrollment policy before creating an intent, so excluded entities
-    retain history without receiving local rows or bytes.
+    machine has not selected to materialize. Materialization selection is
+    distinct from `.amalgmignore`: that policy selects what this machine
+    shares, from every declaration on, and never filters cold download or
+    incoming Apply. Detect observes ignored ground like any other; sharing
+    holds an ignored identity at its last shared result. Incoming eligibility
+    follows materialization selection alone.
 
 54. **Repository Apply is Card + Checkpoint + identity as one result.** Shell
     imports the immutable Git transport chain, materializes Card and
@@ -1009,10 +1342,16 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     rows as the prior materialization: an accepted identity map may relocate
     the same UUID into repository territory, keeps the prior source privately
     recoverable through Verify, then projects the new address transactionally.
-    Apply observes Card + Checkpoint once for each guard moment and never builds
-    a Git pack merely to prove equality. The held address cone keeps the final
-    guard's observation valid through reveal, and reveal's own verified result
-    is the observation consumed by Verify. A visible repository rewrite carries
+    Apply observes Card + Checkpoint for each guard moment and never builds
+    a Git pack merely to prove equality. A new observation returns with its
+    complete source proof closed; reuse revalidates it at the later boundary.
+    The native inventory scan owns its before/after source checks, without an
+    immediate duplicate composite check. Address ownership excludes competing
+    Amalgm effects, not outside editors: Verify reads fresh physical evidence
+    after reveal. The host yields before guards and fresh Verify so completed
+    phases service Watch and transport; it inserts no scheduling gap between
+    a final guard and reveal. This does not bound a single synchronous effect.
+    A visible repository rewrite carries
     `.git/amalgm-reveal` from its first Git mutation until exact Verify; Detect
     treats that marker as unsettled private Apply ground, and restart resumes the
     same durable intent before the marker is removed. Incremental materialization
@@ -1064,8 +1403,13 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     at or below `N` are retained history, never filesystem work, and only
     later records may Apply. When publication folds that tail, final ancestry
     in the complete prefix places every result: a container created after the
-    snapshot can own later children, and a cross-root move vacates its old root;
-    old snapshot membership alone never chooses the result's root. The settled
+    snapshot can own later children, and a result whose final ancestry lies in
+    another root leaves its old root's pages, so no UUID is filed in two roots;
+    old snapshot membership alone never chooses the result's root. That
+    placement serves an enclosing Register's re-rooting; it is not identity
+    continuity. Identity is root-local, no producer emits a same-UUID record
+    across independently materialized roots, and such a record is unsupported:
+    the fold does not carry its subtree into the other root. The settled
     fold passes through the repository parcel projection exactly as publication
     does: a tail that turns a container into a repository retires that
     container's snapshot children into its parcel, and a tail that turns a
@@ -1085,8 +1429,9 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     head operation plus the changed pages needed to replay that publication;
     it never writes a second whole-registry snapshot into SQLite or rebuilds
     roots Live did not select. A submitted intent keeps its mutation identity
-    across restart, and all pre-page journal shapes convert atomically without
-    dropping an unknown authority outcome.
+    across restart. A journal in any earlier shape names no declaration: an
+    empty one is recreated, and a non-empty one refuses to open rather than
+    drop an unknown authority outcome.
 
 60. **Runtime binding is proved, never inferred.** A platform adapter adopts
     an existing runtime only when Shell's published loopback address answers
@@ -1244,8 +1589,14 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     Toolbox loadout, and Chat prepares that exact immutable agent revision
     and tool deployment.
 
-73. **Git host capture distinguishes moving state from durable conflicts.** An
-    index lock or Amalgm reveal is transient and refuses capture. A stable
+73. **Git host capture distinguishes moving state from durable conflicts.**
+    Git administrative storage does not identify its checkout owner. Detect
+    may settle a storage notice only after every affected enrolled checkout
+    is examined or remains explicitly pending. A named single-consumer result
+    closes the complete original binding and exclusion proof at Record.
+
+    Changed native source evidence and Amalgm's own incomplete reveal refuse
+    capture; the mere existence of a Git lock does not. A stable
     unfinished merge is portable Checkpoint truth: Shell captures its
     unmerged stages, worktree conflict bytes, and merge continuation through
     Live's one repository contract, and restores ordinary stages only after
@@ -1256,6 +1607,30 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     by the current contract and refuses explicitly rather than being mistaken
     for transient work or flattened into a clean stage-zero entry.
 
+    Scheduling never extends source evidence. A suspended walk retains its
+    physical identity basis, rechecks it before repository reuse or capture,
+    and closes all participating source proofs at Record admission. Every
+    examined result carries that proof; an unexamined result authorizes no
+    writes. All Git dependencies precede the final physical sweep, and parent
+    witnesses close after their descendants. This is a bounded source check,
+    not an atomic filesystem snapshot or a no-traversal guarantee. Retained
+    validators own witnesses rather than captured content buffers. Inspection
+    fingerprints working files through the shared bounded reader; it never
+    allocates file-sized content that it does not consume. A changed
+    basis retries the observation without persisting its stale associations.
+    A native-index collection is unclosed until its owning observation checks
+    the original semantic binding, index meaning and fresh untracked namespace
+    together. Internal inventory reads keep local invocation/path and file
+    checks; one semantic bracket closes each public result and each later reuse.
+    Physical and ownership witnesses close after the last Git subprocess.
+    Neither returned buffers nor a caller's mutable scope may alter retained
+    evidence. No successful close is cached across an admission boundary.
+    A captured binding path disappearing or becoming obstructed is source
+    change and retains its original cause; access and I/O failures stay faults.
+    Private Checkpoint preparation proves package contents; the installer still
+    checks current independent repository boundaries after preparation and before
+    changing receiver objects, metadata or files.
+
 74. **Same-slot records keep identity and derive distinct disk addresses.**
     Shell never rewrites a portable name to settle concurrent identities.
     Cold materialization and Apply derive the same UUID-ordered suffixes from
@@ -1265,6 +1640,18 @@ writable state; format-1 and format-2 runtimes cannot recover after adoption.
     destination cone, with row addresses committed before disk movement so a
     crash can only re-prove the same portable identities.
 
+75. **Ground storage has one initializer and one visible generation per root.**
+    A ground file's migration and its process epoch run once per file per
+    process, on a bootstrap thread under one owner, never on the main thread.
+    The outcome is known only after that thread exits and its committed result
+    is confirmed. Every opener requires that confirmation, and a failed start
+    records nothing. Both inventories are read through read-only views over
+    `(uuid, generation)` storage; `ground_roots` names each root's one visible
+    generation, and writes touch only that generation. A flat file converts in
+    one transaction that proves the views reproduce it exactly, or it stays as
+    it was. The qualified profile gathers no planner statistics, but
+    statistics already present are kept, never treated as corruption.
+
 ## Relationship to amalgm-engine
 
 Stage 1 cut the bricks out of the engine. Stage 2 proves them here, composed.
@@ -1275,3 +1662,130 @@ Automations hosted independently and claimed by its target Shell. The Engine
 `https://automations.amalgm.ai/e/<capability>` and never depend on the target
 machine being online. Later services cross the same parity gate without
 creating a second runtime for anything already released.
+
+## Ongoing Files reconciliation boundaries
+
+The complete repository payload combines Git state and the member UUID map;
+its hash is separate from the incremental package hash. Register, cold transfer,
+Add and Watch setup retain their existing journeys. Their shared entity rows
+use that complete payload hash. Construct product adapters and the installed
+pause/resume switch keep their existing responsibilities.
+
+The Git effect adapter observes private versus common Git storage. Ongoing
+Apply requires independent checkout storage; shared worktrees and unsupported
+unfinished Git continuations are named capability waits. The enclosing
+repository cannot remove an independently materialized nested repository's
+identity. Its own accepted move or type change must satisfy that prerequisite.
+Live's existing Apply coordinator owns the wait and wake-up; Shell supplies
+physical evidence and reports the prerequisite through Files stage diagnostics.
+
+Git history export uses the captured object format and shallow boundary, and
+packs exactly what the receiver lacks, as upload-pack does. The receiver holds
+each previous tip's closure under the horizon it received, so those tips
+exclude history even when the boundary changed. A boundary the new horizon
+moved past (Git's unshallow) is a commit the receiver holds, if at all,
+without its parents: each one this state reaches wants its parents, so the
+history newly exposed beneath it travels, and each one the receiver holds is
+an edge, so its tree never travels again. Patch operations are read from machine patch headers, never from a
+human summary where filename bytes can resemble instructions.
+
+### Notification-independent observation
+
+Active Files must eventually notice persistent local changes even when native
+Watch is silent. Native36 and its independent raw-native complete-ground control
+show missed equal-length writes through a held descriptor. Healthy handles and
+an empty notification backlog are not physical freshness. The Files host
+therefore runs a metadata maintenance sweep (`detection/maintenance-sweep.ts`),
+paused with the Files host. One visit at a time compares a Watch root's
+metadata with O and reads no bytes; each difference becomes a request in
+Live's maintenance ledger that the ordinary scoped lanes serve, and the sweep
+writes no row or Record. A receipt proves the comparison completed and its
+work was handled, never a byte reread. Visits follow cadence C: an owner's
+next visit is due one freshly drawn interval, one hour times uniform
+[0.75, 1.25), after its last. That is a configured inter-visit interval, not a
+mutation→Record bound; Watch's loss evidence still suspects its root
+immediately, meaning immediate responsibility and scheduling, not single-pass
+completion. Foreground work comes first, never forever: the longest-waiting
+due owner goes first, and a root already owed a complete proof defers its
+visit by at most 10 s. `UserGroundHost.requestVisit` asks for one visit that
+begins after the request and settles once the lanes discharged what it found
+through Detect → Record, or with a typed reason it cannot (`not-ready`,
+`removed`, `stopped`, `unreadable`); it jumps the schedule within the one
+slot and is never a content reread. Apply-owned ground is a gap. An empty
+binding set has no owner. Native notices
+keep their narrow fast path, and a later visit cannot revoke a completed
+finite boundary. One frozen native batch receives service, including one
+necessary widening to the complete domain. That widening is the
+invocation's only immediate retry. It freezes the wider cutoff before
+releasing narrow leases, then yields: the complete examination starts in its
+own dispatcher activation and reads a new basis over the wider scope. Later
+notices retain their own cutoffs. Failure, deferral and repeated widening
+cannot replenish foreground priority. Every examination may reuse proven
+content: a leaf is reused only while its signature is unchanged and both its
+times precede the boundary of a content clock stamped on the root's own
+filesystem in `.amalgm/content-clock` before the reads (`content-clock.ts`).
+The boundary is the stamp less its profile's margin; a time with no
+subsecond part stands for its whole second. A racy leaf is reread; only that
+reread clears it. A stamp behind the root's previous one, or under another
+profile than the previous stamp names, retires every proof under the root;
+a conclusion drawn before that retirement at, above or beneath the root fails
+its admission and is read again, and a unit that consumed an identity
+discovery reads and stands on that discovery's whole scope.
+Directory listings close on the same rule: a racy listing names no complete
+membership until a fresh listing under a later stamp, and only filesystems
+`ground-profile.ts` names qualify at all. A listing no stamp can qualify
+closes only when a fresh listing taken after the whole walk names exactly
+what the walk listed while the directory held still on both sides; only an
+entry moved and moved back across both listings inside its directories'
+clock ticks escapes that, and each such move is a later Watch generation.
+The control tree carries a `.gitignore` of `*`, written once per root per
+process when absent or different, so a registered repository's Git status
+never shows it. Ground without a qualified clock (another device, a root that
+cannot hold a stamp, a clock that went backwards) is read by every
+examination and closes each listing by reading it again: it loses shortcuts,
+never conclusions. Qualifying further filesystems, NTFS and ReFS among them,
+is unfinished.
+A write through a writable `MAP_SHARED` mapping can change bytes while the
+signature stays equal, through flush, unmap and fsync: that mapped-write
+limitation is outside the metadata-only guarantee, and a faster stat tier
+would not reveal it.
+No lane preempts a complete
+examination; only shutdown stops it. Detect leases hold no ground, so Apply
+may reveal while collection reads. Admission runs per unit in bounded batches
+and yields between them. Participating rails dispatch at most one ready work
+chunk per dispatcher activation and return to the event loop before
+dispatching another. Asynchronous operations do not occupy the dispatcher
+while waiting. The participating rails are Detect, Send, Receive, Apply and
+cache maintenance (`turns.ts`): each Detect stage, network answer, download
+and capture-thread reply resumes in its own activation. The dispatcher
+controls participating application continuations. It does not control all
+work in a Node iteration. A long named or routing preparation continues past
+an already-valid boundary (between names, between collection and
+preparation, after a retained snapshot) only within its activation's budget;
+admission's basis check, writes and commit, and an assessment's install with
+its cutoff bookkeeping, are never split. A committed Record is an immutable
+fact: finalizing its assessment and draining the next rail start in later
+activations, and recheck what they publish. Each unit's
+physical closure, binding, SQL-revision and source proofs close together in
+its own transaction. A unit that fails them is left out and retried by timer
+while the others admit. Unreadable or
+Apply-owned ground is a scoped gap, never absence: it defers only the units
+that need its facts, withholds the complete receipt, and never voids the other
+admissions of the same domain. A protected attempt remains subject to real
+source/coverage failures. This scheduling bound does not claim
+short tail latency: blocking Git calls and complete closing cost remain measured
+limitations. Register, Add and watcher placement retain
+their journeys. Integrated correctness and cadence/service-cost qualification
+are pending; this setting grants no performance pass.
+
+Fresh observation reads mutable content without copying unchanged files into
+the cache. Only selected new content is sealed before Record, against the same
+original physical proof. Cache existence or size alone is never content proof.
+Source reads refuse special-file substitutions without waiting for another
+process, and release every owned resource even when another cleanup fails.
+Git parcel reuse requires equal fresh worktree and Card evidence. The Card's
+own stash reader supplies stash evidence; conventional reflog filenames cannot
+stand in for Git's semantic answer. Effective configuration and stash reads
+close before their original physical prerequisites. Internal Git owns its
+piped output settings, so an interactive display preference cannot alter its
+storage eligibility; unrepresented Git inputs still require full capture.