@amalgm/shell 0.1.164-preview.36072132286 → 0.1.164-preview.36809057014

package/dist/entity-apply-host.js

@@ -1,16 +1,36 @@
+import { assertApplyCleanupUnchanged, describeApplyCleanup, finishApplyCleanup } from "./apply-cleanup.js";
+import { contentCacheOwnership } from "./content-cache-ownership.js";
+import { ApplyOwnershipSnapshot, applyRecoveryFootprint, ownedObject, ownershipWait, sqliteApplyOwnership } from "./detection/apply-ownership.js";
+import { applyControlDirectory, applyPreimageRoot, applyRecoveryRemainder, readApplyRecovery, writeApplyRecovery, } from "./apply-recovery.js";
+import { planWorkingReveal, RepositoryGroundObstructed } from "./git-literal-replay.js";
+import { save } from "./ground-saver.js";
+import { groundStore } from "./ground-store.js";
+import { GROUND_ROW_PROJECTION, portableGroundRecord as portable } from "./ground-row.js";
 /** Node filesystem, immutable-cache, Git, and Verify effects for Live Apply. */
 import { createHash } from "node:crypto";
 import { chmodSync, closeSync, copyFileSync, existsSync, fsyncSync, linkSync, lstatSync, openSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, symlinkSync, } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
-import { applyRepositoryIdentity, buildEntityApplyEffects, createUserGroundEnrollmentPolicy, indexRepositoryTerritory, materializedSlotNames, portableFileMode, repositoryIdentityHash, } from "@amalgm/live";
-import { openFileDatabase } from "./sqlite.js";
+import { applyRepositoryIdentity, canonicalVersion, buildEntityApplyEffects, indexRepositoryTerritory, materializedSlotNames, portableFileMode, repositoryIdentityHash, repositoryPayloadVersion, repositoryBoundaryDependencies, repositorySharesWorktreeStorage, trashRemovedEntities, } from "@amalgm/live";
+import { openGroundConnection } from "./ground-database.js";
 import { ensurePrivateDir, ensureUserDir } from "./filesystem.js";
-import { applyRepositoryFiles, hasGitMarker, inspectRepositoryTransportFile, markRepositoryReveal, nestedRepositoryPaths, observeRepository, repositoryObservationMatches, readCachedRepositoryIdentity, sealCachedRepositoryIdentity, repositoryRevealInProgress, } from "./git-repository-host.js";
-import { hashContentFile, sealCapturedArtifact } from "./content-cache-host.js";
+import { unsupportedGitOperation, UnsupportedGitOperationError } from "./git-operation-host.js";
+import { inspectGitWorktreeStorage } from "./git-worktree-host.js";
+import { reflogKeys, repositoryGroundCones } from "./git-binding.js";
+import { PhysicalPathWitnesses } from "./physical-path-witness.js";
+import { observeLiteralPath } from "./git-literal-host.js";
+import { leafPayload, payloadFormat } from "./git-literal-read.js";
+import { applyRepositoryFiles, hasGitMarker, inspectRepositoryTransportFile, judgeRepository, markRepositoryReveal, nestedRepositoryPaths, readRepository, repositoryObservationMatches, readCachedRepositoryIdentity, sealCachedRepositoryIdentity, repositoryRevealInProgress, } from "./git-repository-host.js";
+import { CaptureSourceChangedError, hashContentFile } from "./content-cache-host.js";
+import { physicalKey, sourceFingerprint } from "./source-signature.js";
+import { leafBoundary, stampContentClock } from "./content-clock.js";
+import { sealContent } from "./content-capture-pool.js";
 import { constructApplyAdapters, } from "./construct-apply-host.js";
 import { ConstructLedger } from "./construct-ledger.js";
+import { settledCaptureOutcome } from "./detection/capture-outcome.js";
 import { projectMaterializedGraph } from "./materialized-graph.js";
 import { EntityApplySqliteStore } from "./entity-apply-store.js";
+import { admissionProof, closePhysically, closeSource, sourceProofs, witnessProof } from "./source-proof.js";
+import { awaitTurn } from "./turns.js";
 /** A structural repository record carries no cargo because its immutable
  * transport head did not change. Repair still belongs to the repository
  * adapter: the target head names the exact parcel to reopen when this machine
@@ -20,32 +40,13 @@ const repositoryArtifact = (plan) => {
         return null;
     if (plan.kind === "repo.git")
         return plan.artifact;
-    return plan.kind === "structure" ? plan.repairArtifact : null;
+    return plan.kind === "structure" ? plan.resultArtifact : null;
 };
-/** Detect's settled view and the accepted registry share one ground row
- * shape; the notebook answers first wherever both are consulted. */
-const groundSelect = (table) => `
-  SELECT resource_id AS resourceId, root_uuid AS rootUUID,
-         uuid, type, parent_uuid AS parentUUID, name, status, version,
-         payload_version AS payloadVersion, transport_version AS transportVersion,
-         relative_path AS relativePath, absolute_path AS absolutePath,
-         device_number AS deviceNumber, inode,
-         byte_size AS byteSize, modified_time_ms AS modifiedTimeMs,
-         changed_time_ms AS changedTimeMs, filesystem_mode AS filesystemMode,
-         content_verified_at_ms AS contentVerifiedAtMs
-    FROM ${table}`;
+const groundSelect = (table) => `SELECT ${GROUND_ROW_PROJECTION} FROM ${table}`;
+/** A record carrying only these facets changed what its entity holds, never
+ * which (parent, name) slot it occupies or its lifecycle. */
+const SLOT_KEEPING_FACETS = new Set(["content", "mode"]);
 const sha256Hex = (input) => createHash("sha256").update(input).digest("hex");
-const portable = (row) => ({
-    uuid: row.uuid,
-    type: row.type,
-    parentUUID: row.parentUUID,
-    name: row.name,
-    status: row.status,
-    version: row.version,
-    payloadVersion: row.payloadVersion,
-    transportVersion: row.transportVersion,
-    fileMode: portableFileMode(row.type, row.filesystemMode),
-});
 function fsyncFile(path) {
     // Windows FlushFileBuffers requires write access to a regular file.
     const fd = openSync(path, process.platform === "win32" ? "r+" : "r");
@@ -98,9 +99,21 @@ function fsyncAddressParents(addresses) {
     for (const directory of directories)
         fsyncDirectory(directory);
 }
+/** What a container owns as a repository: its nearest-repository territory
+ * with the container itself counted as the owner, whichever type it holds
+ * now. A container becoming a repository replaces exactly this ground. */
+const repositoryTerritory = (rows, container) => indexRepositoryTerritory(container.type === "repo.git" ? rows
+    : rows.map(row => row.uuid === container.uuid ? { ...row, type: "repo.git" } : row))
+    .ownedBy(container.uuid);
+const identityEntry = (container, row) => ({
+    path: relative(container.absolutePath, row.absolutePath).split(sep).join("/"),
+    uuid: row.uuid, type: row.type, payloadVersion: row.type === "folder" ? null : row.payloadVersion,
+});
+/** One repository reading serves every identity with the same boundaries. */
+const readingAddress = (path, boundaries) => [path, ...boundaries].join("\0");
 const tryLstat = (path) => {
     try {
-        return lstatSync(path);
+        return lstatSync(path, { bigint: true });
     }
     catch (error) {
         const code = error.code;
@@ -109,14 +122,6 @@ const tryLstat = (path) => {
         throw error;
     }
 };
-const exactRecord = (left, right) => left.uuid === right.uuid
-    && left.type === right.type
-    && left.parentUUID === right.parentUUID
-    && left.name === right.name
-    && left.status === right.status
-    && left.version === right.version
-    && left.payloadVersion === right.payloadVersion
-    && left.transportVersion === right.transportVersion;
 const pathInside = (root, candidate) => {
     const path = relative(root, candidate);
     return path === "" || (!isAbsolute(path) && path !== ".." && !path.startsWith(`..${sep}`));
@@ -128,62 +133,73 @@ export class EntityApplyHost {
     /** The construct records this computer holds; constructs have no ground. */
     constructs;
     #database;
-    #userRoot;
     #cacheDir;
     #bindingDir;
     #readContent;
-    #captureLocal;
     #acquireGround;
     #onStage;
     #now;
     #rowByUuid;
     #entityByUuid;
-    #rowAtPath;
     #entityAtPath;
-    #rowsUnderRoot;
-    #notebookUnderRoot;
+    #pendingOutbox;
+    #repositoriesUnderRoot;
     #rowsByParent;
-    #entitiesByParent;
-    #relocateNotebookRow;
-    #relocateEntityRow;
-    #refreshNotebookCtime;
-    #refreshEntityCtime;
+    #physicalByParent;
+    #slotSharer;
     #onLawRelocationStage;
     #prepared = new Map();
     #groundReleases = new Map();
-    /** Repository moments one intent has already read, keyed by intent then by
-     * address + nested-repository boundary. A guard reads each repository once;
-     * the held ground keeps that reading true through reveal, and the reveal's
-     * own proof is the reading Verify consumes. Released with the ground. */
+    /** Repository readings keyed by intent, then by address and nested
+     * boundaries. Each guard reads afresh; the reveal's readback is the reading
+     * Verify consumes once it closes again after Verify's content clock, since
+     * external editors remain independent of Amalgm's ground lock. */
     #observations = new Map();
     constructor(options) {
-        this.#database = openFileDatabase(options.databaseFile);
-        this.constructs = new ConstructLedger(this.#database, options.now);
-        this.#userRoot = options.userRoot;
+        // Read-only: the file's saver thread makes every write this host posts.
+        this.#database = openGroundConnection(options.databaseFile);
         this.store = new EntityApplySqliteStore(this.#database, {
             now: options.now,
-            onIntentFinished: (intent) => this.#releaseGround(intent),
+            onIntentFinished: (intent) => {
+                this.#releaseGround(intent);
+                const control = this.store.recoveryLocation(intent);
+                const recovery = control === null ? null : readApplyRecovery(control, intent);
+                if (control !== null && !recovery)
+                    throw new Error("Terminal Apply lost its ownership receipt before wake");
+                options.onAttributionReleased?.(recovery ? applyRecoveryFootprint(recovery)
+                    : { cones: [], uuids: [intent.entityId] });
+            },
+            onAttemptFailed: (intent) => {
+                this.#observations.delete(this.#key(intent));
+                this.#releaseGround(intent);
+            },
+            onOwnPublicationResolved: (target) => this.#onStage?.({
+                entityId: target.entityId,
+                throughSequence: target.globalSequence,
+                type: target.change.result.type,
+                phase: null,
+                stage: "own-publication-resolved",
+                at: this.#now(),
+            }),
             isLocallyEligible: (target) => this.#isLocallyEligible(target),
+            holdsOwnPlacement: (target, settled) => this.#holdsOwnPlacement(target, settled),
         });
+        this.constructs = new ConstructLedger(this.#database, options.now);
         this.#cacheDir = options.cacheDir;
         this.#bindingDir = options.bindingDir;
         this.#readContent = options.readContent;
-        this.#captureLocal = options.captureLocal;
         this.#acquireGround = options.acquireGround;
         this.#onStage = options.onStage;
         this.#now = options.now ?? Date.now;
         this.#rowByUuid = this.#database.prepare(`${groundSelect("detection_notebook")} WHERE uuid = ? LIMIT 1`);
         this.#entityByUuid = this.#database.prepare(`${groundSelect("entities")} WHERE uuid = ? LIMIT 1`);
-        this.#rowAtPath = this.#database.prepare(`${groundSelect("detection_notebook")} WHERE absolute_path = ? AND status = 'active' LIMIT 1`);
         this.#entityAtPath = this.#database.prepare(`${groundSelect("entities")} WHERE absolute_path = ? AND status = 'active' LIMIT 1`);
-        this.#rowsUnderRoot = this.#database.prepare(`${groundSelect("entities")} WHERE root_uuid = ? ORDER BY relative_path`);
-        this.#notebookUnderRoot = this.#database.prepare(`${groundSelect("detection_notebook")} WHERE root_uuid = ? ORDER BY relative_path`);
+        this.#pendingOutbox = this.#database.prepare("SELECT DISTINCT entity_id FROM record_outbox WHERE authority_id = ? AND status = 'pending'");
+        this.#repositoriesUnderRoot = this.#database.prepare(`${groundSelect("entities")} WHERE root_uuid = ? AND type = 'repo.git' AND status = 'active' ORDER BY relative_path`);
         this.#rowsByParent = this.#database.prepare(`${groundSelect("detection_notebook")} WHERE parent_uuid = ?`);
-        this.#entitiesByParent = this.#database.prepare(`${groundSelect("entities")} WHERE parent_uuid = ?`);
-        this.#relocateNotebookRow = this.#database.prepare("UPDATE detection_notebook SET relative_path = ?, absolute_path = ? WHERE uuid = ?");
-        this.#relocateEntityRow = this.#database.prepare("UPDATE entities SET relative_path = ?, absolute_path = ? WHERE uuid = ?");
-        this.#refreshNotebookCtime = this.#database.prepare("UPDATE detection_notebook SET changed_time_ms = ? WHERE uuid = ?");
-        this.#refreshEntityCtime = this.#database.prepare("UPDATE entities SET changed_time_ms = ? WHERE uuid = ?");
+        this.#physicalByParent = this.#database.prepare(`SELECT o.uuid AS uuid, o.absolute_path AS absolutePath FROM detection_notebook b
+         JOIN entities o ON o.uuid = b.uuid WHERE b.parent_uuid = ?`);
+        this.#slotSharer = this.#database.prepare(`SELECT 1 FROM detection_notebook WHERE parent_uuid = ? AND name = ? AND uuid <> ? AND status = 'active' LIMIT 1`);
         this.#onLawRelocationStage = options.onLawRelocationStage;
         // Every type in Live's alphabet binds both sockets or the registry
         // refuses to build. Filesystem entities reread their native ground;
@@ -199,43 +215,47 @@ export class EntityApplyHost {
                 // the only local fact that it holds one at all.
                 holds: (entityId) => this.constructs.holds(entityId),
                 remember: (record) => this.constructs.remember(record),
+                verified: (intent, record) => this.store.stageConstructVerification(intent, record),
+                prepareRetirement: (intent, purpose) => this.store.stageRetirement(intent, purpose, { contract: "amalgm.apply-no-ground@1" }),
             }),
         ];
-        this.effects = buildEntityApplyEffects(adapters, options.captureLocal);
+        this.effects = buildEntityApplyEffects(adapters, options.captureLocal, async (retirement) => {
+            const cleanup = this.store.cleanupDescription(retirement);
+            if (cleanup.contract === "amalgm.apply-no-ground@1")
+                return;
+            await contentCacheOwnership(this.#cacheDir).using(async () => finishApplyCleanup(cleanup));
+        });
     }
     close() {
-        for (const release of this.#groundReleases.values())
+        for (const { release } of this.#groundReleases.values())
             release();
         this.#groundReleases.clear();
         this.store.close();
     }
-    /** Adopt Inbox history already represented by exact verified notebook
-     * ground before Live starts new Apply lanes. An interrupted prior process
-     * may have left private intent state; the verified baseline makes that
-     * preparation obsolete, so remove it alongside the durable intent. */
-    adoptVerifiedMaterialization(rootUUID = null) {
-        const adopted = this.store.adoptVerifiedMaterialization(rootUUID);
+    /** The installed snapshot watermark settles history, not a new disk claim.
+     * Startup can retire only untouched private preparation. */
+    async adoptSnapshotHistory() {
+        const adopted = await this.store.adoptSnapshotHistory(intent => this.#canRetireUnstartedIntent(intent));
         for (const intent of adopted.supersededIntents) {
             this.#prepared.delete(this.#key(intent));
             this.#observations.delete(this.#key(intent));
             const current = this.#current(intent.entityId);
             if (current) {
-                const context = this.#context(portable(current));
-                rmSync(this.#controlDirectory(intent, context), { recursive: true, force: true });
+                rmSync(this.#controlDirectory(intent, this.#anchors(portable(current))), { recursive: true, force: true });
             }
             this.#releaseGround(intent);
         }
-        return adopted.settledRecords;
+        return adopted.resolvedEntities;
     }
     #adapter(type) {
         const apply = Object.freeze({
-            prepare: (intent, plan) => this.#prepare(intent, plan),
-            guard: (intent, plan) => this.#guard(intent, plan),
-            reveal: (intent, plan) => this.#reveal(intent, plan),
-            discard: (intent, plan) => this.#discard(intent, plan),
+            prepare: (intent, plan) => contentCacheOwnership(this.#cacheDir).using(() => this.#prepare(intent, plan)),
+            guard: (intent, plan) => contentCacheOwnership(this.#cacheDir).using(() => this.#guard(intent, plan)),
+            reveal: (intent, plan) => contentCacheOwnership(this.#cacheDir).using(() => this.#reveal(intent, plan)),
+            prepareRetirement: (intent, plan, purpose) => contentCacheOwnership(this.#cacheDir).using(() => this.#prepareRetirement(intent, plan, purpose)),
         });
         const verify = Object.freeze({
-            verify: (intent, plan) => this.#verify(intent, plan),
+            verify: (intent, plan) => contentCacheOwnership(this.#cacheDir).using(() => this.#verify(intent, plan)),
         });
         return Object.freeze({
             name: `${type}-apply`,
@@ -243,24 +263,57 @@ export class EntityApplyHost {
             rails: Object.freeze({ apply, verify }),
         });
     }
-    /** The portable Inbox contains cloud truth for every entity. Shell alone
-     * decides whether that accepted entity belongs on this machine. External
-     * selected roots are fully materialized; core-ground descendants obey the
-     * portable `.amalgmignore` policy before any Apply intent or disk write. */
+    observedDependencies(entityIds, observations) {
+        return entityIds.filter((uuid) => {
+            const rows = [this.#entityByUuid.get(uuid), this.#rowByUuid.get(uuid)];
+            return rows.some(row => row !== undefined && observations.some(({ directory, suspicion }) => (suspicion.paths === null ? [directory] : suspicion.paths.map(path => join(directory, path)))
+                .some(path => pathInside(path, row.absolutePath) || pathInside(row.absolutePath, path))));
+        });
+    }
+    /** Where an examination of these entities must read: each one's O and B
+     * placement, so an entity that vanished starts from its original address. */
+    examinationAddresses(entityIds) {
+        return [...new Set(entityIds.flatMap(uuid => [this.#entityByUuid.get(uuid), this.#rowByUuid.get(uuid)]
+                .flatMap(row => row ? [row.absolutePath] : [])))];
+    }
+    /** Selected materialization roots decide where accepted results belong:
+     * a result is local while its own row or its parent's is materialized here.
+     * Existing local work whose new parent is still arriving is local and
+     * reaches the coordinator's dependency guard. Ignore rules govern local
+     * Detect only; they cannot hide cloud truth from Apply or turn an existing
+     * selected descendant into a cloud-only entity. Placement is not asked. */
     #isLocallyEligible(target) {
-        const context = this.#context(target);
-        const boundary = context.current ?? context.parent;
-        if (!boundary)
+        return this.#current(target.uuid) !== null
+            || (target.parentUUID !== null && this.#current(target.parentUUID) !== null);
+    }
+    /** Own ground needs no replay only while it sits at its derived address and
+     * the slot it left or entered moves no sibling. A resolution whose settled
+     * records change only content or mode left and entered no slot, so it
+     * proves only its own address; a sibling's placement belongs to the records
+     * that change it. Any other resolution, or an own address that is not a
+     * lone occupant's, derives the parent's complete slot projection. An
+     * unplaced parent is not held placement; the ordinary Apply path owns that
+     * wait. */
+    #holdsOwnPlacement(target, settled) {
+        const parent = this.#current(target.parentUUID ?? target.uuid);
+        if (!parent)
             return false;
-        const root = this.#current(boundary.rootUUID);
-        if (!root || root.absolutePath !== this.#userRoot)
-            return true;
-        const relativePath = relative(this.#userRoot, context.targetPath).split("\\").join("/");
-        if (!relativePath)
+        if (target.parentUUID !== null && target.status === "active"
+            && settled.every(record => record.change.facets.every(facet => SLOT_KEEPING_FACETS.has(facet)))
+            && this.#holdsLoneSlot(target, parent))
             return true;
-        const ignore = join(this.#userRoot, ".amalgmignore");
-        const policy = createUserGroundEnrollmentPolicy(existsSync(ignore) ? readFileSync(ignore, "utf8") : "");
-        return policy(relativePath);
+        const context = this.#context(target);
+        return context.beforeRelocations.length === 0 && context.afterRelocations.length === 0
+            && (target.status !== "active" || context.current?.absolutePath === context.targetPath);
+    }
+    /** The target's own ground sits at its portable name under its placed
+     * parent, and no other active identity shares that portable slot, so its
+     * derived address is that name. */
+    #holdsLoneSlot(target, parent) {
+        const current = this.#current(target.uuid);
+        return current !== null && current.parentUUID === target.parentUUID && current.name === target.name
+            && current.absolutePath === join(parent.absolutePath, target.name)
+            && this.#slotSharer.get(target.parentUUID, target.name, target.uuid) === undefined;
     }
     async #prepare(intent, plan) {
         await this.#ensurePrepared(intent, plan);
@@ -274,15 +327,24 @@ export class EntityApplyHost {
         let prepared = {};
         const repository = repositoryArtifact(plan);
         if (repository) {
-            prepared = { repository: await this.#repositoryChain(repository) };
+            const verified = await this.#repositoryChain(repository);
+            const latest = await inspectRepositoryTransportFile(verified.chain.at(-1).file);
+            if (repositoryPayloadVersion(latest, sha256Hex) !== plan.target.payloadVersion
+                || (plan.kind === "repo.git" && (latest.stateId !== plan.stateId
+                    || latest.cardId !== plan.cardId || latest.checkpointId !== plan.checkpointId
+                    || latest.identityHash !== plan.identityHash
+                    || latest.parentTransportVersion !== plan.parentTransportVersion))) {
+                throw new Error("repository package does not describe the accepted complete result");
+            }
+            prepared = { repository: verified };
         }
         else if (plan.kind === "file.text" || plan.kind === "file.binary" || plan.kind === "link") {
             prepared = { artifact: await this.#prepareArtifact(plan) };
         }
-        else if (plan.kind === "structure" && plan.repairArtifact) {
+        else if (plan.kind === "structure" && plan.resultArtifact) {
             prepared = {
-                artifact: await this.#sealedArtifact(plan.repairArtifact.contentHash)
-                    ?? await this.#readContent(plan.repairArtifact),
+                artifact: await this.#sealedArtifact(plan.resultArtifact.contentHash)
+                    ?? await this.#readContent(plan.resultArtifact),
             };
         }
         this.#prepared.set(key, prepared);
@@ -299,7 +361,7 @@ export class EntityApplyHost {
         if (sealed)
             return sealed;
         if (plan.kind === "link") {
-            sealCapturedArtifact(this.#cacheDir, plan.artifact, Buffer.from(plan.targetText, "utf8"));
+            await sealContent(this.#cacheDir, plan.artifact, Buffer.from(plan.targetText, "utf8"), "apply");
             const literal = await this.#sealedArtifact(plan.artifact.contentHash);
             if (literal)
                 return literal;
@@ -319,7 +381,7 @@ export class EntityApplyHost {
             return null;
         if (await hashContentFile(file) !== contentHash)
             return null;
-        return { file, bytes: stat.size, contentHash };
+        return { file, bytes: Number(stat.size), contentHash };
     }
     async #spliceFromBase(artifact, strategy) {
         let base;
@@ -341,10 +403,27 @@ export class EntityApplyHost {
         ]);
         if (sha256Hex(result) !== artifact.contentHash)
             return null;
-        sealCapturedArtifact(this.#cacheDir, artifact, result);
+        await sealContent(this.#cacheDir, artifact, result, "apply");
         return this.#sealedArtifact(artifact.contentHash);
     }
+    /** Only a final safe/equal guard retains ground through reveal and Verify. */
     async #guard(intent, plan) {
+        let outcome;
+        try {
+            // Resolved promises do not service sockets or Watch callbacks. Let the
+            // host run before collecting the proof that authorizes this decision.
+            await awaitTurn();
+            outcome = await this.#inspectGround(intent, plan);
+            return outcome;
+        }
+        finally {
+            if (intent.phase === "declared"
+                || (outcome?.kind !== "safe" && outcome?.kind !== "already-target")) {
+                this.#releaseGround(intent);
+            }
+        }
+    }
+    async #inspectGround(intent, plan) {
         // The declared guard is an optimistic preflight. Any concurrent
         // local write is caught by the second guard after private preparation, so
         // this first pass must never queue cargo behind Detect, Register, or Add.
@@ -356,6 +435,13 @@ export class EntityApplyHost {
         const finalGuard = intent.phase !== "declared";
         this.#observations.delete(this.#key(intent));
         try {
+            const recoveryReplan = this.#recoveryReplan(intent, plan);
+            if (recoveryReplan)
+                return recoveryReplan;
+            if (plan.target.parentUUID !== null && !this.#current(plan.target.parentUUID)) {
+                return { kind: "dependency", reason: "The accepted parent has not materialized yet.",
+                    waitFor: { producer: "apply", entityIds: [plan.target.parentUUID] } };
+            }
             if (finalGuard) {
                 this.#emit(intent, plan, "waiting-for-ground");
                 await this.#holdGround(intent, plan);
@@ -364,22 +450,66 @@ export class EntityApplyHost {
             else {
                 this.#emit(intent, plan, "preflight-started");
             }
-            const context = this.#context(plan.target);
+            const unavailableRoot = this.#unavailableRoot(plan.target);
+            if (unavailableRoot) {
+                return unavailableRoot;
+            }
+            const context = this.#context(plan.target, intent);
+            const ownership = this.#foreignOwnership(intent, this.#bindingRoot(plan.target), this.applyAddresses(intent, plan));
+            if (ownership.waiting)
+                return ownership.waiting;
             const current = context.current;
+            // A receipt must preserve the source association the guard proved. An
+            // equal-content atomic save can still replace the object being moved.
+            for (const row of [current, ...context.beforeRelocations.map(move => this.#current(move.row.uuid)),
+                ...context.afterRelocations.map(move => this.#current(move.row.uuid))]) {
+                const stat = row && tryLstat(row.absolutePath);
+                if (stat && physicalKey(stat) !== row.physicalKey) {
+                    return { kind: "local-change", reason: "Detect must refresh the source's physical association." };
+                }
+            }
+            if (![context.parent, current?.parentUUID ? this.#current(current.parentUUID) : null]
+                .every(row => row === null || row === undefined || this.#directoryAncestorsMatch(row))) {
+                return { kind: "unsettled-ground", reason: "Detect must reconcile a replaced parent directory." };
+            }
             let repositoryTargetMatches = false;
             let repositoryRelocationsPending = false;
-            if (plan.target.type === "repo.git") {
+            let repositoryIdentityMatches = true;
+            if (plan.target.type === "repo.git" || current?.type === "repo.git") {
+                for (const path of new Set([context.targetPath, current?.absolutePath].filter((path) => path !== undefined))) {
+                    if (!hasGitMarker(path))
+                        continue;
+                    const storage = await inspectGitWorktreeStorage(path);
+                    const unsupported = unsupportedGitOperation(storage.privateDirectory);
+                    if (unsupported) {
+                        return { kind: "dependency", reason: new UnsupportedGitOperationError(unsupported).message,
+                            waitFor: { producer: "capability", entityIds: [intent.entityId] } };
+                    }
+                    if (repositorySharesWorktreeStorage(storage)) {
+                        return { kind: "dependency",
+                            reason: "This checkout shares Git storage with another worktree. Apply requires an independent checkout.",
+                            waitFor: { producer: "capability", entityIds: [intent.entityId] },
+                        };
+                    }
+                }
+            }
+            if (plan.target.type === "repo.git" && plan.target.status === "active") {
                 const repository = (await this.#ensurePrepared(intent, plan)).repository;
                 if (!repository)
                     throw new Error("repository Apply has no prepared transport identity");
+                const dependencies = this.#repositoryBoundaries(context, repository.identity);
+                if (dependencies.length > 0) {
+                    return { kind: "dependency",
+                        reason: "The enclosing result removes an independently owned repository. Its own accepted move or type change must settle first.",
+                        waitFor: { producer: "apply", entityIds: dependencies.map(({ uuid }) => uuid) },
+                    };
+                }
                 // A repository reveal rewrites its target in place. Once one has
                 // started, the repository is private Apply ground in whatever state
                 // an interruption left it: nothing can match it, Detect refuses to
-                // read it, and the only way forward is a reveal that resumes there.
+                // read it, and the only way forward is the reveal that resumes there.
                 if (repositoryRevealInProgress(context.targetPath)
                     || (current && repositoryRevealInProgress(current.absolutePath))) {
-                    if (!finalGuard)
-                        this.#releaseGround(intent);
                     return { kind: "safe" };
                 }
                 const groups = this.#repositoryRelocations(context, repository.identity);
@@ -405,47 +535,80 @@ export class EntityApplyHost {
                     }
                     repositoryRelocationsPending ||= sourcePresent;
                 }
+                repositoryIdentityMatches = this.#repositoryIdentityMatches(intent, context.targetPath, repository.identity);
                 repositoryTargetMatches = current !== null
                     && await this.#matches(intent, plan.target, context.targetPath, plan);
-                if (repositoryTargetMatches && repositoryRelocationsPending)
-                    return { kind: "safe" };
             }
-            if (current
-                && exactRecord(portable(current), plan.target)
+            const recoveryReplanAfterPreparation = this.#recoveryReplan(intent, plan);
+            if (recoveryReplanAfterPreparation)
+                return recoveryReplanAfterPreparation;
+            // Identity comes from O, never a historical sharing address or byte
+            // equality. A same-identity complete target can be adopted even when B
+            // lags, provided no other physical effect remains. Fresh Verify still
+            // owns acknowledgment and recovery retirement.
+            const physical = this.#entityByUuid.get(intent.entityId);
+            const targetStats = tryLstat(context.targetPath);
+            const targetIdentity = physical?.status === "active"
+                && physical.absolutePath === context.targetPath
+                && targetStats !== null && physicalKey(targetStats) === physical.physicalKey;
+            if (targetIdentity
+                && repositoryIdentityMatches
+                && !repositoryRelocationsPending
                 && context.beforeRelocations.length === 0
                 && context.afterRelocations.length === 0
                 && (repositoryTargetMatches
-                    || await this.#matches(intent, plan.target, context.targetPath, plan))) {
+                    || await this.#matches(intent, plan.target, context.targetPath, plan))
+                && this.#physicalDirectoriesMatch(physical)) {
                 return { kind: "already-target" };
             }
-            // A rail transition can change an entity's registered payload witness
-            // without changing its bytes: clean repo leaves use Git object ids,
-            // while the ordinary file rail uses SHA-256. At the same durable UUID
-            // and address, exact target bytes prove that no write is required; Verify
-            // can advance the row directly. Equal bytes at a different address are
-            // deliberately not identity evidence.
-            if (current?.absolutePath === context.targetPath
-                && context.beforeRelocations.length === 0
-                && context.afterRelocations.length === 0
-                && await this.#matches(intent, plan.target, context.targetPath, plan)) {
-                return { kind: "already-target" };
+            const localObservation = settledCaptureOutcome(this.#database, {
+                authorityId: intent.authorityId, entityId: intent.entityId,
+                addresses: this.applyAddresses(intent, plan),
+            });
+            if (localObservation.kind === "local-only") {
+                return { kind: "local-change", reason: localObservation.reason };
+            }
+            if (localObservation.kind === "retry")
+                return localObservation;
+            // Trash, or a leaf replacing a container, displaces the whole directory.
+            // A rename carries its subtree, and collisions relocate intact, so this
+            // is the only container an effect displaces. Local remainder below it
+            // has no copy anywhere else: the effect waits for Detect to see that
+            // ground leave or become shared.
+            if (current && this.#isContainer(current) && tryLstat(current.absolutePath)
+                && (plan.target.status !== "active" || !["workspace", "folder", "repo.git"].includes(plan.target.type))) {
+                const named = this.#displacedRemainder(current, localObservation.remainder);
+                if (named.length > 0) {
+                    return { kind: "dependency", waitFor: { producer: "detect", entityIds: named },
+                        blocker: { code: "local-ground-would-be-displaced",
+                            effect: plan.target.status === "active" ? "replace-container" : "trash" },
+                        reason: `${current.absolutePath} holds local ground sharing never held; removing it would destroy that ground.` };
+                }
+                const publishing = this.#pendingPublication(intent.authorityId, current);
+                if (publishing.length > 0) {
+                    return { kind: "dependency", waitFor: { producer: "send", entityIds: publishing },
+                        reason: `${current.absolutePath} holds local results not yet sequenced; removing it would hide them.` };
+                }
+            }
+            const relocations = [...context.beforeRelocations, ...context.afterRelocations];
+            const vacated = current && (plan.target.status !== "active" || current.absolutePath !== context.targetPath)
+                ? [current.absolutePath] : [];
+            if (relocations.length > 0 && !await this.#lawRelocationsReady(intent, plan, relocations, vacated)) {
+                return { kind: "local-change", reason: "A required sibling relocation has unproved ground." };
+            }
+            if (plan.target.status !== "active" && !current) {
+                if (!await this.#resolvedAbsence(intent, plan, context))
+                    return { kind: "local-change" };
+                return relocations.length === 0 ? { kind: "already-target" } : { kind: "safe" };
             }
             if (!current) {
                 if (!tryLstat(context.targetPath)) {
-                    if (intent.phase === "declared")
-                        this.#releaseGround(intent);
                     return { kind: "safe" };
                 }
-                if (await this.#matches(intent, plan.target, context.targetPath, plan)) {
-                    return { kind: "already-target" };
-                }
                 if (context.collisionEligible
                     && await this.#lawRelocationsReady(intent, plan, context.beforeRelocations)) {
-                    if (intent.phase === "declared")
-                        this.#releaseGround(intent);
                     return { kind: "safe" };
                 }
-                this.#releaseGround(intent);
                 return this.#heldDestination(intent, context.targetPath);
             }
             // A move/rename may never erase a different thing already occupying the
@@ -453,49 +616,50 @@ export class EntityApplyHost {
             if (current.absolutePath !== context.targetPath && tryLstat(context.targetPath)) {
                 if (context.collisionEligible
                     && await this.#lawRelocationsReady(intent, plan, context.beforeRelocations)) {
-                    if (intent.phase === "declared")
-                        this.#releaseGround(intent);
                     return { kind: "safe" };
                 }
-                this.#releaseGround(intent);
                 return this.#heldDestination(intent, context.targetPath);
             }
+            // An unfinished reveal displaced this ground itself: its target was
+            // never visible, so resuming cannot overwrite anything local. Once the
+            // reveal finished, absence is visible-ground evidence like any other.
+            const displaced = this.#displacedPath(intent, context);
+            const recovery = this.#boundRecovery(intent);
+            if (intent.phase === "prepared"
+                && !tryLstat(current.absolutePath)
+                && tryLstat(displaced)
+                && recovery?.source
+                && await this.#matchesPreimage(intent, plan, recovery.source, displaced)) {
+                return { kind: "safe" };
+            }
             // Absence at one address can be a move. While the entity is still
             // materialized, Detect must reconcile its root before repair may destroy
             // that physical continuity. Release our cone before asking Detect to
-            // acquire it. A proved absence removes only the materialized row; the
-            // retained notebook then permits reconstruction on the next guard.
+            // acquire it. A proved removal records Trash before this older result may
+            // proceed; Apply's own displaced ground remains repair evidence.
             if (plan.target.status === "active"
                 && !tryLstat(current.absolutePath)
                 && !tryLstat(context.targetPath)) {
                 if (this.#entityByUuid.get(current.uuid)) {
-                    this.#releaseGround(intent);
-                    await this.#captureLocal(intent, plan, intent.phase === "revealed" ? "after-reveal" : "before-reveal");
-                    return { kind: "retry", reason: "missing ground was reconciled before repair" };
+                    return { kind: "unsettled-ground", reason: "Detect must distinguish a move from local absence." };
                 }
-                if (intent.phase === "declared")
-                    this.#releaseGround(intent);
-                return { kind: "safe" };
-            }
-            if (await this.#matches(intent, portable(current), current.absolutePath, plan)) {
-                if (intent.phase === "declared")
-                    this.#releaseGround(intent);
                 return { kind: "safe" };
             }
-            const displaced = this.#displacedPath(intent, context);
-            if (!tryLstat(current.absolutePath)
-                && tryLstat(displaced)
-                && await this.#matches(intent, portable(current), displaced, plan)) {
-                if (intent.phase === "declared")
-                    this.#releaseGround(intent);
+            // A repository's O also holds unshared remainder; its ground is safe
+            // when it still holds the sharing basis plus only accounted remainder.
+            const shared = current.type === "repo.git" ? this.#rowByUuid.get(current.uuid) : undefined;
+            if (await this.#matches(intent, portable(shared?.status === "active" ? shared : current), current.absolutePath, plan)
+                && this.#physicalDirectoriesMatch(current)) {
                 return { kind: "safe" };
             }
-            this.#releaseGround(intent);
             return { kind: "local-change" };
         }
         catch (error) {
-            this.#releaseGround(intent);
-            return { kind: "retry", reason: error instanceof Error ? error.message : String(error) };
+            if (error instanceof UnsupportedGitOperationError) {
+                return { kind: "dependency", reason: error.message,
+                    waitFor: { producer: "capability", entityIds: [intent.entityId] } };
+            }
+            throw error;
         }
         finally {
             if (!finalGuard) {
@@ -513,8 +677,7 @@ export class EntityApplyHost {
      * Record can say so.
      */
     #heldDestination(intent, targetPath) {
-        const occupant = this.#rowAtPath.get(targetPath)
-            ?? this.#entityAtPath.get(targetPath);
+        const occupant = this.#entityAtPath.get(targetPath);
         if (!occupant || occupant.uuid === intent.entityId)
             return { kind: "local-change" };
         return {
@@ -525,12 +688,34 @@ export class EntityApplyHost {
     async #reveal(intent, plan) {
         this.#emit(intent, plan, "reveal-started");
         try {
-            const context = this.#context(plan.target);
+            const context = this.#context(plan.target, intent);
             const prepared = await this.#ensurePrepared(intent, plan);
-            this.#relocateLawSiblings(context, context.beforeRelocations);
+            // Plan repository removals before anything durable: an obstruction
+            // leaves neither a receipt nor an effect behind.
+            const kept = plan.target.type === "repo.git" && plan.kind !== "lifecycle" ? await this.#revealRemainder(intent, context) : [];
+            let removals = { leaves: [], directories: [] };
+            if (plan.target.type === "repo.git" && plan.kind !== "lifecycle" && context.current && tryLstat(context.current.absolutePath)) {
+                if (!prepared.repository)
+                    throw new Error("repository Apply has no prepared transport chain");
+                try {
+                    removals = planWorkingReveal(context.current.absolutePath, prepared.repository.identity, await this.#sharedIdentity(plan.target.uuid), new Set(kept.map(entry => entry.path)));
+                }
+                catch (error) {
+                    if (!(error instanceof RepositoryGroundObstructed))
+                        throw error;
+                    this.#releaseGround(intent);
+                    return this.#obstructedRepository(context.current, error);
+                }
+            }
+            const waiting = await this.#retainPreimages(intent, plan, context, kept);
+            if (waiting) {
+                this.#releaseGround(intent);
+                return waiting;
+            }
+            await this.#relocateLawSiblings(context, context.beforeRelocations);
             if (plan.kind === "lifecycle") {
                 this.#removeWithRecovery(intent, context);
-                this.#relocateAfterTarget(plan.target, context);
+                await this.#relocateAfterTarget(plan.target, context);
                 return;
             }
             if (plan.target.type === "repo.git") {
@@ -544,47 +729,47 @@ export class EntityApplyHost {
                     markRepositoryReveal(context.current.absolutePath);
                 }
                 if (context.current && context.current.absolutePath !== context.targetPath
-                    && !context.currentShared
                     && tryLstat(context.current.absolutePath)) {
-                    this.#moveWithRecovery(intent, context.current.absolutePath, context.targetPath, context);
+                    this.#moveToVacantAddress(context.current.absolutePath, context.targetPath);
                 }
                 ensureUserDir(context.targetPath);
-                const applied = await applyRepositoryFiles(context.targetPath, repository.chain);
-                // The reveal proof is the reading Verify consumes: the same held
-                // ground, the same moment, no second capture.
-                this.#observe(intent, context.targetPath, applied.identity, { stateId: applied.stateId, card: applied.card });
+                const applied = await applyRepositoryFiles(context.targetPath, repository.chain, { kind: "working", removals, remainder: new Set(kept.map(entry => entry.path)) });
+                // The reveal's readback is the reading Verify inherits.
+                this.#observations.set(this.#key(intent), new Map([[
+                        readingAddress(context.targetPath, applied.reading.boundaries), applied.reading
+                    ]]));
                 this.#moveRepositoryRelocations(intent, context, repository.identity);
-                this.#relocateAfterTarget(plan.target, context);
+                await this.#relocateAfterTarget(plan.target, context);
                 return;
             }
             if (plan.kind === "structure") {
                 if (context.current && context.current.absolutePath !== context.targetPath
-                    && !context.currentShared) {
-                    this.#moveWithRecovery(intent, context.current.absolutePath, context.targetPath, context);
+                    && tryLstat(context.current.absolutePath)) {
+                    this.#moveToVacantAddress(context.current.absolutePath, context.targetPath);
                 }
-                else if (!tryLstat(context.targetPath)) {
-                    if (plan.target.type === "workspace" || plan.target.type === "folder") {
-                        ensureUserDir(context.targetPath);
+                if (plan.target.type === "workspace" || plan.target.type === "folder") {
+                    ensureUserDir(context.targetPath);
+                    if (hasGitMarker(context.targetPath)) {
+                        rmSync(join(context.targetPath, ".git"), { recursive: true, force: true });
                     }
-                    else if (prepared.artifact) {
-                        this.#installArtifact(intent, context, plan.target, prepared.artifact);
+                }
+                else if (!await this.#matches(intent, plan.target, context.targetPath, plan)) {
+                    // No new sender cargo does not mean this receiver has the bytes.
+                    // A later rename or mode result can legitimately select a payload
+                    // different from the receiver's preceding accepted result.
+                    const artifact = prepared.artifact;
+                    if (!artifact)
+                        throw new Error("structural leaf result has no immutable artifact");
+                    if (plan.target.type === "link") {
+                        const targetText = new TextDecoder("utf-8", { fatal: true })
+                            .decode(readFileSync(artifact.file));
+                        this.#installLink(intent, context, targetText);
                     }
                     else {
-                        throw new Error("structural leaf repair has no immutable artifact");
+                        this.#installArtifact(intent, context, plan.target, artifact);
                     }
                 }
-                if ((plan.target.type === "workspace" || plan.target.type === "folder")
-                    && hasGitMarker(context.targetPath)) {
-                    rmSync(join(context.targetPath, ".git"), { recursive: true, force: true });
-                }
-                if (plan.target.type === "file.text" || plan.target.type === "file.binary") {
-                    if (plan.target.fileMode === null) {
-                        throw new Error(`ordinary file ${plan.target.uuid} has no portable mode`);
-                    }
-                    chmodSync(context.targetPath, plan.target.fileMode);
-                    fsyncFile(context.targetPath);
-                }
-                this.#relocateAfterTarget(plan.target, context);
+                await this.#relocateAfterTarget(plan.target, context);
                 return;
             }
             // Identity owns the address transition. A content or link result may
@@ -593,25 +778,24 @@ export class EntityApplyHost {
             // installing at the new address would leave the old address behind for
             // Detect to misidentify as a new local entity and echo back to cloud.
             if (context.current && context.current.absolutePath !== context.targetPath
-                && !context.currentShared
                 && tryLstat(context.current.absolutePath)) {
-                this.#moveWithRecovery(intent, context.current.absolutePath, context.targetPath, context);
+                this.#moveToVacantAddress(context.current.absolutePath, context.targetPath);
             }
             if (plan.kind === "reference") {
                 this.#installLink(intent, context, relative(dirname(context.targetPath), join(this.#bindingDir, plan.targetEntityId)));
-                this.#relocateAfterTarget(plan.target, context);
+                await this.#relocateAfterTarget(plan.target, context);
                 return;
             }
             if (plan.kind === "link") {
                 this.#installLink(intent, context, plan.targetText);
-                this.#relocateAfterTarget(plan.target, context);
+                await this.#relocateAfterTarget(plan.target, context);
                 return;
             }
             const artifact = prepared.artifact;
             if (!artifact)
                 throw new Error(`${plan.kind} Apply has no prepared immutable artifact`);
             this.#installArtifact(intent, context, plan.target, artifact);
-            this.#relocateAfterTarget(plan.target, context);
+            await this.#relocateAfterTarget(plan.target, context);
         }
         catch (error) {
             this.#releaseGround(intent);
@@ -624,27 +808,33 @@ export class EntityApplyHost {
     async #verify(intent, plan) {
         this.#emit(intent, plan, "verify-started");
         try {
+            const recoveryReplan = this.#recoveryReplan(intent, plan);
+            if (recoveryReplan) {
+                this.#releaseGround(intent);
+                return recoveryReplan;
+            }
+            // Yield before the fresh physical proof, never between a final guard
+            // and reveal. Ground ownership and the durable intent remain in force.
+            await awaitTurn();
+            await this.#holdGround(intent, plan);
             // Entity repair is valid only inside the same materialized root that
             // owns the accepted rows. Check that boundary before path planning:
             // planning may inspect siblings, and must never recreate or traverse a
             // missing/replaced workspace piecemeal.
-            const current = this.#current(plan.target.uuid);
-            const parent = plan.target.parentUUID ? this.#current(plan.target.parentUUID) : null;
-            const anchor = current ?? parent;
-            if (anchor) {
-                const root = this.#root(anchor);
-                const rootGround = tryLstat(root.absolutePath);
-                if (!rootGround
-                    || rootGround.dev !== root.deviceNumber
-                    || rootGround.ino !== root.inode) {
-                    this.#releaseGround(intent);
-                    return {
-                        kind: "retry",
-                        reason: `materialized root ${root.uuid} is missing or replaced; explicit root repair is required`,
-                    };
-                }
+            const unavailableRoot = this.#unavailableRoot(plan.target);
+            if (unavailableRoot) {
+                this.#releaseGround(intent);
+                return unavailableRoot;
+            }
+            const prepared = plan.target.type === "repo.git" && plan.target.status === "active"
+                ? (await this.#ensurePrepared(intent, plan)).repository : null;
+            const basis = this.#verificationBasis(plan.target, prepared?.identity ?? []);
+            const context = this.#context(plan.target, intent);
+            const ownership = this.#foreignOwnership(intent, this.#bindingRoot(plan.target), this.applyAddresses(intent, plan));
+            if (ownership.waiting) {
+                this.#releaseGround(intent);
+                return ownership.waiting;
             }
-            const context = this.#context(plan.target);
             if (await this.#restoreRacedLocal(intent, plan, context)) {
                 this.#releaseGround(intent);
                 return { kind: "local-change" };
@@ -653,7 +843,17 @@ export class EntityApplyHost {
                 this.#releaseGround(intent);
                 return { kind: "missing-target" };
             }
-            if (!await this.#matches(intent, plan.target, context.targetPath, plan)) {
+            const anchor = context.current ?? context.parent;
+            if (!anchor)
+                throw new Error(`entity ${intent.entityId} has no materialized root`);
+            // Every read Verify proves follows its root's content clock.
+            const { boundary: clock } = await stampContentClock(this.#database.name, this.#root(anchor).absolutePath);
+            await this.#closeInherited(intent);
+            let receipt;
+            const targetMatches = plan.target.status === "active"
+                ? await this.#matches(intent, plan.target, context.targetPath, plan, context.targetPath, proof => { receipt = proof; })
+                : await this.#resolvedAbsence(intent, plan, context, proof => { receipt = proof; });
+            if (!targetMatches || context.beforeRelocations.length > 0 || context.afterRelocations.length > 0) {
                 this.#releaseGround(intent);
                 return { kind: "local-change" };
             }
@@ -666,12 +866,18 @@ export class EntityApplyHost {
                 fsyncFile(context.targetPath);
             }
             fsyncAddressParents(this.applyAddresses(intent, plan));
+            const verification = receipt.proof;
+            const proof = { semantic: () => verification.semantic(), witnesses: [],
+                admission: () => { ownership.basis.assertCurrent(); closePhysically(verification); } };
             if (plan.target.type === "repo.git" && plan.target.status === "active") {
-                const repository = await this.#repositoryRows(intent, plan, context);
-                this.store.stageVerification(intent, repository.rows, repository.removals);
+                const repository = await this.#repositoryRows(intent, plan, context, receipt, clock);
+                this.store.stageVerification(intent, repository, basis, proof);
             }
             else {
-                this.store.stageVerification(intent, [this.#verifiedRow(plan.target, context)]);
+                const row = this.#verifiedRow(plan.target, context, receipt, clock);
+                const ground = this.#containerGround(plan.target, context, row);
+                closePhysically(proof);
+                this.store.stageVerification(intent, ground, basis, proof);
             }
             return { kind: "match" };
         }
@@ -683,26 +889,493 @@ export class EntityApplyHost {
             this.#emit(intent, plan, "verify-finished");
         }
     }
-    async #discard(intent, plan) {
+    /** Original O/B evidence is captured before any verification output reads
+     * it. Only this target's subtrees, manifest UUIDs and parent namespaces enter. */
+    #verificationBasis(target, identity) {
+        return groundStore(this.#database).readSnapshot(reader => {
+            const parents = new Set(target.parentUUID ? [target.parentUUID] : []);
+            for (const inventory of ["entities", "detection_notebook"]) {
+                const read = inventory === "entities" ? reader.physical : reader.sharing;
+                for (const uuid of [target.uuid, ...identity.map(entry => entry.uuid)]) {
+                    const row = read(uuid);
+                    if (row?.parentUUID)
+                        parents.add(row.parentUUID);
+                }
+                for (const row of reader.subtree(inventory, target.uuid)) {
+                    if (row.parentUUID)
+                        parents.add(row.parentUUID);
+                    if (["workspace", "folder"].includes(row.type))
+                        parents.add(row.uuid);
+                }
+            }
+            // Accepted new parents also occur in the manifest before they have rows.
+            for (const entry of identity)
+                if (entry.type === "folder")
+                    parents.add(entry.uuid);
+            if (["workspace", "folder"].includes(target.type))
+                parents.add(target.uuid);
+            for (const uuid of parents) {
+                reader.physical(uuid);
+                reader.sharing(uuid);
+                reader.children("entities", uuid);
+                reader.children("detection_notebook", uuid);
+            }
+        }).basis;
+    }
+    /** An inactive identity may share its former logical name with a surviving
+     * sibling. Verify the removed identity, never emptiness of that old name. */
+    async #resolvedAbsence(intent, plan, context, remember) {
+        const witnesses = new PhysicalPathWitnesses();
+        let occupantProof;
+        // The occupant's receipt closed completely inside its own match.
+        const retain = () => {
+            const own = witnessProof([witnesses.seal()]);
+            const proof = occupantProof ? sourceProofs([own, occupantProof.proof]) : own;
+            closePhysically(proof);
+            remember?.({ stats: null, proof });
+            return true;
+        };
+        if (context.current) {
+            const current = tryLstat(context.current.absolutePath);
+            if (current)
+                return false;
+            witnesses.remember(context.current.absolutePath, current);
+            const recovery = this.#boundRecovery(intent);
+            if (!recovery?.source || !tryLstat(this.#displacedPath(intent, context)))
+                return false;
+            if (!await this.#matchesPreimage(intent, plan, recovery.source, this.#displacedPath(intent, context)))
+                return false;
+        }
+        const stats = tryLstat(context.targetPath);
+        witnesses.remember(context.targetPath, stats);
+        if (!stats)
+            return retain();
+        const occupant = this.#entityAtPath.get(context.targetPath);
+        return occupant !== undefined && occupant.uuid !== intent.entityId
+            && occupant.physicalKey === physicalKey(stats)
+            && await this.#matches(intent, portable(occupant), context.targetPath, plan, context.targetPath, proof => { occupantProof = proof; }) && retain();
+    }
+    #canRetireUnstartedIntent(intent) {
+        if (this.store.recoveryLocation(intent) !== null)
+            return false;
+        const current = this.#current(intent.entityId);
+        if (!current)
+            return false;
+        const control = this.#controlDirectory(intent, this.#anchors(portable(current)));
+        if (repositoryRevealInProgress(current.absolutePath))
+            return false;
+        // Existing effects must visit the normal guarded, asynchronous retirement
+        // path. Startup adoption is allowed to dispose private preparation only.
+        return !["displaced", "applied", "relocated"]
+            .some(name => tryLstat(join(control, name)) !== null);
+    }
+    #preimage(path) {
+        // O supplies last-proven identity and content. Reading disk here would
+        // incorrectly bless an edit made after the guard as a disposable preimage.
+        const prefix = `${path}${sep}`;
+        const rows = this.#database.prepare(`${groundSelect("entities")}
+      WHERE status = 'active' AND (absolute_path = ? OR (absolute_path >= ? AND absolute_path < ?))
+      ORDER BY absolute_path`).all(path, prefix, `${path}${String.fromCharCode(sep.charCodeAt(0) + 1)}`);
+        const root = rows.find(row => row.absolutePath === path), stat = tryLstat(path);
+        if (!root || !stat || physicalKey(stat) !== root.physicalKey) {
+            throw new Error("Apply preimage source association changed after its guard");
+        }
+        return { path, rows: rows.map(row => ({
+                path: relative(path, row.absolutePath).split(sep).join("/"), record: portable(row),
+                physical: row.absolutePath === path || this.#isContainer(row) ? row.physicalKey : null,
+            })) };
+    }
+    async #retainPreimages(intent, plan, context, remainder) {
+        const control = this.#controlDirectory(intent, context);
+        const existing = this.#boundRecovery(intent);
+        const bind = (recovery) => {
+            const { cones, uuids } = applyRecoveryFootprint(recovery);
+            return this.store.bindRecoveryLocation(intent, control, this.#ownershipScope(intent, recovery.binding.path, cones, uuids));
+        };
+        if (existing) {
+            if (existing.targetPath !== context.targetPath)
+                throw new Error("Apply recovery target address changed; explicit recovery is required");
+            if (!this.#receiptAllowsPlan(existing, context, this.#prepared.get(this.#key(intent))?.repository?.identity)) {
+                throw new Error("Apply recovery cannot authorize additional effects");
+            }
+            return bind(existing);
+        }
+        const repository = this.#prepared.get(this.#key(intent))?.repository;
+        const anchor = context.current ?? context.parent;
+        if (!anchor)
+            throw new Error("Apply recovery lacks a bound root");
+        const root = this.#root(anchor);
+        const recovery = {
+            contract: "amalgm.apply-recovery@6", intent, target: plan.target, targetPath: context.targetPath,
+            binding: { path: root.absolutePath, physical: root.physicalKey },
+            moves: [...context.beforeRelocations, ...context.afterRelocations].map(move => {
+                const physical = this.#current(move.row.uuid);
+                if (!physical)
+                    throw new Error("Apply collision move has no physical identity");
+                return { uuid: physical.uuid, source: this.#preimage(move.source), destination: move.destination };
+            }),
+            source: context.current && tryLstat(context.current.absolutePath)
+                ? this.#preimage(context.current.absolutePath) : null,
+            relocated: repository ? this.#repositoryRelocations(context, repository.identity).map(group => ({
+                uuid: group.sourceRoot.uuid, source: this.#preimage(group.sourceRoot.absolutePath),
+            })) : [],
+            remainder: remainder.map(entry => entry.path),
+        };
+        writeApplyRecovery(control, recovery);
+        fsyncFile(join(control, "preimage.json"));
+        fsyncDirectory(control);
+        fsyncDirectory(dirname(control));
+        return bind(recovery);
+    }
+    /** Durable ownership outlives a transient ground lease. Reuse the same
+     * scope predicate as Detect; only this exact attempt may use its effects. */
+    #foreignOwnership(intent, root, addresses, uuids = []) {
+        const ownership = new ApplyOwnershipSnapshot(sqliteApplyOwnership(this.#database), intent);
+        const owners = ownership.use(this.#ownershipScope(intent, root, addresses, uuids));
+        return { waiting: ownershipWait(owners, this.store.recoveryLocation(intent) !== null), basis: ownership.seal() };
+    }
+    /** Every address an Apply touches lies in its binding: the root its
+     * target or that target's parent is materialized in. */
+    #bindingRoot(target) {
+        const { current, parent } = this.#anchors(target);
+        return this.#root((current ?? parent)).absolutePath;
+    }
+    #ownershipScope(intent, root, addresses, uuids) {
+        const physical = addresses.flatMap(path => {
+            const stat = tryLstat(path);
+            return stat ? [ownedObject(root, physicalKey(stat))] : [];
+        });
+        return { subtrees: addresses, uuids: new Set([intent.entityId, ...uuids]), physical: new Set(physical) };
+    }
+    #boundRecovery(intent) {
+        const control = this.store.recoveryLocation(intent);
+        if (control === null)
+            return null;
+        const recovery = readApplyRecovery(control, intent);
+        if (!recovery)
+            throw new Error("Open Apply intent lost its recovery receipt");
+        return recovery;
+    }
+    #receiptAllowsPlan(recovery, context, identity) {
+        if (recovery.targetPath !== context.targetPath)
+            return false;
+        if (![...context.beforeRelocations, ...context.afterRelocations].every(move => recovery.moves.some(original => original.uuid === move.row.uuid && original.source.path === move.source && original.destination === move.destination)))
+            return false;
+        return !identity || this.#repositoryRelocations(context, identity).every(group => recovery.relocated.some(original => original.uuid === group.sourceRoot.uuid && original.source.path === group.sourceRoot.absolutePath));
+    }
+    /** An old effect owner must be handled before ordinary current-path or
+     * parent checks can hand its own intermediate placement to Detect. Its
+     * receipt lives inside the materialized root, so a missing root is root
+     * recovery, never a lost receipt. */
+    #recoveryReplan(intent, plan) {
+        const control = this.store.recoveryLocation(intent);
+        if (control === null)
+            return null;
+        const unavailableRoot = this.#unavailableRoot(plan.target);
+        if (unavailableRoot)
+            return unavailableRoot;
+        const recovery = this.#boundRecovery(intent);
+        if (!recovery)
+            throw new Error("Open Apply intent lost its recovery receipt");
+        const replan = { kind: "replan", reason: "Original Apply effects require a coherent cancellation before replanning." };
+        if (plan.target.parentUUID !== null && !this.#current(plan.target.parentUUID))
+            return replan;
+        for (const move of recovery.moves) {
+            const current = this.#current(move.uuid), source = tryLstat(move.source.path);
+            const anchor = applyPreimageRoot(move.source).physical;
+            if (current?.absolutePath === move.destination && source && physicalKey(source) === anchor)
+                return replan;
+        }
+        return this.#receiptAllowsPlan(recovery, this.#context(plan.target, intent), this.#prepared.get(this.#key(intent))?.repository?.identity) ? null : replan;
+    }
+    async #recoveryPlacementRepair(intent, plan, recovery) {
+        const original = groundStore(this.#database).readSnapshot(reader => {
+            const moves = [...recovery.moves];
+            const primary = reader.physical(intent.entityId);
+            if (recovery.source && recovery.source.path !== recovery.targetPath && primary
+                && JSON.stringify(portable(primary)) === JSON.stringify(applyPreimageRoot(recovery.source).record)) {
+                moves.unshift({ uuid: intent.entityId, source: recovery.source, destination: recovery.targetPath });
+            }
+            const rows = new Map(), roots = new Map();
+            for (const move of moves) {
+                const current = reader.physical(move.uuid);
+                rows.set(move.uuid, current ? reader.subtree("entities", move.uuid) : []);
+                if (current) {
+                    const root = reader.physical(current.rootUUID);
+                    if (!root)
+                        throw new Error("Apply placement lost its original binding");
+                    roots.set(move.uuid, root);
+                    for (const path of [move.source.path, move.destination])
+                        reader.atPath("entities", current.rootUUID, relative(root.absolutePath, path).split(sep).join("/"));
+                }
+            }
+            return { moves, rows, roots };
+        });
+        const repaired = [], witnesses = new PhysicalPathWitnesses();
+        const preimages = [];
+        for (const move of original.value.moves) {
+            const rows = original.value.rows.get(move.uuid), current = rows.find(row => row.uuid === move.uuid);
+            if (!current || ![move.source.path, move.destination].includes(current.absolutePath)) {
+                throw new Error("Apply recovery lost its recorded placement participant");
+            }
+            const source = tryLstat(move.source.path), destination = tryLstat(move.destination);
+            const anchor = applyPreimageRoot(move.source).physical;
+            const atSource = source !== null && physicalKey(source) === anchor;
+            const atDestination = destination !== null && physicalKey(destination) === anchor;
+            if (atSource === atDestination)
+                throw new Error("Apply recovery identity has ambiguous placement");
+            const actual = atSource ? move.source.path : move.destination;
+            const root = original.value.roots.get(move.uuid);
+            if (!pathInside(root.absolutePath, actual))
+                throw new Error("Apply placement crosses an unproved root binding");
+            const validateRoot = () => {
+                const stat = tryLstat(root.absolutePath);
+                if (!stat?.isDirectory() || stat.isSymbolicLink() || physicalKey(stat) !== root.physicalKey) {
+                    throw new Error("Apply placement root changed");
+                }
+            };
+            validateRoot();
+            preimages.push(admissionProof(validateRoot));
+            if (!await this.#matchesPreimage(intent, plan, move.source, actual, proof => preimages.push(proof))) {
+                throw new Error("Apply recovery placement preimage changed");
+            }
+            const before = new Map(move.source.rows.map(row => [row.record.uuid, row]));
+            if (rows.length !== before.size)
+                throw new Error("Apply recovery placement membership changed");
+            for (const row of rows) {
+                const member = before.get(row.uuid);
+                if (!member || JSON.stringify(portable(row)) !== JSON.stringify(member.record)
+                    || row.absolutePath !== join(current.absolutePath, ...member.path.split("/"))) {
+                    throw new Error("Apply recovery cannot rewrite newer physical attribution");
+                }
+                const absolutePath = join(actual, ...member.path.split("/"));
+                witnesses.remember(absolutePath, tryLstat(absolutePath));
+                if (current.absolutePath !== actual)
+                    repaired.push({ ...row, absolutePath,
+                        relativePath: relative(root.absolutePath, absolutePath).split(sep).join("/") });
+            }
+            // The contradictory recorded root slot must remain unchanged until
+            // the cancellation transaction accepts this original placement proof.
+            witnesses.remember(current.absolutePath, tryLstat(current.absolutePath));
+            witnesses.remember(move.source.path, source);
+            witnesses.remember(move.destination, destination);
+        }
+        return { rows: repaired, basis: original.basis,
+            proof: sourceProofs([...preimages, witnessProof([witnesses.seal()])]) };
+    }
+    async #matchesPreimage(intent, plan, preimage, physicalRoot, remember) {
+        const expected = new Map(preimage.rows.map(row => [row.path, row]));
+        const proofs = [];
+        const visit = async (path, relativePath) => {
+            const row = expected.get(relativePath);
+            if (!row || !await this.#matches(intent, row.record, path, plan, join(preimage.path, ...relativePath.split("/")), receipt => proofs.push(receipt.proof)))
+                return false;
+            const stat = tryLstat(path);
+            if (["workspace", "folder", "repo.git"].includes(row.record.type) && (!stat?.isDirectory() || stat.isSymbolicLink()
+                || physicalKey(stat) !== row.physical))
+                return false;
+            expected.delete(relativePath);
+            if (stat?.isDirectory() && !stat.isSymbolicLink()) {
+                for (const name of readdirSync(path)) {
+                    // Machine control and Git storage have their own ownership. Git's
+                    // complete portable state was checked by its adapter above.
+                    if (name === ".amalgm" || (name === ".git" && row.record.type === "repo.git"))
+                        continue;
+                    if (!await visit(join(path, name), relativePath ? `${relativePath}/${name}` : name))
+                        return false;
+                }
+            }
+            return true;
+        };
+        if (!await visit(physicalRoot, "") || expected.size !== 0)
+            return false;
+        // A preimage match is a claim: its complete proof closes before it holds.
+        const proof = sourceProofs(proofs);
+        await closeSource(proof);
+        remember?.(proof);
+        return true;
+    }
+    async #proveRecoveryRetirement(intent, plan, context, purpose, repaired) {
+        const control = this.#controlDirectory(intent, context);
+        if ([context.targetPath, context.current?.absolutePath].some(path => path && repositoryRevealInProgress(path))) {
+            throw new Error("Interrupted repository effects cannot be retired");
+        }
+        const recovery = this.#boundRecovery(intent);
+        if (this.store.recoveryLocation(intent) !== null && !recovery)
+            throw new Error("Open Apply intent lost its recovery receipt");
+        const witnesses = new PhysicalPathWitnesses();
+        witnesses.remember(control, tryLstat(control));
+        if (!tryLstat(control))
+            return { proof: witnessProof([witnesses.seal()]), attribution: null };
+        const basis = groundStore(this.#database).readSnapshot(reader => {
+            for (const uuid of new Set([intent.entityId, ...(recovery?.moves.map(move => move.uuid) ?? []),
+                ...(recovery?.relocated.map(move => move.uuid) ?? [])]))
+                reader.subtree("entities", uuid);
+        }).basis;
+        const proofs = [];
+        const retain = (receipt) => { proofs.push(receipt.proof); };
+        const corrected = new Map(repaired?.map(row => [row.uuid, row]));
+        const placementProved = purpose.kind === "cancelled" && repaired !== undefined;
+        // Cancellation already has the complete original-placement proof. Keep
+        // that same closing validator instead of rereading every moved subtree.
+        for (const move of placementProved ? [] : recovery?.moves ?? []) {
+            const current = corrected.get(move.uuid) ?? this.#current(move.uuid);
+            const allowed = purpose.kind === "materialized" ? [move.destination] : [move.source.path, move.destination];
+            const physical = current && tryLstat(current.absolutePath);
+            const anchor = applyPreimageRoot(move.source).physical;
+            if (!current || !allowed.includes(current.absolutePath) || !physical
+                || physicalKey(physical) !== anchor
+                || !await this.#matchesPreimage(intent, plan, move.source, current.absolutePath, proof => proofs.push(proof))) {
+                throw new Error("Apply collision relocation has an unresolved identity placement");
+            }
+        }
+        if (recovery?.source && recovery.source.path !== recovery.targetPath) {
+            const source = recovery.source, oldSlot = tryLstat(source.path);
+            witnesses.remember(source.path, oldSlot);
+            const primary = corrected.get(intent.entityId) ?? this.#current(intent.entityId);
+            if (purpose.kind === "materialized") {
+                if (!await this.#matches(intent, recovery.target, recovery.targetPath, plan, recovery.targetPath, retain)) {
+                    throw new Error("Apply primary movement lacks its accepted target");
+                }
+            }
+            else if (!(placementProved && primary
+                && JSON.stringify(portable(primary)) === JSON.stringify(applyPreimageRoot(source).record))
+                && (!primary || ![source.path, recovery.targetPath].includes(primary.absolutePath)
+                    || (primary.absolutePath === recovery.targetPath && primary.version !== recovery.target.version)
+                    || !await this.#matches(intent, portable(primary), primary.absolutePath, plan, primary.absolutePath, retain))) {
+                throw new Error("Apply primary movement has unresolved physical attribution");
+            }
+            if (oldSlot && (purpose.kind === "materialized" || primary?.absolutePath !== source.path)
+                && !recovery.moves.some(move => {
+                    const anchor = applyPreimageRoot(move.source).physical;
+                    return move.destination === source.path && anchor === physicalKey(oldSlot)
+                        && (corrected.get(move.uuid) ?? this.#current(move.uuid))?.absolutePath === source.path;
+                }))
+                throw new Error("Apply primary source has an unexplained occupant");
+        }
+        const displaced = join(control, "displaced"), applied = join(control, "applied"), relocated = join(control, "relocated");
+        if (tryLstat(displaced) && (!recovery?.source
+            || !await this.#matchesPreimage(intent, plan, recovery.source, displaced, proof => proofs.push(proof)))) {
+            throw new Error("Apply recovery retains an unexplained displaced version");
+        }
+        if (tryLstat(applied) && (!recovery || !await this.#matches(intent, recovery.target, applied, plan, recovery.targetPath, retain))) {
+            throw new Error("Apply recovery retains an unexplained applied version");
+        }
+        if (tryLstat(relocated)) {
+            const sources = new Map(recovery?.relocated.map(row => [row.uuid, row.source]) ?? []);
+            for (const uuid of readdirSync(relocated)) {
+                const source = sources.get(uuid);
+                if (!source || !await this.#matchesPreimage(intent, plan, source, join(relocated, uuid), proof => proofs.push(proof))) {
+                    throw new Error("Apply recovery retains an unexplained relocated version");
+                }
+            }
+        }
+        if (readdirSync(control).some(name => !["preimage.json", "prepared", "displaced", "applied", "relocated"].includes(name))) {
+            throw new Error("Apply control contains an unrecognized recovery obligation");
+        }
+        return { proof: sourceProofs([witnessProof([witnesses.seal()]), ...proofs]), attribution: basis };
+    }
+    async #prepareRetirement(intent, plan, purpose) {
         try {
-            this.#prepared.delete(this.#key(intent));
+            const heldControl = this.store.recoveryLocation(intent);
+            if (purpose.kind === "cancelled" && heldControl !== null) {
+                const recovery = readApplyRecovery(heldControl, intent);
+                if (!recovery)
+                    throw new Error("Open Apply intent lost its recovery receipt");
+                // An old obligation cannot depend on the new target's parent or Git
+                // package becoming available. Its immutable receipt supplies scope.
+                this.#releaseGround(intent);
+                const addresses = [...new Set([heldControl, recovery.targetPath,
+                        ...(recovery.source ? [recovery.source.path] : []),
+                        ...recovery.moves.flatMap(move => [move.source.path, move.destination]),
+                        ...recovery.relocated.map(move => move.source.path)])];
+                const release = await this.#acquireGround(addresses);
+                this.#groundReleases.set(this.#key(intent), { addresses, release });
+                const ownership = this.#foreignOwnership(intent, recovery.binding.path, addresses, applyRecoveryFootprint(recovery).uuids);
+                if (ownership.waiting) {
+                    this.#releaseGround(intent);
+                    return ownership.waiting;
+                }
+                const binding = tryLstat(recovery.binding.path);
+                if (!binding?.isDirectory() || binding.isSymbolicLink()
+                    || physicalKey(binding) !== recovery.binding.physical) {
+                    throw new Error("Apply recovery root is missing or replaced");
+                }
+                const repair = await this.#recoveryPlacementRepair(intent, plan, recovery);
+                const cleanup = await describeApplyCleanup(recovery.binding, heldControl);
+                const context = { current: this.#current(intent.entityId), parent: null,
+                    targetPath: recovery.targetPath, targetName: basename(recovery.targetPath),
+                    beforeRelocations: [], afterRelocations: [], collisionEligible: false };
+                const retirement = await this.#proveRecoveryRetirement(intent, plan, context, purpose, repair.rows);
+                closePhysically(repair.proof);
+                assertApplyCleanupUnchanged(cleanup);
+                this.store.stageRetirement(intent, purpose, cleanup, { repair, proof: this.#cleanupProof(ownership, retirement.proof, cleanup), attribution: retirement.attribution });
+                this.#prepared.delete(this.#key(intent));
+                return;
+            }
+            await this.#holdGround(intent, plan);
+            const ownership = this.#foreignOwnership(intent, this.#bindingRoot(plan.target), this.applyAddresses(intent, plan));
+            if (ownership.waiting) {
+                this.#releaseGround(intent);
+                return ownership.waiting;
+            }
             this.#observations.delete(this.#key(intent));
-            const context = this.#context(plan.target);
-            rmSync(this.#controlDirectory(intent, {
-                current: context.current,
-                parent: context.parent,
-            }), { recursive: true, force: true });
+            const context = this.#context(plan.target, intent);
+            const control = this.#controlDirectory(intent, context);
+            const recovery = this.#boundRecovery(intent);
+            const anchor = context.current ?? context.parent;
+            if (!anchor)
+                throw new Error("Apply retirement has no root binding");
+            const root = this.#root(anchor);
+            const binding = recovery?.binding ?? { path: root.absolutePath, physical: root.physicalKey };
+            const cleanup = await describeApplyCleanup(binding, control);
+            const retirement = await this.#proveRecoveryRetirement(intent, plan, context, purpose);
+            assertApplyCleanupUnchanged(cleanup);
+            this.store.stageRetirement(intent, purpose, cleanup, { proof: this.#cleanupProof(ownership, retirement.proof, cleanup), attribution: retirement.attribution });
+            this.#prepared.delete(this.#key(intent));
         }
         catch (error) {
             this.#releaseGround(intent);
             throw error;
         }
     }
+    /** Retirement re-asks its sources before the terminal save; as it posts,
+     * ownership, native witnesses and the cleanup description close. */
+    #cleanupProof(ownership, retirement, cleanup) {
+        return { semantic: () => retirement.semantic(), witnesses: [],
+            admission: () => { ownership.basis.assertCurrent(); closePhysically(retirement); assertApplyCleanupUnchanged(cleanup); } };
+    }
     async #holdGround(intent, plan) {
+        // Immutable identity determines repository relocation cones. Load it
+        // before acquiring ground, including after restart with an empty cache.
+        if (plan.target.type === "repo.git" && plan.target.status === "active") {
+            await this.#ensurePrepared(intent, plan);
+        }
         const key = this.#key(intent);
-        if (this.#groundReleases.has(key))
-            return;
-        this.#groundReleases.set(key, await this.#acquireGround(this.applyAddresses(intent, plan)));
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+            const addresses = this.#groundCones(intent, plan);
+            const held = this.#groundReleases.get(key);
+            if (held && addresses.every(address => held.addresses.some(cone => pathInside(cone, address))))
+                return;
+            this.#releaseGround(intent);
+            // A repository's ref updates append to its reflogs, which may have or
+            // later gain links anywhere; the grant declares them before any effect.
+            const reflogs = plan.target.type === "repo.git"
+                ? () => this.applyAddresses(intent, plan).flatMap(reflogKeys) : undefined;
+            const release = await this.#acquireGround(addresses, reflogs);
+            this.#groundReleases.set(key, { addresses, release });
+            // Context may have changed while waiting. No effects may use cones
+            // discovered after acquisition without releasing and proving them again.
+            if (this.#groundCones(intent, plan).every(address => addresses.some(cone => pathInside(cone, address))))
+                return;
+        }
+        this.#releaseGround(intent);
+        throw new Error("Apply ground scope changed repeatedly while acquiring ownership");
+    }
+    /** The held ground: every address plus Git storage a repository at that
+     * address keeps outside its checkout, which the same effect writes. */
+    #groundCones(intent, plan) {
+        return [...new Set(this.applyAddresses(intent, plan).flatMap(address => repositoryGroundCones(address)))];
     }
     /**
      * The visible addresses one Apply may read or replace: the target address,
@@ -712,10 +1385,25 @@ export class EntityApplyHost {
      * free for Detect and other Apply work.
      */
     applyAddresses(intent, plan) {
-        const context = this.#context(plan.target);
+        const context = this.#context(plan.target, intent);
         const addresses = new Set([context.targetPath]);
+        const physical = this.#entityByUuid.get(intent.entityId);
+        if (physical)
+            addresses.add(physical.absolutePath);
         if (context.current)
             addresses.add(context.current.absolutePath);
+        const recovery = this.#boundRecovery(intent);
+        if (recovery) {
+            addresses.add(recovery.targetPath);
+            if (recovery.source)
+                addresses.add(recovery.source.path);
+            for (const row of recovery.relocated)
+                addresses.add(row.source.path);
+            for (const move of recovery.moves) {
+                addresses.add(move.source.path);
+                addresses.add(move.destination);
+            }
+        }
         for (const relocation of [...context.beforeRelocations, ...context.afterRelocations]) {
             addresses.add(relocation.source);
             addresses.add(relocation.destination);
@@ -730,23 +1418,48 @@ export class EntityApplyHost {
         }
         return [...addresses];
     }
+    /** Called only after the requesting Watch cutoff settles. Outbox protection
+     * remains the rail's independent check; local-only observations never fake it. */
+    captureOutcome(intent, plan, observedAddresses) {
+        const outcome = settledCaptureOutcome(this.#database, {
+            authorityId: intent.authorityId, entityId: intent.entityId,
+            addresses: [...observedAddresses, ...this.applyAddresses(intent, plan)],
+        });
+        return outcome.kind === "settled" ? { kind: "settled" } : outcome;
+    }
     #releaseGround(intent) {
         const key = this.#key(intent);
         this.#observations.delete(key);
-        const release = this.#groundReleases.get(key);
-        if (!release)
+        const held = this.#groundReleases.get(key);
+        if (!held)
             return;
         this.#groundReleases.delete(key);
-        release();
+        held.release();
     }
     /** A collision relocation is safe only when every source still proves its
      * own portable identity and every destination is either free or another
      * relocation source. The final reveal then performs the whole finite chain
      * while holding all source and destination cones. */
-    async #lawRelocationsReady(intent, plan, relocations) {
+    async #lawRelocationsReady(intent, plan, relocations, vacated = []) {
         if (relocations.length === 0)
             return false;
-        const sources = new Set(relocations.map(({ source }) => source));
+        // The executor only moves into a vacant slot. Reject a closed dependency
+        // cycle before changing either rows or disk; retrying it cannot free a slot.
+        const next = new Map(relocations.map(move => [move.source, move.destination]));
+        const checked = new Set();
+        for (const source of next.keys()) {
+            const chain = new Set();
+            let current = source;
+            while (current !== undefined && next.has(current) && !checked.has(current)) {
+                if (chain.has(current))
+                    throw new Error("Apply derived-address plan contains a closed relocation cycle");
+                chain.add(current);
+                current = next.get(current);
+            }
+            for (const path of chain)
+                checked.add(path);
+        }
+        const sources = new Set([...vacated, ...relocations.map(({ source }) => source)]);
         for (const { row, source, destination } of relocations) {
             if (tryLstat(destination) && !sources.has(destination))
                 return false;
@@ -757,9 +1470,9 @@ export class EntityApplyHost {
     }
     /** Relocate a derived-name chain without ever overwriting ground. Each move
      * whose destination is free commits row addresses first, then renames disk.
-     * A crash between those facts is repaired by Detect from the same portable
-     * identity; the derived suffix can never become a rename mutation. */
-    #relocateLawSiblings(_context, relocations) {
+     * A crash between those facts belongs to this Apply receipt. Recovery
+     * reconciles its placement before Detect may attribute another change. */
+    async #relocateLawSiblings(_context, relocations) {
         const pending = [...relocations];
         while (pending.length > 0) {
             const sources = new Set(pending.map(({ source }) => source));
@@ -773,64 +1486,32 @@ export class EntityApplyHost {
             const { row, source, destination } = relocation;
             if (!tryLstat(source))
                 continue;
-            const destinationRelative = relative(this.#root(row).absolutePath, destination)
-                .split(sep).join("/");
-            const descendants = (rows) => rows.filter((candidate) => pathInside(source, candidate.absolutePath));
-            const entityRows = descendants(this.#rowsUnderRoot.all(row.rootUUID));
-            const notebookRows = descendants(this.#notebookUnderRoot.all(row.rootUUID));
-            this.#database.transaction(() => {
-                for (const candidate of entityRows) {
-                    this.#relocateEntityRow.run(destinationRelative + candidate.relativePath.slice(row.relativePath.length), destination + candidate.absolutePath.slice(source.length), candidate.uuid);
-                }
-                for (const candidate of notebookRows) {
-                    this.#relocateNotebookRow.run(destinationRelative + candidate.relativePath.slice(row.relativePath.length), destination + candidate.absolutePath.slice(source.length), candidate.uuid);
-                }
-            })();
+            const relativePath = relative(this.#root(row).absolutePath, destination).split(sep).join("/");
+            await save(this.#database.name, "apply.relocateRows", { uuid: row.uuid,
+                destination: { absolutePath: destination, relativePath } });
             this.#onLawRelocationStage?.("rows-committed", row.uuid, destination);
             renameSync(source, destination);
             this.#onLawRelocationStage?.("ground-moved", row.uuid, destination);
-            const moved = lstatSync(destination);
-            this.#refreshEntityCtime.run(moved.ctimeMs, row.uuid);
-            this.#refreshNotebookCtime.run(moved.ctimeMs, row.uuid);
+            await save(this.#database.name, "apply.renameSignatures", { uuid: row.uuid, ctimeNs: lstatSync(destination, { bigint: true }).ctimeNs });
         }
     }
     /** Reveal has already moved or removed the target ground. Release its old
      * SQLite address before a sibling takes that slot; final Verify will write
      * the complete accepted row. The durable Apply intent owns any crash in
      * this short interval. */
-    #relocateAfterTarget(target, context) {
+    async #relocateAfterTarget(target, context) {
         if (context.afterRelocations.length === 0)
             return;
         const current = context.current;
         if (current) {
-            const entityRows = this.#rowsUnderRoot.all(current.rootUUID)
-                .filter((row) => pathInside(current.absolutePath, row.absolutePath));
-            const notebookRows = this.#notebookUnderRoot.all(current.rootUUID)
-                .filter((row) => pathInside(current.absolutePath, row.absolutePath));
-            if (target.status === "active") {
-                const destinationRelative = relative(this.#root(current).absolutePath, context.targetPath)
-                    .split(sep).join("/");
-                this.#database.transaction(() => {
-                    for (const row of entityRows) {
-                        this.#relocateEntityRow.run(destinationRelative + row.relativePath.slice(current.relativePath.length), context.targetPath + row.absolutePath.slice(current.absolutePath.length), row.uuid);
-                    }
-                    for (const row of notebookRows) {
-                        this.#relocateNotebookRow.run(destinationRelative + row.relativePath.slice(current.relativePath.length), context.targetPath + row.absolutePath.slice(current.absolutePath.length), row.uuid);
-                    }
-                })();
-            }
-            else {
-                const removeEntity = this.#database.prepare("DELETE FROM entities WHERE uuid = ?");
-                const removeNotebook = this.#database.prepare("DELETE FROM detection_notebook WHERE uuid = ?");
-                this.#database.transaction(() => {
-                    for (const row of entityRows)
-                        removeEntity.run(row.uuid);
-                    for (const row of notebookRows)
-                        removeNotebook.run(row.uuid);
-                })();
-            }
+            const root = target.status === "active" ? this.#root(context.parent ?? current) : null;
+            await save(this.#database.name, "apply.relocateRows", { uuid: current.uuid, destination: root && {
+                    absolutePath: context.targetPath,
+                    relativePath: relative(root.absolutePath, context.targetPath).split(sep).join("/"),
+                    root: { uuid: root.uuid, resourceId: root.resourceId },
+                } });
         }
-        this.#relocateLawSiblings(context, context.afterRelocations);
+        await this.#relocateLawSiblings(context, context.afterRelocations);
     }
     #emit(intent, plan, stage) {
         this.#onStage?.({
@@ -842,6 +1523,151 @@ export class EntityApplyHost {
             at: this.#now(),
         });
     }
+    /** The identity frontier the sharing basis holds where a repository
+     * reveals: B's sealed repository result, or, while B still holds that
+     * ground as a container, each shared member the repository would own.
+     * Never a later query of O. */
+    async #sharedIdentity(uuid) {
+        const shared = this.#rowByUuid.get(uuid);
+        if (shared?.status !== "active" || !this.#isContainer(shared))
+            return [];
+        if (shared.type !== "repo.git") {
+            const rows = groundStore(this.#database).rowsUnder("detection_notebook", shared.rootUUID, shared.relativePath);
+            return repositoryTerritory(rows, shared).filter(row => row.status === "active")
+                .map(row => identityEntry(shared, row));
+        }
+        const identity = shared.transportVersion ? await readCachedRepositoryIdentity(this.#cacheDir, shared.transportVersion) : null;
+        if (!identity)
+            throw new Error("repository sharing basis has no sealed identity frontier");
+        return identity.entries;
+    }
+    /** Local ground a repository, or a container becoming one, holds beyond
+     * an expected identity that sharing never held. Anything else beyond the
+     * identity is unaccounted: null. */
+    #remainder(repository, expected) {
+        const known = new Set(expected.map(entry => entry.uuid));
+        const rows = groundStore(this.#database).rowsUnder("entities", repository.rootUUID, repository.relativePath);
+        const extras = repositoryTerritory(rows, repository)
+            .filter(row => row.status === "active" && !known.has(row.uuid));
+        if (extras.length === 0)
+            return [];
+        if (extras.some(row => this.#rowByUuid.get(row.uuid) !== undefined))
+            return null;
+        return extras.map(row => identityEntry(repository, row));
+    }
+    /** The extras one repository comparison may account for: once effects are
+     * authorized, exactly the receipt's frozen allowance; before, only the
+     * local remainder the committed inventories name. */
+    #allowance(intent, identity) {
+        const recovery = this.#boundRecovery(intent);
+        if (recovery)
+            return applyRecoveryRemainder(recovery);
+        const repository = this.#current(intent.entityId);
+        return repository?.type === "repo.git" ? this.#remainder(repository, identity) : [];
+    }
+    /** The remainder a reveal keeps, relative to the sharing basis it replaces. */
+    async #revealRemainder(intent, context) {
+        const recovery = this.#boundRecovery(intent);
+        if (recovery)
+            return applyRecoveryRemainder(recovery);
+        if (!context.current || !this.#isContainer(context.current) || !tryLstat(context.current.absolutePath))
+            return [];
+        const remainder = this.#remainder(context.current, await this.#sharedIdentity(context.current.uuid));
+        if (!remainder)
+            throw new Error("repository ground changed after its final guard; Detect must examine it again");
+        return remainder;
+    }
+    #repositoryIdentityMatches(intent, path, identity) {
+        const repository = this.#entityAtPath.get(path);
+        if (!repository || repository.type !== "repo.git")
+            return false;
+        const remainder = this.#allowance(intent, identity);
+        if (!remainder)
+            return false;
+        const kept = new Set(remainder.map(entry => entry.uuid));
+        const rows = groundStore(this.#database).rowsUnder("entities", repository.rootUUID, repository.relativePath);
+        const territory = indexRepositoryTerritory(rows);
+        const actual = territory.ownedBy(repository.uuid).filter(row => row.status === "active" && !kept.has(row.uuid));
+        const expected = new Map(identity.map(row => [row.uuid, row]));
+        return actual.length === expected.size && actual.every(row => {
+            const member = expected.get(row.uuid);
+            return member?.type === row.type && row.absolutePath === join(path, ...member.path.split("/"))
+                && (!this.#isContainer(row) || this.#samePhysicalDirectory(row));
+        });
+    }
+    /** The rows a displacement wait names: each topmost remainder row inside
+     * the container and every O row from it up to the container. The answer
+     * depends only on those rows, so a change to any of them may release it. */
+    #displacedRemainder(container, remainder) {
+        const inside = remainder.filter(row => row.uuid !== container.uuid
+            && pathInside(container.absolutePath, row.absolutePath));
+        const held = new Set(inside.map(row => row.uuid));
+        const named = new Set();
+        for (const row of inside) {
+            if (row.parentUUID !== null && held.has(row.parentUUID))
+                continue;
+            for (let at = row; at && !named.has(at.uuid); at = at.uuid === container.uuid || at.parentUUID === null ? null : this.#current(at.parentUUID)) {
+                named.add(at.uuid);
+            }
+        }
+        return [...named];
+    }
+    /** Descendants whose local result has no authority sequence yet. Cached
+     * bytes keep the promise deliverable but do not order it before the
+     * incoming removal; once Send sequences them the guard runs again. */
+    #pendingPublication(authorityId, container) {
+        return this.#pendingOutbox.all(authorityId).flatMap(({ entity_id: uuid }) => {
+            const row = uuid === container.uuid ? null : this.#current(uuid);
+            return row && pathInside(container.absolutePath, row.absolutePath) ? [uuid] : [];
+        });
+    }
+    /** Ground the accepted repository would remove or overwrite. Each observed
+     * obstruction is named with its chain; the repository itself is always
+     * named, so the examination that classifies ground Detect has not yet
+     * seen inside it is what releases the wait. */
+    #obstructedRepository(repository, error) {
+        const observed = error.paths.flatMap(path => {
+            const row = this.#entityAtPath.get(join(repository.absolutePath, path));
+            return row ? [row] : [];
+        });
+        return { kind: "dependency", reason: error.message,
+            waitFor: { producer: "detect", entityIds: [...new Set([repository.uuid, ...this.#displacedRemainder(repository, observed)])] },
+            blocker: { code: "local-ground-would-be-displaced", effect: "repository-reveal" } };
+    }
+    #isContainer(row) {
+        return row.type === "workspace" || row.type === "folder" || row.type === "repo.git";
+    }
+    #samePhysicalDirectory(row) {
+        const physical = tryLstat(row.absolutePath);
+        return physical !== null && physical.isDirectory() && !physical.isSymbolicLink()
+            && physicalKey(physical) === row.physicalKey;
+    }
+    #directoryAncestorsMatch(row) {
+        const seen = new Set();
+        let current = row;
+        while (current) {
+            if (seen.has(current.uuid))
+                throw new Error("Apply directory ancestry has a cycle");
+            seen.add(current.uuid);
+            if (this.#isContainer(current) && !this.#samePhysicalDirectory(current))
+                return false;
+            if (current.uuid === current.rootUUID)
+                return true;
+            current = current.parentUUID === null ? null : this.#current(current.parentUUID);
+        }
+        return false;
+    }
+    /** Byte equality cannot adopt a replaced populated directory. Leaves may
+     * have a new inode after an ordinary atomic save; containers retain their
+     * proven physical identity until Detect or this intent accounts for a move. */
+    #physicalDirectoriesMatch(row) {
+        if (!this.#directoryAncestorsMatch(row))
+            return false;
+        if (!this.#isContainer(row))
+            return true;
+        return groundStore(this.#database).rowsUnder("entities", row.rootUUID, row.relativePath)
+            .every(child => child.status !== "active" || !this.#isContainer(child) || this.#samePhysicalDirectory(child));
+    }
     #repositoryRelocations(context, identity) {
         const relocations = identity.flatMap((entry) => {
             const current = this.#current(entry.uuid);
@@ -903,16 +1729,27 @@ export class EntityApplyHost {
         const displaced = this.#displacedPath(intent, context);
         if (!tryLstat(displaced))
             return false;
-        if (await this.#matches(intent, portable(current), displaced, plan))
+        const control = this.#controlDirectory(intent, context);
+        const recovery = this.#boundRecovery(intent);
+        if (!recovery?.source)
+            throw new Error("Displaced Apply ground has no immutable preimage");
+        if (recovery.targetPath !== context.targetPath)
+            throw new Error("Apply recovery target address changed; explicit recovery is required");
+        if (await this.#matchesPreimage(intent, plan, recovery.source, displaced))
             return false;
-        const applied = join(this.#controlDirectory(intent, context), "applied");
-        rmSync(applied, { recursive: true, force: true });
+        const source = recovery.source.path;
+        const applied = join(control, "applied");
+        // The retained local version can return only without erasing another
+        // unaccounted-for version. Ambiguity keeps all ground and this intent.
+        if (tryLstat(applied)
+            || (source !== context.targetPath && tryLstat(source))
+            || (tryLstat(context.targetPath) && !await this.#matches(intent, plan.target, context.targetPath, plan))) {
+            throw new Error("Apply recovery has multiple local versions; explicit recovery is required");
+        }
         if (tryLstat(context.targetPath))
             renameSync(context.targetPath, applied);
-        ensureUserDir(dirname(current.absolutePath));
-        if (tryLstat(current.absolutePath))
-            rmSync(current.absolutePath, { recursive: true, force: true });
-        renameSync(displaced, current.absolutePath);
+        ensureUserDir(dirname(source));
+        renameSync(displaced, source);
         return true;
     }
     #installArtifact(intent, context, target, artifact) {
@@ -944,11 +1781,16 @@ export class EntityApplyHost {
         const displaced = this.#displacedPath(intent, context);
         const current = tryLstat(context.targetPath);
         if (current) {
-            rmSync(displaced, { recursive: true, force: true });
-            // A regular file keeps its displaced bytes through a hard link, so the
-            // reveal is one atomic rename and no reader ever sees the path absent.
-            // Other kinds (links, directories) cannot be linked and keep two renames.
-            if (current.isFile())
+            const held = tryLstat(displaced);
+            if (held) {
+                // A stopped replacement may already have linked its exact live file.
+                // Reuse that same backup without erasing either version. The immutable
+                // receipt and Verify still catch a save racing either attempt.
+                if (!current.isFile() || !held.isFile() || physicalKey(current) !== physicalKey(held)) {
+                    throw new Error("Apply replacement still owns a different displaced preimage");
+                }
+            }
+            else if (current.isFile())
                 linkSync(context.targetPath, displaced);
             else
                 renameSync(context.targetPath, displaced);
@@ -964,45 +1806,62 @@ export class EntityApplyHost {
         }
         fsyncDirectory(dirname(context.targetPath));
     }
-    #moveWithRecovery(intent, source, destination, context) {
+    #moveToVacantAddress(source, destination) {
         ensureUserDir(dirname(destination));
         if (tryLstat(destination)) {
-            const displaced = this.#displacedPath(intent, context);
-            rmSync(displaced, { recursive: true, force: true });
-            renameSync(destination, displaced);
+            throw new Error("Apply move destination is still occupied");
         }
         renameSync(source, destination);
     }
     #removeWithRecovery(intent, context) {
-        const source = context.current?.absolutePath ?? context.targetPath;
-        if (!tryLstat(source))
+        const source = context.current?.absolutePath;
+        if (!source || context.current?.status !== "active" || !tryLstat(source))
             return;
         const displaced = this.#displacedPath(intent, context);
-        rmSync(displaced, { recursive: true, force: true });
+        if (tryLstat(displaced))
+            throw new Error("Apply removal still owns a displaced preimage");
         ensurePrivateDir(dirname(displaced));
         renameSync(source, displaced);
     }
-    async #matches(intent, record, path, plan) {
+    async #matches(intent, record, path, plan, originalPath = path, remember) {
         const stats = tryLstat(path);
+        // A match is a claim, so its proof closes before it returns. A repository
+        // observation already closed at #observe with nothing awaited since; it
+        // joins the retained receipt without a second Git answer here.
+        const retain = async (actual, proof, closed) => {
+            await closeSource(proof);
+            remember?.({ stats: actual ? Object.freeze({ dev: actual.dev, ino: actual.ino, mode: actual.mode, nlink: actual.nlink,
+                    size: actual.size, mtimeNs: actual.mtimeNs, ctimeNs: actual.ctimeNs }) : null,
+                proof: closed ? sourceProofs([proof, closed]) : proof });
+            return true;
+        };
+        const witnesses = new PhysicalPathWitnesses();
+        witnesses.remember(path, stats);
+        const pathProof = witnessProof([witnesses.seal()]);
         if (record.status !== "active")
             return stats === null;
         if (!stats)
             return false;
-        if (record.type === "file.text" || record.type === "file.binary") {
-            return stats.isFile() && !stats.isSymbolicLink()
-                && record.payloadVersion !== null
-                && record.fileMode === portableFileMode(record.type, stats.mode)
-                && await this.#hashFile(path) === record.payloadVersion;
-        }
-        if (record.type === "link") {
-            return stats.isSymbolicLink()
-                && record.payloadVersion !== null
-                && sha256Hex(Buffer.from(readlinkSync(path), "utf8")) === record.payloadVersion;
+        if (["file.text", "file.binary", "link"].includes(record.type)) {
+            if (!record.payloadVersion)
+                return false;
+            const format = payloadFormat(record.payloadVersion);
+            if (format !== "sha1" && format !== "sha256")
+                return false;
+            const { observation, witness } = await observeLiteralPath(dirname(path), basename(path), format, "apply");
+            if (observation.kind !== "leaf" || observation.leaf.type !== record.type)
+                return false;
+            const leaf = observation.leaf;
+            const payload = leafPayload(record.payloadVersion, format, leaf);
+            return payload === record.payloadVersion && (record.type === "link"
+                || record.fileMode === portableFileMode(record.type, Number(leaf.stats.mode)))
+                && await retain(leaf.stats, witnessProof([witness]));
         }
         if (record.type === "reference") {
             if (!stats.isSymbolicLink() || !record.payloadVersion)
                 return false;
-            return readlinkSync(path) === relative(dirname(path), join(this.#bindingDir, record.payloadVersion));
+            return readlinkSync(path) === relative(dirname(originalPath), join(this.#bindingDir, record.payloadVersion))
+                && await retain(stats, pathProof);
         }
         if (record.type === "repo.git") {
             if (!stats.isDirectory() || !hasGitMarker(path)
@@ -1015,20 +1874,29 @@ export class EntityApplyHost {
             const file = join(this.#cacheDir, `${record.transportVersion}.bin`);
             if (!existsSync(file))
                 return false;
-            const layout = inspectRepositoryTransportFile(file);
+            const layout = await inspectRepositoryTransportFile(file);
+            if (repositoryPayloadVersion(layout, sha256Hex) !== record.payloadVersion) {
+                throw new Error("repository transport does not describe the complete accepted payload");
+            }
             const artifact = repositoryArtifact(plan);
             const identity = artifact && record.transportVersion === artifact.contentHash
                 ? (await this.#ensurePrepared(intent, plan)).repository?.identity
-                : readCachedRepositoryIdentity(this.#cacheDir, record.transportVersion);
+                : (await readCachedRepositoryIdentity(this.#cacheDir, record.transportVersion))?.entries;
             if (!identity)
                 throw new Error("repository Apply has no prepared transport identity");
             const prior = {
-                stateId: record.payloadVersion,
+                stateId: layout.stateId,
                 transportVersion: record.transportVersion,
                 card: layout.card,
                 identityHash: layout.identityHash,
             };
-            return repositoryObservationMatches(this.#observe(intent, path, identity), identity, prior);
+            // Only this Apply's own repository may hold accounted remainder.
+            const remainder = record.uuid === intent.entityId ? this.#allowance(intent, identity) : [];
+            if (!remainder)
+                return false;
+            const observed = await this.#observe(intent, path, identity, remainder);
+            return repositoryObservationMatches(observed, identity, prior)
+                && await retain(stats, pathProof, observed.proof);
         }
         if (!stats.isDirectory() || stats.isSymbolicLink())
             return false;
@@ -1037,16 +1905,17 @@ export class EntityApplyHost {
         // Containers do not ship or overwrite a child list. Their physical Apply
         // proof is only the accepted address/type/lifecycle result; independently
         // ordered child UUIDs establish membership as they materialize.
-        return true;
+        return retain(stats, pathProof);
     }
-    #verifiedRow(target, context) {
-        const prior = context.current ?? context.parent;
+    #verifiedRow(target, context, receipt, clock) {
+        const prior = target.status === "active" ? context.parent ?? context.current : context.current ?? context.parent;
         if (!prior)
             throw new Error(`entity ${target.uuid} has no local materialization boundary`);
-        const stats = tryLstat(context.targetPath);
+        const stats = receipt.stats;
         if (target.status === "active" && !stats)
-            throw new Error(`entity ${target.uuid} vanished before Verify`);
-        const evidence = stats ?? prior;
+            throw new Error(`entity ${target.uuid} has no retained Verify observation`);
+        const fingerprint = stats ? sourceFingerprint(stats) : { physicalKey: prior.physicalKey,
+            sourceSignature: prior.sourceSignature, filesystemMode: prior.filesystemMode };
         return {
             resourceId: prior.resourceId,
             rootUUID: prior.rootUUID,
@@ -1055,103 +1924,166 @@ export class EntityApplyHost {
                 ? prior.relativePath
                 : [context.parent?.relativePath, context.targetName].filter(Boolean).join("/"),
             absolutePath: context.targetPath,
-            deviceNumber: "dev" in evidence ? evidence.dev : evidence.deviceNumber,
-            inode: "ino" in evidence ? evidence.ino : evidence.inode,
-            byteSize: "size" in evidence ? evidence.size : evidence.byteSize,
-            modifiedTimeMs: "mtimeMs" in evidence ? evidence.mtimeMs : evidence.modifiedTimeMs,
-            changedTimeMs: "ctimeMs" in evidence ? evidence.ctimeMs : evidence.changedTimeMs,
-            filesystemMode: "mode" in evidence ? evidence.mode : evidence.filesystemMode,
-            contentVerifiedAtMs: ["file.text", "file.binary", "link", "reference"]
-                .includes(target.type) ? Date.now() : null,
+            ...fingerprint,
+            contentVerifiedNs: stats && ["file.text", "file.binary", "link", "reference"]
+                .includes(target.type) ? leafBoundary(clock, stats) : null,
         };
     }
-    async #repositoryRows(intent, plan, context) {
-        if (plan.target.type !== "repo.git") {
-            throw new Error("repository Verify received a non-repository target");
+    /** Address changes preserve each inventory's own portable values. Verifying
+     * a container does not admit the contents of independent descendants. */
+    #rebaseRows(rows, prior, target) {
+        return rows.filter(row => row.uuid !== prior.uuid).map(row => ({
+            ...row, record: portable(row), rootUUID: target.rootUUID, resourceId: target.resourceId,
+            relativePath: target.relativePath + row.relativePath.slice(prior.relativePath.length),
+            absolutePath: target.absolutePath + row.absolutePath.slice(prior.absolutePath.length),
+        }));
+    }
+    #containerGround(target, context, root) {
+        const ground = {
+            observed: [root], shared: [root], removedObserved: [], removedShared: [],
+        };
+        for (const [inventory, output] of [["entities", "observed"], ["detection_notebook", "shared"]]) {
+            const prior = inventory === "entities" ? context.current : this.#rowByUuid.get(target.uuid);
+            if (!prior)
+                continue;
+            if (target.status !== "active") {
+                if (inventory === "entities") {
+                    for (const row of groundStore(this.#database).rowsUnder(inventory, prior.rootUUID, prior.relativePath)) {
+                        ground.removedObserved.push(row.uuid);
+                    }
+                }
+            }
+            else if (prior.absolutePath !== root.absolutePath
+                && (prior.type === "folder" || prior.type === "workspace" || prior.type === "repo.git")) {
+                const rebased = this.#rebaseRows(groundStore(this.#database)
+                    .rowsUnder(inventory, prior.rootUUID, prior.relativePath), prior, root);
+                for (const row of rebased)
+                    ground[output].push(row);
+            }
         }
-        const prepared = await this.#ensurePrepared(intent, plan);
-        const repository = prepared.repository;
+        return ground;
+    }
+    async #repositoryRows(intent, plan, context, receipt, clock) {
+        if (plan.target.type !== "repo.git")
+            throw new Error("repository Verify received a non-repository target");
+        const repository = (await this.#ensurePrepared(intent, plan)).repository;
         if (!repository)
             throw new Error("repository Verify has no transport identity");
-        const root = this.#verifiedRow(plan.target, context);
-        const existing = this.#rowsUnderRoot.all(root.rootUUID);
-        const repositoryPrefix = root.relativePath;
-        const identityByPath = new Map(repository.identity.map((entry) => [entry.path, entry]));
-        const nestedRepositoryPaths = repository.identity
-            .filter((entry) => entry.type === "repo.git")
-            .map((entry) => entry.path);
-        const localRepositoryPath = (row) => {
-            if (row.uuid === plan.target.uuid)
-                return "";
-            if (!repositoryPrefix)
-                return row.relativePath;
-            return row.relativePath.startsWith(`${repositoryPrefix}/`)
-                ? row.relativePath.slice(repositoryPrefix.length + 1)
-                : null;
+        if (this.#repositoryBoundaries(context, repository.identity).length > 0) {
+            throw new Error("repository projection cannot retire independently owned repository identities");
+        }
+        const allowance = this.#allowance(intent, repository.identity);
+        if (!allowance)
+            throw new Error("repository Verify has no accounted remainder");
+        const proof = await this.#observe(intent, context.targetPath, repository.identity, allowance);
+        if (!proof.identityMatches || proof.identityHash !== repositoryIdentityHash(repository.identity, sha256Hex)) {
+            throw new Error("repository Verify physical members differ from accepted identity");
+        }
+        const root = this.#verifiedRow(plan.target, context, receipt, clock);
+        // The O row Verify writes keeps the Git configuration stamp that routes
+        // this repository's own Git notices to it alone.
+        const pair = proof.pair(plan.target.uuid, context.targetPath);
+        if (pair.physicalKey !== root.physicalKey || pair.filesystemMode !== root.filesystemMode) {
+            throw new Error("repository Verify observed a different directory than its receipt");
+        }
+        const authorized = new Set([plan.target.uuid, ...repository.identity.map(row => row.uuid)]);
+        // O is the complete observation: remainder still present keeps its
+        // identity and fresh evidence; remainder now absent leaves O.
+        const kept = new Map(proof.remainder.map(observed => [observed.entry.uuid, observed]));
+        const previousRoot = this.#current(plan.target.uuid);
+        const keptRows = [...kept.values()].map(({ entry, stats }) => {
+            const row = this.#current(entry.uuid);
+            if (!row || !previousRoot)
+                throw new Error("repository remainder lost its observed row");
+            const [placed] = this.#rebaseRows([row], previousRoot, root);
+            // The observation already proved the remainder kept its recorded type.
+            const type = placed.record.type;
+            const fields = { ...placed.record, payloadVersion: type === "folder" ? null : entry.payloadVersion ?? null,
+                fileMode: portableFileMode(type, Number(stats.mode)) };
+            return { ...placed, record: { ...fields, version: canonicalVersion(fields, sha256Hex) }, ...sourceFingerprint(stats),
+                contentVerifiedNs: type === "folder" ? placed.contentVerifiedNs : leafBoundary(clock, stats) };
+        });
+        const observedRoot = (record) => {
+            if (proof.observedPayload === record.payloadVersion)
+                return record;
+            const fields = { ...record, payloadVersion: proof.observedPayload, transportVersion: null };
+            return { ...fields, version: canonicalVersion(fields, sha256Hex) };
         };
-        const removals = existing.filter((row) => {
-            const path = localRepositoryPath(row);
-            if (path === null || path === "")
-                return false;
-            if (nestedRepositoryPaths.some((nested) => path.startsWith(`${nested}/`)))
-                return false;
-            return identityByPath.get(path)?.uuid !== row.uuid;
-        }).map((row) => row.uuid);
-        const removed = new Set(removals);
-        const base = existing.filter((row) => !removed.has(row.uuid)).map((row) => ({
-            record: row.uuid === plan.target.uuid ? plan.target : portable(row),
-            relativePath: row.uuid === plan.target.uuid ? root.relativePath : row.relativePath,
-            absolutePath: row.uuid === plan.target.uuid ? root.absolutePath : row.absolutePath,
-            deviceNumber: row.uuid === plan.target.uuid ? root.deviceNumber : row.deviceNumber,
-            inode: row.uuid === plan.target.uuid ? root.inode : row.inode,
-            byteSize: row.uuid === plan.target.uuid ? root.byteSize ?? 0 : row.byteSize ?? 0,
-            modifiedTimeMs: row.uuid === plan.target.uuid ? root.modifiedTimeMs ?? 0 : row.modifiedTimeMs ?? 0,
-            changedTimeMs: row.uuid === plan.target.uuid ? root.changedTimeMs ?? 0 : row.changedTimeMs ?? 0,
-            filesystemMode: row.uuid === plan.target.uuid ? root.filesystemMode ?? 0 : row.filesystemMode ?? 0,
-            contentVerifiedAtMs: row.uuid === plan.target.uuid
-                ? root.contentVerifiedAtMs : row.contentVerifiedAtMs,
-        }));
-        if (!base.some((row) => row.record.uuid === plan.target.uuid))
-            base.push({
-                record: root.record,
-                relativePath: root.relativePath,
-                absolutePath: root.absolutePath,
-                deviceNumber: root.deviceNumber,
-                inode: root.inode,
-                byteSize: root.byteSize ?? 0,
-                modifiedTimeMs: root.modifiedTimeMs ?? 0,
-                changedTimeMs: root.changedTimeMs ?? 0,
-                filesystemMode: root.filesystemMode ?? 0,
-                contentVerifiedAtMs: root.contentVerifiedAtMs,
-            });
-        const rows = projectMaterializedGraph(base, [{
-                record: plan.target,
-                identity: repository.identity,
-            }], sha256Hex, { existingRows: "prior-materialization" }).map((row) => ({
-            resourceId: root.resourceId,
-            rootUUID: root.rootUUID,
-            ...row,
-        }));
-        const projectedIdentity = indexRepositoryTerritory(rows.map((row) => ({
-            ...row,
-            uuid: row.record.uuid,
-            type: row.record.type,
-            parentUUID: row.record.parentUUID,
-        }))).ownedBy(plan.target.uuid)
-            .map((row) => ({
-            path: root.relativePath
-                ? row.relativePath.slice(root.relativePath.length + 1)
-                : row.relativePath,
-            uuid: row.record.uuid,
-            type: row.record.type,
+        const nested = repository.identity.filter(entry => entry.type === "repo.git");
+        const atPath = new Map([["", root.record.uuid], ...repository.identity.map(entry => [entry.path, entry.uuid])]);
+        const materialized = (row) => ({ ...row, filesystemMode: row.filesystemMode ?? 0 });
+        const inventory = (table) => {
+            const get = (uuid) => (table === "entities" ? this.#entityByUuid : this.#rowByUuid).get(uuid);
+            const previous = get(root.record.uuid);
+            const existing = previous ? groundStore(this.#database).rowsUnder(table, previous.rootUUID, previous.relativePath) : [];
+            const absent = indexRepositoryTerritory(existing).ownedBy(root.record.uuid)
+                .filter(row => !authorized.has(row.uuid) && !(table === "entities" && kept.has(row.uuid)));
+            // A complete repository result retires ordinary member placement. It
+            // cannot erase a nested repository's independently accepted history or
+            // any recoverable member history from the sharing inventory.
+            const removed = table === "entities" ? absent.map(row => row.uuid) : [];
+            const trashed = table === "detection_notebook" ? trashRemovedEntities(existing.map(portable), new Set(absent.filter(row => row.type !== "repo.git").map(row => row.uuid)), sha256Hex) : new Map();
+            const retained = table === "detection_notebook" ? absent.map(row => ({
+                ...row, record: trashed.get(row.uuid) ?? portable(row),
+            })) : [];
+            // Only the repository and its independent boundary spine are context.
+            // Unrelated workspace rows never enter this verification output.
+            const base = [materialized(root)];
+            const descendants = [];
+            for (const entry of nested) {
+                const prior = get(entry.uuid);
+                if (!prior || prior.type !== "repo.git")
+                    throw new Error(`repository boundary ${entry.uuid} has no ${table} state`);
+                const parentPath = dirname(entry.path) === "." ? "" : dirname(entry.path).split(sep).join("/");
+                const parentUUID = atPath.get(parentPath);
+                if (!parentUUID)
+                    throw new Error("repository boundary has no accepted parent");
+                const fields = { ...portable(prior), parentUUID, name: basename(entry.path) };
+                const record = { ...fields, version: canonicalVersion(fields, sha256Hex) };
+                const boundary = { ...prior, record, rootUUID: root.rootUUID, resourceId: root.resourceId,
+                    relativePath: [root.relativePath, entry.path].filter(Boolean).join("/"),
+                    absolutePath: join(root.absolutePath, ...entry.path.split("/")),
+                };
+                base.push(materialized(boundary));
+                const rebased = this.#rebaseRows(groundStore(this.#database)
+                    .rowsUnder(table, prior.rootUUID, prior.relativePath), prior, boundary);
+                for (const row of rebased)
+                    descendants.push(row);
+            }
+            const rows = projectMaterializedGraph(base, [{ record: plan.target, identity: repository.identity }], sha256Hex, { existingRows: "prior-materialization", contentBoundary: clock }).map(row => ({ ...row,
+                resourceId: root.resourceId, rootUUID: root.rootUUID,
+                ...(table === "entities" && row.record.uuid === root.record.uuid ? { record: observedRoot(row.record),
+                    gitConfigurationObservation: pair.gitConfigurationObservation, repositoryObservation: pair } : {}),
+            }));
+            return { rows: [...rows, ...descendants, ...retained, ...(table === "entities" ? keptRows : [])], removed };
+        };
+        const observed = inventory("entities"), shared = inventory("detection_notebook");
+        const projectedIdentity = indexRepositoryTerritory(observed.rows.filter(row => !kept.has(row.record.uuid)).map(row => ({ ...row,
+            uuid: row.record.uuid, type: row.record.type, parentUUID: row.record.parentUUID,
+        }))).ownedBy(plan.target.uuid).map(row => ({
+            path: root.relativePath ? row.relativePath.slice(root.relativePath.length + 1) : row.relativePath,
+            uuid: row.record.uuid, type: row.record.type,
             payloadVersion: row.record.type === "repo.git" ? null : row.record.payloadVersion,
-        }))
-            .sort((left, right) => left.path.localeCompare(right.path));
-        if (repositoryIdentityHash(projectedIdentity, sha256Hex)
-            !== repositoryIdentityHash(repository.identity, sha256Hex)) {
+        })).sort((left, right) => left.path.localeCompare(right.path));
+        if (repositoryIdentityHash(projectedIdentity, sha256Hex) !== repositoryIdentityHash(repository.identity, sha256Hex)) {
             throw new Error("repository Apply projection does not reproduce its transport identity map");
         }
-        return { rows, removals };
+        // #observe closed this observation; only local rows were read since.
+        closePhysically(proof.proof);
+        return { observed: observed.rows, shared: shared.rows,
+            removedObserved: observed.removed, removedShared: shared.removed };
+    }
+    #repositoryBoundaries(context, identity) {
+        const root = context.current ?? context.parent;
+        if (!root)
+            return [];
+        const repositoryPath = context.current?.relativePath;
+        if (repositoryPath === undefined)
+            return [];
+        const rows = this.#repositoriesUnderRoot.all(root.rootUUID);
+        const prefix = repositoryPath ? `${repositoryPath}/` : "";
+        return repositoryBoundaryDependencies(rows.filter((row) => row.uuid !== root.uuid && row.type === "repo.git" && row.status === "active"
+            && row.relativePath.startsWith(prefix)).map((row) => ({ uuid: row.uuid, path: row.relativePath.slice(prefix.length) })), identity);
     }
     async #repositoryChain(artifact) {
         const reversed = [];
@@ -1165,42 +2097,47 @@ export class EntityApplyHost {
             if (local.contentHash !== version)
                 throw new Error("repository Apply cache returned wrong transport");
             reversed.push({ file: local.file, transportVersion: version });
-            version = inspectRepositoryTransportFile(local.file).parentTransportVersion;
+            version = (await inspectRepositoryTransportFile(local.file)).parentTransportVersion;
         }
         const chain = reversed.reverse();
         let identity = null;
         for (const sealed of chain) {
-            identity = applyRepositoryIdentity(identity, inspectRepositoryTransportFile(sealed.file), sha256Hex);
+            identity = applyRepositoryIdentity(identity, await inspectRepositoryTransportFile(sealed.file), sha256Hex);
         }
         const result = identity ?? [];
         const latestFile = chain.at(-1)?.file;
         if (!latestFile)
             throw new Error("repository Apply transport chain is empty");
-        const latest = inspectRepositoryTransportFile(latestFile);
-        sealCachedRepositoryIdentity(this.#cacheDir, artifact.contentHash, result, latest.identityHash);
+        const latest = await inspectRepositoryTransportFile(latestFile);
+        await sealCachedRepositoryIdentity(this.#cacheDir, artifact.contentHash, { entries: result, identityHash: latest.identityHash }, latest.identityHash);
         return { chain, identity: result };
     }
-    #context(target) {
+    /** The rows that place the target: its own and its parent's. A child waits
+     * for its parent; a root is placed by its machine binding. */
+    #anchors(target) {
         const current = this.#current(target.uuid);
         const parent = target.parentUUID ? this.#current(target.parentUUID) : null;
         if (target.parentUUID !== null && !parent) {
             throw new Error(`entity ${target.uuid} waits for materialized parent ${target.parentUUID}`);
         }
+        if (!parent && !current)
+            throw new Error(`root entity ${target.uuid} has no machine binding`);
+        return { current, parent };
+    }
+    #context(target, intent) {
+        const { current, parent } = this.#anchors(target);
         if (!parent) {
-            const targetPath = current?.absolutePath;
-            if (!targetPath)
-                throw new Error(`root entity ${target.uuid} has no machine binding`);
             return {
                 current,
                 parent,
-                targetPath,
+                targetPath: current.absolutePath,
                 targetName: target.name,
                 beforeRelocations: [],
                 afterRelocations: [],
-                currentShared: false,
                 collisionEligible: false,
             };
         }
+        const recovery = intent ? this.#boundRecovery(intent) : null;
         const finalByParent = new Map();
         const affectedParents = new Map();
         affectedParents.set(parent.uuid, parent);
@@ -1242,6 +2179,7 @@ export class EntityApplyHost {
             const parentRow = affectedParents.get(parentUUID);
             if (!parentRow)
                 continue;
+            const sources = this.#physicalSources(parentUUID);
             for (const row of siblings) {
                 if (row.uuid === target.uuid)
                     continue;
@@ -1250,18 +2188,23 @@ export class EntityApplyHost {
                     && row.name === target.name)
                     continue;
                 const destination = join(parentRow.absolutePath, derivedByUuid.get(row.uuid) ?? row.name);
-                const source = destination === row.absolutePath && !tryLstat(destination)
-                    ? this.#physicalSiblingPath(parentRow.absolutePath, row)
-                    : row.absolutePath;
+                let source = sources.get(row.uuid) ?? null;
+                if (source === null)
+                    continue;
+                // A sibling recorded at its destination is already there, unless this
+                // attempt's recovery moved it away and the move's source still holds it.
+                const move = source === destination ? recovery?.moves.find(move => move.uuid === row.uuid) : undefined;
+                if (move && !tryLstat(destination)) {
+                    const original = tryLstat(move.source.path);
+                    source = original && physicalKey(original) === applyPreimageRoot(move.source).physical ? move.source.path : null;
+                }
                 if (source === null || source === destination)
                     continue;
                 const relocation = { row, source, destination };
-                const leavesOldSlot = current !== null
+                const leavesOldSlot = target.status !== "active" || (current !== null
                     && row.parentUUID === current.parentUUID
                     && row.name === current.name
-                    && (target.status !== "active"
-                        || target.parentUUID !== current.parentUUID
-                        || target.name !== current.name);
+                    && (target.parentUUID !== current.parentUUID || target.name !== current.name));
                 (leavesOldSlot ? afterRelocations : beforeRelocations).push(relocation);
             }
         }
@@ -1272,9 +2215,6 @@ export class EntityApplyHost {
             targetName,
             beforeRelocations,
             afterRelocations,
-            currentShared: current !== null
-                && [...finalByParent.values()].flat()
-                    .some((row) => row.uuid !== current.uuid && row.absolutePath === current.absolutePath),
             // A new identity can arrive concurrently in an already-held portable
             // slot. An existing identity renaming or moving into another identity's
             // slot is not concurrency; mutation-time law forbids it and Apply keeps
@@ -1282,33 +2222,39 @@ export class EntityApplyHost {
             collisionEligible,
         };
     }
-    /** Active children across accepted and Detect truth; the notebook row wins
-     * for a UUID exactly as #current does. */
+    /** B determines admitted portable slots. O alone supplies any physical
+     * source; a retained B address cannot claim a new occupant at that path. */
     #activeSiblings(parentUUID) {
-        const rows = new Map();
-        for (const row of this.#entitiesByParent.all(parentUUID)) {
-            rows.set(row.uuid, row);
-        }
-        for (const row of this.#rowsByParent.all(parentUUID)) {
-            rows.set(row.uuid, row);
-        }
-        return [...rows.values()].filter((row) => row.status === "active");
-    }
-    /** Rows are committed before a derived-address rename. After a crash, the
-     * row therefore names the destination while the same inode can still stand
-     * at the old sibling address. Recover that source without guessing by name. */
-    #physicalSiblingPath(parent, row) {
-        const matches = readdirSync(parent, { withFileTypes: true }).flatMap((entry) => {
-            const path = join(parent, entry.name);
-            const stats = tryLstat(path);
-            return stats && stats.dev === row.deviceNumber && stats.ino === row.inode ? [path] : [];
-        });
-        return matches.length === 1 ? matches[0] : null;
+        return this.#rowsByParent.all(parentUUID)
+            .filter(row => row.status === "active");
+    }
+    /** Where O holds each of those slots' identities, in one read. */
+    #physicalSources(parentUUID) {
+        return new Map(this.#physicalByParent.all(parentUUID)
+            .map(({ uuid, absolutePath }) => [uuid, absolutePath]));
     }
     #current(entityId) {
-        return this.#rowByUuid.get(entityId)
-            ?? this.#entityByUuid.get(entityId)
-            ?? null;
+        const row = this.#entityByUuid.get(entityId);
+        return row?.status === "active" ? row : null;
+    }
+    /** Entity Apply cannot reconstruct a missing workspace one child at a time. */
+    #unavailableRoot(target) {
+        const anchors = [this.#current(target.uuid), target.parentUUID ? this.#current(target.parentUUID) : null];
+        const checked = new Set();
+        for (const anchor of anchors) {
+            if (!anchor)
+                continue;
+            const root = this.#root(anchor);
+            if (checked.has(root.uuid))
+                continue;
+            checked.add(root.uuid);
+            const ground = tryLstat(root.absolutePath);
+            if (ground && physicalKey(ground) === root.physicalKey)
+                continue;
+            return { kind: "dependency", reason: `Materialized root ${root.uuid} is missing or replaced; explicit root repair is required.`,
+                waitFor: { producer: "capability", entityIds: [root.uuid] } };
+        }
+        return null;
     }
     #root(current) {
         const root = this.#current(current.rootUUID);
@@ -1317,31 +2263,50 @@ export class EntityApplyHost {
         return root;
     }
     #controlDirectory(intent, context) {
+        const existing = this.store.recoveryLocation(intent);
+        if (existing !== null)
+            return existing;
         const anchor = context.current ?? context.parent;
         if (!anchor)
             throw new Error(`entity ${intent.entityId} has no Apply control root`);
-        return join(this.#root(anchor).absolutePath, ".amalgm", "apply", `${intent.entityId}-${intent.throughSequence}`);
+        return applyControlDirectory(this.#root(anchor).absolutePath, intent);
     }
     #displacedPath(intent, context) {
         return join(this.#controlDirectory(intent, context), "displaced");
     }
-    /** Read one repository moment for this intent, or return the moment it
-     * already holds for the same address and nested-repository boundary. A
-     * supplied observation (the reveal proof) replaces whatever was held. */
-    #observe(intent, path, identity, proof) {
+    /** Each decision reads a repository once and judges every record it
+     * compares from that one closed reading. */
+    async #observe(intent, path, identity, remainder) {
         const key = this.#key(intent);
         const held = this.#observations.get(key) ?? new Map();
         this.#observations.set(key, held);
-        const address = [path, ...nestedRepositoryPaths(identity)].join("\0");
-        const observation = proof ?? held.get(address) ?? observeRepository(path, identity);
-        held.set(address, observation);
-        return observation;
+        const boundaries = nestedRepositoryPaths(identity);
+        const address = readingAddress(path, boundaries);
+        let reading = held.get(address);
+        if (!reading) {
+            reading = await readRepository(path, boundaries, "apply");
+            held.set(address, reading);
+        }
+        return judgeRepository(reading, identity, remainder);
     }
-    #key(intent) {
-        return `${intent.entityId}:${intent.throughSequence}`;
+    /** A decision trusts an inherited reading only after closing it once more.
+     * One that no longer closes has passed; the decision reads anew. */
+    async #closeInherited(intent) {
+        const held = this.#observations.get(this.#key(intent));
+        for (const [address, reading] of held ?? []) {
+            try {
+                await closeSource(reading.proof);
+            }
+            catch (error) {
+                if (!(error instanceof CaptureSourceChangedError))
+                    throw error;
+                held.delete(address);
+            }
+        }
     }
-    async #hashFile(file) {
-        return hashContentFile(file);
+    #key(intent) {
+        return JSON.stringify([intent.attemptId, intent.authorityId, intent.entityId, intent.fromSequence,
+            intent.throughSequence, intent.targetMutationId, intent.targetState, intent.targetType, intent.createdAt]);
     }
 }
 //# sourceMappingURL=entity-apply-host.js.map