@amalgm/shell 0.1.164-preview.36072132286 → 0.1.164-preview.36809057014

package/dist/user-ground-host.d.ts

@@ -1,35 +1,35 @@
+import { type UnavailableRoot } from "./detection/unreadable.js";
+import { type GroundRow } from "./ground-row.js";
 import { type UserGroundPort, type UserHomeDeclaration } from "@amalgm/core/identity";
-import { type EntityType, type FilesAddPorts, type FilesRegisterPorts, type UserGroundIdentity } from "@amalgm/live";
-import type Database from "better-sqlite3";
+import { EntityApplyRail, type EntityRecordDelivery, type FilesAddPorts, type FilesRegisterPorts, type MaintenanceReceipts, type UserGroundIdentity } from "@amalgm/live";
 import { type FilesStageObserver } from "./files-observability.js";
 import { type EntityApplyHostOptions, type EntityApplyStageEvidence } from "./entity-apply-host.js";
 import { type ConstructRecordChange } from "./construct-door.js";
 import type { ConstructPort, SharingPorts } from "@amalgm/live/sharing";
+import type { DiscoveryStats } from "./detection/identity-discovery.js";
+import type { RootExaminationTimings } from "./detection/root-examination.js";
+import { type VisitOutcome } from "./detection/maintenance-sweep.js";
 import { type DurabilityBarrier } from "./durability-barrier.js";
+import { type DetectCommitEvidence } from "./detection/runtime.js";
 import { type OpenNativeWatch, type WatchCoverageEvidence, type WatchHealth } from "./watching/index.js";
 import { WireClient } from "./wire-client.js";
-interface GroundRow {
-    readonly resourceId: string;
-    readonly rootUUID: string;
-    readonly uuid: string;
-    readonly type: EntityType;
-    readonly parentUUID: string | null;
-    readonly name: string;
-    readonly status: "active";
-    readonly version: string;
-    readonly payloadVersion: string | null;
-    readonly transportVersion: string | null;
-    readonly relativePath: string;
-    readonly absolutePath: string;
-    readonly deviceNumber: number;
-    readonly inode: number;
-    readonly byteSize: number | null;
-    readonly modifiedTimeMs: number | null;
-    readonly changedTimeMs: number | null;
-    readonly filesystemMode: number | null;
-    readonly contentVerifiedAtMs: number | null;
+/** One identity discovery: whether the rows a scoped root's repositories no
+ * longer found are absent from its whole namespace, and what it cost. */
+export interface DetectDiscoveryEvidence {
+    readonly rootId: string;
+    readonly directory: string;
+    readonly rows: number;
+    readonly elapsedMs: number;
+    /** absent: witnessed; found: an identity stands where the pass did not
+     * observe it; gap: the namespace could not answer; failed: a fault. */
+    readonly outcome: "absent" | "found" | "gap" | "failed";
+    readonly reason: string | null;
+    readonly found: number;
+    readonly stats?: DiscoveryStats;
 }
 export interface DetectScanEvidence {
+    readonly outcome: "observed" | "failed";
+    readonly error?: string;
     readonly rootId: string;
     readonly directory: string;
     readonly scope: "complete" | "paths" | "none";
@@ -41,6 +41,8 @@ export interface DetectScanEvidence {
     readonly durationMs: number;
     readonly plannedRows?: number;
     readonly records?: number;
+    /** Results Build settled against an exact accepted result: no record. */
+    readonly settled?: number;
     readonly recordBytes?: number;
     /** Wall time inside readdir/lstat — the traversal's own cost. */
     readonly walkMs?: number;
@@ -53,17 +55,36 @@ export interface DetectScanEvidence {
     readonly captureBytes?: number;
     /** Wall time inside Git index inspection during the walk. */
     readonly gitMs?: number;
-    /** Wall time proving repository identity through Git, across every
-     * repository. Repositories are sealed one at a time, so this is serial. */
-    readonly repositoryIdentityMs?: number;
     /** Wall time packing repository transport bytes, across every repository. */
     readonly repositoryCaptureMs?: number;
+    /** Largest individual synchronous capture, separate from the batch sum. */
+    readonly repositoryCaptureMaxMs?: number;
+    readonly repositoryCaptureMaxId?: string;
+    readonly repositoryCaptureMaxOutcome?: "captured" | "failed";
+    readonly repositoryCaptureFailures?: number;
     /** Wall time sealing and re-inspecting repository transport artifacts. */
     readonly repositorySealMs?: number;
+    /** Repository seal outcomes: `reuse`, `miss:<reason>`, `write`,
+     * `write-refused:<reason>`. Evidence only; never an input to a decision. */
+    readonly seal?: Readonly<Record<string, number>>;
     /** Wall time resolving stored UUIDs against what the walk found. */
     readonly reconcileMs?: number;
     /** Wall time planning and persisting rows once identity is settled. */
     readonly persistMs?: number;
+    /** A complete examination's outcome: `reused` when disk equals O and B
+     * stands at O's selection, `scoped:<repositories>+<folders>` when a scope
+     * holds its differences, otherwise the first reason the main walk answers.
+     * Evidence only. */
+    readonly selection?: string;
+    /** Where a content thread's examination of a quiet root went. */
+    readonly pooled?: RootExaminationTimings;
+}
+/** What one flush boundary proved: every root, except those Git refused. */
+export interface FlushOutcome {
+    readonly refused: readonly {
+        readonly directory: string;
+        readonly reason: string;
+    }[];
 }
 export interface UserGroundHostOptions {
     /** Runtime-owned transport. Standalone host examinations may own their client. */
@@ -86,6 +107,12 @@ export interface UserGroundHostOptions {
     readonly durabilityBarrier?: DurabilityBarrier;
     /** Root-scoped Detect evidence for product diagnostics and examinations. */
     readonly onDetectScan?: (evidence: DetectScanEvidence) => void;
+    /** Passive full-ground examination receipt, emitted only after an outer
+     * Record commit. Omitted in production; never changes admission decisions. */
+    readonly onDetectCommit?: (evidence: DetectCommitEvidence) => void;
+    /** Controlled source-race seam for full-ground examinations. Production
+     * supplies no callback; the proof must close after this scheduling boundary. */
+    readonly onRepositoryYield?: (rootPath: string, repositoryPath: string) => void;
     /** Transient Apply progress; durable responsibility remains in SQLite. */
     readonly onApplyStage?: (evidence: EntityApplyStageEvidence) => void;
     /** Crash seam for derived-address relocation examinations. */
@@ -116,6 +143,45 @@ export interface UserGroundHostOptions {
     readonly filesTraceActive?: () => boolean;
 }
 export type WorkspaceAddStage = "intent-recorded" | "materialization-verified" | "rows-committed" | "ground-revealed" | "binding-created" | "watching";
+/** Resources always close. Catch-up is proved through the final cutoff,
+ * cancelled by pause, or incomplete: a durable Apply intent owns ground the
+ * final pass could not attribute, Git refused a root, a root's ground was
+ * still moving through the final pass, user ground could not be read, or a
+ * Register declaration still awaits the authority. A failed step rejects
+ * close with no catch-up claim. Startup suspects every root regardless;
+ * nothing here lets it skip. */
+export type UserGroundCatchUp = {
+    readonly state: "complete-through-cutoff";
+} | {
+    readonly state: "cancelled";
+} | {
+    readonly state: "incomplete";
+    readonly cutoff: readonly {
+        readonly rootId: string;
+        readonly generation: number;
+    }[];
+    readonly unresolvedRoots: readonly string[];
+    readonly owningIntents: readonly {
+        readonly entityId: string;
+        readonly attemptId: string;
+    }[];
+    readonly refusedRoots: readonly {
+        readonly directory: string;
+        readonly reason: string;
+    }[];
+    readonly movingRoots: readonly string[];
+    readonly unavailableRoots: readonly UnavailableRoot[];
+    /** Register declarations the authority has not accepted. */
+    readonly heldRoots: readonly string[];
+};
+/** Resources always close; delivery never claims synchronization. Records
+ * still pending are saved locally and send again, under the same mutation
+ * identity, when Files next starts. Null when no Record rail ran. */
+export interface UserGroundClosed {
+    readonly resources: "closed";
+    readonly catchUp: UserGroundCatchUp;
+    readonly delivery: EntityRecordDelivery | null;
+}
 export interface UserGroundCloseOptions {
     /** False cancels this lifetime without catching up. Durable work and the
      * blind interval remain for resume; ordinary product shutdown catches up. */
@@ -128,20 +194,43 @@ export declare class UserGroundHost {
     private readonly wire;
     private readonly ownedWire;
     private readonly operations;
+    /** Roots whose pooled scope refused after its snapshot: their next
+     * complete examination is the main walk, never the same scope again. */
+    private readonly walkOwed;
     private closeTask;
     private readonly direct;
     private readonly watchHost;
     private activeIdentity;
     private rescanTimer;
     private rescanGenerationStartedAt;
-    private watchDirty;
+    /** Roots whose repository Git itself will not open, with the reason. Every
+     * examination re-derives the answer, so restart finds each one again. */
+    private readonly rootRefusals;
+    /** The committed head this machine last read or published. */
     private cloudState;
     private converged;
     /** Cumulative graph-page reads, reported as diffs on the stages that
      * materialize roots so the ledger shows what each operation actually read. */
     private readonly graphPageReads;
-    private syncing;
+    /** Named and repository lanes by lane key: one attempt per lane and root,
+     * NAMED_DETECT_LANES at once. */
+    private readonly namedAttempts;
+    private namedRotation;
+    /** Roots whose ground an effect holds; they wait for its release holding no slot. */
+    private readonly groundWaits;
+    /** The one complete-lane attempt. */
+    private completeAttempt;
+    /** Lanes whose last attempt failed. A parked lane holds no slot. */
+    private readonly parkedDetect;
+    /** Callers proving a finite ticket; every finished attempt wakes them. */
+    private readonly detectWaiters;
     private recordRail;
+    /** Rail rings a Detect commit owes, queued for a later turn so the
+     * committing task ends before a rail's drain starts. Each stays here until
+     * it runs; shutdown drains them into its flushes and pause retires them,
+     * since a ring only wakes durable work. */
+    private readonly nextTurns;
+    private stopCacheMaintenance;
     private recordStore;
     private entityAccess;
     private constructLedger;
@@ -149,13 +238,27 @@ export declare class UserGroundHost {
     private releaseGrantWatch;
     private applyRail;
     private applyHost;
+    private detectJobs;
+    /** This runtime's identity in the disposition ledger. */
+    private readonly incarnation;
+    private detectLedger;
     private namedDetect;
-    private coldOperation;
     private closing;
+    /** Add journeys holding their ground; the maintenance sweep waits them out. */
+    private workspaceAdds;
+    /** The periodic metadata sweep of every Watch root. Its findings are owed
+     * to the scoped lanes; it never writes. */
+    private readonly maintenance;
+    /** The maintenance requests each cut captured before its proof read. */
+    private readonly maintenanceCoverage;
     /** Visible-ground effects coordinate by address cone: Detect passes hold
      * the roots they observe, Apply holds its target addresses, Register and
      * Add hold the ground they materialize. Unrelated cones never wait. */
     private readonly ground;
+    private readonly boundUserRoots;
+    /** Apply waits on ground without a deadline; shutdown cancels them just
+     * before it stops the Apply rail, which resumes from durable intents. */
+    private readonly applyWaits;
     readonly port: UserGroundPort;
     constructor(options: UserGroundHostOptions);
     /** One admitted Files journey; shutdown waits for every writer to settle. */
@@ -167,6 +270,17 @@ export declare class UserGroundHost {
     databasePath(identity: UserGroundIdentity): string;
     rows(identity: UserGroundIdentity): GroundRow[];
     watchHealth(): WatchHealth;
+    /** Read-only reasons owned by the running Apply coordinator. */
+    applyWaiting(): ReturnType<EntityApplyRail["waiting"]>;
+    private wakeObservedApply;
+    /** A Detect dependency is a request, never a hope. It is made in the same
+     * synchronous step that parks the waiter, which the rail already wakes for
+     * any examination after its comparison. The named ground is suspected like
+     * a native ring, so one finite examination follows even when nothing else
+     * changes; its settlement wakes the waiter, and a no-op examination only
+     * lets it compare again. It holds no ground its own examination needs. */
+    private openDetectLedger;
+    private requestExamination;
     watchEvidence(): WatchCoverageEvidence;
     coverWorkspaceEvidence(workspaceId: string): WatchCoverageEvidence;
     /** Add already projects authoritative rows; this proves that the same
@@ -185,29 +299,131 @@ export declare class UserGroundHost {
      * the next start or an explicit re-Add, while readiness proceeds. */
     private resumeWorkspaceAdds;
     private resumeWorkspaceAdd;
-    /** Finish the user-visible register journey inside the one persistent Files
-     * owner. The declaration remains durable if any later stage fails, and a
-     * retry reuses its UUID through filesCommandPorts().register. */
+    /** Register W: publish its declaration D, W's walked subtree and the core
+     * records that reach it, in one graph head. Locally Register admits D and
+     * the bookkeeping that installs it, and nothing else: every other
+     * observation stays owed to ordinary Detect, and W stays held from it until
+     * the authority accepts D. Live's binding and reference stay durable if a
+     * later stage fails, so a retry declares the same W again. */
     completeWorkspaceRegistration(workspaceId: string): Promise<{
         readonly registered: true;
+        readonly alreadyRegistered?: true;
         readonly entityCount: number;
         readonly cloudHead: string;
         readonly watch: WatchCoverageEvidence;
     }>;
+    /** An accepted W publishes no head, yet its accepted cargo must stand whole
+     * at the authority. What the authority lacks ships again from whatever
+     * here still holds it exactly: a cache copy, or ground whose row names the
+     * accepted payload. The rest was overtaken here or left this machine; the
+     * stage names how much, and newer local work syncs as its own Records. */
+    private restoreAcceptedCargo;
+    /** Register's Watch evidence: W's ground has one healthy content owner. */
+    private registrationCoverage;
+    /** The core root D's chain lands in: AV's, which must be the core ground
+     * this machine holds, or D would name ground it never observed. */
+    private declarationCoreRoot;
+    /** Whether AV holds W as its own active root. Anything else AV holds of W
+     * refuses: once another root holds W, that root's graph owns its identity. */
+    private acceptedWorkspace;
+    /** Walk W once, seal what D names, and publish D. W alone is leased and
+     * cut, through the authority's answer: core and every other root keep
+     * detecting and applying, and a walk its own ground overtook walks again.
+     * An authority that moved past the view D was folded on refuses it; D then
+     * folds onto the newer view beside a new journal row, with no new walk. */
+    private declareWorkspace;
+    /** Fold D onto a fresh accepted view and admit it beside a new journal
+     * row. The commit reads the chain's addresses again, so core Detect working
+     * beside Register is never overwritten; a chain that moved folds again. */
+    private declarationFold;
+    /** W's ground on this machine: its binding, and every bound workspace it
+     * encloses, whose identities it keeps. */
+    private declarationGround;
+    /** One declaring walk of W: observed whole and selected under W's own
+     * policy, with nothing persisted. Selected bytes ship from the walk's own
+     * read, and every artifact D names seals before D can be journaled. */
+    private walkDeclaration;
+    /** One maintenance visit of a Watch root that begins after now, settled
+     * once the ordinary lanes discharged what it found: a metadata comparison,
+     * never a content reread. */
+    requestVisit(rootId: string): Promise<VisitOutcome>;
+    /** Each Watch root's maintenance visit receipts now. */
+    maintenanceReceipts(): ReadonlyMap<string, MaintenanceReceipts>;
     /** Prove one finite observation boundary in SQLite, immutable content
      * storage, and the official cloud head. Rings received during that proof
-     * remain pending and already own their next debounced Detect pass. */
-    flush(): Promise<void>;
-    private syncNow;
-    private flushObservedChanges;
+     * remain pending and already own their next debounced Detect pass. Roots
+     * refused at that boundary are named: their local rows are current, and
+     * their last complete result remains the official one. */
+    flush(): Promise<FlushOutcome>;
+    /** Prove everything owed now, through its current cutoff. Ground still
+     * moving when no retry remains names every root the cutoff left unsettled
+     * that no unreadable ground explains. */
+    private proveOwed;
+    /** Run lanes until everything this ticket scoped at its cutoff is settled.
+     * An attempt that covered the ticket and failed fails the caller honestly;
+     * attempts on other ground, or frozen before the ticket, never do. */
+    private proveTicket;
+    /** Every attempt already running, drained. Outcomes stay with their lanes. */
+    private detectDrained;
+    /** Start every lane with owed work and a free slot. Synchronous and
+     * idempotent, so every ring, release, retry and finished attempt may call
+     * it. A caller proving a ticket passes it: a lane parked on a failure that
+     * serves the ticket runs now, because a finite proof observes its own
+     * attempt. An owner wait never reruns; unchanged work cannot end it. */
+    private dispatchDetect;
+    private nextTurn;
+    private endNextTurns;
+    /** What every lane is doing as one starts, so starvation is visible. */
+    private laneState;
+    private awaitGround;
+    /** A lane slot or ground wait ended: lanes restart, then every ticket
+     * re-examines. Waking a ticket before its slot is free would find the lane
+     * still serving and sleep through the release. */
+    private laneFreed;
+    /** Timers, releases and finished attempts wake lanes; cold journeys and
+     * shutdown own their own proofs. */
+    private wakeDetect;
+    private blocked;
+    /** What a lane's failure is to the tickets it covered. A basis that
+     * advanced while Detect read is truth still arriving, never a fault: its
+     * cuts stay pending as moving ground, re-read on the lane's retry.
+     *
+     * An owner wait answers a ticket only while an owner it names stands.
+     * Owners that all ended during the attempt released before it could park,
+     * and a release unparks only waits already parked: what they withheld is
+     * merely stale, ground still moving, and their release's ring reruns it.
+     * This read and the park share one synchronous turn, so a release after it
+     * finds the park. Unreadable ownership keeps the wait. */
+    private laneCause;
+    /** Consecutive racy readings per lane. Waiting is the answer until the
+     * RACY_READINGS-th, which is reported unsettled while the lane retries. */
+    private readonly racyReadings;
+    private racyUnsettled;
+    private park;
+    private unpark;
+    private clearDetectParks;
+    /** A failed attempt answers every ticket its cuts covered; its slot's
+     * release wakes them. */
+    private detectEnded;
     /** Install the exact snapshot/tail boundary before Receive or Apply can
      * treat older official history as materialization work. The SQLite cursor,
      * retained Inbox resolution, and Apply baseline all derive from the same N. */
     private adoptCloudDeliveryBaseline;
     private startRecordRail;
     private startApplyRail;
-    close(options?: UserGroundCloseOptions): Promise<void>;
+    close(options?: UserGroundCloseOptions): Promise<UserGroundClosed>;
+    /** Every step runs in order even after an earlier one failed; the failures
+     * reject together only once every resource is closed. */
     private shutdown;
+    /** Pause cancels this lifetime. Durable work and the blind interval remain
+     * for resume; nothing here claims catch-up. */
+    private cancelLifetime;
+    /** Command shutdown is the last catch-up boundary. Durable Apply ownership
+     * of observed or unreachable ground, Git refusing a root, ground still
+     * moving through the final pass, or user ground this process cannot read
+     * leaves it incomplete; startup suspects every root unconditionally, and
+     * a terminal Apply or a changed refusal wakes the held Detect. */
+    private catchUpThroughCutoff;
     /**
      * The host half of Sharing's ports: the access tables over the tunnel, the
      * owner and principal lookups the gateway answers, and this computer's
@@ -226,6 +442,8 @@ export declare class UserGroundHost {
     recordConstruct(change: ConstructRecordChange): Promise<void>;
     /** The entity type this computer recorded for a UUID, for construct doors. */
     constructKind(uuid: string): string | null;
+    /** The user root's synchronization address, resolved once when first
+     * bound; every child cone is derived from it. */
     private userRoot;
     private cacheDir;
     private cloudPort;
@@ -263,6 +481,7 @@ export declare class UserGroundHost {
      * The graph proves every page against its declared identity as it parses,
      * so this reader only guards the cache against torn copies. */
     private readGraphPage;
+    private graphPagePath;
     private localPort;
     /** Send's small-cargo fast path: the record's sealed artifact rides the
      * submit frame itself, so one round trip carries record, manifest, and
@@ -296,22 +515,106 @@ export declare class UserGroundHost {
     private downloadContent;
     private reserveGroundRoots;
     private ensureWatchers;
+    /** Rings arrive in bursts; one quiet window, bounded by a maximum deferral,
+     * gathers them before lanes are dispatched. */
     private scheduleRescan;
-    /** A finite cold command may suppress Detect while it owns publication, but
-     * it may never consume a Watch generation that arrived during that window. */
-    private finishColdOperation;
     private acquireGroundScope;
-    private syncLocalChanges;
+    /** Add holds its ground for its whole cold journey; no maintenance visit
+     * starts until it releases. */
+    private holdWorkspaceAdd;
+    private suspectPhysical;
+    /** A durable binding is registration evidence even if the native event
+     * that created it was lost across a crash. Rebuild coverage first, then
+     * express that uncertainty through Watch like every other Detect input.
+     * These are ambiguous recovery facts, so each affected root is wholly
+     * suspect; unrelated roots remain untouched. */
+    private repairRegistrationGround;
+    /** A prepared lane holds its slot across one boundary, then activates.
+     * Whatever activation declines stays owed: the freed slot dispatches again,
+     * which prepares afresh. */
+    private startNamed;
+    /** ACTIVATE, one synchronous step. The runtime and the root's binding are
+     * those PREPARE read, or nothing is cut. Only names still owed are cut:
+     * newer names wait for a lane that prepared them. The prepared footprint is
+     * a proposal the collection enforces: storage it resolves outside the lease
+     * fails it for a wider retry, and admission re-checks the index it routed by. */
+    private activateNamed;
+    /** One root's named rings of one kind, cut now and proved by name or inside
+     * their repositories. The cut ends settled, escalated to the complete
+     * lane, or pending behind a park. Only what a later reading of the same
+     * names answers is parked here: what the narrow proof cannot conclude, a
+     * refusal or a fault, is escalated like a widened proof, since rerunning
+     * it unchanged would fail again and hold the root's later names behind it. */
+    private namedLane;
+    private proveNamed;
+    /** Named rings inside repositories are examined there by the complete
+     * lane's own repository handler and per-unit admission, without waiting
+     * behind a complete proof. Names that cannot stand inside their
+     * repositories are escalated with the wider proof they need. */
+    private proveRepositories;
+    /** A cut's alias hints are decided before its proof settles them: what they
+     * owe rings as a later generation, the domain only when a hint cannot bound
+     * its objects. */
+    private discoverAliases;
+    /** One maintenance visit of a Watch root, against O as it stands. A visit
+     * that read the whole namespace and could trust O at its root is a complete
+     * walk that stands. */
+    private maintainRoot;
+    /** Each cut captures, before its proof reads, the maintenance requests that
+     * proof answers: a named cut those at and beneath its paths, a complete cut
+     * every promoted one. */
+    private coverMaintenance;
+    /** Proved cuts answer what they covered; failed, deferred or cancelled ones never do. */
+    private maintenanceServed;
+    /** An escalated cut's requests are owed to the wider proof. Watch escalates
+     * only its own names, so the sweep's are escalated beside them: the
+     * complete lane proves those paths, not the whole root. */
+    private escalateMaintenance;
+    private startComplete;
+    /** Whole-root proofs, one attempt at a time. Every cut it freezes is
+     * released when it ends, proved or not. */
+    private completeLane;
+    /** One complete attempt owns at most one complete-domain continuation, over
+     * its finite original cutoffs. Each pass admits what it proved; whatever
+     * moved stays pending for its next ring or a short timer, never a retry
+     * inside this turn. */
+    private syncObservationCuts;
+    /** Complete observations are examined on content threads, concurrently:
+     * disk and Git against O by the main walk's own laws, and O against its
+     * selection standing in B. A root that proves unchanged is not walked
+     * here, and one whose differences a scope can hold is examined only
+     * there; any other answers with the first reason, and the main walk
+     * observes it. */
+    private examineQuietRoots;
+    /** A root's first absence would otherwise list its whole namespace while an
+     * edit waits. Once a complete walk of the root stands (Register's walk,
+     * an Add's verified install, a complete examination, or a maintenance visit
+     * that read it whole), the discovery thread lists it in the background, so a
+     * later absence re-reads only directories whose signatures moved. It seeks
+     * nothing and concludes nothing: when it cannot close, the next discovery
+     * reads cold, as it would have. */
+    private warmDiscovery;
+    /** Names a named proof escalated are examined inside the repositories they
+     * reach, by the same handler a pooled examination's differences use.
+     * Nothing else of the root is read. A root that is itself a repository has
+     * no frame to scope inside: its own walk reads only Watch's names and what
+     * its Git holds dirty or untracked. What cannot be routed to repositories
+     * needs the complete root, and says why. */
+    private directScope;
     private syncLocalChangesUnlocked;
-    private publishPendingSnapshotsBeforeLookup;
-    /** Register is the deliberate cold graph-publication boundary. Ordinary
-     * Watch detection stops at a durable exact record and never rebuilds this
-     * resource snapshot. */
-    private prepareSnapshotPublication;
-    private publishMaterializedSnapshot;
-    /** Close the graph-preparation stage with every leg it spent, so a slow
-     * preparation names the slow part instead of one opaque number. */
-    private finishPreparation;
+    /** Declarations whose outcome this process never learned resolve before a
+     * lookup reads the head. A submitted row may already be accepted: its exact
+     * mutation recovers the receipt. A conclusive refusal settles the row as
+     * rejected, and its ground stays held until Register declares it again. */
+    private resolveDeclarationsBeforeLookup;
+    /** AV: the authority's current head H plus every accepted result Receive
+     * has delivered after its watermark M. The head is read fresh, because a
+     * graph-head commit is never an entity delivery. `beyond` is a delivery a
+     * refused watermark proved the authority holds, so Receive reaches past it
+     * before the tail is read. Neither Apply nor Send is waited on: accepted
+     * state is what the authority has accepted, whatever this machine has
+     * physically applied or still owes. */
+    private freshAcceptedView;
     /** Which of these heads does the authority hold sealed under the current
      * content contract — and which of the sealed ones are packed, their whole
      * closure inside immutable packs? Batched so a whole workspace costs a
@@ -320,29 +623,21 @@ export declare class UserGroundHost {
      * answer is a protocol 16 capability and is required: a missing field
      * means an older gateway, and this machine refuses to guess placement. */
     private sealInventory;
-    private publishPendingSnapshots;
     /** Seal this publication's graph pages. Pages are immutable, content
      * addressed, and already in memory, so the authority's seal inventory alone
      * decides what still has to move and whole pages ride the cargo stream. The
      * head may not commit until every page it newly names is sealed. */
     private uploadGraphPages;
-    private publishLoadedSnapshot;
+    /** Seal a journaled declaration's pages and submit its exact head commit.
+     * Its content sealed before the row was journaled, so only pages move here.
+     * Acceptance clears the row and wakes the ground it held: acceptance is not
+     * an entity delivery, so no delivery would wake it. A non-retryable answer
+     * settles the row as rejected; every other failure leaves it pending with
+     * its outcome unknown. */
+    private submitDeclaration;
+    /** The accepted declaration no longer holds its ground. Acceptance is not
+     * an entity delivery and rings no filesystem event, so it wakes what the
+     * declaration held itself: the core records it added are suspected, and
+     * every lane parked on its root reruns with whatever W owes. */
+    private wakeDeclaration;
 }
-/** The single opener and schema-migration entry for a user ground database.
- * Exported so the upgrade path is provable in isolation — the journal
- * conversion law test opens a legacy file through this exact entry inside a
- * heap-capped child process. */
-export declare function initializeDatabase(file: string): Database.Database;
-/** A local sibling-set change can alter collision-derived disk addresses
- * without changing any portable record. Detect commits its portable truth
- * first, then settles only the affected sibling groups while it still owns
- * their ground cone: it reads exactly those parents and their children, and
- * a relocated subtree by its address range, never the whole ground. Rows
- * move before bytes, matching Apply's recovery law; Watch observes the
- * resulting renames as the same UUIDs at their newly derived addresses and
- * therefore emits no Record. */
-export declare function settleMaterializedSlotAddresses(file: string, parentUUIDs: ReadonlySet<string>): {
-    readonly rowsRead: number;
-    readonly relocatedRoots: number;
-};
-export {};