@amalgm/shell 0.1.87 → 0.1.89

package/dist/user-ground-host.js

@@ -3,7 +3,7 @@ import { existsSync, lstatSync, realpathSync, readFileSync, readdirSync, readlin
 import { open } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { buildUserHomeManifest, buildUserManifest, liveMachineStateDir, scopedAmalgmDir, shippedUserHomeDeclaration, } from "@amalgm/core/identity";
-import { CHUNK_BYTES, CONTENT_CONTRACT, INLINE_CARGO_MAX_BYTES, ENTITY_CLOUD_CONTRACT, ENTITY_CLOUD_SCHEMA_VERSION, artifactForRecord, canonicalVersion, checkContentManifest, classifyDirectory, classifyFile, classifyRegisteredRoot, createLocalEntityRecord, createEntityRecordAuthorityPort, convergeUserGround, createUserGroundEnrollmentPolicy, isRepositoryMetadataEntry, indexRepositoryTerritory, download as downloadArtifact, encodeEntityRecord, EntityApplyRail, EntityRecordRail, membershipHash, parseSnapshot, pathIsSuspect, privateEntityResourceId, rootReplacementFromRecords, sameRecords, snapshotFromRecords, stableJson, travelingRecords, upload as uploadArtifact, userGroundRecords, } from "@amalgm/live";
+import { CHUNK_BYTES, CONTENT_CONTRACT, INLINE_CARGO_MAX_BYTES, ENTITY_CLOUD_CONTRACT, ENTITY_CLOUD_SCHEMA_VERSION, artifactForRecord, canonicalVersion, checkContentManifest, classifyDirectory, classifyFile, classifyRegisteredRoot, createLocalEntityRecord, createEntityRecordAuthorityPort, convergeUserGround, createUserGroundEnrollmentPolicy, isRepositoryMetadataEntry, indexRepositoryTerritory, download as downloadArtifact, encodeEntityRecord, EntityApplyRail, EntityRecordRail, membershipHash, parseSnapshot, pathIsSuspect, privateEntityResourceId, repositoryIdentityHash, rootReplacementFromRecords, sameRecords, snapshotFromRecords, stableJson, travelingRecords, upload as uploadArtifact, userGroundRecords, } from "@amalgm/live";
 import Database from "better-sqlite3";
 import { atomicCopy, atomicWrite, ensurePrivateDir, ensureUserDir } from "./filesystem.js";
 import { emitFilesStage, } from "./files-observability.js";
@@ -18,7 +18,7 @@ import { AcceptedInboxResultIndex } from "./detection/accepted-result.js";
 import { NamedDetectRuntime } from "./detection/runtime.js";
 import { WORKSPACE_UUID as UUID, createFilesRegisterPorts, ensureWorkspaceBinding, ensureWorkspaceReference, pathExists, pathWithin, referenceWorkspaceId, selectKnownRegistrationId, workspaceBindingDir, } from "./files-register-host.js";
 import { applyRepositoryFiles, captureRepository, inspectRepositoryTransportFile, hasGitMarker, readCachedRepositoryIdentity, } from "./git-repository-host.js";
-import { inspectGitRegistration, sameGitIdentity, } from "./git-registration-host.js";
+import { gitEvidenceFingerprint, inspectGitRegistration, sameGitIdentity, } from "./git-registration-host.js";
 import { projectMaterializedGraph } from "./materialized-graph.js";
 import { NodeWatchHost, } from "./watching/index.js";
 import { GroundCoordinator } from "./ground-coordination.js";
@@ -227,6 +227,7 @@ export class UserGroundHost {
             findKnownWorkspaceId: ({ absolutePath, deviceNumber, inode }) => findKnownEntityId(this.databasePath(identity), absolutePath, deviceNumber, inode),
         });
         const add = {
+            sha256Hex,
             lookupRegistry: async () => {
                 const started = performance.now();
                 this.stage({
@@ -1666,7 +1667,8 @@ export class UserGroundHost {
         }
     }
     async publishPendingSnapshotsBeforeLookup(identity, resourceId) {
-        const pending = readSnapshotPublications(this.databasePath(identity));
+        const pending = readSnapshotPublications(this.databasePath(identity))
+            .filter((entry) => entry.status === "pending");
         if (pending.length === 0)
             return;
         const first = pending[0];
@@ -1680,12 +1682,36 @@ export class UserGroundHost {
             checksum: "",
             records: snapshotFromRecords(JSON.parse(first.snapshotJson).records || []).records,
         };
-        await this.publishPendingSnapshots(identity);
+        try {
+            await this.publishPendingSnapshots(identity);
+        }
+        catch (error) {
+            // A conclusive refusal settles the intent as rejected: the lookup that
+            // follows fetches authoritative state and a later register supersedes
+            // the settled row, so a refused publication never wedges startup. An
+            // unknown outcome must keep blocking — the mutation may have landed.
+            if (!conclusivelyRefused(error))
+                throw error;
+            this.cloudState = null;
+        }
     }
     /** Register is the deliberate cold graph-publication boundary. Ordinary
      * Watch detection stops at a durable exact record and never rebuilds this
      * resource snapshot. */
     async publishMaterializedSnapshot(identity, publicationRootIds, trace) {
+        // Any durable pending intent resolves before a new snapshot derives: an
+        // acknowledged publication advances the head through its original
+        // mutation id (the authority answers a known mutation id idempotently),
+        // and a conclusive refusal marks the row rejected so the snapshot
+        // derived below may supersede it. A transport failure keeps the row
+        // pending — its outcome is unknown, so nothing may replace it.
+        try {
+            await this.publishPendingSnapshots(identity, trace);
+        }
+        catch (error) {
+            if (!conclusivelyRefused(error))
+                throw error;
+        }
         const state = this.cloudState;
         if (!state)
             throw new Error("cloud state is unavailable for graph publication");
@@ -1693,7 +1719,7 @@ export class UserGroundHost {
             .map(portableRecord), readGroundRowsForRoots(this.databasePath(identity), "detection_notebook", publicationRootIds)
             .map(portableRecord));
         const merged = mergeMaterializedRoots(state.records, localRecords);
-        const traveling = travelingRecords(merged);
+        const traveling = travelingRecords(merged, sha256Hex);
         const impossibleGitLeaf = traveling.find((record) => (record.type === "file.text" || record.type === "file.binary" || record.type === "link")
             && record.payloadVersion?.startsWith("git:"));
         if (impossibleGitLeaf) {
@@ -1705,16 +1731,6 @@ export class UserGroundHost {
         const checksum = sha256Hex(snapshotJson);
         if (checksum === state.checksum)
             return;
-        const pending = readSnapshotPublications(this.databasePath(identity));
-        const identical = pending.find((entry) => entry.resourceId === state.resourceId
-            && entry.snapshotChecksum === checksum);
-        if (identical) {
-            await this.publishPendingSnapshots(identity, trace);
-            return;
-        }
-        if (pending.length > 0) {
-            throw new Error("a different graph snapshot is already pending publication");
-        }
         const localIds = new Set(localRecords.map((record) => record.uuid));
         const replacementRootIds = localRecords
             .filter((record) => record.parentUUID === null)
@@ -1736,7 +1752,7 @@ export class UserGroundHost {
             const artifact = artifactForRecord(record);
             return artifact !== null && !publishedArtifacts.has(artifact.contentHash);
         });
-        appendSnapshotJournal(this.databasePath(identity), {
+        supersedeSnapshotJournal(this.databasePath(identity), {
             mutationId: randomUUID(),
             resourceId: state.resourceId,
             authorityEpoch: state.authorityEpoch,
@@ -1746,11 +1762,17 @@ export class UserGroundHost {
             uploadRecords,
             replacementRootIds: replacement.rootIds,
             replacementRecords: replacement.records,
+            status: "pending",
         });
         await this.publishPendingSnapshots(identity, trace);
     }
     async publishPendingSnapshots(identity, trace) {
         for (const pending of readSnapshotPublications(this.databasePath(identity))) {
+            // A rejected row is a settled fact, not an intent: the authority
+            // conclusively refused this exact mutation, and only a newer complete
+            // snapshot superseding it can publish this resource again.
+            if (pending.status === "rejected")
+                continue;
             const snapshot = snapshotFromRecords(JSON.parse(pending.snapshotJson).records || []);
             const replacement = rootReplacementFromRecords(pending.replacementRootIds, pending.replacementRecords);
             try {
@@ -1796,6 +1818,13 @@ export class UserGroundHost {
                         durationMs: performance.now() - graphCommitStarted,
                     });
                 }
+                // A non-retryable error frame is the authority's answer: this exact
+                // mutation is refused forever. Settle the row so it is never
+                // replayed and a newer snapshot may supersede it. Every other
+                // failure leaves the outcome unknown and the row pending.
+                if (error instanceof WireRequestError && error.retryable === false) {
+                    markSnapshotJournalRejected(this.databasePath(identity), pending.mutationId);
+                }
                 throw pipelineStageError("cloud graph commit", error);
             }
             if (trace?.journey === "register") {
@@ -2006,13 +2035,21 @@ function initializeDatabase(file) {
       mutation_id TEXT NOT NULL UNIQUE,
       resource_id TEXT NOT NULL,
       publication_json TEXT NOT NULL,
-      created_at INTEGER NOT NULL
+      created_at INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'rejected'))
     );
     CREATE TABLE IF NOT EXISTS workspace_add_intents (
       workspace_uuid TEXT PRIMARY KEY,
       destination_path TEXT NOT NULL UNIQUE,
       intent_json TEXT NOT NULL
     );
+    CREATE TABLE IF NOT EXISTS repository_git_evidence (
+      uuid TEXT PRIMARY KEY,
+      payload_version TEXT NOT NULL,
+      transport_version TEXT NOT NULL,
+      identity_hash TEXT NOT NULL,
+      fingerprint TEXT NOT NULL
+    );
     CREATE INDEX IF NOT EXISTS entities_by_absolute_path
       ON entities(absolute_path);
     CREATE INDEX IF NOT EXISTS entities_by_physical_identity
@@ -2034,6 +2071,10 @@ function initializeDatabase(file) {
     if (!inboxColumns.has("resolved_at")) {
         database.exec("ALTER TABLE record_inbox ADD COLUMN resolved_at INTEGER");
     }
+    const publicationColumns = new Set(database.prepare("PRAGMA table_info(snapshot_publications)").all().map(({ name }) => name));
+    if (!publicationColumns.has("status")) {
+        database.exec("ALTER TABLE snapshot_publications ADD COLUMN status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'rejected'))");
+    }
     database.exec("DROP INDEX IF EXISTS record_inbox_delivery");
     database.exec("DROP TABLE IF EXISTS mutation_journal");
     migratedDatabases.add(file);
@@ -2407,7 +2448,7 @@ function readSnapshotPublications(file) {
     try {
         return database.prepare(`
       SELECT mutation_id AS mutationId, resource_id AS resourceId,
-             publication_json AS publicationJson
+             publication_json AS publicationJson, status
         FROM snapshot_publications ORDER BY sequence
     `).all().map((row) => {
             const publication = JSON.parse(row.publicationJson);
@@ -2428,6 +2469,7 @@ function readSnapshotPublications(file) {
                 uploadRecords: snapshotFromRecords(publication.uploadRecords).records,
                 replacementRootIds: publication.replacementRootIds.map(String),
                 replacementRecords: snapshotFromRecords(publication.replacementRecords).records,
+                status: row.status === "rejected" ? "rejected" : "pending",
             };
         });
     }
@@ -2502,27 +2544,68 @@ function commitDetectedState(file, input) {
         database.close();
     }
 }
-function appendSnapshotJournal(file, entry) {
+/** Journal the newest snapshot publication for its resource. A journal row
+ * has exactly two meanings: `pending` — the submit outcome is unknown, so
+ * the same mutation id must retry until the authority answers (the mutation
+ * may already be accepted with only the acknowledgement lost); `rejected` —
+ * the authority conclusively refused it, so it is never replayed. Only a
+ * rejected row may be superseded — last write wins — and supersession and
+ * insertion share one transaction, so a crash leaves exactly one durable
+ * intent. Content uploads are content-addressed and idempotent, so a
+ * superseded row loses no uploaded work. */
+function supersedeSnapshotJournal(file, entry) {
     const database = initializeDatabase(file);
     try {
-        database.prepare(`
-      INSERT INTO snapshot_publications(
-        mutation_id, resource_id, publication_json, created_at
-      ) VALUES (?, ?, ?, ?)
-    `).run(entry.mutationId, entry.resourceId, stableJson({
-            authorityEpoch: entry.authorityEpoch,
-            baseVersion: entry.baseVersion,
-            snapshotChecksum: entry.snapshotChecksum,
-            snapshotJson: entry.snapshotJson,
-            uploadRecords: entry.uploadRecords,
-            replacementRootIds: entry.replacementRootIds,
-            replacementRecords: entry.replacementRecords,
-        }), Date.now());
+        database.transaction(() => {
+            const unresolved = database.prepare(`
+        SELECT 1 AS present FROM snapshot_publications
+          WHERE resource_id = ? AND status = 'pending' LIMIT 1
+      `).get(entry.resourceId);
+            if (unresolved) {
+                throw new Error("a pending publication with an unknown outcome must resolve before supersession");
+            }
+            database.prepare("DELETE FROM snapshot_publications WHERE resource_id = ? AND status = 'rejected'")
+                .run(entry.resourceId);
+            database.prepare(`
+        INSERT INTO snapshot_publications(
+          mutation_id, resource_id, publication_json, created_at
+        ) VALUES (?, ?, ?, ?)
+      `).run(entry.mutationId, entry.resourceId, stableJson({
+                authorityEpoch: entry.authorityEpoch,
+                baseVersion: entry.baseVersion,
+                snapshotChecksum: entry.snapshotChecksum,
+                snapshotJson: entry.snapshotJson,
+                uploadRecords: entry.uploadRecords,
+                replacementRootIds: entry.replacementRootIds,
+                replacementRecords: entry.replacementRecords,
+            }), Date.now());
+        })();
     }
     finally {
         database.close();
     }
 }
+/** Settle a journal row as conclusively refused. It is never replayed again;
+ * a newer complete snapshot supersedes it on the next publication. */
+function markSnapshotJournalRejected(file, mutationId) {
+    const database = initializeDatabase(file);
+    try {
+        database.prepare("UPDATE snapshot_publications SET status = 'rejected' WHERE mutation_id = ?")
+            .run(mutationId);
+    }
+    finally {
+        database.close();
+    }
+}
+/** True when the authority itself answered that this exact mutation is
+ * refused (a non-retryable error frame), as opposed to a transport or
+ * pipeline failure whose outcome is unknown. Stage wrappers carry the wire
+ * error as their cause. */
+function conclusivelyRefused(error) {
+    if (error instanceof WireRequestError)
+        return error.retryable === false;
+    return error instanceof Error && conclusivelyRefused(error.cause);
+}
 function deleteJournalEntry(file, mutationId) {
     const database = initializeDatabase(file);
     try {
@@ -2666,6 +2749,45 @@ function runGroundUpsert(database, table, statement, row) {
             + `occupied by ${occupant?.uuid ?? "no retained row"} (${occupant?.absolutePath ?? "unknown"})`, { cause: error });
     }
 }
+/** The Git-evidence fingerprint proven by the last successful capture, bound
+ * to the exact heads AND the exact identity map it certified. A stored
+ * fingerprint only gates when the stored root row still carries the same
+ * heads and the current rows still derive the same identity map, so neither a
+ * capture whose detection never reached the table nor a raced base rollback
+ * can silence a real change. */
+function readSealedRepositoryEvidence(file, uuid) {
+    const database = initializeDatabase(file);
+    try {
+        return database.prepare(`
+      SELECT payload_version AS payloadVersion,
+             transport_version AS transportVersion,
+             identity_hash AS identityHash,
+             fingerprint
+        FROM repository_git_evidence WHERE uuid = ?
+    `).get(uuid) ?? null;
+    }
+    finally {
+        database.close();
+    }
+}
+function writeSealedRepositoryEvidence(file, uuid, evidence) {
+    const database = initializeDatabase(file);
+    try {
+        database.prepare(`
+      INSERT INTO repository_git_evidence
+        (uuid, payload_version, transport_version, identity_hash, fingerprint)
+      VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(uuid) DO UPDATE SET
+        payload_version = excluded.payload_version,
+        transport_version = excluded.transport_version,
+        identity_hash = excluded.identity_hash,
+        fingerprint = excluded.fingerprint
+    `).run(uuid, evidence.payloadVersion, evidence.transportVersion, evidence.identityHash, evidence.fingerprint);
+    }
+    finally {
+        database.close();
+    }
+}
 function persistRows(file, identity, resourceId, rootUUID, rows, previousRows = [], options = {}) {
     const database = initializeDatabase(file);
     try {
@@ -3136,16 +3258,25 @@ async function reconcileRoot(input) {
     let rootRepositoryEvidence = null;
     let rootRepositoryInspectionFailed = false;
     if (rootType === "repo.git") {
-        evidence && (evidence.gitInspections += 1);
-        try {
-            // A Git metadata ring can arrive before the corresponding worktree
-            // ring. Git already knows every dirty tracked and untracked path, so
-            // those paths join this observation and Card + Checkpoint cannot carry
-            // stale identity.
-            rootRepositoryEvidence = inspectGitRegistration(rootPath);
-        }
-        catch {
-            rootRepositoryInspectionFailed = true;
+        // On a complete pass whose Git state files are unchanged since the last
+        // sealed capture, the up-front dirty-path evidence would only re-prove
+        // what the stored rows already hold. The walk's lazy inspection still
+        // asks Git the moment any entry is actually observed.
+        const sealed = suspects === null
+            ? readSealedRepositoryEvidence(database, rootUUID)
+            : null;
+        if (sealed === null || sealed.fingerprint !== gitEvidenceFingerprint(rootPath)) {
+            evidence && (evidence.gitInspections += 1);
+            try {
+                // A Git metadata ring can arrive before the corresponding worktree
+                // ring. Git already knows every dirty tracked and untracked path, so
+                // those paths join this observation and Card + Checkpoint cannot carry
+                // stale identity.
+                rootRepositoryEvidence = inspectGitRegistration(rootPath);
+            }
+            catch {
+                rootRepositoryInspectionFailed = true;
+            }
         }
     }
     const normalizedSuspects = suspects === null ? null : suspects.map((path) => {
@@ -3401,7 +3532,25 @@ async function reconcileRoot(input) {
         }
     };
     await visit(rootPath, rootUUID, rootType);
-    const resolvedIdentity = reconcileGroundUUIDs(existingRows.map((row) => ({
+    // When every entry sits at its stored address with its stored type and
+    // physical fingerprint (honoring any fixed UUID), path-first claiming makes
+    // the multi-pass reconciliation the identity map — resolve directly. Any
+    // single mismatch falls back to the full algorithm.
+    const stableIdentity = () => {
+        const resolved = new Map();
+        for (const entry of entries) {
+            const row = existingByPath.get(entry.relativePath);
+            if (!row
+                || row.type !== entry.type
+                || row.deviceNumber !== entry.deviceNumber
+                || row.inode !== entry.inode
+                || (entry.fixedUUID !== undefined && entry.fixedUUID !== row.uuid))
+                return null;
+            resolved.set(entry.relativePath, row.uuid);
+        }
+        return resolved;
+    };
+    const resolvedIdentity = stableIdentity() ?? reconcileGroundUUIDs(existingRows.map((row) => ({
         uuid: row.uuid,
         type: row.type,
         relativePath: row.relativePath,
@@ -3435,22 +3584,36 @@ async function reconcileRoot(input) {
         group.push({ uuid: entry.uuid, name: entry.name });
         children.set(entry.parentUUID, group);
     }
+    // canonicalVersion is a pure function of these identity inputs, so a stored
+    // leaf row whose inputs are unchanged already holds the exact version —
+    // recomputing 70k hashes on a stable restart pass proved nothing. Container
+    // versions still derive from live membership, which is never persisted.
+    const existingVersionByUuid = new Map(existingRows.map((row) => [row.uuid, row]));
     const rowsFromEntries = () => entries.map((entry) => {
-        const versionPayload = entry.type === "workspace" || entry.type === "folder"
-            ? membershipHash(children.get(entry.uuid) ?? [], sha256Hex)
-            : entry.payloadVersion;
+        const container = entry.type === "workspace" || entry.type === "folder";
+        const stored = container ? undefined : existingVersionByUuid.get(entry.uuid);
+        const storedVersion = stored !== undefined
+            && stored.type === entry.type
+            && stored.parentUUID === entry.parentUUID
+            && stored.name === entry.name
+            && stored.status === "active"
+            && stored.payloadVersion === entry.payloadVersion
+            ? stored.version
+            : null;
         const record = {
             uuid: entry.uuid,
             type: entry.type,
             parentUUID: entry.parentUUID,
             name: entry.name,
             status: "active",
-            version: canonicalVersion({
+            version: storedVersion ?? canonicalVersion({
                 type: entry.type,
                 parentUUID: entry.parentUUID,
                 name: entry.name,
                 status: "active",
-                payloadVersion: versionPayload,
+                payloadVersion: container
+                    ? membershipHash(children.get(entry.uuid) ?? [], sha256Hex)
+                    : entry.payloadVersion,
             }, sha256Hex),
             payloadVersion: entry.payloadVersion,
             transportVersion: entry.transportVersion,
@@ -3552,15 +3715,51 @@ async function reconcileRoot(input) {
                 }))
                     .sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
             };
-            let repoIdentity = await refreshRepositoryIdentity();
-            /* The rows and the transport identity are derived from the same fresh
-             * worktree evidence. A later Watch ring for one of these dirty paths is
-             * therefore ordinary equality, not a transport-only echo. */
             const priorRow = existingByPath.get(repository.relativePath);
             if (priorRow?.type === "repo.git") {
                 repository.payloadVersion = priorRow.payloadVersion;
                 repository.transportVersion = priorRow.transportVersion;
             }
+            // A complete pass re-proves a repository through Git unless Git's own
+            // state files still match the fingerprint sealed with the exact heads
+            // the stored row carries AND every owned entry sits unchanged at its
+            // stored physical identity. Both together mean capture would derive the
+            // rows this scan already holds; any single doubt asks Git in full.
+            const unchangedSinceSeal = (entry) => {
+                const row = existingByPath.get(entry.relativePath);
+                return row !== undefined
+                    && row.uuid === entry.uuid
+                    && row.type === entry.type
+                    && row.payloadVersion === entry.payloadVersion
+                    && row.deviceNumber === entry.deviceNumber
+                    && row.inode === entry.inode
+                    && row.byteSize === entry.byteSize
+                    && row.modifiedTimeMs === entry.modifiedTimeMs
+                    && row.changedTimeMs === entry.changedTimeMs
+                    && row.filesystemMode === entry.filesystemMode;
+            };
+            if (scanSuspects === null
+                && priorRow?.type === "repo.git" && priorRow.payloadVersion && priorRow.transportVersion) {
+                const sealed = readSealedRepositoryEvidence(database, repository.uuid);
+                if (sealed !== null
+                    && sealed.payloadVersion === priorRow.payloadVersion
+                    && sealed.transportVersion === priorRow.transportVersion
+                    && sealed.fingerprint === gitEvidenceFingerprint(repository.absolutePath)
+                    && ownedEntries.every(unchangedSinceSeal)
+                    && sealed.identityHash === repositoryIdentityHash(ownedEntries.map((entry) => ({
+                        path: repositoryPath(entry),
+                        uuid: entry.uuid,
+                        type: entry.type,
+                        payloadVersion: entry.type === "repo.git" ? null : entry.payloadVersion,
+                    })), sha256Hex)) {
+                    continue;
+                }
+            }
+            const fingerprintBefore = gitEvidenceFingerprint(repository.absolutePath);
+            let repoIdentity = await refreshRepositoryIdentity();
+            /* The rows and the transport identity are derived from the same fresh
+             * worktree evidence. A later Watch ring for one of these dirty paths is
+             * therefore ordinary equality, not a transport-only echo. */
             let prior = null;
             let priorLayout = null;
             if (priorRow?.type === "repo.git" && priorRow.payloadVersion && priorRow.transportVersion) {
@@ -3637,6 +3836,18 @@ async function reconcileRoot(input) {
                 parentTransportVersion: currentLayout.parentTransportVersion,
                 transportVersion: captured.transportVersion,
             });
+            // The fingerprint is only sealed when Git's state files did not move
+            // while capture ran; a concurrent ref or index write leaves no seal and
+            // the next complete pass asks Git again.
+            if (fingerprintBefore !== null
+                && fingerprintBefore === gitEvidenceFingerprint(repository.absolutePath)) {
+                writeSealedRepositoryEvidence(database, repository.uuid, {
+                    payloadVersion: captured.stateId,
+                    transportVersion: captured.transportVersion,
+                    identityHash: repositoryIdentityHash(repoIdentity, sha256Hex),
+                    fingerprint: fingerprintBefore,
+                });
+            }
         }
     }
     catch {
@@ -4251,7 +4462,7 @@ async function installCloudWorkspace(input) {
         }
         const expectedRecords = pending?.records ?? records;
         const localRecords = existing.map(portableRecord);
-        if (!sameRecords(travelingRecords(localRecords), expectedRecords)) {
+        if (!sameRecords(travelingRecords(localRecords, sha256Hex), expectedRecords)) {
             throw new Error(`local workspace ${workspace.uuid} differs from its cloud graph`);
         }
         if (pending && root.absolutePath !== pending.destinationPath) {