@amalgm/shell 0.1.164-preview.36072132286 → 0.1.164-preview.36809057014

package/dist/detection/runtime.js

@@ -1,809 +1,719 @@
+import { makeRecordContentDurable } from "../content-cache-host.js";
 /**
  * The named Detect lane.
  *
  * A watcher path that still names enrolled, non-repository ground does not
  * justify a workspace walk. This runtime holds one SQLite connection,
- * resolves indexed paths, widens only to a named new folder's subtree, and
- * commits exact Live proposals plus local truth in one transaction. Evidence
- * it cannot prove is declined before mutation and goes to reconciliation in
- * the owning host.
+ * resolves indexed paths and commits exact Live proposals plus local truth
+ * in one transaction. Every examination ends in one typed outcome. Evidence it
+ * cannot prove is declined before mutation as a `widen` naming the missing
+ * proof and the scope that can supply it; a moved source is `retry`; a fault
+ * is thrown to the owning host, never converted into a wider scan.
  */
 import { createHash, randomUUID } from "node:crypto";
-import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
-import { join, posix, resolve } from "node:path";
-import { canonicalVersion, checkContentManifest, classifyFile, createLocalEntityRecord, createUserGroundEnrollmentPolicy, detectedChangeProposal, encodeEntityRecord, indexRepositoryTerritory, membershipHash, materializedSlotNames, portableFileMode, } from "@amalgm/live";
-import { openFileDatabase } from "../sqlite.js";
-import { captureContentFile, sealCapturedArtifact } from "../content-cache-host.js";
-import { captureRepository, hasGitMarker, inspectRepositoryTransportFile, readCachedRepositoryIdentity, sealCachedRepositoryIdentity, } from "../git-repository-host.js";
-import { inspectGitRegistration, sameGitIdentity, } from "../git-registration-host.js";
+import { lstatSync, readlinkSync } from "node:fs";
+import { join, posix } from "node:path";
+import { AMALGM_IGNORE_FILE, artifactForRecord, canonicalVersion, childGroupOwed, classifyFile, createLocalEntityRecord, detectedChangeProposal, encodeEntityRecord, observedPortableName, portableFileMode, resolveScopedLeaves, selectPublication, PublicationScopeExceeded, } from "@amalgm/live";
+import { openGroundConnection } from "../ground-database.js";
+import { save } from "../ground-saver.js";
+import { activeUnder, effectivelyActive, GROUND_ROW_PROJECTION, localParentOf, portableGroundRecord as portable } from "../ground-row.js";
+import { groundStore } from "../ground-store.js";
+import { PhysicalPathWitnesses } from "../physical-path-witness.js";
+import { GroundBasisChangedError } from "../ground-basis.js";
+import { GroundEffectCrossedError, GroundFootprintExceededError, PhysicalKeySet } from "../ground-coordination.js";
+import { physicalKey, sourceFingerprint, sourceReusable } from "../source-signature.js";
+import { closePhysically } from "../source-proof.js";
+import { leafBoundary, stampContentClock } from "../content-clock.js";
+import { repositoryGroundCones } from "../git-binding.js";
+import { eachInTurns, settleInTurns, turnBoundary } from "../turns.js";
+import { CargoGroup } from "../cargo-group.js";
+import { CaptureSourceChangedError } from "../content-cache-host.js";
+import { captureContent, contentManifest, readOwedAddresses, replayCachedContent, sealContent } from "../content-capture-pool.js";
+import { hasGitMarker } from "../git-repository-host.js";
+import { referenceWorkspaceId } from "../files-register-host.js";
 import { AcceptedInboxResultIndex } from "./accepted-result.js";
-import { sameNotebookBasisRow } from "./notebook-basis.js";
-import { exactTextReplay } from "./portable.js";
-const NAMED_WALK_YIELD_ENTRIES = 256;
-const ROW_SELECT = `
-  SELECT resource_id AS resourceId, root_uuid AS rootUUID,
-         uuid, type, parent_uuid AS parentUUID, name, status, version,
-         payload_version AS payloadVersion, transport_version AS transportVersion,
-         relative_path AS relativePath, absolute_path AS absolutePath,
-         device_number AS deviceNumber, inode,
-         byte_size AS byteSize, modified_time_ms AS modifiedTimeMs,
-         changed_time_ms AS changedTimeMs, filesystem_mode AS filesystemMode,
-         content_verified_at_ms AS contentVerifiedAtMs
-    FROM detection_notebook`;
-const ROW_COLUMNS = [
-    "uuid", "resource_id", "root_uuid", "type", "parent_uuid", "name", "status", "version",
-    "payload_version", "transport_version", "relative_path", "absolute_path", "device_number",
-    "inode", "byte_size", "modified_time_ms", "changed_time_ms", "filesystem_mode",
-    "content_verified_at_ms",
-].join(", ");
-const rowValues = (row) => [
-    row.uuid, row.resourceId, row.rootUUID, row.type, row.parentUUID, row.name, row.status,
-    row.version, row.payloadVersion, row.transportVersion, row.relativePath, row.absolutePath,
-    row.deviceNumber, row.inode, row.byteSize, row.modifiedTimeMs, row.changedTimeMs,
-    row.filesystemMode, row.contentVerifiedAtMs,
-];
-const upsert = (database, table) => database.prepare(`
-    INSERT INTO ${table}(${ROW_COLUMNS})
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    ON CONFLICT(uuid) DO UPDATE SET
-      resource_id = excluded.resource_id,
-      root_uuid = excluded.root_uuid,
-      type = excluded.type,
-      parent_uuid = excluded.parent_uuid,
-      name = excluded.name,
-      status = excluded.status,
-      version = excluded.version,
-      payload_version = excluded.payload_version,
-      transport_version = excluded.transport_version,
-      relative_path = excluded.relative_path,
-      absolute_path = excluded.absolute_path,
-      device_number = excluded.device_number,
-      inode = excluded.inode,
-      byte_size = excluded.byte_size,
-      modified_time_ms = excluded.modified_time_ms,
-      changed_time_ms = excluded.changed_time_ms,
-      filesystem_mode = excluded.filesystem_mode,
-      content_verified_at_ms = excluded.content_verified_at_ms
-  `);
-const portable = (row) => {
-    const derived = row.type === "workspace" || row.type === "folder";
-    return {
-        uuid: row.uuid,
-        type: row.type,
-        parentUUID: row.parentUUID,
-        name: row.name,
-        status: row.status,
-        version: row.version,
-        payloadVersion: derived ? null : row.payloadVersion,
-        fileMode: portableFileMode(row.type, row.filesystemMode),
-        transportVersion: derived ? null : row.transportVersion,
-    };
+import { aliasExaminations } from "./alias-examination.js";
+import { NamedDirectoryProof } from "./directory-proof.js";
+import { finalizeContainers, membershipParents } from "./container-membership.js";
+import { scopedIdentityPort } from "./scoped-identity-port.js";
+import { retainContentVerification } from "./verified-content.js";
+import { NamedGroundReader } from "./ground-reader.js";
+import { readSharingPolicy } from "./sharing-policy.js";
+import { GitNoticeBindings, GitNoticeChanged } from "./git-notice.js";
+import { repositoryRoutes } from "./repository-routes.js";
+import { ApplyAttributionDeferred, ApplyOwnershipSnapshot, ownedObject, sqliteApplyOwnership } from "./apply-ownership.js";
+import { admissionRejection } from "./dispositions.js";
+import { denied } from "./unreadable.js";
+/** One named attempt's phases, in order: reader and ownership snapshot,
+ * repository membership, Git routing and directory proofs, address checks
+ * and byte reads, cache durability, the semantic close, the in-process ready
+ * registration, the admission transaction, and what a changed policy newly
+ * includes. */
+const NAMED_PHASES = ["open", "members", "route", "collect", "durable", "close", "ready", "admit", "include"];
+const nothing = { evidence: [], observedEntityIds: [] };
+const widen = (proof, roots, detail) => ({ ...nothing, kind: "widen", proof, roots, ...(detail ? { detail } : {}) });
+const retry = (reason, after = "timer") => ({ ...nothing, kind: "retry", reason, after });
+const LEAF_TYPES = new Set(["file.text", "file.binary", "link"]);
+const parentPath = (path) => path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+/** Where an escaped context member lives, for the widen receipt. */
+const contextPath = (context, uuid) => [...context.observed, ...context.before].find(row => row.uuid === uuid)?.relativePath ?? uuid;
+const required = (row, uuid) => {
+    if (!row)
+        throw new Error(`named Detect has no row for proved parent ${uuid}`);
+    return row;
 };
+/** Evidence from one committed examination decides its settled kind. */
+function settled(evidence, observedEntityIds, excluded) {
+    const kind = evidence.some(item => item.records > 0) ? "recorded" : excluded ? "excluded" : "unchanged";
+    return { kind, evidence, observedEntityIds };
+}
+const ROW_SELECT = `SELECT ${GROUND_ROW_PROJECTION} FROM entities`;
 const sha256Hex = (input) => createHash("sha256").update(input).digest("hex");
-const sameFingerprint = (row, stats) => row.deviceNumber === stats.dev
-    && row.inode === stats.ino
-    && row.byteSize === stats.size
-    && row.modifiedTimeMs === stats.mtimeMs
-    && row.changedTimeMs === stats.ctimeMs
-    && row.filesystemMode === stats.mode;
-/** One persistent, prepared Detect store. It owns no Watch or Send behavior. */
+/** One persistent, prepared Detect store. It owns no Watch or Send behavior;
+ * attempts on different roots run concurrently, each with its own state. */
 export class NamedDetectRuntime {
+    store;
+    constructor(databaseFile, cacheDir, bindingDir, onRecordCommit, measureGround = () => false, onDetectCommit, 
+    /** Rings a checkout whose Git binding was refreshed after its witness moved. */
+    rebound) {
+        const database = openGroundConnection(databaseFile);
+        this.store = {
+            database,
+            cacheDir,
+            bindingDir,
+            rowAtAbsolutePath: database.prepare(`${ROW_SELECT} WHERE absolute_path = ? AND status = 'active'`),
+            receivedThrough: database.prepare(`
+        SELECT received_through AS receivedThrough
+          FROM entity_receive_cursors
+         WHERE authority_id = ? AND entity_id = ?
+      `),
+            acceptedInbox: new AcceptedInboxResultIndex(database),
+            measureGround,
+            ...(onRecordCommit ? { onRecordCommit } : {}),
+            ...(onDetectCommit ? { onDetectCommit } : {}),
+            gitBindings: new GitNoticeBindings(rebound),
+        };
+    }
+    /** Startup discovery binds every enrolled repository in the background, so
+     * no first notice pays for all of them. */
+    discover() {
+        const { value } = groundStore(this.store.database).readSnapshot(reader => reader.repositoryMembers());
+        this.store.gitBindings.discover(value);
+    }
+    close() {
+        this.store.database.close();
+    }
+    /** The repositories escalated names reach, by this runtime's Git bindings. */
+    repositoryRoutes(directory, paths) {
+        return repositoryRoutes(this.store.database, this.store.gitBindings, directory, paths);
+    }
+    /** Named names split by the lane that proves them. A name in Git storage or
+     * inside an indexed repository belongs to its repository's examination;
+     * every other name is proved as a named leaf. The index is only a routing
+     * hint: each lane re-reads the real routes, and a wrong hint widens. */
+    repositoryNames(directory, paths) {
+        const leaves = [], repositories = [];
+        const nearest = indexedRepositories(this.store.rowAtAbsolutePath, directory);
+        for (const path of paths) {
+            (nearest(path) !== null || path.split("/").includes(".git") ? repositories : leaves).push(path);
+        }
+        return { leaves, repositories };
+    }
+    /** A blocked batch does not own unrelated named leaves. Retry its independent
+     * names without settling the original Watch generation. */
+    detectAvailable(observation, register, lease) {
+        return new NamedDetectAttempt(this.store, register, lease).detectGroups(observation);
+    }
+    /** The physical footprint a lane's proof of these paths reads: each path's
+     * subtree, or its nearest indexed repository's whole root and any Git
+     * storage kept outside it, plus the root's enrollment policy. Ancestors
+     * need no lease of their own: an effect on any ancestor overlaps these
+     * cones. An index that changes before admission fails the ground basis
+     * there; storage the observed binding names must lie inside the lease. */
+    footprint(directory, paths) {
+        const cones = new Set([join(directory, AMALGM_IGNORE_FILE)]);
+        const nearest = indexedRepositories(this.store.rowAtAbsolutePath, directory);
+        const repositories = new Set();
+        for (const path of paths) {
+            const repository = nearest(path);
+            if (repository === null)
+                cones.add(join(directory, path));
+            else
+                repositories.add(repository.path);
+        }
+        // Every name in one repository shares its cones: they are read once.
+        for (const repository of repositories) {
+            for (const cone of repositoryGroundCones(join(directory, repository)))
+                cones.add(cone);
+        }
+        return [...cones];
+    }
+}
+/** The nearest indexed repository enclosing each named path, root-relative,
+ * each ancestor looked up once for all the names. It is a lane and footprint
+ * hint; each proof re-reads the real routes. */
+function indexedRepositories(rowAtAbsolutePath, directory) {
+    const known = new Map();
+    const nearest = (at) => {
+        let found = known.get(at);
+        if (found !== undefined)
+            return found;
+        const row = rowAtAbsolutePath.get(join(directory, at));
+        found = row?.type === "repo.git" ? { path: at, uuid: row.uuid }
+            : at === "" ? null : nearest(at.includes("/") ? at.slice(0, at.lastIndexOf("/")) : "");
+        known.set(at, found);
+        return found;
+    };
+    return nearest;
+}
+/** One root's named proof: its reader, ownership snapshot, Git proof,
+ * collection registration and ground lease belong to this attempt alone. */
+class NamedDetectAttempt {
+    register;
+    lease;
     database;
     cacheDir;
-    userRoot;
-    rootAtDirectory;
-    rowAtPath;
-    rowAtUuid;
-    rowsUnderPath;
-    rowsAtPhysicalIdentity;
-    notebookChildren;
-    materializedSiblings;
-    /** One frozen sibling snapshot per Detect pass: collision-derived names
-     * are computed once per parent, never once per captured file. */
-    slotNamesByParent = new Map();
-    materializedByUuid;
-    writeEntity;
-    writeNotebook;
-    appendRecord;
+    bindingDir;
+    rowAtAbsolutePath;
     receivedThrough;
     acceptedInbox;
+    measureGround;
     onRecordCommit;
-    userPolicy;
-    walkedEntries = 0;
-    constructor(databaseFile, cacheDir, userRoot, onRecordCommit) {
-        this.database = openFileDatabase(databaseFile);
-        this.database.pragma("busy_timeout = 5000");
-        this.database.pragma("journal_mode = WAL");
-        this.database.pragma("synchronous = FULL");
-        this.cacheDir = cacheDir;
-        this.userRoot = resolve(userRoot);
-        this.userPolicy = this.readUserPolicy();
-        this.rootAtDirectory = this.database.prepare(`${ROW_SELECT} WHERE absolute_path = ? AND relative_path = '' AND status = 'active' LIMIT 1`);
-        this.rowAtPath = this.database.prepare(`${ROW_SELECT} WHERE root_uuid = ? AND relative_path = ? AND status = 'active' LIMIT 1`);
-        this.rowAtUuid = this.database.prepare(`${ROW_SELECT} WHERE uuid = ? LIMIT 1`);
-        this.rowsUnderPath = this.database.prepare(`${ROW_SELECT}
-      WHERE root_uuid = ? AND status = 'active'
-        AND (? = '' OR relative_path = ?
-          OR substr(relative_path, 1, length(?) + 1) = ? || '/')
-      ORDER BY relative_path`);
-        this.rowsAtPhysicalIdentity = this.database.prepare(`${ROW_SELECT} WHERE device_number = ? AND inode = ? AND status = 'active' ORDER BY uuid`);
-        this.notebookChildren = this.database.prepare(`
-      SELECT uuid, name FROM detection_notebook
-       WHERE parent_uuid = ? AND status = 'active' ORDER BY name, uuid
-    `);
-        this.materializedSiblings = this.database.prepare(`${ROW_SELECT} WHERE parent_uuid = ? AND status = 'active' ORDER BY name, uuid`);
-        this.materializedByUuid = this.database.prepare("SELECT 1 AS present FROM entities WHERE uuid = ?");
-        this.writeEntity = upsert(this.database, "entities");
-        this.writeNotebook = upsert(this.database, "detection_notebook");
-        this.appendRecord = this.database.prepare(`
-      INSERT INTO record_outbox(
-        mutation_id, authority_id, entity_id, record_json, status,
-        global_sequence, created_at, accepted_at
-      ) VALUES (?, ?, ?, ?, 'pending', NULL, ?, NULL)
-    `);
-        this.receivedThrough = this.database.prepare(`
-      SELECT received_through AS receivedThrough
-        FROM entity_receive_cursors
-       WHERE authority_id = ? AND entity_id = ?
-    `);
-        this.acceptedInbox = new AcceptedInboxResultIndex(this.database);
-        this.onRecordCommit = onRecordCommit;
+    onDetectCommit;
+    gitBindings;
+    observation = null;
+    ownership = null;
+    gitProof = null;
+    /** The root's content-clock stamp, taken before this observation's first
+     * byte: every leaf it reads carries it. */
+    clock = null;
+    /** What this observation's reads staged, named together before its
+     * Record needs them (cargo-group.ts). */
+    cargo = null;
+    phaseStarted = 0;
+    phases = new Map();
+    get ground() {
+        if (!this.observation)
+            throw new Error("named ground read outside its observation");
+        return this.observation;
     }
-    close() {
-        this.database.close();
+    constructor(store, 
+    /** Registers each collection this attempt brings to admission. */
+    register, lease) {
+        this.register = register;
+        this.lease = lease;
+        this.database = store.database;
+        this.cacheDir = store.cacheDir;
+        this.bindingDir = store.bindingDir;
+        this.rowAtAbsolutePath = store.rowAtAbsolutePath;
+        this.receivedThrough = store.receivedThrough;
+        this.acceptedInbox = store.acceptedInbox;
+        this.measureGround = store.measureGround;
+        if (store.onRecordCommit)
+            this.onRecordCommit = store.onRecordCommit;
+        if (store.onDetectCommit)
+            this.onDetectCommit = store.onDetectCommit;
+        this.gitBindings = store.gitBindings;
+    }
+    /** Ends a phase; a phase reached more than once accumulates. */
+    mark(phase) {
+        const now = performance.now();
+        this.phases.set(phase, (this.phases.get(phase) ?? 0) + now - this.phaseStarted);
+        this.phaseStarted = now;
+    }
+    timings() {
+        const git = this.gitProof;
+        return {
+            phases: Object.fromEntries(NAMED_PHASES.flatMap(phase => this.phases.has(phase) ? [[phase, this.phases.get(phase)]] : [])),
+            git: git ? { discoveryWaitMs: git.discoveryWaitMs, routeMs: git.routeMs(), semanticMs: git.semanticMs() } : null,
+        };
+    }
+    async detect(observation) {
+        if (observation.suspicion.paths === null) {
+            throw new Error("named Detect requires named suspicion; complete roots belong to reconciliation");
+        }
+        this.phaseStarted = performance.now();
+        this.phases = new Map();
+        this.observation = new NamedGroundReader(this.database);
+        this.cargo = CargoGroup.open();
+        try {
+            return { ...await this.attempt(observation), timings: this.timings() };
+        }
+        finally {
+            await this.cargo.abandon();
+            this.observation = null;
+            this.ownership = null;
+            this.gitProof = null;
+            this.clock = null;
+            this.cargo = null;
+        }
     }
-    refreshEnrollmentPolicy() {
-        this.userPolicy = this.readUserPolicy();
+    async attempt(observation) {
+        try {
+            ({ boundary: this.clock } = await stampContentClock(this.database.name, observation.directory));
+            this.ownership = new ApplyOwnershipSnapshot(sqliteApplyOwnership(this.database));
+            this.mark("open");
+            return await this.observe([observation]);
+        }
+        catch (error) {
+            if (error instanceof GitNoticeChanged)
+                return retry("git-notice-changed");
+            if (error instanceof GroundBasisChangedError)
+                return retry("ground-basis-changed");
+            if (error instanceof GroundEffectCrossedError)
+                return retry("ground-effect-crossed", "ground-release");
+            if (error instanceof GroundFootprintExceededError)
+                return retry("ground-footprint-exceeded", "ground-release");
+            if (error instanceof CaptureSourceChangedError)
+                return retry(`source-changed: ${error.message}`);
+            if (error instanceof ApplyAttributionDeferred)
+                return { ...nothing, kind: "deferred", owners: error.owners };
+            if (denied(error))
+                return widen("unreadable", [observation.directory]);
+            throw error;
+        }
     }
-    async detect(observations) {
-        this.slotNamesByParent.clear();
-        if (observations.some(({ suspicion }) => suspicion.paths === null)) {
-            return { handled: false, evidence: [] };
+    async detectGroups(observation) {
+        const first = await this.detect(observation);
+        const paths = observation.suspicion.paths;
+        if (first.kind !== "deferred" || !paths || paths.length < 2)
+            return first;
+        const groups = new Map();
+        for (const path of paths) {
+            const absolute = join(observation.directory, path);
+            if (first.owners.some(owner => owner.cones.some(cone => absolute === cone || absolute.startsWith(`${cone}/`))))
+                continue;
+            // The real named proof below still re-reads ancestors, identities and ownership.
+            const row = this.rowAtAbsolutePath.get(absolute);
+            const ordinaryLeaf = row !== undefined && ["file.text", "file.binary", "link"].includes(row.type);
+            const key = ordinaryLeaf ? "ordinary-leaves" : `entry:${path}`;
+            const group = groups.get(key) ?? [];
+            group.push(path);
+            groups.set(key, group);
         }
-        const repository = await this.detectRepository(observations);
-        if (repository)
-            return repository;
+        const evidence = [], observedEntityIds = [], examine = [];
+        // A committed group's owed examinations outlive this batch's answer.
+        const progress = () => ({ evidence, observedEntityIds, ...(examine.length ? { examine } : {}) });
+        const owners = [...first.owners];
+        let widened = null, moved = null;
+        for (const paths of groups.values()) {
+            const result = await this.detect({ ...observation, suspicion: { ...observation.suspicion, paths } });
+            for (const item of result.evidence)
+                evidence.push(item);
+            for (const uuid of result.observedEntityIds)
+                observedEntityIds.push(uuid);
+            for (const path of result.examine ?? [])
+                examine.push(path);
+            if (result.kind === "widen")
+                widened ??= result.proof;
+            // A racy source waits for its timer; an immediate rerun would read it again.
+            if (result.kind === "retry" && (!moved || result.after === "timer"))
+                moved = result;
+            if (result.kind === "deferred")
+                owners.push(...result.owners);
+        }
+        // Deferred names still hold this root, so it cannot be reconciled alone
+        // now: remaining unproved names need the domain continuation.
+        if (widened)
+            return { kind: "widen", proof: widened, roots: "domain", ...progress() };
+        if (moved)
+            return { kind: "retry", reason: moved.reason, after: moved.after, ...progress() };
+        return { kind: "deferred", owners, ...progress() };
+    }
+    requireAttribution(scope) {
+        const owners = this.ownership.use(scope);
+        if (owners.length)
+            throw new ApplyAttributionDeferred(owners);
+    }
+    async observe(observations) {
+        if (observations.every(({ suspicion }) => suspicion.paths?.length === 0)) {
+            return { ...nothing, kind: "unchanged" };
+        }
+        const members = this.ground.repositoryMembers();
+        this.mark("members");
+        this.gitProof = await this.gitBindings.observe(members, uuid => this.ground.physical(uuid));
+        const wider = new Set();
+        for (const observation of observations)
+            for (const path of observation.suspicion.paths) {
+                const route = this.gitProof.route(join(observation.directory, path));
+                if (route.kind !== "reconcile")
+                    continue;
+                wider.add(observation.directory);
+                for (const uuid of route.rootUUIDs) {
+                    const root = this.ground.physical(uuid);
+                    if (!root || root.relativePath !== "")
+                        throw new Error("Git notice consumer has no materialized root");
+                    wider.add(root.absolutePath);
+                }
+            }
+        if (wider.size)
+            return widen("git-notice-consumer", [...wider]);
+        const contexts = new Map();
+        for (const observation of observations) {
+            if (observation.suspicion.paths?.length === 0)
+                continue;
+            const root = this.ground.root(observation.directory);
+            if (!root)
+                return widen("unindexed-root", [observation.directory]);
+            const context = new NamedDirectoryProof({
+                lookup: (path, parent) => {
+                    const row = parent ? this.ground.atPath(root.rootUUID, path).find(row => activeUnder(row, parent))
+                        : this.activeRowAtPath(root.rootUUID, path);
+                    this.requireAttribution({ entries: [join(observation.directory, path)], ...(row ? { uuids: new Set([row.uuid]) } : {}) });
+                    return row;
+                },
+                read: path => {
+                    const absolutePath = join(observation.directory, ...path.split("/"));
+                    const stats = tryLstat(absolutePath);
+                    return stats?.isDirectory() && !stats.isSymbolicLink()
+                        ? { physicalKey: physicalKey(stats), repository: hasGitMarker(absolutePath) }
+                        : null;
+                },
+            });
+            contexts.set(observation.directory, context);
+            for (const path of observation.suspicion.paths) {
+                // Each name's directory proof is its own reads: names are boundaries.
+                await turnBoundary();
+                this.requireAttribution({ entries: [join(observation.directory, path)] });
+                if (!context.named(path))
+                    return widen("named-directory", [observation.directory]);
+            }
+        }
+        this.mark("route");
+        const result = await this.detectWithContext(observations, contexts, new PhysicalPathWitnesses());
+        return { ...result, evidence: result.evidence.map(evidence => ({
+                ...evidence,
+                metadataReads: evidence.metadataReads + (contexts.get(evidence.directory)?.metadataReads ?? 0),
+            })) };
+    }
+    async detectWithContext(observations, contexts, sources) {
         const captured = [];
-        const outgoing = new Set();
-        const membershipParents = new Set();
+        const acceptedBasis = this.acceptedInbox.snapshot();
         const evidence = [];
-        const prepared = [];
-        let repositoryBoundary = false;
+        const policies = new Map();
+        const examine = new Set();
+        // Roots whose policy this attempt reads as a named leaf.
+        const policyChanges = [];
+        const widened = (proof, detail) => widen(proof, observations.filter(item => item.suspicion.paths?.length).map(item => item.directory), detail);
+        let excluded = 0;
         for (const observation of observations) {
             const paths = observation.suspicion.paths;
-            if (paths.length === 0)
+            if (!paths.length)
                 continue;
-            if (paths.some((path) => path === ".amalgmignore"
-                || path === ".git" || path.startsWith(".git/") || path.includes("/.git/")
-                || path.endsWith("/.git"))) {
-                return { handled: false, evidence: [] };
-            }
-            const root = this.rootAtDirectory.get(observation.directory);
+            const root = this.ground.root(observation.directory);
             if (!root)
-                return { handled: false, evidence: [] };
+                return widened("unindexed-root");
+            const policy = readSharingPolicy(observation.directory);
+            policies.set(root.uuid, policy);
+            if (paths.includes(AMALGM_IGNORE_FILE)) {
+                policyChanges.push({ directory: observation.directory, rootUUID: root.rootUUID, text: policy.text });
+            }
             const started = performance.now();
-            const scopedPaths = paths.filter((path) => !paths.some((candidate) => candidate !== path && path.startsWith(`${candidate}/`)));
-            const policy = resolve(observation.directory) === this.userRoot
-                ? this.userPolicy
-                : () => true;
-            const entries = scopedPaths.filter(policy).map((path) => {
-                const exact = this.rowAtPath.get(root.rootUUID, path);
+            const first = captured.length;
+            // 1. Classify every name from metadata alone. Structure beyond ordinary
+            // leaves, and every control or repository consumer, needs wider proof.
+            const leaves = [];
+            const absent = [];
+            for (const path of paths) {
+                await turnBoundary();
+                if (path.split("/").includes(".git"))
+                    return widened("structural-path", path);
+                if (path === "")
+                    return widened("root-path");
+                const exact = this.activeRowAtPath(root.rootUUID, path);
                 const absolutePath = join(observation.directory, ...path.split("/"));
+                this.requireAttribution({ entries: [absolutePath], ...(exact ? { uuids: new Set([exact.uuid]) } : {}) });
                 const stats = tryLstat(absolutePath);
-                if (!stats && exact) {
-                    if (this.enclosedByRepository(exact)) {
-                        repositoryBoundary = true;
-                    }
-                }
-                return { path, absolutePath, exact, stats };
-            });
-            if (entries.some(({ exact, stats }) => exact !== undefined && stats === null)) {
-                // An absent named address is not enough to distinguish deletion from
-                // a move whose destination doorbell arrives later (or never arrives
-                // on this platform). Reconcile the complete materialized root while
-                // the old row still supplies physical identity evidence.
-                return {
-                    handled: false,
-                    evidence: [],
-                    widenedRoots: [observation.directory],
-                };
-            }
-            const moveIntoRepository = entries.some(({ path, absolutePath, exact, stats }) => {
-                if (exact !== undefined || stats === null)
-                    return false;
-                const portableParent = posix.dirname(path);
-                const parentPath = portableParent === "." ? "" : portableParent;
-                const parent = this.rowAtPath.get(root.rootUUID, parentPath);
-                if (!parent || (parent.type !== "repo.git" && !this.enclosedByRepository(parent))) {
-                    return false;
+                if (stats) {
+                    const owners = this.ownership.physical(ownedObject(observation.directory, physicalKey(stats)));
+                    if (owners.length)
+                        throw new ApplyAttributionDeferred(owners);
                 }
-                return this.uniqueMovedBase(stats.dev, stats.ino, absolutePath) !== null;
-            });
-            if (moveIntoRepository) {
-                // A destination-only event can cross from the ordinary file rail into
-                // repository territory. The complete root is the smallest proof that
-                // can remove the old address and add the new repo-owned address in one
-                // identity reconciliation.
-                return {
-                    handled: false,
-                    evidence: [],
-                    widenedRoots: [observation.directory],
-                };
-            }
-            if (repositoryBoundary)
-                return { handled: false, evidence: [] };
-            prepared.push({ observation, root, paths, policy, started, entries });
-        }
-        for (const item of prepared) {
-            const { observation, root, paths, policy, started, entries } = item;
-            let metadataReads = entries.length;
-            let contentReads = 0;
-            let recordBytes = 0;
-            const beforeCount = captured.length;
-            for (const { path, absolutePath, exact, stats } of entries) {
+                sources.remember(absolutePath, stats);
+                if (exact ? this.enclosedByRepository(exact)
+                    : this.repositoryAtPath(root.rootUUID, path, observation.directory))
+                    return widened("repository-enclosed", path);
                 if (!stats) {
+                    absent.push(path);
                     continue;
                 }
-                const portableParent = posix.dirname(path);
-                const parentPath = portableParent === "." ? "" : portableParent;
-                const parent = this.rowAtPath.get(root.rootUUID, parentPath);
-                if (!parent || !["workspace", "folder"].includes(parent.type)
-                    || this.enclosedByRepository(parent)) {
-                    return { handled: false, evidence: [] };
-                }
-                let scope;
-                if (stats.isFile()) {
-                    if (exact && !["file.text", "file.binary"].includes(exact.type)) {
-                        return { handled: false, evidence: [] };
-                    }
-                    const file = await this.captureFile({
-                        root, path, absolutePath, stats, parent, exact,
-                    });
-                    scope = {
-                        items: file.item ? [file.item] : [],
-                        metadataReads: 1,
-                        contentReads: file.contentReads,
-                    };
-                }
-                else if (stats.isSymbolicLink()) {
-                    if (exact?.type === "reference"
-                        || (resolve(observation.directory) === this.userRoot
-                            && (path === "workspaces" || path.startsWith("workspaces/")))) {
-                        return { handled: false, evidence: [] };
-                    }
-                    const link = this.captureLink({
-                        root, path, absolutePath, stats, parent, exact,
-                    });
-                    if (!link)
-                        return { handled: false, evidence: [] };
-                    scope = {
-                        items: link.item ? [link.item] : [],
-                        metadataReads: 1,
-                        contentReads: link.contentReads,
-                    };
-                }
-                else if (stats.isDirectory() && !stats.isSymbolicLink()) {
-                    const directory = await this.captureDirectory({
-                        root,
-                        path,
-                        absolutePath,
-                        stats,
-                        parent,
-                        policy,
-                    });
-                    if (!directory)
-                        return { handled: false, evidence: [] };
-                    scope = directory;
-                }
-                else {
-                    return { handled: false, evidence: [] };
-                }
-                metadataReads += scope.metadataReads - 1;
-                contentReads += scope.contentReads;
-                for (const item of scope.items) {
-                    if (item.proposal
-                        && !this.acceptedInbox.covers(item.result.resourceId, item.proposal)) {
-                        outgoing.add(item.proposal);
-                        recordBytes += Buffer.byteLength(this.previewRecordJson(item.result.resourceId, item.proposal));
-                    }
-                    captured.push(item);
-                    if (item.base === null
-                        || item.base.parentUUID !== item.result.parentUUID
-                        || item.base.name !== item.result.name) {
-                        if (item.base?.parentUUID)
-                            membershipParents.add(item.base.parentUUID);
-                        if (item.result.parentUUID)
-                            membershipParents.add(item.result.parentUUID);
-                    }
-                }
-            }
-            evidence.push({
-                directory: observation.directory,
-                paths: paths.length,
-                metadataReads,
-                contentReads,
-                gitInspections: 0,
-                repositoryCaptures: 0,
-                plannedRows: captured.length - beforeCount,
-                records: captured.slice(beforeCount).filter(({ proposal }) => proposal !== null && outgoing.has(proposal)).length,
-                recordBytes,
-                durationMs: performance.now() - started,
-            });
-        }
-        const committedRecords = [];
-        const commitStarted = performance.now();
-        const committed = this.database.transaction(() => {
-            if (captured.some((item) => {
-                const current = this.rowAtUuid.get(item.result.uuid);
-                return item.base ? !sameNotebookBasisRow(item.base, current) : current !== undefined;
-            }))
-                return false;
-            for (const item of captured) {
-                this.writeEntity.run(...rowValues(item.result));
-                this.writeNotebook.run(...rowValues(item.result));
-                if (!item.proposal || !outgoing.has(item.proposal))
-                    continue;
-                if (this.acceptedInbox.covers(item.result.resourceId, item.proposal))
-                    continue;
-                committedRecords.push(this.appendOutboxRecord(item.result.resourceId, item.proposal));
-            }
-            for (const parentUUID of membershipParents) {
-                const base = this.rowAtUuid.get(parentUUID);
-                if (!base || !["workspace", "folder"].includes(base.type))
-                    continue;
-                const children = this.notebookChildren.all(parentUUID);
-                const payloadVersion = membershipHash(children, sha256Hex);
-                const version = canonicalVersion({
-                    type: base.type,
-                    parentUUID: base.parentUUID,
-                    name: base.name,
-                    status: base.status,
-                    payloadVersion,
-                }, sha256Hex);
-                if (version === base.version)
-                    continue;
-                const result = { ...base, payloadVersion: null, transportVersion: null, version };
-                this.writeEntity.run(...rowValues(result));
-                this.writeNotebook.run(...rowValues(result));
-                const proposal = detectedChangeProposal({
-                    base: portable(base),
-                    result: portable(result),
-                    replay: { kind: "structure" },
-                });
-                if (!proposal)
-                    continue;
-                if (!this.acceptedInbox.covers(base.resourceId, proposal)) {
-                    committedRecords.push(this.appendOutboxRecord(base.resourceId, proposal));
-                }
-            }
-            return true;
-        })();
-        if (!committed)
-            return { handled: false, evidence: [] };
-        this.onRecordCommit?.({
-            durationMs: performance.now() - commitStarted,
-            records: committedRecords,
-        });
-        return { handled: true, evidence };
-    }
-    /** A known leaf edit inside one repository is still named evidence. It
-     * updates that leaf's local identity proof, then records one nearest-repo
-     * Card + Checkpoint transition. Ambiguous structure and rail changes widen
-     * to reconciliation before this method mutates SQLite. */
-    async detectRepository(observations) {
-        const active = observations.filter(({ suspicion }) => suspicion.paths.length > 0);
-        if (active.length === 0)
-            return null;
-        let repository = null;
-        let directory = "";
-        const leafRows = new Map();
-        let metadataReads = 0;
-        let contentReads = 0;
-        let observedPaths = 0;
-        let stateEvidence = false;
-        const gitLockPaths = [];
-        const started = performance.now();
-        for (const observation of active) {
-            const root = this.rootAtDirectory.get(observation.directory);
-            if (!root)
-                return null;
-            const paths = observation.suspicion.paths
-                .filter((path) => !observation.suspicion.paths?.some((candidate) => candidate !== path && path.startsWith(`${candidate}/`)));
-            observedPaths += paths.length;
-            for (const path of paths) {
-                const owner = this.repositoryAtPath(root.rootUUID, path);
-                if (!owner || (repository && owner.uuid !== repository.uuid))
-                    return null;
-                repository = owner;
-                directory = observation.directory;
-                const segments = path.split("/");
-                const marker = segments.indexOf(".git");
-                if (marker >= 0) {
-                    // An established repository may report Card or index metadata.
-                    // Any named worktree path in the same generation is captured above;
-                    // the Git Checkpoint itself carries staged bytes and modes exactly.
-                    if (!hasGitMarker(owner.absolutePath))
-                        return null;
-                    metadataReads += 1;
-                    if (isGitLockPath(segments.slice(marker + 1)))
-                        gitLockPaths.push(path);
-                    else
-                        stateEvidence = true;
-                    continue;
-                }
-                stateEvidence = true;
-                const exact = this.rowAtPath.get(root.rootUUID, path);
-                const stats = tryLstat(join(observation.directory, ...path.split("/")));
-                if (!exact || !stats || exact.uuid === owner.uuid
-                    || this.repositoryAtPath(root.rootUUID, exact.relativePath)?.uuid !== owner.uuid)
-                    return null;
-                metadataReads += 1;
-                if (stats.isFile() && ["file.text", "file.binary"].includes(exact.type)) {
-                    const captured = await captureContentFile(exact.absolutePath, stats, null);
-                    const type = classifyFile({ binary: captured.binary });
-                    const result = {
-                        ...exact,
-                        type,
-                        version: canonicalVersion({
-                            type,
-                            parentUUID: exact.parentUUID,
-                            name: exact.name,
-                            status: exact.status,
-                            payloadVersion: captured.contentHash,
-                            fileMode: portableFileMode(type, stats.mode),
-                        }, sha256Hex),
-                        payloadVersion: captured.contentHash,
-                        transportVersion: null,
-                        deviceNumber: stats.dev,
-                        inode: stats.ino,
-                        byteSize: stats.size,
-                        modifiedTimeMs: stats.mtimeMs,
-                        changedTimeMs: stats.ctimeMs,
-                        filesystemMode: stats.mode,
-                        contentVerifiedAtMs: Date.now(),
-                    };
-                    leafRows.set(result.uuid, result);
-                    contentReads += 1;
-                    continue;
+                const kind = stats.isFile() ? "file" : stats.isSymbolicLink() ? "link" : null;
+                if (kind === "link" && referenceWorkspaceId(absolutePath, this.bindingDir) !== null) {
+                    return widened("managed-reference", path);
                 }
-                if (stats.isSymbolicLink() && exact.type === "link") {
-                    const target = readlinkSync(exact.absolutePath);
-                    const targetBytes = Buffer.from(target, "utf8");
-                    const payloadVersion = sha256Hex(targetBytes);
-                    // Record may become sendable in the same SQLite transaction below;
-                    // immutable cargo therefore has to be sealed during this truth read,
-                    // exactly like ordinary file capture.
-                    sealCapturedArtifact(this.cacheDir, {
-                        entityId: exact.uuid,
-                        entityType: "link",
-                        kind: "link",
-                        contentHash: payloadVersion,
-                    }, targetBytes);
-                    const result = {
-                        ...exact,
-                        version: canonicalVersion({
-                            type: "link",
-                            parentUUID: exact.parentUUID,
-                            name: exact.name,
-                            status: exact.status,
-                            payloadVersion,
-                        }, sha256Hex),
-                        payloadVersion,
-                        deviceNumber: stats.dev,
-                        inode: stats.ino,
-                        byteSize: stats.size,
-                        modifiedTimeMs: stats.mtimeMs,
-                        changedTimeMs: stats.ctimeMs,
-                        filesystemMode: stats.mode,
-                        contentVerifiedAtMs: Date.now(),
-                    };
-                    leafRows.set(result.uuid, result);
-                    contentReads += 1;
-                    continue;
+                if (kind === null || (exact && !LEAF_TYPES.has(exact.type))) {
+                    const found = kind ?? (stats.isDirectory() ? "directory" : "special");
+                    return widened(exact ? "kind-changed" : "unindexed-path", `${exact?.type ?? "none"} to ${found}: ${path}`);
                 }
-                return null;
+                leaves.push({ path, absolutePath, stats, kind });
             }
-        }
-        if (!repository || !directory)
-            return null;
-        if (!stateEvidence && gitLockPaths.some((path) => existsSync(join(directory, ...path.split("/"))))) {
-            // A lock path is proof that Git may still be constructing the state it
-            // will reveal. Keep this Watch generation pending and retry cheaply;
-            // absence of a second OS callback is never proof that the operation did
-            // not finish. Once every named lock is gone, capture Card + Checkpoint
-            // exactly once from settled repository truth.
-            return { handled: false, evidence: [], unsettled: true };
-        }
-        const priorRows = this.rowsUnderPath.all(repository.rootUUID, repository.relativePath, repository.relativePath, repository.relativePath, repository.relativePath);
-        const projectedIdentity = repositoryIdentity(repository, priorRows);
-        const priorByOwnedPath = new Map(projectedIdentity.map((entry) => [entry.path, entry.uuid]));
-        const priorByUuid = new Map(priorRows.map((row) => [row.uuid, row]));
-        // A Card transition can make a formerly dirty path clean without emitting
-        // a worktree event for that path. Refresh every nearest-owned clean leaf
-        // from Git's index/object database before sealing the identity map; this
-        // reads no worktree bytes and prevents the receiver from correcting the
-        // sender's stale evidence as an otherwise-valid echo.
-        const refreshRepositoryRows = async () => {
-            const registration = inspectGitRegistration(repository.absolutePath);
-            for (const [path, clean] of registration.cleanLeaves) {
-                const uuid = priorByOwnedPath.get(path);
-                const base = uuid ? (leafRows.get(uuid) ?? priorByUuid.get(uuid)) : undefined;
-                if (!base || (clean.type !== "link"
-                    && clean.type !== "file.text" && clean.type !== "file.binary"))
-                    continue;
-                const version = canonicalVersion({
-                    type: clean.type,
-                    parentUUID: base.parentUUID,
-                    name: base.name,
-                    status: base.status,
-                    payloadVersion: clean.payloadVersion,
-                    fileMode: portableFileMode(clean.type, clean.fileMode),
-                }, sha256Hex);
-                if (base.type === clean.type
-                    && base.payloadVersion === clean.payloadVersion
-                    && base.version === version)
-                    continue;
-                leafRows.set(base.uuid, {
-                    ...base,
-                    type: clean.type,
-                    version,
-                    payloadVersion: clean.payloadVersion,
-                    transportVersion: null,
-                    contentVerifiedAtMs: Date.now(),
-                });
+            // A link to any file read may appear while it is read.
+            this.lease.physical(new PhysicalKeySet(leaves.filter(leaf => leaf.kind === "file").map(leaf => physicalKey(leaf.stats))));
+            // Collection is complete; identity preparation starts at a boundary.
+            await turnBoundary();
+            // 2. One identity decision for every leaf, from the closure of facts
+            // the complete resolver reads for them.
+            const identity = await resolveScopedLeaves(root.rootUUID, leaves.map(leaf => ({ relativePath: leaf.path,
+                kind: leaf.kind, physicalKey: physicalKey(leaf.stats), links: Number(leaf.stats.nlink) })), scopedIdentityPort({ root, directory: observation.directory, ground: this.ground,
+                proof: contexts.get(observation.directory), sources, eligible: row => this.isEffectivelyActive(row),
+                attribute: scope => this.requireAttribution(scope), require: address => this.lease.require([address]),
+                lstat: tryLstat }));
+            if (identity.kind === "examine")
+                return widened("identity-unproved", `${identity.reason}: ${identity.path}`);
+            for (const path of identity.occupied)
+                examine.add(join(observation.directory, ...path.split("/")));
+            const moved = new Map();
+            const { identities } = identity;
+            for (const leaf of leaves) {
+                const row = identities.get(leaf.path) ?? null;
+                if (row && row.relativePath !== leaf.path)
+                    moved.set(row.relativePath, row.uuid);
             }
-            for (const path of registration.dirtyPaths) {
-                const uuid = priorByOwnedPath.get(path);
-                const base = uuid ? (leafRows.get(uuid) ?? priorByUuid.get(uuid)) : undefined;
-                if (!base)
-                    return null;
-                let stats;
-                try {
-                    stats = lstatSync(base.absolutePath);
-                }
-                catch {
-                    // A dirty deletion or a newly discovered path changes repository
-                    // membership. The ordinary reconciliation lane owns that graph
-                    // change and will rebuild the exact identity map once.
-                    return null;
-                }
-                const observed = uuid ? leafRows.get(uuid) : undefined;
-                if (observed
-                    && observed.deviceNumber === stats.dev
-                    && observed.inode === stats.ino
-                    && observed.byteSize === stats.size
-                    && observed.modifiedTimeMs === stats.mtimeMs
-                    && observed.changedTimeMs === stats.ctimeMs
-                    && observed.filesystemMode === stats.mode) {
-                    continue;
-                }
-                let type;
-                let payloadVersion;
-                if (stats.isSymbolicLink()) {
-                    type = "link";
-                    payloadVersion = sha256Hex(Buffer.from(readlinkSync(base.absolutePath), "utf8"));
-                }
-                else if (stats.isFile()) {
-                    const captured = await captureContentFile(base.absolutePath, stats, null);
-                    type = classifyFile({ binary: captured.binary });
-                    payloadVersion = captured.contentHash;
-                }
-                else {
-                    return null;
-                }
-                leafRows.set(base.uuid, {
-                    ...base,
-                    type,
-                    version: canonicalVersion({
-                        type,
-                        parentUUID: base.parentUUID,
-                        name: base.name,
-                        status: base.status,
-                        payloadVersion,
-                        fileMode: portableFileMode(type, stats.mode),
-                    }, sha256Hex),
-                    payloadVersion,
-                    transportVersion: null,
-                    deviceNumber: stats.dev,
-                    inode: stats.ino,
-                    byteSize: stats.size,
-                    modifiedTimeMs: stats.mtimeMs,
-                    changedTimeMs: stats.ctimeMs,
-                    filesystemMode: stats.mode,
-                    contentVerifiedAtMs: Date.now(),
-                });
-                contentReads += 1;
+            // 3. An identity moved in this unit covers its old address. A name no
+            // active identity holds, observed or shared, settles as
+            // examined-no-change: a trashed row there is an absence already
+            // concluded. Any other absence needs the complete membership.
+            for (const path of absent) {
+                await turnBoundary();
+                const holders = ["entities", "detection_notebook"].flatMap(inventory => this.ground.atPath(root.rootUUID, path, inventory).filter(row => this.isEffectivelyActive(row, inventory)));
+                if (holders.some(row => moved.get(path) !== row.uuid))
+                    return widened("absent-path", path);
             }
-            return priorRows.map((row) => leafRows.get(row.uuid) ?? row);
-        };
-        const currentRows = await refreshRepositoryRows();
-        if (!currentRows)
-            return null;
-        let identity = repositoryIdentity(repository, currentRows);
-        let prior = null;
-        let priorLayout = null;
-        if (repository.payloadVersion && repository.transportVersion) {
-            const priorFile = join(this.cacheDir, `${repository.transportVersion}.bin`);
-            if (existsSync(priorFile)) {
-                try {
-                    const layout = inspectRepositoryTransportFile(priorFile);
-                    if (layout.stateId === repository.payloadVersion) {
-                        priorLayout = layout;
-                        prior = {
-                            stateId: repository.payloadVersion,
-                            transportVersion: repository.transportVersion,
-                            card: layout.card,
-                            identityHash: layout.identityHash,
-                        };
-                    }
-                }
-                catch {
-                    prior = null;
-                    priorLayout = null;
-                }
+            // Every address is checked before any byte is read; the reads then run
+            // together on the capture threads instead of one file at a time.
+            const reads = [];
+            await eachInTurns(leaves, leaf => {
+                const base = identities.get(leaf.path) ?? null;
+                const parent = this.activeRowAtPath(root.rootUUID, parentPath(leaf.path));
+                if (!parent)
+                    throw new Error(`named leaf ${leaf.path} has no proved parent`);
+                reads.push({ root, path: leaf.path, absolutePath: leaf.absolutePath, stats: leaf.stats, kind: leaf.kind,
+                    parent, base, uuid: base?.uuid ?? randomUUID(), sources });
+            });
+            // Each read's reuse proof and dispatch are ground reads of its own.
+            const results = await settleInTurns(reads, input => input.kind === "link" ? this.captureLink(input) : this.captureFile(input));
+            let contentReads = 0;
+            for (const [index, result] of results.entries()) {
+                captured.push(result.item);
+                if (!policy.includes(reads[index].path))
+                    excluded++;
+                contentReads += result.contentReads;
             }
+            evidence.push({ directory: observation.directory, metadataReads: paths.length,
+                metadataReused: leaves.length - contentReads, contentReads,
+                gitInspections: 0, repositoryCaptures: 0, plannedRows: captured.length - first,
+                records: 0, settled: 0, recordBytes: 0, durationMs: performance.now() - started });
         }
-        let captured = null;
-        let coherent = false;
-        const previousIdentity = prior
-            ? readCachedRepositoryIdentity(this.cacheDir, prior.transportVersion)
-            : null;
-        for (let attempt = 0; attempt < 3; attempt += 1) {
-            captured = captureRepository(repository.absolutePath, identity, prior, prior ? previousIdentity : null);
-            const identityPaths = new Set(identity.map((entry) => entry.path));
-            if (captured.state.checkpoint.untracked.some((entry) => !identityPaths.has(entry.path))) {
-                // The Checkpoint found ground for which this named pass has no durable
-                // UUID yet. Widen to the ordinary reconciliation lane so bytes and
-                // identity enter one repository record, never an identity-only echo
-                // on the receiving machine.
-                return null;
+        // Each captured name owes its object's other names (alias-examination.ts).
+        for (const path of aliasExaminations(captured.map(({ base, result }) => ({ before: base, after: result })), { objectRows: key => this.ground.objectRows(key), physical: uuid => this.ground.physical(uuid) }))
+            examine.add(path);
+        this.mark("collect");
+        const priors = new Map();
+        const sharing = new Map();
+        const adopted = new Set();
+        for (const { base, result } of captured) {
+            await turnBoundary();
+            const prior = base ? this.ground.sharing(result.uuid) : undefined;
+            if (prior && prior.status !== "active")
+                return widened("unshared-leaf", result.relativePath);
+            if (prior)
+                priors.set(result.uuid, prior);
+            // A new sharing identity allocates its address; another identity there
+            // is a divergence only the complete graph resolves.
+            else if (this.ground.atPath(result.rootUUID, result.relativePath, "detection_notebook").length) {
+                return widened("address-changed", result.relativePath);
             }
-            const refreshedRows = await refreshRepositoryRows();
-            if (!refreshedRows)
-                return null;
-            const after = repositoryIdentity(repository, refreshedRows);
-            if (sameGitIdentity(after, identity)) {
-                identity = [...captured.identity];
-                coherent = true;
-                break;
+            if (acceptedBasis.covers(result.resourceId, { entityId: result.uuid, result: portable(result) })) {
+                adopted.add(result.uuid);
+                sharing.set(result.uuid, result);
             }
-            identity = after;
+            else if (prior)
+                sharing.set(result.uuid, prior);
         }
-        if (!coherent || !captured) {
-            throw new Error("repository identity did not settle during Detect capture");
+        const targets = new Set(captured.map(item => item.result.uuid));
+        const context = this.publicationContext([...captured.flatMap(({ base, result }) => base ? [base, result] : [result]),
+            ...priors.values(), ...sharing.values()], targets);
+        if (context === null)
+            return widened("address-changed", "ancestor structure differs");
+        let selection;
+        try {
+            selection = selectPublication({ before: [...sharing.values()], observed: captured.map(item => item.result),
+                context, includes: (path, rootId) => {
+                    const policy = policies.get(rootId);
+                    if (!policy)
+                        throw new Error("publication has no observed root policy");
+                    return policy.includes(path);
+                } });
         }
-        for (const entry of captured.identity) {
-            if (!entry.payloadVersion
-                || (entry.type !== "file.text" && entry.type !== "file.binary" && entry.type !== "link")) {
-                continue;
-            }
-            const uuid = priorByOwnedPath.get(entry.path);
-            const base = uuid ? (leafRows.get(uuid) ?? priorByUuid.get(uuid)) : undefined;
-            if (!base)
-                continue;
-            const type = entry.type;
-            leafRows.set(base.uuid, {
-                ...base,
-                type,
-                version: canonicalVersion({
-                    type,
-                    parentUUID: base.parentUUID,
-                    name: base.name,
-                    status: base.status,
-                    payloadVersion: entry.payloadVersion,
-                    fileMode: portableFileMode(type, base.filesystemMode),
-                }, sha256Hex),
-                payloadVersion: entry.payloadVersion,
-                transportVersion: null,
-            });
-        }
-        if (captured.bytes) {
-            sealCapturedArtifact(this.cacheDir, {
-                entityId: repository.uuid,
-                entityType: "repo.git",
-                kind: "git",
-                contentHash: captured.transportVersion,
-            }, captured.bytes);
+        catch (error) {
+            if (!(error instanceof PublicationScopeExceeded))
+                throw error;
+            return widened("scope-exceeded", contextPath(context, error.entityIds[0]));
         }
-        const layout = inspectRepositoryTransportFile(join(this.cacheDir, `${captured.transportVersion}.bin`));
-        sealCachedRepositoryIdentity(this.cacheDir, captured.transportVersion, captured.identity, layout.identityHash);
-        const stats = lstatSync(repository.absolutePath);
-        const result = {
-            ...repository,
-            version: canonicalVersion({
-                type: "repo.git",
-                parentUUID: repository.parentUUID,
-                name: repository.name,
-                status: repository.status,
-                payloadVersion: captured.stateId,
-            }, sha256Hex),
-            payloadVersion: captured.stateId,
-            transportVersion: captured.transportVersion,
-            deviceNumber: stats.dev,
-            inode: stats.ino,
-            byteSize: stats.size,
-            modifiedTimeMs: stats.mtimeMs,
-            changedTimeMs: stats.ctimeMs,
-            filesystemMode: stats.mode,
-        };
-        const proposal = detectedChangeProposal({
-            base: portable(repository),
-            result: portable(result),
-            replay: {
-                kind: "repo.git",
-                stateId: layout.stateId,
-                cardId: layout.cardId,
-                checkpointId: layout.checkpointId,
-                cardChanged: priorLayout?.cardId !== layout.cardId,
-                checkpointChanged: priorLayout?.checkpointId !== layout.checkpointId,
-                parentTransportVersion: layout.parentTransportVersion,
-                transportVersion: captured.transportVersion,
-            },
+        const admitted = selection.selected.filter(row => selection.sources.get(row.uuid) === "observed" || adopted.has(row.uuid));
+        // Selection is complete; container preparation starts at a boundary.
+        await turnBoundary();
+        // Parents derive O from every observed result and S from the selected
+        // result only, each against its stored row; neither membership change is
+        // a Record of its own.
+        const observedContainers = finalizeContainers({
+            parents: [...membershipParents(captured.map(({ base, result }) => ({ before: base ? this.ground.physical(result.uuid) : null, after: result })))]
+                .map(uuid => required(this.ground.physical(uuid), uuid)),
+            children: uuid => this.ground.siblings("entities", uuid),
+            targets, results: captured.map(item => item.result), sha256Hex
+        });
+        const selected = new Map(selection.selected.map(row => [row.uuid, row]));
+        const sharedContainers = finalizeContainers({
+            parents: [...membershipParents([...targets].map(uuid => ({ before: priors.get(uuid) ?? null, after: selected.get(uuid) ?? null })))]
+                .map(uuid => required(this.ground.sharing(uuid), uuid)),
+            children: uuid => this.ground.siblings("detection_notebook", uuid),
+            targets, results: selection.selected, sha256Hex
         });
-        const shouldRecord = proposal !== null
-            && !this.acceptedInbox.covers(repository.resourceId, proposal);
-        const recordBytes = proposal && shouldRecord
-            ? Buffer.byteLength(this.previewRecordJson(repository.resourceId, proposal))
-            : 0;
-        const committedRecords = [];
+        // Payload replays read their results' cache names; no other stage is
+        // cargo. A payload observed through a reused proof is read once now.
+        const carried = admitted.filter(row => !adopted.has(row.uuid) && replaysPayload(priors.get(row.uuid) ?? null, row));
+        const unread = carried.filter(row => !this.cargo.holds(row.payloadVersion));
+        await settleInTurns(unread, row => this.sealUnread(row));
+        await this.cargo.publish(new Set(carried.map(row => row.payloadVersion)));
+        // Every replay starts before any is awaited: each reads the cache on a
+        // content thread.
+        const proposals = (await settleInTurns(admitted.filter(row => !adopted.has(row.uuid)), async (row) => {
+            const proposal = await this.proposalFor(priors.get(row.uuid) ?? null, row);
+            return proposal ? [{ authorityId: row.resourceId, proposal }] : [];
+        })).flat();
+        await makeRecordContentDurable(this.cacheDir, proposals.flatMap(({ proposal }) => proposal.cargo));
+        this.mark("durable");
+        // Consumed Git answers their witnesses cannot close are asked again;
+        // only native witnesses close inside admission.
+        await this.gitProof.proof.semantic();
+        this.mark("close");
+        const basis = this.ground.finish();
+        const ownership = this.ownership.seal();
         const commitStarted = performance.now();
-        let committedRecord = false;
-        const committed = this.database.transaction(() => {
-            const bases = new Map([[repository.uuid, repository]]);
-            for (const uuid of leafRows.keys()) {
-                const base = priorByUuid.get(uuid);
-                if (base)
-                    bases.set(uuid, base);
+        const accounted = admitted.filter(row => adopted.has(row.uuid)).length;
+        const written = await this.admit("named leaves: admission depends on their ancestor spine", basis, acceptedBasis, () => {
+            ownership.assertCurrent();
+            // One recheck after every leaf was observed closes each container.
+            if ([...contexts.values()].some(context => !context.unchanged()))
+                return null;
+            closePhysically(this.gitProof.proof);
+            for (const policy of policies.values())
+                policy.validate();
+            sources.validate();
+            const createdAt = Date.now();
+            return {
+                writes: {
+                    repositoryObservations: [], seals: [],
+                    materialized: captured.map(item => retainContentVerification(item.base, item.result)).concat(observedContainers),
+                    materializedRemovals: [],
+                    notebook: admitted.map(row => retainContentVerification(sharing.get(row.uuid), row)).concat(sharedContainers),
+                    records: proposals.map(({ authorityId, proposal }) => createLocalEntityRecord({ mutationId: randomUUID(),
+                        authorityId, lastSeenGlobalSequence: this.entityReceivedThrough(authorityId, proposal.entityId),
+                        change: proposal, createdAt })),
+                },
+                counts: { proposed: proposals.length + accounted, admitted: proposals.length,
+                    alreadyAccounted: accounted, withheld: captured.length - admitted.length },
+            };
+        });
+        if (!written)
+            return retry("admission-basis-changed");
+        const { records: committedRecords, ground, changes } = written;
+        if (changes)
+            this.onDetectCommit(Object.freeze({ changes, records: written.recordJSON }));
+        this.onRecordCommit?.({ durationMs: performance.now() - commitStarted,
+            records: committedRecords, ...(ground ? { ground } : {}) });
+        // A changed policy owes a proof wherever sharing is not yet its
+        // selection. Saves commit in posting order, so this commit made every
+        // admission that read the old policy visible to the read; any later one
+        // read this policy.
+        for (const { directory, rootUUID, text } of policyChanges) {
+            for (const path of await readOwedAddresses(this.database.name, rootUUID, text, this.bindingDir)) {
+                examine.add(join(directory, ...path.split("/")));
             }
-            if ([...bases.values()].some((base) => !sameNotebookBasisRow(base, this.rowAtUuid.get(base.uuid)))) {
-                return false;
+        }
+        if (policyChanges.length)
+            this.mark("include");
+        return { ...settled(evidence.map(item => {
+                const root = observations.find(observation => observation.directory === item.directory);
+                const within = (row) => row.absolutePath.startsWith(`${root.directory}/`);
+                const ids = new Set(captured.filter(entry => within(entry.result)).map(entry => entry.result.uuid));
+                const records = committedRecords.filter(record => ids.has(record.entityId));
+                const late = unread.filter(within).length;
+                return { ...item, metadataReused: item.metadataReused - late, contentReads: item.contentReads + late,
+                    records: records.length, settled: [...ids].filter(id => adopted.has(id)).length,
+                    recordBytes: records.reduce((sum, record) => sum + Buffer.byteLength(encodeEntityRecord(record)), 0) };
+            }), captured.map(item => item.result.uuid), captured.length > 0 && excluded === captured.length),
+            ...(examine.size ? { examine: [...examine] } : {}) };
+    }
+    /** The unchanged structure that closes the targets' collision-derived
+     * addresses, from each inventory separately: every container on the
+     * ancestry of any target row, and the complete active child group of each
+     * one a collision owes (Live's childGroupOwed), in both inventories. A
+     * container's members are the target rows and ancestry containers it
+     * holds; their slots are read one by one, never the container, so a leaf
+     * in a directory of any size reads its ancestry and a few slots. Ancestors
+     * agree structurally in both inventories; owed groups need not, since an
+     * O-only ignored sibling is observation, not sharing. The selector refuses
+     * any selection that would change a context member. Content outside the
+     * targets is neither loaded nor a validation dependency. */
+    publicationContext(rows, targets) {
+        const before = new Map(), observed = new Map();
+        const members = new Map();
+        const place = (row) => {
+            const placed = members.get(row.parentUUID);
+            if (placed)
+                placed.push(row);
+            else
+                members.set(row.parentUUID, [row]);
+        };
+        const shape = (row) => JSON.stringify([
+            row.uuid, row.parentUUID, row.name, row.type, row.relativePath, row.status,
+        ]);
+        const node = (row) => row.relativePath === "" ? { ...row, parentUUID: null } : row;
+        for (const row of rows) {
+            place(row);
+            const path = new Set();
+            for (let parentUUID = row.parentUUID; parentUUID !== null && !observed.has(parentUUID);) {
+                if (path.has(parentUUID))
+                    throw new Error("publication ancestry has a cycle");
+                path.add(parentUUID);
+                const current = this.ground.structure("entities", parentUUID);
+                const shared = this.ground.structure("detection_notebook", parentUUID);
+                if (!current || !shared || current.status !== "active" || shape(current) !== shape(shared))
+                    return null;
+                before.set(shared.uuid, node(shared));
+                observed.set(current.uuid, node(current));
+                if (current.relativePath === "")
+                    break;
+                place(current);
+                parentUUID = current.parentUUID;
             }
-            for (const row of leafRows.values()) {
-                this.writeEntity.run(...rowValues(row));
-                this.writeNotebook.run(...rowValues(row));
+        }
+        const active = (row) => row.status === "active";
+        // An ancestor keeps the structure row proved above.
+        const ancestry = new Set(observed.keys());
+        const unchanged = (row) => active(row) && !targets.has(row.uuid) && !ancestry.has(row.uuid);
+        for (const [parentUUID, placed] of members) {
+            if (!["detection_notebook", "entities"].some(inventory => childGroupOwed(placed, name => this.ground.slot(inventory, parentUUID, name).filter(active).map(row => row.uuid))))
+                continue;
+            for (const sibling of this.ground.siblings("detection_notebook", parentUUID).filter(unchanged)) {
+                before.set(sibling.uuid, sibling);
             }
-            this.writeEntity.run(...rowValues(result));
-            this.writeNotebook.run(...rowValues(result));
-            if (proposal && shouldRecord
-                && !this.acceptedInbox.covers(repository.resourceId, proposal)) {
-                committedRecords.push(this.appendOutboxRecord(repository.resourceId, proposal));
-                committedRecord = true;
+            for (const sibling of this.ground.siblings("entities", parentUUID).filter(unchanged)) {
+                observed.set(sibling.uuid, sibling);
             }
-            return true;
-        })();
-        if (!committed)
-            return { handled: false, evidence: [] };
-        this.onRecordCommit?.({
-            durationMs: performance.now() - commitStarted,
-            records: committedRecords,
-        });
-        return {
-            handled: true,
-            evidence: [{
-                    directory,
-                    paths: active.reduce((count, item) => count + item.suspicion.paths.length, 0),
-                    metadataReads,
-                    contentReads,
-                    gitInspections: 1,
-                    repositoryCaptures: 1,
-                    plannedRows: 1,
-                    records: committedRecord ? 1 : 0,
-                    recordBytes: committedRecord ? recordBytes : 0,
-                    durationMs: performance.now() - started,
-                }],
-        };
-    }
-    repositoryAtPath(rootUUID, path) {
-        const segments = path.split("/");
-        const marker = segments.indexOf(".git");
-        if (marker >= 0) {
-            const candidate = segments.slice(0, marker).join("/");
-            const row = this.rowAtPath.get(rootUUID, candidate);
-            return row?.type === "repo.git" ? row : null;
         }
+        return { before: [...before.values()], observed: [...observed.values()] };
+    }
+    repositoryAtPath(rootUUID, path, directory) {
+        const route = this.gitProof.route(join(directory, path));
+        if (route.kind === "reconcile")
+            return null;
+        if (route.kind === "single")
+            return this.ground.physical(route.uuid) ?? null;
         let candidate = path;
         while (true) {
-            const row = this.rowAtPath.get(rootUUID, candidate);
+            const row = this.activeRowAtPath(rootUUID, candidate);
             if (row?.type === "repo.git")
                 return row;
             if (candidate === "")
@@ -812,77 +722,77 @@ export class NamedDetectRuntime {
             candidate = parent === "." ? "" : parent;
         }
     }
-    previewRecordJson(authorityId, proposal) {
-        return encodeEntityRecord(createLocalEntityRecord({
-            mutationId: "00000000-0000-4000-8000-000000000000",
-            authorityId,
-            lastSeenGlobalSequence: this.entityReceivedThrough(authorityId, proposal.entityId),
-            change: proposal,
-            createdAt: 0,
-        }));
-    }
-    appendOutboxRecord(authorityId, proposal) {
-        const createdAt = Date.now();
-        const record = createLocalEntityRecord({
-            mutationId: randomUUID(),
-            authorityId,
-            lastSeenGlobalSequence: this.entityReceivedThrough(authorityId, proposal.entityId),
-            change: proposal,
-            createdAt,
-        });
-        this.appendRecord.run(record.mutationId, record.authorityId, record.entityId, encodeEntityRecord(record), createdAt);
-        return record;
+    /** One admission of a registered collection, as one save
+     * (admission-save.ts): its ready fact commits beside its outcome, in the
+     * save on success or after it otherwise. Collection held no ground; what
+     * this thread owns is answered when the save is posted, and saves commit
+     * in post order. Null when the basis moved. */
+    async admit(unit, basis, accepted, prepare) {
+        const collection = this.register(unit, basis);
+        this.mark("ready");
+        const invalidated = { disposition: "invalidated", retry: null, phase: "admission-basis",
+            reason: "the admission basis changed after collection" };
+        try {
+            let prepared, posted = null;
+            try {
+                this.lease.assertUncrossed();
+                prepared = prepare();
+                if (prepared)
+                    posted = save(this.database.name, "detect.admit", {
+                        units: [{ ...prepared.writes, basis: basis.toData(), dispositions: collection.admission(prepared.counts) }],
+                        accepted: accepted.reads(), observe: this.onDetectCommit !== undefined
+                    });
+            }
+            catch (error) {
+                collection.rejected(admissionRejection(error), null);
+                throw error;
+            }
+            if (!prepared || !posted) {
+                collection.rejected(invalidated, null);
+                return null;
+            }
+            const requested = performance.now();
+            let saved;
+            try {
+                saved = await posted;
+            }
+            catch (error) {
+                collection.rejected(admissionRejection(error), { requested, began: null, checked: null, ended: performance.now() });
+                throw error;
+            }
+            const result = saved.value;
+            const marks = { requested: saved.posted, began: saved.began,
+                checked: result.accepted ? result.checkedAt - performance.timeOrigin : null, ended: saved.ended };
+            if (!result.accepted || result.stale.length) {
+                collection.rejected(invalidated, marks);
+                return null;
+            }
+            collection.committed(marks, result.outcomes[0]);
+            return { records: prepared.writes.records, recordJSON: Object.freeze([...result.records]),
+                ...(this.measureGround() || result.changes ? { ground: result.evidence } : {}),
+                ...(result.changes ? { changes: result.changes } : {}) };
+        }
+        finally {
+            this.mark("admit");
+        }
     }
     entityReceivedThrough(authorityId, entityId) {
         const row = this.receivedThrough.get(authorityId, entityId);
         return row?.receivedThrough ?? 0;
     }
-    /** Derived collision names are local addresses, not portable renames. A
-     * same-parent observation at either the portable name or the exact address
-     * derived from the current sibling set keeps the stored portable name. A
-     * different parent, or any third basename, is real move/rename evidence. */
-    capturedName(base, path, parentUUID) {
-        const seen = posix.basename(path);
-        if (!base || base.parentUUID !== parentUUID)
-            return seen;
-        let derived = this.slotNamesByParent.get(parentUUID);
-        if (!derived) {
-            derived = materializedSlotNames(this.materializedSiblings.all(parentUUID));
-            this.slotNamesByParent.set(parentUUID, derived);
-        }
-        const expected = derived.get(base.uuid) ?? base.name;
-        return seen === base.name || seen === expected ? base.name : seen;
-    }
     async captureFile(input) {
-        const { root, path, absolutePath, stats, parent, exact } = input;
-        const base = exact ?? this.uniqueMovedBase(stats.dev, stats.ino, absolutePath);
-        const fingerprintTrusted = base !== null
-            && base.relativePath === path
-            && this.materializedByUuid.get(base.uuid) !== undefined
-            && sameFingerprint(base, stats)
-            && base.contentVerifiedAtMs !== null
-            && stats.mtimeMs < base.contentVerifiedAtMs;
-        if (fingerprintTrusted)
-            return { item: null, contentReads: 0 };
-        const canReuseMovedContent = base !== null
-            && base.relativePath !== path
-            && base.deviceNumber === stats.dev
-            && base.inode === stats.ino
-            && base.byteSize === stats.size
-            && base.modifiedTimeMs === stats.mtimeMs
-            && base.filesystemMode === stats.mode
-            && base.payloadVersion !== null;
-        const content = canReuseMovedContent ? null : await captureContentFile(absolutePath, stats, this.cacheDir);
-        const type = content ? classifyFile({ binary: content.binary }) : base?.type;
-        const payloadVersion = content?.contentHash ?? base?.payloadVersion ?? null;
-        if (!type || !["file.text", "file.binary"].includes(type) || !payloadVersion) {
-            throw new Error(`named Detect could not capture ${path}`);
-        }
-        const name = this.capturedName(base, path, parent.uuid);
+        const { root, path, absolutePath, stats, parent, base, uuid, sources } = input;
+        sources.remember(absolutePath, stats);
+        if (this.unchangedLeaf(input))
+            return { item: { base, result: base }, contentReads: 0 };
+        const content = await captureContent(absolutePath, stats, this.cacheDir, { lane: "named", cargo: this.cargo });
+        const type = classifyFile({ binary: content.binary });
+        const payloadVersion = content.contentHash;
+        const name = observedPortableName(base, parent.uuid, posix.basename(path));
         const result = {
             resourceId: root.resourceId,
             rootUUID: root.rootUUID,
-            uuid: base?.uuid ?? randomUUID(),
+            uuid,
             type,
             parentUUID: parent.uuid,
             name,
@@ -893,222 +803,31 @@ export class NamedDetectRuntime {
                 name,
                 status: "active",
                 payloadVersion,
-                fileMode: portableFileMode(type, stats.mode),
+                fileMode: portableFileMode(type, Number(stats.mode)),
             }, sha256Hex),
             payloadVersion,
             transportVersion: null,
             relativePath: path,
             absolutePath,
-            deviceNumber: stats.dev,
-            inode: stats.ino,
-            byteSize: stats.size,
-            modifiedTimeMs: stats.mtimeMs,
-            changedTimeMs: stats.ctimeMs,
-            filesystemMode: stats.mode,
-            contentVerifiedAtMs: content ? Date.now() : base?.contentVerifiedAtMs ?? null,
-        };
-        const replay = base !== null
-            && base.type === result.type
-            && base.payloadVersion === result.payloadVersion
-            && base.transportVersion === result.transportVersion
-            ? { kind: "structure" }
-            : this.replayFor(base, result);
-        return {
-            item: {
-                base,
-                result,
-                proposal: detectedChangeProposal({
-                    base: base ? portable(base) : null,
-                    result: portable(result),
-                    replay,
-                }),
-            },
-            contentReads: content ? 1 : 0,
-        };
-    }
-    async captureDirectory(input) {
-        if (existsSync(join(input.absolutePath, ".git")))
-            return null;
-        const exact = this.rowAtPath.get(input.root.rootUUID, input.path);
-        if (exact && !["workspace", "folder"].includes(exact.type))
-            return null;
-        const base = exact ?? this.uniqueMovedBase(input.stats.dev, input.stats.ino, input.absolutePath);
-        if (base && !["workspace", "folder"].includes(base.type))
-            return null;
-        const uuid = base?.uuid ?? randomUUID();
-        const childItems = [];
-        let metadataReads = 1;
-        let contentReads = 0;
-        const children = [];
-        for (const child of readdirSync(input.absolutePath, { withFileTypes: true })
-            .sort((left, right) => left.name.localeCompare(right.name))) {
-            const path = `${input.path}/${child.name}`;
-            if (!input.policy(path))
-                continue;
-            const absolutePath = join(input.absolutePath, child.name);
-            const stats = lstatSync(absolutePath);
-            metadataReads += 1;
-            // A named new folder can still be a large subtree. Yield periodically so
-            // the wire and Apply progress while it is enumerated.
-            if (++this.walkedEntries % NAMED_WALK_YIELD_ENTRIES === 0) {
-                await new Promise((resolve) => setImmediate(resolve));
-            }
-            const parentRow = {
-                resourceId: input.root.resourceId,
-                rootUUID: input.root.rootUUID,
-                uuid,
-                type: "folder",
-                parentUUID: input.parent.uuid,
-                name: posix.basename(input.path),
-                status: "active",
-                version: "0".repeat(64),
-                payloadVersion: null,
-                transportVersion: null,
-                relativePath: input.path,
-                absolutePath: input.absolutePath,
-                deviceNumber: input.stats.dev,
-                inode: input.stats.ino,
-                byteSize: input.stats.size,
-                modifiedTimeMs: input.stats.mtimeMs,
-                changedTimeMs: input.stats.ctimeMs,
-                filesystemMode: input.stats.mode,
-                contentVerifiedAtMs: null,
-            };
-            if (stats.isSymbolicLink()) {
-                const link = this.captureLink({
-                    root: input.root,
-                    path,
-                    absolutePath,
-                    stats,
-                    parent: parentRow,
-                    exact: this.rowAtPath.get(input.root.rootUUID, path),
-                });
-                if (!link)
-                    return null;
-                const identity = link.item?.result
-                    ?? this.rowAtPath.get(input.root.rootUUID, path);
-                if (!identity)
-                    throw new Error(`captured link ${path} has no identity`);
-                children.push({ uuid: identity.uuid, name: identity.name });
-                if (link.item)
-                    childItems.push(link.item);
-                contentReads += link.contentReads;
-            }
-            else if (stats.isDirectory()) {
-                const nested = await this.captureDirectory({
-                    root: input.root,
-                    path,
-                    absolutePath,
-                    stats,
-                    parent: parentRow,
-                    policy: input.policy,
-                });
-                if (!nested)
-                    return null;
-                const nestedRoot = nested.items[0];
-                if (!nestedRoot)
-                    throw new Error(`captured directory ${path} has no root`);
-                children.push({ uuid: nestedRoot.result.uuid, name: nestedRoot.result.name });
-                childItems.push(...nested.items);
-                metadataReads += nested.metadataReads - 1;
-                contentReads += nested.contentReads;
-            }
-            else if (stats.isFile()) {
-                const file = await this.captureFile({
-                    root: input.root,
-                    path,
-                    absolutePath,
-                    stats,
-                    parent: parentRow,
-                    exact: this.rowAtPath.get(input.root.rootUUID, path),
-                });
-                const identity = file.item?.result
-                    ?? this.rowAtPath.get(input.root.rootUUID, path);
-                if (!identity)
-                    throw new Error(`captured file ${path} has no identity`);
-                children.push({ uuid: identity.uuid, name: identity.name });
-                if (file.item)
-                    childItems.push(file.item);
-                contentReads += file.contentReads;
-            }
-        }
-        const name = this.capturedName(base, input.path, input.parent.uuid);
-        const result = {
-            resourceId: input.root.resourceId,
-            rootUUID: input.root.rootUUID,
-            uuid,
-            type: "folder",
-            parentUUID: input.parent.uuid,
-            name,
-            status: "active",
-            version: canonicalVersion({
-                type: "folder",
-                parentUUID: input.parent.uuid,
-                name,
-                status: "active",
-                payloadVersion: membershipHash(children, sha256Hex),
-            }, sha256Hex),
-            payloadVersion: null,
-            transportVersion: null,
-            relativePath: input.path,
-            absolutePath: input.absolutePath,
-            deviceNumber: input.stats.dev,
-            inode: input.stats.ino,
-            byteSize: input.stats.size,
-            modifiedTimeMs: input.stats.mtimeMs,
-            changedTimeMs: input.stats.ctimeMs,
-            filesystemMode: input.stats.mode,
-            contentVerifiedAtMs: null,
-        };
-        const proposal = detectedChangeProposal({
-            base: base ? portable(base) : null,
-            result: portable(result),
-            replay: { kind: "structure" },
-        });
-        return {
-            items: [{ base, result, proposal }, ...childItems],
-            metadataReads,
-            contentReads,
+            ...sourceFingerprint(stats),
+            contentVerifiedNs: leafBoundary(this.clock, stats),
         };
+        return { item: { base, result }, contentReads: 1 };
     }
-    captureLink(input) {
-        const { root, path, absolutePath, stats, parent, exact } = input;
-        const base = exact ?? this.uniqueMovedBase(stats.dev, stats.ino, absolutePath);
-        if (base && base.type !== "link")
-            return null;
-        const fingerprintTrusted = base !== null
-            && base.relativePath === path
-            && this.materializedByUuid.get(base.uuid) !== undefined
-            && sameFingerprint(base, stats)
-            && base.contentVerifiedAtMs !== null
-            && stats.mtimeMs < base.contentVerifiedAtMs;
-        if (fingerprintTrusted)
-            return { item: null, contentReads: 0 };
-        const canReuseMovedTarget = base !== null
-            && base.relativePath !== path
-            && base.deviceNumber === stats.dev
-            && base.inode === stats.ino
-            && base.byteSize === stats.size
-            && base.modifiedTimeMs === stats.mtimeMs
-            && base.filesystemMode === stats.mode
-            && base.payloadVersion !== null;
-        const target = canReuseMovedTarget ? null : readlinkSync(absolutePath);
-        const targetBytes = target === null ? null : Buffer.from(target, "utf8");
-        const uuid = base?.uuid ?? randomUUID();
-        const payloadVersion = target === null
-            ? base?.payloadVersion ?? null
-            : sha256Hex(targetBytes);
-        if (!payloadVersion)
-            return null;
-        if (targetBytes) {
-            sealCapturedArtifact(this.cacheDir, {
-                entityId: uuid,
-                entityType: "link",
-                kind: "link",
-                contentHash: payloadVersion,
-            }, targetBytes);
-        }
-        const name = this.capturedName(base, path, parent.uuid);
+    async captureLink(input) {
+        const { root, path, absolutePath, stats, parent, base, uuid, sources } = input;
+        sources.remember(absolutePath, stats);
+        if (this.unchangedLeaf(input))
+            return { item: { base, result: base }, contentReads: 0 };
+        const targetBytes = Buffer.from(readlinkSync(absolutePath), "utf8");
+        const payloadVersion = sha256Hex(targetBytes);
+        await sealContent(this.cacheDir, {
+            entityId: uuid,
+            entityType: "link",
+            kind: "link",
+            contentHash: payloadVersion,
+        }, targetBytes, "detect-link", this.cargo);
+        const name = observedPortableName(base, parent.uuid, posix.basename(path));
         const result = {
             resourceId: root.resourceId,
             rootUUID: root.rootUUID,
@@ -1128,99 +847,97 @@ export class NamedDetectRuntime {
             transportVersion: null,
             relativePath: path,
             absolutePath,
-            deviceNumber: stats.dev,
-            inode: stats.ino,
-            byteSize: stats.size,
-            modifiedTimeMs: stats.mtimeMs,
-            changedTimeMs: stats.ctimeMs,
-            filesystemMode: stats.mode,
-            contentVerifiedAtMs: target === null ? base?.contentVerifiedAtMs ?? null : Date.now(),
-        };
-        const replay = base !== null && base.payloadVersion === result.payloadVersion
-            ? { kind: "structure" }
-            : target === null ? { kind: "structure" } : {
-                kind: "link",
-                resultPayloadVersion: payloadVersion,
-                target,
-            };
-        return {
-            item: {
-                base,
-                result,
-                proposal: detectedChangeProposal({
-                    base: base ? portable(base) : null,
-                    result: portable(result),
-                    replay,
-                }),
-            },
-            contentReads: target === null ? 0 : 1,
+            ...sourceFingerprint(stats),
+            contentVerifiedNs: leafBoundary(this.clock, stats),
         };
+        return { item: { base, result }, contentReads: 1 };
+    }
+    /** An existing leaf still at its address whose exact source signature
+     * predates its last content verification needs no byte read. */
+    unchangedLeaf({ path, stats, parent, base }) {
+        return base !== null
+            && base.relativePath === path
+            && base.parentUUID === parent.uuid
+            && this.ground.physical(base.uuid) !== undefined
+            && sourceReusable(base, stats);
+    }
+    /** A result whose content proof this pass reused staged no cargo. Its
+     * bytes are read once, and must be the observed payload; the source the
+     * observation remembered is validated again at admission. */
+    async sealUnread(row) {
+        const payloadVersion = row.payloadVersion;
+        if (row.type === "link") {
+            const target = Buffer.from(readlinkSync(row.absolutePath), "utf8");
+            if (sha256Hex(target) !== payloadVersion) {
+                throw new CaptureSourceChangedError(`link changed before sealing: ${row.absolutePath}`);
+            }
+            await sealContent(this.cacheDir, { entityId: row.uuid, entityType: "link", kind: "link", contentHash: payloadVersion }, target, "detect-link", this.cargo);
+            return;
+        }
+        const content = await captureContent(row.absolutePath, lstatSync(row.absolutePath, { bigint: true }), this.cacheDir, { lane: "named", cargo: this.cargo });
+        if (content.contentHash !== payloadVersion) {
+            throw new CaptureSourceChangedError(`file changed before sealing: ${row.absolutePath}`);
+        }
+    }
+    /** Replay construction follows the portable sharing decision. */
+    async proposalFor(shared, result) {
+        if (shared?.version === result.version)
+            return null;
+        const replay = !replaysPayload(shared, result) ? { kind: "structure" }
+            : await this.replayFor(shared, result);
+        return detectedChangeProposal({ base: shared ? portable(shared) : null, result: portable(result), replay });
     }
     enclosedByRepository(row) {
         let cursor = row;
         const seen = new Set();
-        while (cursor.parentUUID !== null) {
+        for (let parentUUID = localParentOf(cursor); parentUUID !== null; parentUUID = localParentOf(cursor)) {
             if (seen.has(cursor.uuid))
-                throw new Error("Detect notebook has a parent cycle");
+                throw new Error("Detect physical ground has a parent cycle");
             seen.add(cursor.uuid);
-            const parent = this.rowAtUuid.get(cursor.parentUUID);
+            const parent = this.ground.physical(parentUUID);
             if (!parent)
-                throw new Error(`Detect notebook has no parent ${cursor.parentUUID}`);
+                throw new Error(`Detect physical ground has no parent ${parentUUID}`);
             if (parent.type === "repo.git")
                 return true;
             cursor = parent;
         }
         return false;
     }
-    readUserPolicy() {
-        const ignore = join(this.userRoot, ".amalgmignore");
-        return createUserGroundEnrollmentPolicy(existsSync(ignore) ? readFileSync(ignore, "utf8") : "");
+    /** A trashed ancestor makes every old descendant ineligible for identity
+     * reuse, even when its stored status is still active. Each inventory's
+     * lifecycle is read along its own parent chain. */
+    isEffectivelyActive(row, inventory = "entities") {
+        return effectivelyActive(row, uuid => inventory === "entities" ? this.ground.physical(uuid) : this.ground.sharing(uuid));
     }
-    uniqueMovedBase(deviceNumber, inode, absolutePath) {
-        const candidates = this.rowsAtPhysicalIdentity.all(deviceNumber, inode)
-            .filter((row) => row.absolutePath !== absolutePath
-            // Windows may name only the destination of a rename. The entity
-            // projection proves this physical identity was still materialized
-            // before the current observation; notebook-only rows deliberately do
-            // not qualify, so a later inode reuse cannot steal missing identity.
-            && this.materializedByUuid.get(row.uuid) !== undefined
-            && !existsSync(row.absolutePath));
-        return candidates.length === 1 ? candidates[0] : null;
+    activeRowAtPath(rootUUID, path) {
+        return this.ground.atPath(rootUUID, path).find(row => this.isEffectivelyActive(row));
     }
-    replayFor(base, result) {
-        if (result.type === "file.text") {
-            const resultBytes = readFileSync(join(this.cacheDir, `${result.payloadVersion}.bin`));
-            const baseFile = base?.payloadVersion ? join(this.cacheDir, `${base.payloadVersion}.bin`) : null;
-            const baseBytes = baseFile && existsSync(baseFile) ? readFileSync(baseFile) : null;
-            return exactTextReplay({
-                entityId: result.uuid,
-                basePayloadVersion: base?.payloadVersion ?? null,
-                baseBytes,
-                resultPayloadVersion: result.payloadVersion,
-                resultBytes,
-                sha256Hex,
-            });
+    /** A text or link replay carries sealed cache bytes, built on a content
+     * thread; a binary replay carries its manifest. */
+    async replayFor(base, result) {
+        if (result.type === "file.text" || result.type === "link") {
+            return replayCachedContent(this.cacheDir, { entityId: result.uuid, type: result.type,
+                basePayloadVersion: base?.payloadVersion ?? null, resultPayloadVersion: result.payloadVersion }, "named");
         }
-        const manifestFile = join(this.cacheDir, "manifests", `${result.payloadVersion}.json`);
-        const checked = checkContentManifest(JSON.parse(readFileSync(manifestFile, "utf8")), result.payloadVersion);
-        if (!checked.ok)
-            throw new Error(checked.error);
+        const artifact = artifactForRecord(portable(result));
+        if (!artifact)
+            throw new Error(`detected binary file ${result.uuid} has no content head`);
         return {
             kind: "file.binary",
-            resultPayloadVersion: result.payloadVersion,
-            manifest: checked.value,
+            resultPayloadVersion: artifact.contentHash,
+            manifest: await contentManifest(this.cacheDir, artifact),
         };
     }
 }
-/** `.git/index.lock`, `.git/HEAD.lock`, `.git/refs/heads/main.lock`, and
- * their packed and worktree-local equivalents: Git's transient control files. */
-function isGitLockPath(pathInsideGit) {
-    const name = pathInsideGit.at(-1);
-    return pathInsideGit.length > 0 && name !== undefined && name.endsWith(".lock");
+/** A Record replays its result's payload unless it shares its base's payload,
+ * when it replays structure only. Only a payload replay carries cargo. */
+function replaysPayload(shared, result) {
+    return shared === null || shared.type !== result.type
+        || shared.payloadVersion !== result.payloadVersion || shared.transportVersion !== result.transportVersion;
 }
 function tryLstat(path) {
     try {
-        return lstatSync(path);
+        return lstatSync(path, { bigint: true });
     }
     catch (error) {
         const code = error.code;
@@ -1229,16 +946,4 @@ function tryLstat(path) {
         throw error;
     }
 }
-function repositoryIdentity(repository, rows) {
-    return indexRepositoryTerritory(rows).ownedBy(repository.uuid)
-        .map((row) => ({
-        path: repository.relativePath
-            ? row.relativePath.slice(repository.relativePath.length + 1)
-            : row.relativePath,
-        uuid: row.uuid,
-        type: row.type,
-        payloadVersion: row.type === "repo.git" ? null : row.payloadVersion,
-    }))
-        .sort((left, right) => left.path.localeCompare(right.path));
-}
 //# sourceMappingURL=runtime.js.map