@amalgm/shell 0.1.164-preview.36072132286 → 0.1.164-preview.36809057014

package/dist/entity-apply-store.js

@@ -1,115 +1,61 @@
-/** Persistent SQLite effects for Live's Inbox -> Apply -> Verify rail. */
-import { createHash } from "node:crypto";
-import { assertApplyIntent, assertRecord, canonicalVersion, decodeAcceptedEntityRecord, membershipHash, portableFileMode, sameRecords, } from "@amalgm/live";
-import { ensureSnapshotDeliveryBaselineTable } from "./snapshot-delivery-baseline.js";
-const sha256Hex = (input) => createHash("sha256").update(input).digest("hex");
-const GROUND_COLUMNS = [
-    "uuid", "resource_id", "root_uuid", "type", "parent_uuid", "name", "status", "version",
-    "payload_version", "transport_version", "relative_path", "absolute_path", "device_number",
-    "inode", "byte_size", "modified_time_ms", "changed_time_ms", "filesystem_mode",
-    "content_verified_at_ms",
-].join(", ");
-const rowValues = (row) => [
-    row.record.uuid,
-    row.resourceId,
-    row.rootUUID,
-    row.record.type,
-    row.record.parentUUID,
-    row.record.name,
-    row.record.status,
-    row.record.version,
-    row.record.payloadVersion,
-    row.record.transportVersion,
-    row.relativePath,
-    row.absolutePath,
-    row.deviceNumber,
-    row.inode,
-    row.byteSize,
-    row.modifiedTimeMs,
-    row.changedTimeMs,
-    row.filesystemMode,
-    row.contentVerifiedAtMs,
-];
-const sameIntent = (left, right) => left.authorityId === right.authorityId
-    && left.entityId === right.entityId
-    && left.fromSequence === right.fromSequence
-    && left.throughSequence === right.throughSequence
-    && left.targetMutationId === right.targetMutationId
-    && left.targetState === right.targetState
-    && left.targetType === right.targetType;
+/** Persistent SQLite effects for Live's Inbox -> Apply -> Verify rail. Reads
+ * run on this connection; every write is a save on the ground file's saver
+ * thread (apply-saves.ts). */
+import { randomUUID } from "node:crypto";
+import { assertRecord, decodeAcceptedEntityRecord, isConstructType, } from "@amalgm/live";
+import { applyResolution, hasLocalWorkAfter, ownedCleanup, ownPublication, readIntent, readRetirement, recoveryLocation, requireIntent, sameIntent, snapshotHistory, } from "./apply-rows.js";
+import { save } from "./ground-saver.js";
+import { closePhysically, sourceProofs, witnessProof } from "./source-proof.js";
+import { cachedStatement } from "./sqlite.js";
+import { turnBoundary } from "./turns.js";
 /**
  * Apply has one persistent database owner. Verify hands this owner the exact
- * rows it just proved; completion writes those rows, cursors, Inbox resolution,
- * and intent removal in one SQLite transaction.
+ * rows it just proved; completion writes those rows, cursors, Inbox resolution
+ * and the terminal disposition in one save.
  */
 export class EntityApplySqliteStore {
     #database;
+    #file;
     #now;
     #onIntentFinished;
+    #onAttemptFailed;
+    #onOwnPublicationResolved;
     #isLocallyEligible;
+    #holdsOwnPlacement;
     #verified = new Map();
-    #candidateEntities;
-    #state;
-    #inboxAfter;
-    #intent;
-    #intentByEntity;
-    #authorityForEntity;
-    #targetRecord;
-    #localRelevance;
-    #localWork;
-    #insertIntent;
-    #updateIntent;
-    #deleteIntent;
-    #resolveInbox;
-    #upsertState;
-    #upsertEntity;
-    #upsertNotebook;
-    #deleteEntity;
-    #deleteNotebook;
-    #entitySlot;
-    #notebookAtUuid;
-    #notebookChildren;
-    #updateEntityVersion;
-    #updateNotebookVersion;
-    #materializedMatches;
-    #resolveMaterializedHistory;
-    #baselineRows;
-    #baselineIntents;
-    #snapshotBaseline;
+    #cleanupProof = new Map();
     constructor(database, options = {}) {
         this.#database = database;
+        this.#file = database.name;
         this.#now = options.now ?? Date.now;
         this.#onIntentFinished = options.onIntentFinished ?? (() => undefined);
+        this.#onAttemptFailed = options.onAttemptFailed ?? (() => undefined);
+        this.#onOwnPublicationResolved = options.onOwnPublicationResolved ?? (() => undefined);
         this.#isLocallyEligible = options.isLocallyEligible ?? (() => true);
-        database.pragma("busy_timeout = 5000");
-        database.pragma("journal_mode = WAL");
-        database.pragma("synchronous = FULL");
-        ensureSnapshotDeliveryBaselineTable(database);
-        database.exec(`
-      CREATE TABLE IF NOT EXISTS entity_apply_state (
-        entity_id TEXT PRIMARY KEY,
-        authority_id TEXT NOT NULL,
-        resolved_through INTEGER NOT NULL CHECK(resolved_through >= 0),
-        materialized_sequence INTEGER,
-        materialized_record_json TEXT,
-        CHECK((materialized_sequence IS NULL AND materialized_record_json IS NULL)
-           OR (materialized_sequence > 0 AND materialized_record_json IS NOT NULL))
-      );
-      CREATE TABLE IF NOT EXISTS entity_apply_intents (
-        entity_id TEXT PRIMARY KEY,
-        authority_id TEXT NOT NULL,
-        intent_json TEXT NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS record_inbox_apply
-        ON record_inbox(authority_id, entity_id, global_sequence);
-      CREATE INDEX IF NOT EXISTS record_inbox_entity_apply
-        ON record_inbox(entity_id, global_sequence DESC);
-    `);
-        const inboxColumns = new Set(database.prepare("PRAGMA table_info(record_inbox)").all().map(({ name }) => name));
-        if (!inboxColumns.has("resolved_at")) {
-            database.exec("ALTER TABLE record_inbox ADD COLUMN resolved_at INTEGER");
+        this.#holdsOwnPlacement = options.holdsOwnPlacement ?? (() => false);
+    }
+    /** Only an explicitly installed snapshot watermark resolves startup history.
+     * Sharing-baseline equality is never evidence of current disk contents.
+     * Any existing physical recovery obligation must survive this adoption. */
+    async adoptSnapshotHistory(mayRetire = () => false) {
+        const history = snapshotHistory(this.#database);
+        const candidates = new Map();
+        for (const intent of [...history.intents,
+            ...history.rows.flatMap(row => readIntent(this.#database, row.entityId) ?? [])]) {
+            if (!readRetirement(this.#database, intent))
+                candidates.set(intent.entityId, intent);
+        }
+        const retirable = [...candidates.values()].filter(intent => mayRetire(intent));
+        const { value } = await save(this.#file, "apply.adoptSnapshotHistory", { retirable });
+        for (const intent of value.supersededIntents) {
+            const staged = this.#verified.get(intent.entityId);
+            if (staged && sameIntent(staged.intent, intent))
+                this.#verified.delete(intent.entityId);
         }
-        this.#candidateEntities = database.prepare(`
+        return value;
+    }
+    readApplyWork(limit, afterCursor) {
+        const all = cachedStatement(this.#database, `
       SELECT entity_id AS entityId FROM entity_apply_intents
       UNION
       SELECT inbox.entity_id AS entityId
@@ -117,255 +63,7 @@ export class EntityApplySqliteStore {
         LEFT JOIN entity_apply_state state ON state.entity_id = inbox.entity_id
        WHERE inbox.global_sequence > COALESCE(state.resolved_through, 0)
       ORDER BY entityId
-    `);
-        this.#state = database.prepare(`
-      SELECT resolved_through AS resolvedThrough,
-             materialized_sequence AS materializedSequence,
-             materialized_record_json AS materializedRecordJson
-        FROM entity_apply_state WHERE authority_id = ? AND entity_id = ?
-    `);
-        this.#inboxAfter = database.prepare(`
-      SELECT record_json AS recordJson, delivery_sequence AS deliverySequence
-        FROM record_inbox
-       WHERE authority_id = ? AND entity_id = ? AND global_sequence > ?
-       ORDER BY global_sequence
-    `);
-        this.#snapshotBaseline = database.prepare(`
-      SELECT delivery_sequence AS deliverySequence
-        FROM authority_snapshot_baselines WHERE authority_id = ?
-    `);
-        this.#intent = database.prepare(`
-      SELECT intent_json AS intentJson FROM entity_apply_intents
-       WHERE authority_id = ? AND entity_id = ?
-    `);
-        this.#intentByEntity = database.prepare(`
-      SELECT intent_json AS intentJson FROM entity_apply_intents WHERE entity_id = ?
-    `);
-        this.#authorityForEntity = database.prepare(`
-      SELECT authority_id AS authorityId FROM record_inbox
-       WHERE entity_id = ? ORDER BY global_sequence DESC LIMIT 1
-    `);
-        this.#targetRecord = database.prepare(`
-      SELECT record_json AS recordJson FROM record_inbox
-       WHERE authority_id = ? AND entity_id = ? AND global_sequence = ?
-    `);
-        this.#localRelevance = database.prepare(`
-      SELECT 1 AS present FROM entities WHERE uuid = ?
-      UNION ALL
-      SELECT 1 AS present FROM detection_notebook WHERE uuid = ?
-      LIMIT 1
-    `);
-        this.#localWork = database.prepare(`
-      SELECT 1 AS present FROM record_outbox
-       WHERE authority_id = ? AND entity_id = ?
-         AND (status = 'pending' OR global_sequence > ?)
-       LIMIT 1
-    `);
-        this.#insertIntent = database.prepare(`
-      INSERT INTO entity_apply_intents(entity_id, authority_id, intent_json)
-      VALUES (?, ?, ?)
-    `);
-        this.#updateIntent = database.prepare(`
-      UPDATE entity_apply_intents SET intent_json = ?
-       WHERE authority_id = ? AND entity_id = ?
-    `);
-        this.#deleteIntent = database.prepare(`
-      DELETE FROM entity_apply_intents WHERE authority_id = ? AND entity_id = ?
-    `);
-        this.#resolveInbox = database.prepare(`
-      UPDATE record_inbox SET resolved_at = ?
-       WHERE authority_id = ? AND entity_id = ?
-         AND global_sequence > ? AND global_sequence <= ?
-    `);
-        this.#upsertState = database.prepare(`
-      INSERT INTO entity_apply_state(
-        entity_id, authority_id, resolved_through,
-        materialized_sequence, materialized_record_json
-      ) VALUES (?, ?, ?, ?, ?)
-      ON CONFLICT(entity_id) DO UPDATE SET
-        authority_id = excluded.authority_id,
-        resolved_through = excluded.resolved_through,
-        materialized_sequence = excluded.materialized_sequence,
-        materialized_record_json = excluded.materialized_record_json
-    `);
-        const upsert = (table) => database.prepare(`
-      INSERT INTO ${table}(${GROUND_COLUMNS})
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(uuid) DO UPDATE SET
-        resource_id = excluded.resource_id,
-        root_uuid = excluded.root_uuid,
-        type = excluded.type,
-        parent_uuid = excluded.parent_uuid,
-        name = excluded.name,
-        status = excluded.status,
-        version = excluded.version,
-        payload_version = excluded.payload_version,
-        transport_version = excluded.transport_version,
-        relative_path = excluded.relative_path,
-        absolute_path = excluded.absolute_path,
-        device_number = excluded.device_number,
-        inode = excluded.inode,
-        byte_size = excluded.byte_size,
-        modified_time_ms = excluded.modified_time_ms,
-        changed_time_ms = excluded.changed_time_ms,
-        filesystem_mode = excluded.filesystem_mode,
-        content_verified_at_ms = excluded.content_verified_at_ms
-    `);
-        this.#upsertEntity = upsert("entities");
-        this.#upsertNotebook = upsert("detection_notebook");
-        this.#deleteEntity = database.prepare("DELETE FROM entities WHERE uuid = ?");
-        this.#deleteNotebook = database.prepare("DELETE FROM detection_notebook WHERE uuid = ?");
-        this.#entitySlot = database.prepare(`
-      SELECT uuid, type, payload_version AS payloadVersion,
-             absolute_path AS absolutePath FROM entities
-       WHERE resource_id = ? AND root_uuid = ? AND relative_path = ?
-    `);
-        this.#notebookAtUuid = database.prepare(`
-      SELECT uuid, type, parent_uuid AS parentUUID, name, status
-        FROM detection_notebook WHERE uuid = ?
-    `);
-        this.#notebookChildren = database.prepare(`
-      SELECT uuid, name FROM detection_notebook
-       WHERE parent_uuid = ? AND status = 'active' ORDER BY name, uuid
-    `);
-        this.#updateEntityVersion = database.prepare("UPDATE entities SET version = ? WHERE uuid = ?");
-        this.#updateNotebookVersion = database.prepare("UPDATE detection_notebook SET version = ? WHERE uuid = ?");
-        this.#materializedMatches = database.prepare(`
-      SELECT inbox.authority_id AS authorityId,
-             inbox.entity_id AS entityId,
-             inbox.global_sequence AS globalSequence,
-             inbox.record_json AS recordJson,
-             intent.intent_json AS intentJson,
-             notebook.type,
-             notebook.parent_uuid AS parentUUID,
-             notebook.name,
-             notebook.status,
-             notebook.version,
-             notebook.payload_version AS payloadVersion,
-             notebook.filesystem_mode AS filesystemMode,
-             notebook.transport_version AS transportVersion
-        FROM detection_notebook AS notebook
-        JOIN record_inbox AS inbox
-          ON inbox.authority_id = notebook.resource_id
-         AND inbox.entity_id = notebook.uuid
-         AND inbox.global_sequence = (
-           SELECT MAX(candidate.global_sequence)
-             FROM record_inbox AS candidate
-            WHERE candidate.authority_id = notebook.resource_id
-              AND candidate.entity_id = notebook.uuid
-              AND json_extract(candidate.record_json, '$.resultState') = notebook.version
-         )
-        LEFT JOIN entity_apply_intents AS intent
-          ON intent.entity_id = inbox.entity_id
-         AND intent.authority_id = inbox.authority_id
-        LEFT JOIN entity_apply_state AS state
-          ON state.entity_id = inbox.entity_id
-         AND state.authority_id = inbox.authority_id
-       WHERE (? IS NULL OR notebook.root_uuid = ?)
-         AND (inbox.resolved_at IS NULL
-           OR intent.intent_json IS NOT NULL
-           OR state.entity_id IS NULL
-           OR state.materialized_sequence IS NULL
-           OR state.materialized_sequence < inbox.global_sequence)
-       ORDER BY inbox.entity_id
-    `);
-        this.#resolveMaterializedHistory = database.prepare(`
-      UPDATE record_inbox SET resolved_at = ?
-       WHERE authority_id = ? AND entity_id = ? AND global_sequence <= ?
-         AND resolved_at IS NULL
-    `);
-        this.#baselineRows = database.prepare(`
-      SELECT inbox.authority_id AS authorityId,
-             inbox.entity_id AS entityId,
-             MAX(inbox.global_sequence) AS resolvedThrough
-        FROM record_inbox AS inbox
-        JOIN authority_snapshot_baselines AS baseline
-          ON baseline.authority_id = inbox.authority_id
-        LEFT JOIN entity_apply_state AS state
-          ON state.authority_id = inbox.authority_id
-         AND state.entity_id = inbox.entity_id
-       WHERE inbox.delivery_sequence <= baseline.delivery_sequence
-         AND inbox.global_sequence > COALESCE(state.resolved_through, 0)
-       GROUP BY inbox.authority_id, inbox.entity_id
-    `);
-        this.#baselineIntents = database.prepare(`
-      SELECT intent.intent_json AS intentJson
-        FROM entity_apply_intents AS intent
-        JOIN record_inbox AS target
-          ON target.authority_id = intent.authority_id
-         AND target.entity_id = intent.entity_id
-         AND target.global_sequence = json_extract(intent.intent_json, '$.throughSequence')
-        JOIN authority_snapshot_baselines AS baseline
-          ON baseline.authority_id = intent.authority_id
-       WHERE target.delivery_sequence <= baseline.delivery_sequence
-    `);
-    }
-    /**
-     * A verified notebook row is the last exact materialization this machine
-     * proved. When retained Inbox history contains that same complete result,
-     * the disk does not need to replay it: adopt the newest equal sequence as
-     * Apply's baseline and leave every later different result as ordinary work.
-     *
-     * This runs before the installed root becomes eligible to Apply, or before
-     * the Apply rail starts. Returned superseded intents let the host remove any
-     * private preparation left by an interrupted older process.
-     */
-    adoptVerifiedMaterialization(rootUUID = null) {
-        const supersededIntents = [];
-        let settledRecords = 0;
-        this.#database.transaction(() => {
-            for (const row of this.#baselineRows.all()) {
-                const prior = this.#state.get(row.authorityId, row.entityId);
-                this.#upsertState.run(row.entityId, row.authorityId, row.resolvedThrough, prior?.materializedSequence ?? null, prior?.materializedRecordJson ?? null);
-            }
-            for (const { intentJson } of this.#baselineIntents.all()) {
-                const intent = JSON.parse(intentJson);
-                assertApplyIntent(intent);
-                this.#deleteIntent.run(intent.authorityId, intent.entityId);
-                this.#verified.delete(intent.entityId);
-                supersededIntents.push(intent);
-            }
-        })();
-        const matches = this.#materializedMatches.all(rootUUID, rootUUID);
-        this.#database.transaction(() => {
-            for (const match of matches) {
-                const accepted = decodeAcceptedEntityRecord(match.recordJson);
-                const notebook = {
-                    uuid: match.entityId,
-                    type: match.type,
-                    parentUUID: match.parentUUID,
-                    name: match.name,
-                    status: match.status,
-                    version: match.version,
-                    payloadVersion: match.payloadVersion,
-                    fileMode: portableFileMode(match.type, match.filesystemMode),
-                    transportVersion: match.transportVersion,
-                };
-                if (!sameRecords([notebook], [accepted.change.result]))
-                    continue;
-                const prior = this.#state.get(match.authorityId, match.entityId);
-                if (!prior || prior.resolvedThrough <= match.globalSequence) {
-                    this.#upsertState.run(match.entityId, match.authorityId, match.globalSequence, match.globalSequence, JSON.stringify(accepted.change.result));
-                }
-                settledRecords += this.#resolveMaterializedHistory.run(this.#now(), match.authorityId, match.entityId, match.globalSequence).changes;
-                if (match.intentJson) {
-                    const intent = JSON.parse(match.intentJson);
-                    assertApplyIntent(intent);
-                    if (intent.throughSequence <= match.globalSequence) {
-                        this.#deleteIntent.run(intent.authorityId, intent.entityId);
-                        this.#verified.delete(intent.entityId);
-                        supersededIntents.push(intent);
-                    }
-                }
-            }
-        })();
-        return Object.freeze({
-            settledRecords,
-            supersededIntents: Object.freeze(supersededIntents),
-        });
-    }
-    readApplyWork(limit, afterCursor) {
-        const all = this.#candidateEntities.all()
+    `).all()
             .map(({ entityId }) => entityId)
             .filter((entityId) => afterCursor === null || entityId > afterCursor);
         const materializable = [];
@@ -389,197 +87,204 @@ export class EntityApplySqliteStore {
         });
     }
     #readApplyWork(entityId) {
-        const intent = this.#readIntent(entityId);
+        const intent = readIntent(this.#database, entityId);
         const authorityId = intent?.authorityId ?? this.#authorityFor(entityId);
         if (!authorityId)
             return null;
-        const state = this.#state.get(authorityId, entityId);
-        let resolvedThrough = state?.resolvedThrough ?? 0;
-        const rows = this.#inboxAfter.all(authorityId, entityId, resolvedThrough);
-        const baseline = this.#snapshotBaseline.get(authorityId);
-        const first = rows[0];
-        if (!state && first && baseline
-            && first.deliverySequence > baseline.deliverySequence) {
-            const firstRecord = decodeAcceptedEntityRecord(first.recordJson);
-            resolvedThrough = firstRecord.globalSequence - 1;
-        }
+        const { state, resolvedThrough, rows } = applyResolution(this.#database, authorityId, entityId);
+        const materialized = state?.materializedSequence && state.materializedRecordJson
+            ? { globalSequence: state.materializedSequence, record: assertRecord(JSON.parse(state.materializedRecordJson)) }
+            : null;
+        const retired = intent ? readRetirement(this.#database, intent) : null;
+        if (retired)
+            return { authorityId, entityId, resolvedThrough, materialized, records: [], intent, retirement: retired.retirement };
         const records = rows.map(({ recordJson }) => decodeAcceptedEntityRecord(recordJson));
-        if (records.length === 0)
-            return null;
-        const target = records.at(-1);
-        const local = this.#localRelevance.get(entityId, entityId) !== undefined
-            || (target.change.result.parentUUID !== null
-                && this.#localRelevance.get(target.change.result.parentUUID, target.change.result.parentUUID) !== undefined);
-        if (!local || !this.#isLocallyEligible(target.change.result))
-            return null;
-        return {
-            authorityId,
-            entityId,
-            resolvedThrough,
-            materialized: state?.materializedSequence && state.materializedRecordJson
-                ? {
-                    globalSequence: state.materializedSequence,
-                    record: assertRecord(JSON.parse(state.materializedRecordJson)),
-                }
-                : null,
-            records,
-            intent,
-        };
+        if (!intent) {
+            const target = records.at(-1);
+            if (!target)
+                return null;
+            const parent = target.change.result.parentUUID;
+            if (!(this.#locallyPresent(entityId) || (parent !== null && this.#locallyPresent(parent)))
+                || !this.#isLocallyEligible(target.change.result))
+                return null;
+        }
+        return { authorityId, entityId, resolvedThrough, materialized, records, intent };
+    }
+    #locallyPresent(uuid) {
+        return cachedStatement(this.#database, `SELECT 1 FROM entities WHERE uuid = ?
+      UNION ALL SELECT 1 FROM detection_notebook WHERE uuid = ? LIMIT 1`).get(uuid, uuid) !== undefined;
+    }
+    #authorityFor(entityId) {
+        const row = cachedStatement(this.#database, `SELECT authority_id AS authorityId FROM record_inbox
+       WHERE entity_id = ? ORDER BY global_sequence DESC LIMIT 1`).get(entityId);
+        return row?.authorityId ?? null;
     }
     hasLocalWorkAfter(authorityId, entityId, targetSequence) {
-        return this.#localWork.get(authorityId, entityId, targetSequence) !== undefined;
+        return hasLocalWorkAfter(this.#database, authorityId, entityId, targetSequence);
     }
-    beginIntent(intent) {
-        assertApplyIntent(intent);
-        const existing = this.#readIntent(intent.entityId, intent.authorityId);
-        if (existing) {
-            if (!sameIntent(existing, intent) || existing.phase !== intent.phase) {
-                throw new Error(`entity ${intent.entityId} already has a different Apply intent`);
-            }
-            return;
-        }
-        this.#insertIntent.run(intent.entityId, intent.authorityId, JSON.stringify(intent));
+    /** The save re-answers every database condition; placement is disk, so
+     * it is proved here before the save is posted. Apply settles a page's
+     * bookkeeping together, so each proof and each answer is a turn boundary:
+     * one saver batch answers many resolutions, and no number of them runs in
+     * one activation. */
+    async resolveOwnPublication(work, target) {
+        await turnBoundary();
+        const publication = { authorityId: work.authorityId, entityId: work.entityId, resolvedThrough: work.resolvedThrough,
+            globalSequence: target.globalSequence, mutationId: target.mutationId };
+        const own = ownPublication(this.#database, publication);
+        // The history still starts where the work saw it and ends at the target,
+        // so the work's records through the target are exactly what it settles.
+        if (!own || !this.#holdsOwnPlacement(own.accepted.change.result, work.records.filter(record => record.globalSequence <= target.globalSequence)))
+            return false;
+        const { value: resolved } = await save(this.#file, "apply.resolveOwnPublication", { ...publication, resolvedAt: this.#now() });
+        await turnBoundary();
+        if (resolved)
+            this.#onOwnPublicationResolved(target);
+        return resolved;
+    }
+    async beginIntent(intent) {
+        await save(this.#file, "apply.beginIntent", intent);
     }
-    setIntentPhase(intent) {
-        assertApplyIntent(intent);
-        const existing = this.#requireIntent(intent);
-        if (!sameIntent(existing, intent))
-            throw new Error("Apply phase update changed intent identity");
-        const updated = this.#updateIntent.run(JSON.stringify(intent), intent.authorityId, intent.entityId);
-        if (updated.changes !== 1)
-            throw new Error("Apply intent phase was not durable");
+    recoveryLocation(intent) {
+        return recoveryLocation(this.#database, intent);
+    }
+    /** Publish where this attempt's recovery receipt lives, unless another
+     * unfinished operation owns part of its scope. The save decides against
+     * every binding posted before it. */
+    async bindRecoveryLocation(intent, directory, scope) {
+        return (await save(this.#file, "apply.bindRecovery", { intent, directory, scope })).value;
+    }
+    async setIntentPhase(intent) {
+        await save(this.#file, "apply.setIntentPhase", intent);
     }
     cancelIntent(intent) {
-        const existing = this.#requireIntent(intent);
-        if (!sameIntent(existing, intent))
-            throw new Error("Apply cancel changed intent identity");
-        this.#verified.delete(intent.entityId);
-        this.#deleteIntent.run(intent.authorityId, intent.entityId);
-        this.#onIntentFinished(intent);
+        return this.#commitRetirement(intent, { kind: "cancelled" });
     }
-    stageVerification(intent, rows, removals = []) {
-        this.#requireIntent(intent);
-        this.#verified.set(intent.entityId, Object.freeze({
-            rows: Object.freeze([...rows]),
-            removals: Object.freeze([...new Set(removals)]),
-        }));
+    stageRetirement(intent, purpose, description, evidence = {}) {
+        requireIntent(this.#database, intent);
+        const { repair, proof = witnessProof([]), attribution = null } = evidence;
+        if ((description.contract === "amalgm.apply-no-ground@1") !== isConstructType(intent.targetType)) {
+            throw new Error("Apply cleanup disposition does not belong to its entity type");
+        }
+        if (repair && (purpose.kind !== "cancelled" || isConstructType(intent.targetType))) {
+            throw new Error("Apply placement repair belongs only to cancelled filesystem effects");
+        }
+        this.#cleanupProof.set(intent.entityId, { intent: Object.freeze({ ...intent }),
+            purpose: Object.freeze({ ...purpose }), description: JSON.parse(JSON.stringify(description)), proof, attribution,
+            ...(repair ? { repair: { ...repair, rows: Object.freeze(repair.rows.map(row => Object.freeze({ ...row }))) } } : {}) });
+    }
+    cleanupDescription(retirement) {
+        return ownedCleanup(this.#database, retirement);
+    }
+    async acknowledgeCleanup(retirement) {
+        await save(this.#file, "apply.acknowledgeCleanup", retirement);
+    }
+    /** Verify's rows as data: each repository observation's proof closes with
+     * the Verify proof, never on the saver thread. */
+    stageVerification(intent, ground, basis, proof) {
+        requireIntent(this.#database, intent);
+        if (isConstructType(intent.targetType))
+            throw new Error("construct verification cannot claim filesystem ground");
+        const detach = (rows) => Object.freeze(rows.map(({ repositoryObservation, ...row }) => Object.freeze({ ...row, record: Object.freeze({ ...row.record }),
+            ...(repositoryObservation ? { repositoryObservation: dataOf(repositoryObservation) } : {}) })));
+        this.#verified.set(intent.entityId, { intent: Object.freeze({ ...intent }), basis, proof,
+            ground: Object.freeze({ observed: detach(ground.observed), shared: detach(ground.shared),
+                removedObserved: Object.freeze([...new Set(ground.removedObserved)]),
+                removedShared: Object.freeze([...new Set(ground.removedShared)]),
+            }) });
+    }
+    /** Product verification has no filesystem projection. The product remains
+     * the owner of its running state and ledger; this stages its exact receipt. */
+    stageConstructVerification(intent, target) {
+        requireIntent(this.#database, intent);
+        if (!isConstructType(intent.targetType) || target.uuid !== intent.entityId
+            || target.type !== intent.targetType || target.version !== intent.targetState) {
+            throw new Error("construct Verify does not describe its exact Apply target");
+        }
+        this.#verified.set(intent.entityId, { intent: Object.freeze({ ...intent }), ground: null, basis: null,
+            proof: witnessProof([]) });
     }
     completeIntent(intent, completion) {
+        return this.#commitRetirement(intent, completion);
+    }
+    async #commitRetirement(intent, completion) {
+        const verified = this.#verified.get(intent.entityId), cleanup = this.#cleanupProof.get(intent.entityId);
         try {
-            const existing = this.#requireIntent(intent);
-            if (!sameIntent(existing, intent) || existing.phase !== "revealed") {
-                throw new Error("Apply completion does not match its revealed intent");
-            }
-            const prior = this.#state.get(intent.authorityId, intent.entityId);
-            const verified = this.#verified.get(intent.entityId);
-            if (completion.kind === "materialized" && !verified) {
-                throw new Error("Apply completion has no exact Verify evidence");
-            }
-            const targetRow = this.#targetRecord.get(intent.authorityId, intent.entityId, intent.throughSequence);
-            if (!targetRow)
-                throw new Error("Apply target disappeared from its retained Inbox");
-            const target = decodeAcceptedEntityRecord(targetRow.recordJson);
-            this.#database.transaction(() => {
-                if (completion.kind === "materialized") {
-                    const membershipContainers = new Set();
-                    for (const uuid of verified.removals) {
-                        const old = this.#notebookAtUuid.get(uuid);
-                        if (old?.parentUUID)
-                            membershipContainers.add(old.parentUUID);
-                        this.#deleteEntity.run(uuid);
-                        this.#deleteNotebook.run(uuid);
-                    }
-                    for (const row of verified.rows) {
-                        const old = this.#notebookAtUuid.get(row.record.uuid);
-                        if (old?.parentUUID)
-                            membershipContainers.add(old.parentUUID);
-                        if (row.record.parentUUID)
-                            membershipContainers.add(row.record.parentUUID);
-                        if (row.record.type === "workspace" || row.record.type === "folder") {
-                            membershipContainers.add(row.record.uuid);
-                        }
-                        this.#deleteEntity.run(row.record.uuid);
-                    }
-                    for (const row of verified.rows) {
-                        if (row.record.status === "active") {
-                            try {
-                                this.#upsertEntity.run(...rowValues(row));
-                            }
-                            catch (error) {
-                                const occupant = this.#entitySlot.get(row.resourceId, row.rootUUID, row.relativePath);
-                                throw new Error(`Apply projection could not place ${row.record.uuid} at `
-                                    + `${row.rootUUID}:${row.relativePath}; occupied by `
-                                    + `${occupant?.uuid ?? "no retained row"} (${occupant?.absolutePath ?? "unknown"}); `
-                                    + `incoming=${row.record.type}:${row.record.payloadVersion ?? "none"}; `
-                                    + `occupant=${occupant?.type ?? "none"}:${occupant?.payloadVersion ?? "none"}`, { cause: error });
-                            }
-                        }
-                        else {
-                            this.#deleteEntity.run(row.record.uuid);
-                        }
-                        this.#upsertNotebook.run(...rowValues(row));
-                    }
-                    this.#refreshMembershipVersions(membershipContainers);
-                }
-                this.#resolveInbox.run(this.#now(), intent.authorityId, intent.entityId, intent.fromSequence, intent.throughSequence);
-                this.#upsertState.run(intent.entityId, intent.authorityId, intent.throughSequence, completion.kind === "materialized"
-                    ? intent.throughSequence
-                    : prior?.materializedSequence ?? null, completion.kind === "materialized"
-                    ? JSON.stringify(target.change.result)
-                    : prior?.materializedRecordJson ?? null);
-                const removed = this.#deleteIntent.run(intent.authorityId, intent.entityId);
-                if (removed.changes !== 1)
-                    throw new Error("Apply intent disappeared before completion");
-            })();
-            this.#verified.delete(intent.entityId);
+            const retirement = await this.#commitTerminalOutcome(intent, completion, verified, cleanup);
+            this.#release(intent, verified, cleanup);
+            return retirement;
         }
-        finally {
-            this.#onIntentFinished(intent);
+        catch (error) {
+            // Only this attempt's own staged evidence retires with its failure.
+            this.#release(intent, verified, cleanup);
+            this.#onAttemptFailed(intent);
+            throw error;
         }
     }
-    close() {
-        this.#database.close();
-    }
-    /** Container versions are a projection of the final notebook graph. An
-     * independently ordered folder receipt may name membership from before a
-     * child receipt; it can never overwrite the membership already present on
-     * this machine. No container record is emitted for this derivation. */
-    #refreshMembershipVersions(uuids) {
-        for (const uuid of uuids) {
-            const row = this.#notebookAtUuid.get(uuid);
-            if (!row || (row.type !== "workspace" && row.type !== "folder"))
-                continue;
-            const children = this.#notebookChildren.all(uuid);
-            const version = canonicalVersion({
-                type: row.type,
-                parentUUID: row.parentUUID,
-                name: row.name,
-                status: row.status,
-                payloadVersion: membershipHash(children, sha256Hex),
-            }, sha256Hex);
-            this.#updateEntityVersion.run(version, uuid);
-            this.#updateNotebookVersion.run(version, uuid);
+    #release(intent, verified, cleanup) {
+        if (verified && this.#verified.get(intent.entityId) === verified && sameIntent(verified.intent, intent)) {
+            this.#verified.delete(intent.entityId);
+        }
+        if (cleanup && this.#cleanupProof.get(intent.entityId) === cleanup && sameIntent(cleanup.intent, intent)) {
+            this.#cleanupProof.delete(intent.entityId);
         }
     }
-    #authorityFor(entityId) {
-        const row = this.#authorityForEntity.get(entityId);
-        return row?.authorityId ?? null;
+    /** Every terminal prerequisite, read from local state now. Semantic closing
+     * awaits, so the commit asks again afterwards rather than trusting a read
+     * taken before the wait. */
+    #terminalPrerequisites(intent, completion, verified, cleanup) {
+        const repeated = readRetirement(this.#database, intent);
+        if (repeated) {
+            if (repeated.retirement.purpose.kind !== completion.kind)
+                throw new Error("Apply terminal purpose cannot change");
+            return { repeated: repeated.retirement };
+        }
+        const existing = requireIntent(this.#database, intent);
+        if (completion.kind !== "cancelled" && existing.phase !== "revealed") {
+            throw new Error("Apply completion does not match its revealed intent");
+        }
+        if (completion.kind === "materialized" && (!verified || !sameIntent(verified.intent, intent)
+            || this.#verified.get(intent.entityId) !== verified)) {
+            throw new Error("Apply completion has no exact Verify evidence");
+        }
+        if (!cleanup || !sameIntent(cleanup.intent, intent) || cleanup.purpose.kind !== completion.kind
+            || this.#cleanupProof.get(intent.entityId) !== cleanup)
+            throw new Error("Apply retirement has no proven cleanup description");
+        return { cleanup };
     }
-    #readIntent(entityId, authorityId) {
-        const row = authorityId
-            ? this.#intent.get(authorityId, entityId)
-            : this.#intentByEntity.get(entityId);
-        if (!row)
-            return null;
-        const intent = JSON.parse(row.intentJson);
-        assertApplyIntent(intent);
-        return intent;
+    async #commitTerminalOutcome(intent, completion, verified, staged) {
+        const opening = this.#terminalPrerequisites(intent, completion, verified, staged);
+        if ("repeated" in opening)
+            return opening.repeated;
+        // Git and other slow owners re-answer first; native witnesses and
+        // ownership close as the save is posted, and the save re-reads every
+        // database fact the outcome depends on.
+        const proofs = [opening.cleanup.proof, ...(opening.cleanup.repair ? [opening.cleanup.repair.proof] : []),
+            ...(completion.kind === "materialized" ? [verified.proof] : [])];
+        await sourceProofs(proofs).semantic();
+        const closing = this.#terminalPrerequisites(intent, completion, verified, staged);
+        if ("repeated" in closing)
+            return closing.repeated;
+        const { cleanup } = closing;
+        for (const proof of proofs)
+            closePhysically(proof);
+        const retirement = { token: randomUUID(), intent, purpose: completion };
+        const ground = completion.kind === "materialized" && verified?.ground && verified.basis
+            ? { ground: verified.ground, basis: verified.basis.toData() } : null;
+        await save(this.#file, "apply.retire", {
+            retirement,
+            cleanup: cleanup.description,
+            attribution: cleanup.attribution?.toData() ?? null,
+            repair: cleanup.repair ? { rows: cleanup.repair.rows, basis: cleanup.repair.basis.toData() } : null,
+            verified: ground,
+            resolvedAt: this.#now(),
+        });
+        this.#onIntentFinished(intent);
+        return retirement;
     }
-    #requireIntent(intent) {
-        const existing = this.#readIntent(intent.entityId, intent.authorityId);
-        if (!existing)
-            throw new Error(`entity ${intent.entityId} has no durable Apply intent`);
-        return existing;
+    close() {
+        this.#database.close();
     }
 }
+const dataOf = ({ proof: _proof, ...pair }) => pair;
 //# sourceMappingURL=entity-apply-store.js.map