@hraness/sponge 0.2.6 → 0.3.0

package/dist/src/acquisition/normalize.js

@@ -1,15 +1,20 @@
 import { articleMetadata, articleMetadataWarnings } from '../metadata/article.js';
 import { limits } from '../../contracts/index.js';
 import { validateCapture, validateAsset } from '../../contracts/validate.js';
-import { readConfined, hash } from './files.js';
-export function object(value) { if (!value || typeof value !== 'object' || Array.isArray(value))
-    throw Error('integrity'); return value; }
+import { readConfined } from './files.js';
+import { sha256 as hash } from '../util/hash.js';
+import { SpongeError } from '../errors.js';
+export function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new SpongeError('integrity');
+    return value;
+}
 export function metadataFromMarkdown(markdown, observedAt) {
     if (!markdown.startsWith('---\n'))
         return [];
     const end = markdown.indexOf('\n---', 4);
     if (end < 0 || Buffer.byteLength(markdown.slice(0, end)) > limits.metadataBytes)
-        throw Error('limit-exceeded');
+        throw new SpongeError('limit-exceeded');
     const claims = [];
     for (const line of markdown.slice(4, end).split('\n')) {
         const match = /^(title|author|description|published|canonical_url|language): (".*")$/.exec(line);
@@ -24,39 +29,73 @@ export function metadataFromMarkdown(markdown, observedAt) {
 }
 export async function normalizeBundle(input) {
     const verified = object(input.inspection), inspection = object(verified.inspection), document = object(inspection.document), summary = object(input.summary);
-    if (verified.ok !== true || inspection.schemaVersion !== 4 || document.integrity !== 'verified' || !Array.isArray(inspection.assets) || inspection.assets.some(a => object(a).integrity !== 'verified'))
-        throw Error('integrity');
+    if (verified.ok !== true ||
+        inspection.schemaVersion !== 4 ||
+        document.integrity !== 'verified' ||
+        !Array.isArray(inspection.assets) ||
+        inspection.assets.some((a) => object(a).integrity !== 'verified'))
+        throw new SpongeError('integrity');
     const manifestBytes = await readConfined(input.bundleRoot, 'capture.json', limits.metadataBytes), manifest = object(JSON.parse(manifestBytes.toString()));
-    if (manifest.schemaVersion !== 4 || manifest.sourceUrl !== input.sourceUrl || inspection.sourceUrl !== input.sourceUrl)
-        throw Error('integrity');
+    if (manifest.schemaVersion !== 4 ||
+        manifest.sourceUrl !== input.sourceUrl ||
+        inspection.sourceUrl !== input.sourceUrl)
+        throw new SpongeError('integrity');
     const documentRecord = object(manifest.document);
-    const markdown = { relativePath: String(documentRecord.path), sha256: String(documentRecord.sha256), bytes: Number(documentRecord.bytes), mediaType: 'text/markdown' };
+    const markdown = {
+        relativePath: String(documentRecord.path),
+        sha256: String(documentRecord.sha256),
+        bytes: Number(documentRecord.bytes),
+        mediaType: 'text/markdown',
+    };
     validateAsset(markdown);
     const bytes = await readConfined(input.bundleRoot, markdown.relativePath, limits.markdownBytes);
     if (bytes.length !== markdown.bytes || hash(bytes) !== markdown.sha256 || document.sha256 !== markdown.sha256)
-        throw Error('integrity');
-    if (!Array.isArray(manifest.assets) || manifest.assets.length > limits.imagesPerItem || manifest.assets.length !== inspection.assets.length)
-        throw Error('limit-exceeded');
+        throw new SpongeError('integrity');
+    if (!Array.isArray(manifest.assets) ||
+        manifest.assets.length > limits.imagesPerItem ||
+        manifest.assets.length !== inspection.assets.length)
+        throw new SpongeError('limit-exceeded');
     const assets = [];
     for (const raw of manifest.assets) {
         const item = object(raw);
-        const asset = { relativePath: String(item.path), sha256: String(item.sha256), bytes: Number(item.bytes), mediaType: String(item.mimeType) };
+        const asset = {
+            relativePath: String(item.path),
+            sha256: String(item.sha256),
+            bytes: Number(item.bytes),
+            mediaType: String(item.mimeType),
+        };
         validateAsset(asset);
         if (!asset.mediaType.startsWith('image/') || asset.bytes > limits.imageBytes)
-            throw Error('limit-exceeded');
-        const checked = inspection.assets.find(a => object(a).path === asset.relativePath);
+            throw new SpongeError('limit-exceeded');
+        const checked = inspection.assets.find((a) => object(a).path === asset.relativePath);
         if (!checked || object(checked).expectedSha256 !== asset.sha256 || object(checked).expectedBytes !== asset.bytes)
-            throw Error('integrity');
+            throw new SpongeError('integrity');
         assets.push(asset);
     }
     const images = object(object(manifest.artifacts).images);
     if (!['captured', 'partial', 'not-requested'].includes(String(images.status)))
-        throw Error('integrity');
+        throw new SpongeError('integrity');
     const text = manifest.status === 'complete' && summary.status === 'complete' ? 'complete' : 'partial';
     const imageStatus = images.status === 'partial' ? 'partial' : images.status === 'not-requested' ? 'not-requested' : 'complete';
     const metadataWarnings = manifest.metadata === undefined ? [] : articleMetadataWarnings(manifest.metadata);
     const partial = text === 'partial' || imageStatus === 'partial' || metadataWarnings.length > 0;
-    const capture = { schemaVersion: 1, requestId: input.requestId, kind: 'article', status: partial ? 'partial' : 'complete', sourceUrl: input.sourceUrl, markdown, assets, metadataWarnings, metadata: manifest.metadata === undefined ? metadataFromMarkdown(bytes.toString('utf8'), String(manifest.capturedAt)) : articleMetadata(manifest.metadata, String(manifest.capturedAt)), warnings: partial ? ['partial'] : [], extractor: { name: 'wordcell', version: input.wordcellVersion }, manifestSha256: hash(manifestBytes), completeness: { text, images: imageStatus } };
+    const capture = {
+        schemaVersion: 1,
+        requestId: input.requestId,
+        kind: 'article',
+        status: partial ? 'partial' : 'complete',
+        sourceUrl: input.sourceUrl,
+        markdown,
+        assets,
+        metadataWarnings,
+        metadata: manifest.metadata === undefined
+            ? metadataFromMarkdown(bytes.toString('utf8'), String(manifest.capturedAt))
+            : articleMetadata(manifest.metadata, String(manifest.capturedAt)),
+        warnings: partial ? ['partial'] : [],
+        extractor: { name: 'wordcell', version: input.wordcellVersion },
+        manifestSha256: hash(manifestBytes),
+        completeness: { text, images: imageStatus },
+    };
     validateCapture(capture);
     return capture;
 }

package/dist/src/acquisition/pins.js

@@ -2,8 +2,26 @@ import { captureLockfile } from './lock.js';
 /** Immutable released media/PDF capability pins; installed qualification is recorded separately. */
 export const defaultCapturePins = {
     id: 'capture-ghostget-0.18.102-bun-1.3.14-darwin-arm64',
-    ghostget: { version: '0.18.102', url: 'https://github.com/hraness/ghostget/releases/download/v0.18.102/hraness-ghostget-0.18.102.tgz', bytes: 12493537, sha256: '68edcad50b72f77b2ed73e9affba3b49e6b683622cdec9e2fabdffa90e3a0bdb' },
-    wordcell: { version: '0.27.0', url: 'https://github.com/hraness/wordcell/releases/download/v0.27.0/hraness-wordcell-0.27.0.tgz', bytes: 1465897, sha256: 'df47868147cda46d741895d3cd1ddcbec14a563b341aa09052545be7696c9262' },
-    bun: { version: '1.3.14', url: 'https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-darwin-aarch64.zip', bytes: 23586433, sha256: 'd8b96221828ad6f97ac7ac0ab7e95872341af763001e8803e8267652c2652620', executableSha256: 'e0c90ec15d33363e6b70713d56bc3b2c7585c17f40a0fe0f8fd9305901d4e233', archiveExecutable: 'bun-darwin-aarch64/bun' },
-    lockfile: captureLockfile, lockSha256: "456370c26a7286bab70307595745f4be382a684a11223e848dbb0032761d59d0",
+    ghostget: {
+        version: '0.18.102',
+        url: 'https://github.com/hraness/ghostget/releases/download/v0.18.102/hraness-ghostget-0.18.102.tgz',
+        bytes: 12493537,
+        sha256: '68edcad50b72f77b2ed73e9affba3b49e6b683622cdec9e2fabdffa90e3a0bdb',
+    },
+    wordcell: {
+        version: '0.27.0',
+        url: 'https://github.com/hraness/wordcell/releases/download/v0.27.0/hraness-wordcell-0.27.0.tgz',
+        bytes: 1465897,
+        sha256: 'df47868147cda46d741895d3cd1ddcbec14a563b341aa09052545be7696c9262',
+    },
+    bun: {
+        version: '1.3.14',
+        url: 'https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-darwin-aarch64.zip',
+        bytes: 23586433,
+        sha256: 'd8b96221828ad6f97ac7ac0ab7e95872341af763001e8803e8267652c2652620',
+        executableSha256: 'e0c90ec15d33363e6b70713d56bc3b2c7585c17f40a0fe0f8fd9305901d4e233',
+        archiveExecutable: 'bun-darwin-aarch64/bun',
+    },
+    lockfile: captureLockfile,
+    lockSha256: '456370c26a7286bab70307595745f4be382a684a11223e848dbb0032761d59d0',
 };

package/dist/src/acquisition/process.js

@@ -3,34 +3,56 @@ import { spawn } from 'node:child_process';
 export async function runOwned(executable, args, options) {
     if (options.signal?.aborted)
         return { code: null, stdout: '', stopped: 'cancelled', cleanup: 'settled' };
-    return new Promise(resolve => {
-        const child = spawn(executable, [...args], { cwd: options.cwd, env: options.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' });
+    return new Promise((resolve) => {
+        const child = spawn(executable, [...args], {
+            cwd: options.cwd,
+            env: options.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: process.platform !== 'win32',
+        });
         const stdout = [];
         let bytes = 0, stopped, escalation, finished = false;
-        const exists = () => { if (!child.pid)
-            return false; try {
-            process.kill(process.platform === 'win32' ? child.pid : -child.pid, 0);
-            return true;
-        }
-        catch (e) {
-            return e.code !== 'ESRCH';
-        } };
-        const send = (signal) => { if (!child.pid)
-            return; try {
-            process.kill(process.platform === 'win32' ? child.pid : -child.pid, signal);
-        }
-        catch { } };
-        const stop = (reason) => { stopped ??= reason; if (escalation)
-            return; send('SIGTERM'); escalation = setTimeout(() => send('SIGKILL'), options.graceMs ?? 5000); };
+        const exists = () => {
+            if (!child.pid)
+                return false;
+            try {
+                process.kill(process.platform === 'win32' ? child.pid : -child.pid, 0);
+                return true;
+            }
+            catch (e) {
+                return e.code !== 'ESRCH';
+            }
+        };
+        const send = (signal) => {
+            if (!child.pid)
+                return;
+            try {
+                process.kill(process.platform === 'win32' ? child.pid : -child.pid, signal);
+            }
+            catch { }
+        };
+        const stop = (reason) => {
+            stopped ??= reason;
+            if (escalation)
+                return;
+            send('SIGTERM');
+            escalation = setTimeout(() => send('SIGKILL'), options.graceMs ?? 5000);
+        };
         const abort = () => stop('cancelled');
         options.signal?.addEventListener('abort', abort, { once: true });
         const timer = setTimeout(() => stop('unavailable'), options.deadlineMs);
-        child.stdout.on('data', (data) => { bytes += data.length; if (bytes > options.maxOutputBytes)
-            stop('limit-exceeded');
-        else
-            stdout.push(data); });
-        child.stderr.on('data', (data) => { bytes += data.length; if (bytes > options.maxOutputBytes)
-            stop('limit-exceeded'); });
+        child.stdout.on('data', (data) => {
+            bytes += data.length;
+            if (bytes > options.maxOutputBytes)
+                stop('limit-exceeded');
+            else
+                stdout.push(data);
+        });
+        child.stderr.on('data', (data) => {
+            bytes += data.length;
+            if (bytes > options.maxOutputBytes)
+                stop('limit-exceeded');
+        });
         const finish = async (code) => {
             if (finished)
                 return;
@@ -43,21 +65,37 @@ export async function runOwned(executable, args, options) {
                 send('SIGTERM');
                 const end = Date.now() + 500;
                 while (exists() && Date.now() < end)
-                    await new Promise(r => setTimeout(r, 10));
+                    await new Promise((r) => setTimeout(r, 10));
                 if (exists())
                     send('SIGKILL');
             }
             const end = Date.now() + 1500;
             while (exists() && Date.now() < end)
-                await new Promise(r => setTimeout(r, 10));
-            resolve({ code, stdout: Buffer.concat(stdout).toString('utf8'), stopped, cleanup: exists() ? 'pending' : 'settled' });
+                await new Promise((r) => setTimeout(r, 10));
+            resolve({
+                code,
+                stdout: Buffer.concat(stdout).toString('utf8'),
+                stopped,
+                cleanup: exists() ? 'pending' : 'settled',
+            });
         };
-        child.once('error', () => { stopped ??= 'unavailable'; void finish(null); });
-        child.once('close', code => void finish(code));
+        child.once('error', () => {
+            stopped ??= 'unavailable';
+            void finish(null);
+        });
+        child.once('close', (code) => void finish(code));
         if (options.signal?.aborted)
             abort();
     });
 }
 export function isolatedEnvironment(home, tmp, stateHome) {
-    return { HRANESS_NO_UPDATE: '1', HOME: home, TMPDIR: tmp, GHOSTGET_STATE_HOME: stateHome, PATH: '/usr/bin:/bin:/usr/sbin:/sbin', LANG: 'en_US.UTF-8', NO_COLOR: '1' };
+    return {
+        HRANESS_NO_UPDATE: '1',
+        HOME: home,
+        TMPDIR: tmp,
+        GHOSTGET_STATE_HOME: stateHome,
+        PATH: '/usr/bin:/bin:/usr/sbin:/sbin',
+        LANG: 'en_US.UTF-8',
+        NO_COLOR: '1',
+    };
 }

package/dist/src/acquisition/runtime.d.ts

@@ -1,5 +1,4 @@
-import type { ErrorCode } from '../../contracts/index.js';
-export interface DownloadPin {
+interface DownloadPin {
     url: string;
     sha256: string;
     bytes: number;
@@ -37,12 +36,11 @@ export interface SetupPlan {
     requiredFreeBytes: number;
     capabilities: string[];
 }
-export declare class CaptureSetupError extends Error {
-    readonly code: ErrorCode;
-    readonly recoveryRoot?: string | undefined;
-    constructor(code: ErrorCode, recoveryRoot?: string | undefined);
-}
 export declare function captureSetupPlan(pins: CapturePins): SetupPlan;
+/** Full inventory walks performed by this process (observability for tests). */
+export declare const runtimeVerification: {
+    fullWalks: number;
+};
 declare function provisionRuntime(options: {
     runtimeRoot: string;
     pins: CapturePins;

package/dist/src/acquisition/runtime.js

@@ -1,16 +1,9 @@
-import { mkdir, mkdtemp, writeFile, rename, rm, chmod, statfs, lstat, readdir, readlink, realpath } from 'node:fs/promises';
+import { mkdir, mkdtemp, writeFile, rename, rm, chmod, statfs, lstat, readdir, readlink, realpath, } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 import { runOwned, isolatedEnvironment } from './process.js';
-import { hash, privateRoot, readConfined, physicalBytes } from './files.js';
-export class CaptureSetupError extends Error {
-    code;
-    recoveryRoot;
-    constructor(code, recoveryRoot) {
-        super(code);
-        this.code = code;
-        this.recoveryRoot = recoveryRoot;
-    }
-}
+import { privateRoot, readConfined, physicalBytes } from './files.js';
+import { sha256 as hash } from '../util/hash.js';
+import { SpongeError } from '../errors.js';
 // Retained inventory excludes the isolated Bun cache and temporary Bun zip.
 const budget = 1024 ** 3;
 const stagingBudget = 2 * budget;
@@ -18,35 +11,53 @@ const stagingBudget = 2 * budget;
 const installDeadlineMs = 30 * 60 * 1000;
 function checkPins(pins) {
     if (!/^[a-z0-9][a-z0-9.-]{0,99}$/.test(pins.id) || hash(pins.lockfile) !== pins.lockSha256)
-        throw new CaptureSetupError('invalid-input');
+        throw new SpongeError('invalid-input');
     for (const pin of [pins.bun, pins.ghostget, pins.wordcell]) {
         let url;
         try {
             url = new URL(pin.url);
         }
         catch {
-            throw new CaptureSetupError('invalid-input');
+            throw new SpongeError('invalid-input');
         }
-        if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.-]+)?$/.test(pin.version) || !/^[a-f0-9]{64}$/.test(pin.sha256) || !Number.isSafeInteger(pin.bytes) || pin.bytes < 1 || pin.bytes > budget || url.protocol !== 'https:' || url.username || url.password)
-            throw new CaptureSetupError('invalid-input');
+        if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.-]+)?$/.test(pin.version) ||
+            !/^[a-f0-9]{64}$/.test(pin.sha256) ||
+            !Number.isSafeInteger(pin.bytes) ||
+            pin.bytes < 1 ||
+            pin.bytes > budget ||
+            url.protocol !== 'https:' ||
+            url.username ||
+            url.password)
+            throw new SpongeError('invalid-input');
     }
-    if (!/^[a-z0-9][a-z0-9.-]*\/bun$/.test(pins.bun.archiveExecutable) || !/^[a-f0-9]{64}$/.test(pins.bun.executableSha256))
-        throw new CaptureSetupError('invalid-input');
+    if (!/^[a-z0-9][a-z0-9.-]*\/bun$/.test(pins.bun.archiveExecutable) ||
+        !/^[a-f0-9]{64}$/.test(pins.bun.executableSha256))
+        throw new SpongeError('invalid-input');
 }
 export function captureSetupPlan(pins) {
     checkPins(pins);
     const artifacts = [pins.bun, pins.ghostget, pins.wordcell], downloadBytes = artifacts.reduce((n, a) => n + a.bytes, 0);
-    return { artifacts, downloadBytes, installationBudgetBytes: budget, stagingBudgetBytes: stagingBudget, installationBudgetKind: 'monitored', installationDeadlineMs: installDeadlineMs, dependencyDownloads: 'frozen-lock', requiredFreeBytes: 2 * 1024 ** 3 + budget + stagingBudget + downloadBytes, capabilities: ['article-http', 'selected-ghostget-account', 'selected-attached-browser', 'verified-offline-images'] };
+    return {
+        artifacts,
+        downloadBytes,
+        installationBudgetBytes: budget,
+        stagingBudgetBytes: stagingBudget,
+        installationBudgetKind: 'monitored',
+        installationDeadlineMs: installDeadlineMs,
+        dependencyDownloads: 'frozen-lock',
+        requiredFreeBytes: 2 * 1024 ** 3 + budget + stagingBudget + downloadBytes,
+        capabilities: ['article-http', 'selected-ghostget-account', 'selected-attached-browser', 'verified-offline-images'],
+    };
 }
 async function download(pin, path, signal) {
     const boundedSignal = signal ? AbortSignal.any([signal, AbortSignal.timeout(120000)]) : AbortSignal.timeout(120000);
     const response = await fetch(pin.url, { signal: boundedSignal });
     if (!response.ok || !response.body || new URL(response.url).protocol !== 'https:')
-        throw new CaptureSetupError('unavailable');
+        throw new SpongeError('unavailable');
     const declared = response.headers.get('content-length');
     if (declared !== null && Number(declared) !== pin.bytes) {
         await response.body.cancel();
-        throw new CaptureSetupError('integrity');
+        throw new SpongeError('integrity');
     }
     // Primary release artifacts are small, fixed byte records. Never write an unchecked chunk.
     const chunks = [];
@@ -54,16 +65,17 @@ async function download(pin, path, signal) {
     for await (const chunk of response.body) {
         bytes += chunk.length;
         if (bytes > pin.bytes)
-            throw new CaptureSetupError('integrity');
+            throw new SpongeError('integrity');
         chunks.push(chunk);
     }
     const data = Buffer.concat(chunks);
     if (bytes !== pin.bytes || hash(data) !== pin.sha256)
-        throw new CaptureSetupError('integrity');
+        throw new SpongeError('integrity');
     await writeFile(path, data, { mode: 0o600, flag: 'wx' });
 }
-async function inventory(root) {
-    const entries = [];
+/** Hashes every retained byte when `full`; always records a stat line per entry (ctime cannot be set from user space). */
+async function inventory(root, full = true) {
+    const entries = [], stats = [];
     let total = 0, count = 0;
     async function visit(dir) {
         for (const name of (await readdir(dir)).sort()) {
@@ -71,44 +83,66 @@ async function inventory(root) {
             if (rel === 'runtime-receipt.json')
                 continue;
             if (++count > 60000)
-                throw new CaptureSetupError('limit-exceeded');
-            const stat = await lstat(path);
-            total += stat.size;
+                throw new SpongeError('limit-exceeded');
+            const stat = await lstat(path, { bigint: true });
+            stats.push(statLine(rel, stat));
+            total += Number(stat.size);
             if (total > budget)
-                throw new CaptureSetupError('limit-exceeded');
+                throw new SpongeError('limit-exceeded');
             if (stat.isDirectory())
                 await visit(path);
+            else if (!full)
+                continue;
             else if (stat.isSymbolicLink()) {
                 const target = await realpath(path);
                 if (!target.startsWith(root + '/'))
-                    throw new CaptureSetupError('integrity');
+                    throw new SpongeError('integrity');
                 entries.push(`${rel}\0link\0${await readlink(path)}`);
             }
             else if (stat.isFile())
-                entries.push(`${rel}\0${hash(await readConfined(root, rel, budget - total + stat.size))}`);
+                entries.push(`${rel}\0${hash(await readConfined(root, rel, budget - total + Number(stat.size)))}`);
             else
-                throw new CaptureSetupError('integrity');
+                throw new SpongeError('integrity');
         }
     }
     await visit(root);
-    return hash(entries.join('\n'));
+    return { sha256: hash(entries.join('\n')), stats };
 }
+const statLine = (rel, s) => `${rel}\0${s.dev}\0${s.ino}\0${s.mode}\0${s.uid}\0${s.size}\0${s.mtimeNs}\0${s.ctimeNs}`;
+// One full verify per process and runtime; later uses compare only the stat receipt and fall back to a full verify on any difference.
+const verified = new Map();
+/** Full inventory walks performed by this process (observability for tests). */
+export const runtimeVerification = { fullWalks: 0 };
 async function inspectRuntime(root, pins) {
     checkPins(pins);
     await privateRoot(root);
-    const receipt = JSON.parse((await readConfined(root, 'runtime-receipt.json', 4096)).toString());
-    if (receipt.schemaVersion !== 1 || receipt.pinId !== pins.id || receipt.lockSha256 !== pins.lockSha256 || receipt.inventorySha256 !== await inventory(root))
-        throw new CaptureSetupError('integrity');
-    const bun = join(root, pins.bun.archiveExecutable), ghostget = join(root, 'node_modules/@hraness/ghostget/src/cli.ts');
+    const key = JSON.stringify([root, pins.id, pins.lockSha256, pins.bun.archiveExecutable, pins.bun.executableSha256]), bun = join(root, pins.bun.archiveExecutable), ghostget = join(root, 'node_modules/@hraness/ghostget/src/cli.ts');
+    // Stat receipt of the root, its receipt file and every inventoried entry. Each stat precedes any read of its entry, so a later change always shows.
+    const head = [
+        statLine('.', await lstat(root, { bigint: true })),
+        statLine('runtime-receipt.json', await lstat(join(root, 'runtime-receipt.json'), { bigint: true })),
+    ];
+    const cached = verified.get(key);
+    if (cached !== undefined && cached === hash([...head, ...(await inventory(root, false)).stats].join('\n')))
+        return { root, bun, ghostget, pins };
+    verified.delete(key);
+    runtimeVerification.fullWalks++;
+    const receipt = JSON.parse((await readConfined(root, 'runtime-receipt.json', 4096)).toString()), walked = await inventory(root);
+    if (receipt.schemaVersion !== 1 ||
+        receipt.pinId !== pins.id ||
+        receipt.lockSha256 !== pins.lockSha256 ||
+        receipt.inventorySha256 !== walked.sha256)
+        throw new SpongeError('integrity');
     if (hash(await readConfined(root, pins.bun.archiveExecutable, 128 * 1024 ** 2)) !== pins.bun.executableSha256)
-        throw new CaptureSetupError('integrity');
+        throw new SpongeError('integrity');
+    verified.set(key, hash([...head, ...walked.stats].join('\n')));
     return { root, bun, ghostget, pins };
 }
 async function provisionRuntime(options) {
     const { pins, signal } = options, plan = captureSetupPlan(pins);
     options.onPlan?.(plan);
     if (process.platform !== 'darwin' || process.arch !== 'arm64')
-        throw new CaptureSetupError('unsupported');
+        throw new SpongeError('unsupported');
     await mkdir(options.runtimeRoot, { recursive: true, mode: 0o700 });
     const base = await privateRoot(await realpath(options.runtimeRoot));
     const destination = join(base, pins.id);
@@ -122,7 +156,7 @@ async function provisionRuntime(options) {
     }
     const disk = await statfs(base);
     if (disk.bavail * disk.bsize < plan.requiredFreeBytes)
-        throw new CaptureSetupError('limit-exceeded');
+        throw new SpongeError('limit-exceeded');
     const stage = await mkdtemp(join(base, '.install-'));
     await chmod(stage, 0o700);
     const home = join(stage, 'home');
@@ -133,65 +167,92 @@ async function provisionRuntime(options) {
     if (signal?.aborted)
         abort();
     let cleanup = 'settled', checking = false, limitExceeded = false;
-    const monitor = setInterval(async () => { if (checking)
-        return; checking = true; try {
-        if (await physicalBytes(stage) > stagingBudget) {
-            limitExceeded = true;
+    const monitor = setInterval(async () => {
+        if (checking)
+            return;
+        checking = true;
+        try {
+            if ((await physicalBytes(stage)) > stagingBudget) {
+                limitExceeded = true;
+                controller.abort();
+            }
+        }
+        catch {
             controller.abort();
         }
-    }
-    catch {
-        controller.abort();
-    }
-    finally {
-        checking = false;
-    } }, 100);
+        finally {
+            checking = false;
+        }
+    }, 100);
     try {
         await download(pins.bun, join(stage, 'bun.zip'), controller.signal);
-        const unpack = await runOwned('/usr/bin/unzip', ['-q', join(stage, 'bun.zip'), '-d', stage], { cwd: stage, env: isolatedEnvironment(home, home, home), signal: controller.signal, deadlineMs: 30000, maxOutputBytes: 65536 });
+        const unpack = await runOwned('/usr/bin/unzip', ['-q', join(stage, 'bun.zip'), '-d', stage], {
+            cwd: stage,
+            env: isolatedEnvironment(home, home, home),
+            signal: controller.signal,
+            deadlineMs: 30000,
+            maxOutputBytes: 65536,
+        });
         cleanup = unpack.cleanup;
         if (unpack.code !== 0 || unpack.stopped || cleanup !== 'settled')
-            throw new CaptureSetupError(limitExceeded ? 'limit-exceeded' : unpack.stopped ?? 'unavailable');
+            throw new SpongeError(limitExceeded ? 'limit-exceeded' : (unpack.stopped ?? 'unavailable'));
         const bun = join(stage, pins.bun.archiveExecutable);
         if (hash(await readConfined(stage, pins.bun.archiveExecutable, 128 * 1024 ** 2)) !== pins.bun.executableSha256)
-            throw new CaptureSetupError('integrity');
+            throw new SpongeError('integrity');
         await chmod(bun, 0o700);
         await download(pins.ghostget, join(stage, `hraness-ghostget-${pins.ghostget.version}.tgz`), controller.signal);
         await download(pins.wordcell, join(stage, `hraness-wordcell-${pins.wordcell.version}.tgz`), controller.signal);
-        await writeFile(join(stage, 'package.json'), JSON.stringify({ private: true, dependencies: { '@hraness/ghostget': `./hraness-ghostget-${pins.ghostget.version}.tgz` } }), { mode: 0o600 });
+        await writeFile(join(stage, 'package.json'), JSON.stringify({
+            private: true,
+            dependencies: { '@hraness/ghostget': `./hraness-ghostget-${pins.ghostget.version}.tgz` },
+        }), { mode: 0o600 });
         await writeFile(join(stage, 'bun.lock'), pins.lockfile, { mode: 0o600 });
-        const install = await runOwned(bun, ['install', '--frozen-lockfile', '--ignore-scripts'], { cwd: stage, env: isolatedEnvironment(home, home, home), signal: controller.signal, deadlineMs: installDeadlineMs, maxOutputBytes: 65536 });
+        const install = await runOwned(bun, ['install', '--frozen-lockfile', '--ignore-scripts'], {
+            cwd: stage,
+            env: isolatedEnvironment(home, home, home),
+            signal: controller.signal,
+            deadlineMs: installDeadlineMs,
+            maxOutputBytes: 65536,
+        });
         cleanup = install.cleanup;
         if (install.code !== 0 || install.stopped || cleanup !== 'settled')
-            throw new CaptureSetupError(limitExceeded ? 'limit-exceeded' : install.stopped ?? 'unavailable');
+            throw new SpongeError(limitExceeded ? 'limit-exceeded' : (install.stopped ?? 'unavailable'));
         await rm(home, { recursive: true, force: true });
         await rm(join(stage, 'bun.zip'));
-        for (const [name, pin] of [['ghostget', pins.ghostget], ['wordcell', pins.wordcell]]) {
+        for (const [name, pin] of [
+            ['ghostget', pins.ghostget],
+            ['wordcell', pins.wordcell],
+        ]) {
             const pkg = JSON.parse((await readConfined(stage, `node_modules/@hraness/${name}/package.json`, 65536)).toString());
             if (pkg.version !== pin.version)
-                throw new CaptureSetupError('integrity');
+                throw new SpongeError('integrity');
         }
-        await writeFile(join(stage, 'runtime-receipt.json'), JSON.stringify({ schemaVersion: 1, pinId: pins.id, lockSha256: pins.lockSha256, inventorySha256: await inventory(stage) }), { mode: 0o600 });
+        await writeFile(join(stage, 'runtime-receipt.json'), JSON.stringify({
+            schemaVersion: 1,
+            pinId: pins.id,
+            lockSha256: pins.lockSha256,
+            inventorySha256: (await inventory(stage)).sha256,
+        }), { mode: 0o600 });
         if (controller.signal.aborted)
-            throw new CaptureSetupError('cancelled');
+            throw new SpongeError('cancelled');
         await rename(stage, destination);
         return await inspectCaptureRuntime(destination, pins);
     }
     finally {
         clearInterval(monitor);
         while (checking)
-            await new Promise(r => setTimeout(r, 5));
+            await new Promise((r) => setTimeout(r, 5));
         signal?.removeEventListener('abort', abort);
         if (cleanup === 'settled') {
             try {
                 await rm(stage, { recursive: true, force: true });
             }
             catch {
-                throw new CaptureSetupError('cleanup-required', stage);
+                throw new SpongeError('cleanup-required', { detail: { stage } });
             }
         }
         else
-            throw new CaptureSetupError('cleanup-required', stage);
+            throw new SpongeError('cleanup-required', { detail: { stage } });
     }
 }
 export async function inspectCaptureRuntime(root, pins) {
@@ -199,9 +260,9 @@ export async function inspectCaptureRuntime(root, pins) {
         return await inspectRuntime(root, pins);
     }
     catch (error) {
-        if (error instanceof CaptureSetupError)
+        if (error instanceof SpongeError)
             throw error;
-        throw new CaptureSetupError('runtime-missing');
+        throw new SpongeError('runtime-missing');
     }
 }
 export async function provisionCapture(options) {
@@ -209,10 +270,10 @@ export async function provisionCapture(options) {
         return await provisionRuntime(options);
     }
     catch (error) {
-        if (error instanceof CaptureSetupError)
+        if (error instanceof SpongeError)
             throw error;
         if (options.signal?.aborted)
-            throw new CaptureSetupError('cancelled');
-        throw new CaptureSetupError('unavailable');
+            throw new SpongeError('cancelled');
+        throw new SpongeError('unavailable');
     }
 }