amalgm 0.1.239 → 0.1.241

package/runtime/scripts/amalgm-mcp/workspace/reducer.js

@@ -7,9 +7,10 @@
  *   - one winning card (highest official card version), and
  *   - one checkpoint tree (checkpoint transitions applied in official order).
  *
- * The materializer has no peer branches. It obtains the winning commit,
- * moves to that exact card when safe, advances the one held checkpoint tree
- * to the newly reduced tree, and verifies on the next pass.
+ * The materializer advances one official event at a time. Before touching the
+ * checkout it durably records the observed source, the official state, and the
+ * target with any proven local intent preserved. Restart completes that one
+ * transition before a newer event may begin.
  */
 
 const crypto = require('crypto');
@@ -22,25 +23,27 @@ const {
   captureCheckpoint,
   hasCommit,
   headAndDirty,
-  isAncestor,
   localBranches,
-  mergeBase,
-  operationState,
 } = require('./git');
 const {
   CHECKPOINT_CONTRACT,
+  captureIntentAgainst,
+  captureIntentForCard,
   checkpointValueReady,
-  readCheckpoint,
   readCheckpointValue,
   repoKeyOfCard,
   revisionOf,
 } = require('./checkpoint');
-const { machineId } = require('./identity');
 const merge = require('./merge');
+const provenance = require('./provenance');
 const transition = require('./transition');
 
 const STATE_DIR = path.join(AMALGM_DIR, 'state', 'repo-reducer');
+const VERIFICATION_CONTRACT = 'verified-repo-state@1';
+const APPLYING_CONTRACT = 'repo-apply@4';
+const HYDRATING_CONTRACT = 'repo-hydrate@5';
 const REDUCE_QUIET_MS = 25;
+const REPAIR_RETRY_MS = 1_000;
 const REDUCE_INTERVAL_MS = 30_000;
 
 const service = {
@@ -52,21 +55,34 @@ const service = {
   repos: new Map(),
   lastPass: null,
 };
-const materializing = new Set();
+const repoTurnTails = new Map();
+const activeRepoTurns = new Map();
 
 function isMaterializing(repoKey) {
-  return materializing.has(repoKey);
+  return activeRepoTurns.get(repoKey) === 'materialize';
 }
 
-async function withMaterialization(repoKey, work) {
-  materializing.add(repoKey);
+async function withRepoTurn(repoKey, kind, work) {
+  const previous = repoTurnTails.get(repoKey) || Promise.resolve();
+  let release;
+  const gate = new Promise((resolve) => { release = resolve; });
+  const tail = previous.then(() => gate);
+  repoTurnTails.set(repoKey, tail);
+  await previous;
+  activeRepoTurns.set(repoKey, kind);
   try {
     return await work();
   } finally {
-    materializing.delete(repoKey);
+    activeRepoTurns.delete(repoKey);
+    release();
+    if (repoTurnTails.get(repoKey) === tail) repoTurnTails.delete(repoKey);
   }
 }
 
+function withMaterialization(repoKey, work) {
+  return withRepoTurn(repoKey, 'materialize', work);
+}
+
 function stateFile(repoKey) {
   const digest = crypto.createHash('sha256').update(repoKey).digest('hex').slice(0, 24);
   return path.join(STATE_DIR, `${digest}.json`);
@@ -96,7 +112,25 @@ function persistRepoState(repoKey, state) {
   if (repoStateIdentity(previous) === repoStateIdentity(next)) {
     return { state: previous, changed: false };
   }
-  fs.writeFileSync(stateFile(repoKey), `${JSON.stringify(next, null, 2)}\n`);
+  const file = stateFile(repoKey);
+  const temporary = `${file}.${process.pid}.${crypto.randomBytes(8).toString('hex')}.tmp`;
+  let descriptor = fs.openSync(temporary, 'wx', 0o600);
+  try {
+    fs.writeFileSync(descriptor, `${JSON.stringify(next, null, 2)}\n`);
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = null;
+    fs.renameSync(temporary, file);
+    const directory = fs.openSync(STATE_DIR, 'r');
+    try {
+      fs.fsyncSync(directory);
+    } finally {
+      fs.closeSync(directory);
+    }
+  } finally {
+    if (descriptor !== null) fs.closeSync(descriptor);
+    if (fs.existsSync(temporary)) fs.rmSync(temporary, { force: true });
+  }
   return { state: next, changed: true };
 }
 
@@ -105,6 +139,37 @@ function repoStateEventValue(state) {
   return value;
 }
 
+function saveRepoState(repoKey, localCard, previous, state) {
+  const persisted = persistRepoState(repoKey, state);
+  if (persisted.changed) {
+    appendStateEvent({
+      resource: 'workspace-reducer',
+      op: previous ? 'update' : 'insert',
+      id: localCard.replica,
+      value: repoStateEventValue(persisted.state),
+      source: 'workspace-reducer',
+    });
+  }
+  return persisted.state;
+}
+
+async function releaseVerifiedReceipts(repoKey, state) {
+  const operationId = state?.receiptOperationId;
+  if (!operationId) return state;
+  if (
+    state.materialized !== true
+    || typeof state.path !== 'string'
+    || !/^[0-9a-f]{64}$/.test(operationId)
+  ) {
+    throw new Error('invalid verified receipt release');
+  }
+  transition.releaseFileReceipts(state.path, operationId);
+  transition.releaseGitMetadataReceipts(state.path, operationId);
+  await transition.releaseBranchReceipt(state.path, operationId);
+  const { receiptOperationId, ...released } = state;
+  return persistRepoState(repoKey, released).state;
+}
+
 function validVersion(value) {
   return Number.isInteger(value) && value > 0;
 }
@@ -135,15 +200,13 @@ function reduceWall(entries) {
         repo = {
           repoKey,
           card: null,
-          checkpointBases: [],
           transitions: [],
-          parked: [],
           branchMap: new Map(),
         };
         repos.set(repoKey, repo);
       }
       if (!repo.card || card.positionVersion > repo.card.positionVersion) {
-        repo.card = { ...card, writer: wallEntry.machine };
+        repo.card = card;
       } else if (
         card.positionVersion === repo.card.positionVersion
         && card.positionMutationId === repo.card.positionMutationId
@@ -168,53 +231,19 @@ function reduceWall(entries) {
         if (
           checkpoint.checkpoint === CHECKPOINT_CONTRACT
           && validVersion(checkpoint.version)
-          && checkpoint.machine === wallEntry.machine
         ) {
           repo.transitions.push(checkpoint);
         }
       }
-      const checkpointBase = card.checkpointBase;
-      if (
-        checkpointBase?.checkpoint === CHECKPOINT_CONTRACT
-        && Number.isInteger(checkpointBase.through)
-        && checkpointBase.through >= 0
-        && checkpointBase.baseOid === card.head?.oid
-        && checkpointBase.branch === card.head?.branch
-      ) {
-        repo.checkpointBases.push(checkpointBase);
-      }
     }
   }
   for (const repo of repos.values()) {
-    const matchingBases = repo.checkpointBases
-      .filter((entry) => (
-        entry.baseOid === repo.card.head?.oid
-        && entry.branch === repo.card.head?.branch
-        && checkpointValueReady(entry.value)
-      ))
-      .sort((left, right) => right.through - left.through);
-    const newestThrough = matchingBases[0]?.through ?? null;
-    const newestBases = matchingBases
-      .filter((entry) => entry.through === newestThrough)
-      .sort((left, right) => (
-        Number(checkpointValueReady(right.value)) - Number(checkpointValueReady(left.value))
-      ));
-    const baseRevisions = new Set(newestBases.map((entry) => entry.value?.revision ?? null));
-    repo.checkpointBaseConflict = baseRevisions.size > 1;
-    repo.checkpointBase = repo.checkpointBaseConflict ? null : newestBases[0] || null;
     repo.transitions = repo.transitions
       .filter((entry) => (
         entry.baseOid === repo.card.head?.oid
         && entry.branch === repo.card.head?.branch
-        && (!repo.checkpointBase || entry.version > repo.checkpointBase.through)
       ))
       .sort((left, right) => left.version - right.version);
-    repo.parked = uniqueParked(repo.transitions.flatMap((checkpoint) => (
-      (checkpoint.parked || []).map((entry) => ({
-        ...entry,
-        version: checkpoint.version,
-      }))
-    )));
     if (repo.card.head?.branch) {
       const held = repo.branchMap.get(repo.card.head.branch);
       if (!held || repo.card.positionVersion > held.version) {
@@ -229,581 +258,1926 @@ function reduceWall(entries) {
     }
     repo.branches = [...repo.branchMap.values()].sort((left, right) => left.name.localeCompare(right.name));
     delete repo.branchMap;
-    delete repo.checkpointBases;
   }
   return repos;
 }
 
-function uniqueParked(entries) {
-  const byOid = new Map();
-  const order = [];
-  for (const entry of entries || []) {
-    if (typeof entry?.oid === 'string' && /^[0-9a-f]{40,64}$/.test(entry.oid)) {
-      const held = byOid.get(entry.oid);
-      if (!held) order.push(entry.oid);
-      if (!held || held.objects?.kind !== 'bundle' || entry.objects?.kind === 'bundle') {
-        byOid.set(entry.oid, entry);
-      }
-    }
-  }
-  return order.map((oid) => byOid.get(oid));
-}
-
-function parkedForState(previous, shared, discovered) {
-  const sharedOids = new Set((shared || []).map((entry) => entry.oid));
-  const unpublished = (previous || []).filter((entry) => (
-    !validVersion(entry.version) && !sharedOids.has(entry.oid)
-  ));
-  return uniqueParked([
-    ...(shared || []),
-    ...unpublished,
-    ...(discovered || []),
-  ]);
-}
-
 async function obtainCardObjects(localCard, targetCard) {
   const oid = targetCard.head?.oid;
   if (!oid || await hasCommit(localCard.path, oid)) return { state: 'ready' };
-  if (targetCard.objects?.kind === 'bundle') {
-    const imported = await require('./objects').importFromLocator(localCard.path, targetCard.objects);
-    if (imported.state !== 'imported') return { state: `objects-${imported.state}` };
-  } else if (targetCard.objects?.kind === 'pending') {
-    return { state: 'objects-uploading' };
-  } else {
-    const approved = localCard.repo?.remote
-      && localCard.repo.remote === targetCard.repo?.remote
-      && targetCard.head?.branch;
-    if (!approved) return { state: 'missing-objects-no-approved-source' };
-    await transition.fetchBranch(localCard.path, 'origin', targetCard.head.branch);
-  }
-  return await hasCommit(localCard.path, oid)
-    ? { state: 'ready' }
-    : { state: 'missing-objects-after-fetch' };
-}
-
-async function hydrateRepo(project, plan) {
-  const targetCard = plan.card;
-  if (!project?.path) return { state: 'waiting', reason: 'local-project-path-missing' };
-  if (!targetCard?.head?.oid) return { state: 'waiting', reason: 'winning-card-unborn' };
   if (targetCard.objects?.kind !== 'bundle') {
-    return { state: 'waiting', reason: targetCard.objects?.kind === 'pending'
-      ? 'objects-uploading'
-      : 'winning-card-bundle-missing' };
+    throw new Error('official card has no complete bundle');
   }
-  const prepared = require('./objects').prepareBundleImport(targetCard.objects);
-  if (prepared.state !== 'ready') {
-    return { state: 'waiting', reason: `objects-${prepared.state}` };
-  }
-  await transition.initializeRepo(project.path, targetCard.repo?.remote || null);
-  await transition.importBundle(project.path, prepared.file);
-  const holding = transition.holdInitialFiles(project.path);
-  try {
-    await transition.checkoutInitialCard(project.path, {
-      branch: targetCard.head.branch,
-      oid: targetCard.head.oid,
-    });
-  } catch (error) {
-    transition.restoreInitialFiles(project.path, holding);
-    throw error;
+  const imported = await require('./objects').importFromLocator(localCard.path, targetCard.objects);
+  if (imported.state !== 'imported') return { state: `objects-${imported.state}` };
+  if (!await hasCommit(localCard.path, oid)) {
+    throw new Error(`official card bundle does not contain ${oid}`);
   }
-  transition.restoreInitialFiles(project.path, holding);
-  await refreshRepoCards();
-  return { state: 'hydrated', moved: true };
+  return { state: 'ready' };
 }
 
-async function moveToWinningCard(localCard, targetCard) {
-  const current = await headAndDirty(localCard.path);
-  const operation = await operationState(localCard.path);
-  if (operation !== 'none') return { state: 'waiting', reason: 'local-operation-in-flight' };
-  if (
-    current.head.oid !== localCard.head?.oid
-    || current.head.branch !== localCard.head?.branch
-  ) {
-    return { state: 'waiting', reason: 'local-card-changed-after-verification' };
-  }
-  if (
-    current.head.oid === targetCard.head?.oid
-    && current.head.branch === targetCard.head?.branch
-  ) return { state: 'ready', moved: false };
-
-  const pendingCard = current.head.oid
-    && targetCard.head?.oid
-    && current.head.branch === targetCard.head?.branch
-    && await isAncestor(localCard.path, targetCard.head.oid, current.head.oid);
-  if (pendingCard) return { state: 'ready', moved: false, pendingCard: true };
-
-  const objects = await obtainCardObjects(localCard, targetCard);
-  if (objects.state !== 'ready') return { state: 'waiting', reason: objects.state };
-
-  const forward = current.head.oid
-    && targetCard.head?.oid
-    && await isAncestor(localCard.path, current.head.oid, targetCard.head.oid);
-  if (!current.head.oid || !targetCard.head?.oid) {
-    return { state: 'waiting', reason: 'unborn-card-movement' };
-  }
-  const commonOid = forward
-    ? current.head.oid
-    : await mergeBase(localCard.path, current.head.oid, targetCard.head.oid);
-  if (!commonOid) return { state: 'waiting', reason: 'unrelated-card-histories' };
-
-  const captured = await captureCheckpoint(localCard.path);
-  if (captured.indexDiff === null || captured.baseOid !== current.head.oid) {
-    return { state: 'waiting', reason: 'local-state-moving' };
-  }
-  const repoKey = repoKeyOfCard(localCard);
-  const resourceId = require('./wall').projectForRepo(repoKey)?.resourceId;
-  const reducedState = readRepoState(repoKey, resourceId);
-  const capturedOnRail = reducedState?.baseOid === current.head.oid
-    && reducedState.checkpointRevision === revisionOf(
-      current.head.oid,
-      captured.indexDiff,
-      captured.worktreeDiff,
-    );
-  const movingIndexDiff = capturedOnRail ? '' : captured.indexDiff;
-  const movingWorktreeDiff = capturedOnRail ? '' : captured.worktreeDiff;
-  const parked = [];
-  if (!forward && current.head.oid !== targetCard.head.oid) {
-    const parkedRef = await transition.parkCommit(localCard.path, current.head.oid);
-    parked.push({
-      oid: current.head.oid,
-      ref: parkedRef,
-      sourceBranch: current.head.branch,
-      objects: await require('./objects').bundleSourceFor(
-        localCard.path,
-        repoKey,
-        current.head.oid,
-      ),
-    });
-  }
+function planThrough(plan) {
+  return Math.max(
+    Number(plan?.card?.positionVersion) || 0,
+    ...(plan?.branches || []).map((branch) => Number(branch.version) || 0),
+    ...(plan?.transitions || []).map((operation) => Number(operation.version) || 0),
+  );
+}
 
-  const winningTree = await merge.treeOf(localCard.path, targetCard.head.oid);
-  const oldTree = await merge.treeOf(localCard.path, current.head.oid);
-  const oldIndexTree = await merge.treeOfPatch(localCard.path, current.head.oid, movingIndexDiff);
-  const staged = await merge.reduceTree(
-    localCard.path,
-    winningTree,
-    oldTree,
-    oldIndexTree,
+function validHydrating(value, repoKey, projectPath) {
+  return Boolean(
+    value
+    && value.contract === HYDRATING_CONTRACT
+    && value.repoKey === repoKey
+    && value.path === projectPath
+    && value.plan?.repoKey === repoKey
+    && validTree(value.plan.card?.head?.oid)
+    && Number.isInteger(value.through)
+    && value.through > 0
+    && validTree(value.emptyTree)
+    && value.reduced?.state === 'ready'
+    && validTree(value.reduced.indexTree)
+    && validTree(value.reduced.worktreeTree)
+    && value.requestDigest === applyingRequestDigest(value.through, value.plan)
+    && value.operationId === hydratingId(value.requestDigest)
+    && (value.bootstrapSealed === undefined || value.bootstrapSealed === true)
+    && (value.bootstrapReleased === undefined || value.bootstrapReleased === true)
+    && value.bootstrap
+    && validBootstrapMetadata(value.bootstrap.source, true)
+    && validBootstrapMetadata(value.bootstrap.target, false)
+    && (
+      value.execution === undefined
+      || (
+        validPhysicalState(value.execution.source)
+        && validPhysicalState(value.execution.target)
+        && validPhysicalState(value.execution.official)
+        && value.execution.operationId === value.operationId
+        && validSourceReceipts(value.execution.sourceReceipts)
+      )
+    )
   );
-  const oldWorktree = await merge.treeOfPatch(localCard.path, oldIndexTree, movingWorktreeDiff);
-  const working = await merge.reduceTree(
-    localCard.path,
-    staged.tree,
-    oldIndexTree,
-    oldWorktree,
-  );
-
-  const rollbackDir = path.join(STATE_DIR, 'card-moves');
-  fs.mkdirSync(rollbackDir, { recursive: true });
-  fs.writeFileSync(
-    path.join(rollbackDir, `${current.head.oid}-to-${targetCard.head.oid}.json`),
-    `${JSON.stringify({
-      baseOid: current.head.oid,
-      indexDiff: captured.indexDiff,
-      worktreeDiff: captured.worktreeDiff,
-    })}\n`,
-  );
-  await transition.forceMoveToCard(localCard.path, {
-    expectedBranch: current.head.branch,
-    expectedOid: current.head.oid,
-    targetBranch: targetCard.head.branch,
-    targetOid: targetCard.head.oid,
-  });
-  const applied = await merge.advance(localCard.path, winningTree, working.tree, {
-    label: `card-${targetCard.positionVersion}`,
-  });
-  await transition.setIndexTree(localCard.path, staged.tree);
+}
+
+function hydrationBootstrapSealed(hydrating) {
+  return Boolean(
+    hydrating?.bootstrapSealed === true
+    || hydrating?.bootstrapReleased === true
+    || hydrating?.execution,
+  );
+}
+
+function validBootstrapMetadata(value, allowUnborn) {
+  return Boolean(
+    value
+    && value.head
+    && (typeof value.head.branch === 'string' || value.head.branch === null)
+    && (validTree(value.head.oid) || (allowUnborn && value.head.oid === null))
+    && Array.isArray(value.branches)
+    && value.branches.every((branch) => (
+      typeof branch?.name === 'string'
+      && branch.name.length > 0
+      && validTree(branch.oid)
+    )),
+  );
+}
+
+function bootstrapBranchNames(bootstrap) {
+  const source = new Map(branchState(bootstrap.source.branches).map((ref) => [ref.name, ref.oid]));
+  const target = new Map(branchState(bootstrap.target.branches).map((ref) => [ref.name, ref.oid]));
+  return [...new Set([...source.keys(), ...target.keys()])]
+    .filter((name) => !sameOid(source.get(name), target.get(name)))
+    .sort();
+}
+
+async function hydrationBootstrapCrossed(worktreeRoot, hydrating) {
+  const names = bootstrapBranchNames(hydrating.bootstrap);
+  const crossed = await Promise.all(names.map(async (name) => (
+    await transition.branchReceiptCrossed(worktreeRoot, hydrating.operationId, name)
+      ? name
+      : null
+  )));
   return {
-    state: 'ready',
-    moved: true,
-    parked,
+    branches: new Set(crossed.filter(Boolean)),
+    head: transition.gitMetadataReceiptCrossed(
+      worktreeRoot,
+      hydrating.operationId,
+      'HEAD',
+    ),
   };
 }
 
-async function materializeParked(localCard, entries) {
-  const waiting = [];
-  const active = uniqueParked(entries);
-  for (const entry of active) {
-    if (!(await hasCommit(localCard.path, entry.oid))) {
-      if (entry.objects?.kind === 'bundle') {
-        const imported = await require('./objects').importFromLocator(localCard.path, entry.objects);
-        if (imported.state !== 'imported') {
-          waiting.push({ ...entry, state: imported.state });
-          continue;
-        }
-      } else {
-        waiting.push({ ...entry, state: entry.objects?.kind || 'objects-missing' });
-        continue;
-      }
-    }
-    await transition.parkCommit(localCard.path, entry.oid);
-  }
-  await transition.pruneParkedCommits(
-    localCard.path,
-    new Set(active.map((entry) => entry.oid)),
+async function applyHydrationBootstrap(worktreeRoot, hydrating) {
+  transition.recoverGitMetadataTransactions(worktreeRoot);
+  const currentHead = (await headAndDirty(worktreeRoot)).head;
+  const currentBranches = await localBranches(worktreeRoot);
+  const crossed = await hydrationBootstrapCrossed(worktreeRoot, hydrating);
+  const branches = reconcileApplyingBranches(
+    currentBranches,
+    hydrating.bootstrap.source.branches,
+    hydrating.bootstrap.target.branches,
+    crossed.branches,
+    receiptProvenHeadReturn(currentHead, hydrating.bootstrap.source.head, crossed.head),
+  );
+  const initialRefPlan = branchRefApplyPlan(
+    currentHead,
+    currentBranches,
+    branches,
+  );
+  const initialRefs = await advanceBranchRefChanges(
+    worktreeRoot,
+    initialRefPlan.beforeHead,
+    hydrating.operationId,
+  );
+  if (initialRefs.state !== 'ready') return initialRefs;
+  const afterRefs = (await headAndDirty(worktreeRoot)).head;
+  const afterBranches = await localBranches(worktreeRoot);
+  const refreshedCrossed = await hydrationBootstrapCrossed(
+    worktreeRoot,
+    hydrating,
+  );
+  const resolvedBranches = reconcileApplyingBranches(
+    afterBranches,
+    hydrating.bootstrap.source.branches,
+    hydrating.bootstrap.target.branches,
+    refreshedCrossed.branches,
+    receiptProvenHeadReturn(
+      afterRefs,
+      hydrating.bootstrap.source.head,
+      refreshedCrossed.head,
+    ),
+  );
+  const head = reconcileApplyingHead(
+    afterRefs,
+    hydrating.bootstrap.source.head,
+    hydrating.bootstrap.target.head,
+    resolvedBranches,
+    {
+      headCrossed: refreshedCrossed.head,
+      branchCrossed: refreshedCrossed.branches,
+      plannedPostRefBranches: hydrating.bootstrap.target.branches,
+    },
+  );
+  return advanceBranchesAndHead(
+    worktreeRoot,
+    afterRefs,
+    afterBranches,
+    resolvedBranches,
+    head,
+    hydrating.operationId,
   );
-  return waiting;
 }
 
-async function materializeBranches(localCard, plan, heldBranches = []) {
-  const current = new Map((await localBranches(localCard.path)).map((ref) => [ref.name, ref.oid]));
-  const held = new Map(heldBranches.map((ref) => [ref.name, ref.oid]));
-  const waiting = [];
-  const pending = [];
-  let moved = false;
-  for (const ref of plan.branches || []) {
-    if (ref.name === plan.card.head?.branch) {
-      if (ref.oid !== plan.card.head.oid) {
-        waiting.push({ name: ref.name, state: 'checked-out-ref-disagrees-with-card' });
-      }
-      continue;
-    }
-    const currentOid = current.get(ref.name) || null;
-    const heldOid = held.get(ref.name) || null;
-    if (currentOid !== heldOid && currentOid !== ref.oid) {
-      pending.push({ name: ref.name, oid: currentOid });
-      continue;
+async function hydrateRepo(project, plan) {
+  if (!project?.path) throw new Error('code project has no registered local path');
+  let stored = readRepoState(plan.repoKey, project.resourceId);
+  if (stored?.receiptOperationId) {
+    stored = await releaseVerifiedReceipts(plan.repoKey, stored);
+  }
+  const pending = validHydrating(stored?.hydrating, plan.repoKey, project.path)
+    ? stored.hydrating
+    : null;
+  const activePlan = pending?.plan || recoveryPlan(plan);
+  const targetCard = activePlan.card;
+  if (!targetCard?.head?.oid) throw new Error('official card has no commit');
+  await transition.initializeRepo(project.path, plan.card.repo?.remote || null);
+  let reduced = pending?.reduced || null;
+  let through = pending?.through || null;
+  if (!pending) {
+    if (plan.card.objects?.kind !== 'bundle') {
+      throw new Error('official card has no complete bundle');
     }
-    if (currentOid === ref.oid) continue;
-    if (ref.oid === null) {
-      if (current.has(ref.name)) {
-        await transition.deleteBranchRef(localCard.path, ref.name);
-        moved = true;
-      }
-      continue;
+    const bundle = require('./objects').prepareBundleImport(plan.card.objects);
+    if (bundle.state !== 'ready') {
+      return { state: 'waiting', reason: `objects-${bundle.state}` };
     }
-    if (!(await hasCommit(localCard.path, ref.oid))) {
-      if (ref.objects?.kind === 'bundle') {
-        const imported = await require('./objects').importFromLocator(localCard.path, ref.objects);
-        if (imported.state !== 'imported') {
-          waiting.push({ name: ref.name, state: imported.state });
-          continue;
-        }
-      } else if (ref.objects?.kind === 'remote' && localCard.repo?.remote) {
-        await transition.fetchBranch(localCard.path, 'origin', ref.name);
-      } else {
-        waiting.push({ name: ref.name, state: ref.objects?.kind || 'objects-missing' });
-        continue;
+    await transition.importBundle(project.path, bundle.file);
+    reduced = await preparePlan({ path: project.path }, plan);
+    if (reduced.state !== 'ready') return reduced;
+    through = planThrough(plan);
+  }
+  const requestDigest = applyingRequestDigest(through, activePlan);
+  const official = targetRepoState(activePlan, through, reduced);
+  const initialHead = pending ? null : await headAndDirty(project.path);
+  const initialBranches = pending ? null : await localBranches(project.path);
+  let hydrating = pending || {
+    contract: HYDRATING_CONTRACT,
+    repoKey: plan.repoKey,
+    path: project.path,
+    through,
+    plan: activePlan,
+    reduced: {
+      state: 'ready',
+      indexTree: reduced.indexTree,
+      worktreeTree: reduced.worktreeTree,
+      checkpointRevision: reduced.checkpointRevision,
+    },
+    requestDigest,
+    operationId: hydratingId(requestDigest),
+    emptyTree: await transition.emptyTree(project.path),
+    bootstrap: {
+      source: {
+        head: {
+          branch: initialHead.head.branch,
+          oid: initialHead.head.oid,
+        },
+        branches: branchState(initialBranches),
+      },
+      target: {
+        head: official.head,
+        branches: official.branches,
+      },
+    },
+  };
+  if (!pending) {
+    persistRepoState(plan.repoKey, {
+      ...(stored || {}),
+      resourceId: project.resourceId || null,
+      path: project.path,
+      replica: null,
+      hydrating,
+      materialized: false,
+    });
+  }
+  if (!hydrationBootstrapSealed(hydrating)) {
+    try {
+      await transition.ensureEmptyIndex(
+        project.path,
+        hydrating.operationId,
+        { retainReceipt: true },
+      );
+    } catch (error) {
+      if (error instanceof transition.TransitionError) {
+        return { state: 'waiting', reason: 'local-index-moving' };
       }
+      throw error;
     }
-    if (!(await hasCommit(localCard.path, ref.oid))) {
-      waiting.push({ name: ref.name, state: 'objects-missing-after-import' });
-      continue;
+    const bootstrapped = await applyHydrationBootstrap(project.path, hydrating);
+    if (bootstrapped.state !== 'ready') return bootstrapped;
+  }
+  let observed = await observePhysicalRepo(project.path);
+  if (observed.state !== 'ready') {
+    return { state: 'waiting', reason: 'local-state-moving' };
+  }
+  let execution = hydrating.execution || null;
+  if (!execution) {
+    const bootstrapCrossed = await hydrationBootstrapCrossed(project.path, hydrating);
+    const index = await merge.reconcileApplyingTree(
+      project.path,
+      observed.value.indexTree,
+      hydrating.emptyTree,
+      official.indexTree,
+    );
+    const worktree = await merge.reconcileApplyingTree(
+      project.path,
+      observed.value.worktreeTree,
+      hydrating.emptyTree,
+      official.worktreeTree,
+    );
+    const branches = reconcileApplyingBranches(
+      observed.value.branches,
+      hydrating.bootstrap.source.branches,
+      official.branches,
+      bootstrapCrossed.branches,
+      receiptProvenHeadReturn(
+        observed.value.head,
+        hydrating.bootstrap.source.head,
+        bootstrapCrossed.head,
+      ),
+    );
+    const head = sameCardPosition(observed.value, { head: official.head })
+      ? official.head
+      : reconcileApplyingHead(
+        observed.value.head,
+        hydrating.bootstrap.source.head,
+        hydrating.bootstrap.target.head,
+        branches,
+        {
+          headCrossed: bootstrapCrossed.head,
+          branchCrossed: bootstrapCrossed.branches,
+          plannedPostRefBranches: hydrating.bootstrap.target.branches,
+        },
+      );
+    if (head.branch) {
+      const attached = branches.find((branch) => branch.name === head.branch);
+      if (attached) attached.oid = head.oid;
+      else branches.push({ name: head.branch, oid: head.oid });
+      branches.sort((left, right) => left.name.localeCompare(right.name));
     }
-    if (current.get(ref.name) !== ref.oid) {
-      await transition.setBranchRef(localCard.path, ref.name, ref.oid);
-      moved = true;
+    const source = observed.value;
+    const target = {
+      head,
+      branches,
+      indexTree: index.tree,
+      worktreeTree: worktree.tree,
+    };
+    const receipts = await sourceReceipts(project.path, source, target);
+    const sealed = await observePhysicalRepo(project.path);
+    const sealedReceipts = await sourceReceipts(project.path, source, target);
+    if (
+      sealed.state !== 'ready'
+      || sealed.digest !== stateDigest(source)
+      || !sameReceiptPlan(receipts, sealedReceipts)
+    ) {
+      return { state: 'waiting', reason: 'local-state-moving' };
     }
+    execution = {
+      source,
+      target,
+      official: officialPhysicalState(official),
+      operationId: hydrating.operationId,
+      sourceReceipts: sealedReceipts,
+    };
   }
-  return { moved, waiting, pending };
-}
-
-async function reduceCheckpoint(localCard, plan) {
-  const baseOid = plan.card.head.oid;
-  const baseTree = await merge.treeOf(localCard.path, baseOid);
-  let indexTree = baseTree;
-  let worktreeTree = baseTree;
-  if (plan.checkpointBaseConflict) {
-    return { state: 'waiting', reason: 'checkpoint-base-disagrees' };
+  if (hydrating.bootstrapSealed !== true) {
+    hydrating = {
+      ...hydrating,
+      execution,
+      bootstrapSealed: true,
+    };
+    persistRepoState(plan.repoKey, {
+      ...(stored || {}),
+      resourceId: project.resourceId || null,
+      path: project.path,
+      replica: null,
+      hydrating,
+      materialized: false,
+    });
   }
-  if (plan.checkpointBase) {
-    const snapshot = readCheckpointValue(baseOid, plan.checkpointBase.value);
-    if (snapshot.state !== 'ready') {
-      return { state: 'waiting', reason: `checkpoint-base-${snapshot.state}` };
-    }
-    indexTree = await merge.treeOfPatch(localCard.path, baseOid, snapshot.indexDiff);
-    worktreeTree = await merge.treeOfPatch(
-      localCard.path,
-      indexTree,
-      snapshot.worktreeDiff,
+  if (hydrating.bootstrapReleased !== true) {
+    transition.releaseGitMetadataReceipts(
+      project.path,
+      hydrating.operationId,
     );
+    await transition.releaseBranchReceipt(project.path, hydrating.operationId);
+    const latest = readRepoState(plan.repoKey, project.resourceId);
+    hydrating = {
+      ...hydrating,
+      execution,
+      bootstrapReleased: true,
+    };
+    persistRepoState(plan.repoKey, {
+      ...(latest || stored || {}),
+      resourceId: project.resourceId || null,
+      path: project.path,
+      replica: null,
+      hydrating,
+      materialized: false,
+    });
   }
-
-  for (const operation of plan.transitions) {
-    const from = readCheckpointValue(baseOid, operation.from);
-    const to = readCheckpointValue(baseOid, operation.to);
-    if (from.state === 'payload-pending' || to.state === 'payload-pending') continue;
-    if (from.state !== 'ready' || to.state !== 'ready') {
-      return { state: 'waiting', reason: `checkpoint-${from.state !== 'ready' ? from.state : to.state}` };
-    }
-    const fromIndexTree = await merge.treeOfPatch(localCard.path, baseOid, from.indexDiff);
-    const toIndexTree = await merge.treeOfPatch(localCard.path, baseOid, to.indexDiff);
-    const reducedIndex = await merge.reduceTree(
-      localCard.path,
-      indexTree,
-      fromIndexTree,
-      toIndexTree,
-    );
-    indexTree = reducedIndex.tree;
-
-    const fromWorktreeTree = await merge.treeOfPatch(localCard.path, fromIndexTree, from.worktreeDiff);
-    const toWorktreeTree = await merge.treeOfPatch(localCard.path, toIndexTree, to.worktreeDiff);
-    const reducedWorktree = await merge.reduceTree(
-      localCard.path,
-      worktreeTree,
-      fromWorktreeTree,
-      toWorktreeTree,
+  const crossed = await crossedSourceReceipts(
+    project.path,
+    execution.operationId,
+    execution.sourceReceipts,
+  );
+  const index = await merge.reconcileApplyingTree(
+    project.path,
+    observed.value.indexTree,
+    execution.source.indexTree,
+    execution.target.indexTree,
+    { sourceCrossed: crossed.index },
+  );
+  const worktree = await merge.reconcileApplyingTree(
+    project.path,
+    observed.value.worktreeTree,
+    execution.source.worktreeTree,
+    execution.target.worktreeTree,
+    { crossedPaths: crossed.worktree },
+  );
+  const branches = reconcileApplyingBranches(
+    observed.value.branches,
+    execution.source.branches,
+    execution.target.branches,
+    crossed.branches,
+    receiptProvenHeadReturn(
+      observed.value.head,
+      execution.source.head,
+      crossed.head,
+    ),
+  );
+  const head = reconcileApplyingHead(
+    observed.value.head,
+    execution.source.head,
+    execution.target.head,
+    branches,
+    {
+      headCrossed: crossed.head,
+      branchCrossed: crossed.branches,
+      plannedPostRefBranches: execution.target.branches,
+    },
+  );
+  const headResult = await advanceBranchesAndHead(
+    project.path,
+    observed.value.head,
+    observed.value.branches,
+    branches,
+    head,
+    execution.operationId,
+  );
+  if (headResult.state !== 'ready') return headResult;
+  const worktreeResult = await advanceWorktree(
+    project.path,
+    observed.value.worktreeTree,
+    worktree.tree,
+    { label: execution.operationId },
+  );
+  if (worktreeResult.state !== 'ready') return worktreeResult;
+  const indexResult = await advanceIndex(
+    project.path,
+    observed.value.indexTree,
+    index.tree,
+    execution.operationId,
+  );
+  if (indexResult.state !== 'ready') return indexResult;
+  const final = await observePhysicalRepo(project.path);
+  if (final.state !== 'ready') {
+    return { state: 'waiting', reason: 'local-state-moving' };
+  }
+  const localCard = await require('./card').buildRepoCard(project.path);
+  const captured = await captureIntentAgainst(
+    project,
+    localCard,
+    {
+      through,
+      card: {
+        head: {
+          branch: official.head.branch,
+          oid: official.head.oid,
+          detached: !official.head.branch,
+        },
+        branches: official.branches,
+      },
+      indexTree: official.indexTree,
+      worktreeTree: official.worktreeTree,
+    },
+    final,
+  );
+  if (captured.state === 'waiting') return captured;
+  if (captured.state === 'rejected') {
+    throw new Error(
+      captured.intent?.terminal?.message
+      || `local code intent rejected: ${captured.reason}`,
     );
-    worktreeTree = reducedWorktree.tree;
   }
-
-  const indexDiff = await merge.diffOfTree(localCard.path, baseOid, indexTree);
-  const worktreeDiff = await merge.diffOfTree(localCard.path, indexTree, worktreeTree);
-  return {
-    state: 'ready',
-    indexTree,
-    worktreeTree,
+  const indexDiff = await merge.diffOfTree(
+    project.path,
+    activePlan.card.head.oid,
+    reduced.indexTree,
+  );
+  const worktreeDiff = await merge.diffOfTree(
+    project.path,
+    reduced.indexTree,
+    reduced.worktreeTree,
+  );
+  const verified = persistRepoState(plan.repoKey, {
+    verificationContract: VERIFICATION_CONTRACT,
+    resourceId: project.resourceId || null,
+    path: localCard.path,
+    replica: localCard.replica,
+    branch: activePlan.card.head.branch,
+    baseOid: activePlan.card.head.oid,
+    cardVersion: activePlan.card.positionVersion,
+    cardMutationId: activePlan.card.positionMutationId,
+    targetCard: {
+      branch: activePlan.card.head.branch,
+      oid: activePlan.card.head.oid,
+      version: activePlan.card.positionVersion,
+      mutationId: activePlan.card.positionMutationId,
+    },
+    appliedThrough: through,
+    checkpointRevision: reduced.checkpointRevision,
     indexDiff,
     worktreeDiff,
-    checkpointRevision: revisionOf(baseOid, indexDiff, worktreeDiff),
+    checkpointVersions: (activePlan.transitions || []).map((entry) => entry.version),
+    branches: activePlan.branches || [],
+    heldTree: reduced.worktreeTree,
+    heldIndexTree: reduced.indexTree,
+    targetDigest: stateDigest(official),
+    expectedPhysicalDigest: final.digest,
+    observedPhysicalDigest: final.digest,
+    materialized: true,
+    receiptOperationId: execution.operationId,
+  }).state;
+  await releaseVerifiedReceipts(plan.repoKey, verified);
+  await refreshRepoCards();
+  return { state: 'hydrated', moved: true };
+}
+
+function sameCardPosition(left, right) {
+  return left?.head?.oid === right?.head?.oid
+    && left?.head?.branch === right?.head?.branch;
+}
+
+function validTree(oid) {
+  return typeof oid === 'string' && /^[0-9a-f]{40,64}$/.test(oid);
+}
+
+function cardState(card) {
+  return {
+    branch: card?.head?.branch ?? null,
+    oid: card?.head?.oid ?? null,
   };
 }
 
-function captureIsOnRail(plan, captured, localMachine = machineId(), acknowledged = null) {
-  if (
-    !captured
-    || captured.indexDiff === null
-    || captured.baseOid !== plan.card.head.oid
-  ) return false;
-  const revision = revisionOf(
-    captured.baseOid,
-    captured.indexDiff,
-    captured.worktreeDiff,
-  );
-  const latest = [...plan.transitions]
-    .reverse()
-    .find((operation) => operation.machine === localMachine);
+function intentOwnsHead(intent) {
   return Boolean(
-    (latest && latest.to?.revision === revision)
-    || (
-      Number.isInteger(acknowledged?.version)
-      && acknowledged.version > 0
-      && acknowledged.baseOid === captured.baseOid
-      && acknowledged.branch === plan.card.head.branch
-      && acknowledged.to?.revision === revision
+    intent
+    && !sameCardPosition(
+      { head: cardState(intent.base.card) },
+      { head: cardState(intent.local.card) },
     )
   );
 }
 
-async function materializeRepo(localCardInput, plan, appliedThrough = null) {
-  const refreshed = localCardInput;
-  const cardResult = await moveToWinningCard(refreshed, plan.card);
-  if (cardResult.state !== 'ready') return cardResult;
-
-  const localCard = cardResult.moved
-    ? await refreshRepoCard(refreshed.replica) || refreshed
-    : refreshed;
-  const project = require('./wall').projectForRepo(plan.repoKey);
-  const previous = readRepoState(plan.repoKey, project?.resourceId);
-  const parked = parkedForState(
-    previous?.parked,
-    plan.parked,
-    cardResult.parked,
-  );
-  const parkedWaiting = await materializeParked(localCard, parked);
-  const planParked = new Set((plan.parked || []).map((entry) => entry.oid));
-  const requiredParkedWaiting = parkedWaiting.filter((entry) => planParked.has(entry.oid));
-  if (requiredParkedWaiting.length > 0) {
-    // Parking is a local write. Remember it before waiting on an inbound
-    // bundle, so the next pass cannot replace unnumbered local work.
-    const persisted = persistRepoState(plan.repoKey, {
-      ...(previous || {}),
-      resourceId: project?.resourceId || null,
-      path: localCard.path,
-      replica: localCard.replica,
-      parked,
-      parkedWaiting,
-      materialized: false,
-    });
-    if (persisted.changed) {
-      appendStateEvent({
-        resource: 'workspace-reducer',
-        op: previous ? 'update' : 'insert',
-        id: localCard.replica,
-        value: repoStateEventValue(persisted.state),
-        source: 'workspace-reducer',
-      });
+async function usableIntent(project, previous, localCard) {
+  const intents = require('./intent');
+  const intent = intents.readIntent(project);
+  if (!intent) return { state: 'none', intent: null, successor: null };
+  const successor = intent.successor || null;
+  if (
+    previous?.verificationContract === VERIFICATION_CONTRACT
+    && previous.materialized === true
+    && Number.isInteger(previous.appliedThrough)
+    && intent.publication?.foldedAt
+    && Number.isInteger(intent.publication.numberedVersion)
+    && intent.publication.numberedVersion <= previous.appliedThrough
+    && !successor
+  ) {
+    intents.clearIntent(project);
+    return { state: 'none', intent: null, successor: null };
+  }
+  const initial = intents._test.validInitialBase(intent.base);
+  if (initial) {
+    const emptyTree = await transition.emptyTree(localCard.path);
+    if (
+      intent.base.indexTree !== emptyTree
+      || intent.base.worktreeTree !== emptyTree
+    ) {
+      return { state: 'blocked', intent };
     }
-    return { state: 'waiting', reason: `parked-${requiredParkedWaiting[0].state}` };
-  }
-  const branchResult = await materializeBranches(localCard, plan, previous?.branches);
-  if (branchResult.waiting.length > 0) {
-    return { state: 'waiting', reason: `branch-${branchResult.waiting[0].state}` };
-  }
-  const reduced = await reduceCheckpoint(localCard, plan);
-  if (reduced.state !== 'ready') return reduced;
-
-  const sharedBaseTree = await merge.treeOf(localCard.path, plan.card.head.oid);
-  const previousHeldWorktree = (
-    previous?.baseOid === plan.card.head.oid
-      && previous.heldTree
-      && await merge.hasTree(localCard.path, previous.heldTree)
-      ? previous.heldTree
-      : sharedBaseTree
-  );
-  const previousHeldIndex = (
-    previous?.baseOid === plan.card.head.oid
-      && previous.heldIndexTree
-      && await merge.hasTree(localCard.path, previous.heldIndexTree)
-      ? previous.heldIndexTree
-      : sharedBaseTree
-  );
-  let stateBaseOid = plan.card.head.oid;
-  let stateBranch = plan.card.head.branch;
-  let stateCardVersion = plan.card.positionVersion;
-  let stateCardMutationId = plan.card.positionMutationId;
-  let stateIndexDiff = reduced.indexDiff;
-  let stateWorktreeDiff = reduced.worktreeDiff;
-  let heldWorktree;
-  let heldIndex;
-  let targetWorktree;
-  let targetIndex;
-  if (cardResult.pendingCard) {
-    const pendingBaseTree = await merge.treeOf(localCard.path, localCard.head.oid);
-    const rebasedIndex = await merge.reduceTree(
-      localCard.path,
-      reduced.indexTree,
-      previousHeldIndex,
-      pendingBaseTree,
-    );
-    const rebasedWorktree = await merge.reduceTree(
-      localCard.path,
-      reduced.worktreeTree,
-      previousHeldWorktree,
-      pendingBaseTree,
-    );
-    heldIndex = pendingBaseTree;
-    heldWorktree = pendingBaseTree;
-    targetIndex = rebasedIndex.tree;
-    targetWorktree = rebasedWorktree.tree;
-    stateBaseOid = localCard.head.oid;
-    stateBranch = localCard.head.branch;
-    stateCardVersion = null;
-    stateCardMutationId = null;
-    stateIndexDiff = await merge.diffOfTree(localCard.path, stateBaseOid, targetIndex);
-    stateWorktreeDiff = await merge.diffOfTree(localCard.path, targetIndex, targetWorktree);
-  } else {
-    const captured = await captureCheckpoint(localCard.path);
-    const wall = require('./wall');
-    const localCheckpoint = readCheckpoint(machineId(), plan.repoKey);
-    const acknowledged = localCheckpoint && {
-      ...localCheckpoint,
-      version: wall.mutationVersion(
-        project?.resourceId,
-        localCheckpoint.mutationId,
-        plan.repoKey,
-      ),
-    };
-    const represented = captureIsOnRail(plan, captured, machineId(), acknowledged);
-    const capturedIndex = represented
-      ? await merge.treeOfPatch(localCard.path, plan.card.head.oid, captured.indexDiff)
-      : null;
-    const capturedWorktree = represented
-      ? await merge.treeOfPatch(localCard.path, capturedIndex, captured.worktreeDiff)
-      : null;
-    heldWorktree = capturedWorktree || previousHeldWorktree;
-    heldIndex = capturedIndex || previousHeldIndex;
-    targetWorktree = reduced.worktreeTree;
-    targetIndex = reduced.indexTree;
-  }
-
-  const currentIndex = await merge.indexTree(localCard.path);
-  const reducedLocalIndex = await merge.reduceTree(
-    localCard.path,
-    targetIndex,
-    heldIndex,
-    currentIndex,
-  );
-  const applied = await merge.advance(localCard.path, heldWorktree, targetWorktree, {
-    label: `checkpoint-${reduced.checkpointRevision || 'clean'}`,
-  });
-  const indexResult = await advanceIndex(localCard.path, currentIndex, reducedLocalIndex.tree);
-  if (indexResult.state !== 'ready') return indexResult;
-  const persisted = persistRepoState(plan.repoKey, {
-    resourceId: project?.resourceId || null,
-    path: localCard.path,
-    replica: localCard.replica,
-    branch: stateBranch,
-    baseOid: stateBaseOid,
-    cardVersion: stateCardVersion,
-    cardMutationId: stateCardMutationId,
-    pendingCard: Boolean(cardResult.pendingCard),
-    appliedThrough,
-    checkpointRevision: revisionOf(stateBaseOid, stateIndexDiff, stateWorktreeDiff),
-    indexDiff: stateIndexDiff,
-    worktreeDiff: stateWorktreeDiff,
-    checkpointVersions: plan.transitions.map((entry) => entry.version),
-    branches: plan.branches || [],
-    pendingRefs: branchResult.pending,
-    heldTree: applied.heldTree,
-    heldIndexTree: targetIndex,
-    parked,
-    parkedWaiting: [...parkedWaiting, ...branchResult.waiting],
-    materialized: applied.heldTree === targetWorktree
-      && reducedLocalIndex.tree === targetIndex,
-  });
-  if (persisted.changed) {
-    appendStateEvent({
-      resource: 'workspace-reducer',
-      op: previous ? 'update' : 'insert',
-      id: localCard.replica,
-      value: repoStateEventValue(persisted.state),
-      source: 'workspace-reducer',
-    });
   }
-  return {
-    state: 'in-sync',
-    reason: null,
-    moved: cardResult.moved || branchResult.moved || applied.applied.length > 0,
-  };
+  const applying = validApplying(previous?.applying)
+    ? previous.applying
+    : null;
+  const verified = previous?.verificationContract === VERIFICATION_CONTRACT
+    && previous.materialized === true
+    && Number.isInteger(previous.appliedThrough);
+  const verifiedThrough = applying?.through ?? previous?.appliedThrough;
+  if (
+    !initial
+    && (
+      (!applying && !verified)
+      || intent.base.through > verifiedThrough
+    )
+  ) {
+    return { state: 'blocked', intent };
+  }
+  for (const tree of [
+    intent.base.indexTree,
+    intent.base.worktreeTree,
+    intent.local.indexTree,
+    intent.local.worktreeTree,
+    successor?.base?.indexTree,
+    successor?.base?.worktreeTree,
+    successor?.local?.indexTree,
+    successor?.local?.worktreeTree,
+  ]) {
+    if (tree == null) continue;
+    if (!validTree(tree) || !await merge.hasTree(localCard.path, tree)) {
+      return { state: 'blocked', intent, successor };
+    }
+  }
+  return { state: 'ready', intent, successor };
 }
 
-async function advanceIndex(worktreeRoot, observedTree, targetTree) {
-  if (observedTree === targetTree) return { state: 'ready', moved: false };
-  const patch = await merge.diffOfTree(worktreeRoot, observedTree, targetTree);
+async function advanceWorktree(worktreeRoot, heldTree, targetTree, options) {
   try {
-    await transition.applyIndexPatch(worktreeRoot, patch);
-    return { state: 'ready', moved: true };
+    return {
+      state: 'ready',
+      value: await merge.advance(worktreeRoot, heldTree, targetTree, options),
+    };
   } catch (error) {
     if (error instanceof transition.TransitionError) {
-      return { state: 'waiting', reason: 'local-index-moving', moved: false };
+      return { state: 'waiting', reason: 'local-state-moving' };
     }
     throw error;
   }
 }
 
-function localCardMayMaterialize(publishedCard, publication) {
-  return Boolean(publishedCard)
-    || publication?.reason === 'shared-state-covered'
-    || publication?.reason === 'project-not-current';
+function recoveryPlan(plan) {
+  return {
+    repoKey: plan.repoKey,
+    card: {
+      head: {
+        branch: plan.card.head?.branch ?? null,
+        oid: plan.card.head?.oid ?? null,
+      },
+      positionVersion: plan.card.positionVersion,
+      positionMutationId: plan.card.positionMutationId,
+    },
+    branches: (plan.branches || []).map((ref) => ({
+      name: ref.name,
+      oid: ref.oid ?? null,
+      version: ref.version,
+      mutationId: ref.mutationId,
+    })),
+    transitions: (plan.transitions || []).map((operation) => ({
+      machine: operation.machine,
+      version: operation.version,
+      mutationId: operation.mutationId,
+      to: { revision: operation.to?.revision ?? null },
+    })),
+  };
 }
 
-function pathForRepo(localCard, project) {
-  return localCard?.path || project?.path || null;
+function applyingRequestDigest(through, plan) {
+  return stateDigest({ through, plan: recoveryPlan(plan) });
 }
 
-async function runReducer() {
-  service.counters.passes += 1;
+function applyingId(requestDigest, source, target) {
+  return stateDigest({
+    requestDigest,
+    source: stateDigest(source),
+    target: stateDigest(target),
+  });
+}
+
+function hydratingId(requestDigest) {
+  return stateDigest({
+    contract: HYDRATING_CONTRACT,
+    requestDigest,
+  });
+}
+
+function validSourceReceipts(value) {
+  return Boolean(
+    value
+    && Array.isArray(value.worktree)
+    && value.worktree.every((name) => typeof name === 'string' && name.length > 0)
+    && typeof value.index === 'boolean'
+    && typeof value.head === 'boolean'
+    && Array.isArray(value.branches)
+    && value.branches.every((name) => typeof name === 'string' && name.length > 0),
+  );
+}
+
+function validApplying(value) {
+  if (!(
+    value
+    && value.contract === APPLYING_CONTRACT
+    && value.plan?.repoKey
+    && value.reduced?.state === 'ready'
+    && Number.isInteger(value.through)
+    && value.through >= 0
+    && value.requestDigest === applyingRequestDigest(value.through, value.plan)
+    && validPhysicalState(value.source)
+    && validPhysicalState(value.target)
+    && validPhysicalState(value.official)
+    && /^[0-9a-f]{64}$/.test(value.operationId)
+    && validSourceReceipts(value.sourceReceipts)
+  )) return false;
+  if (
+    value.predecessorIntentDigest !== undefined
+    && !(
+      /^[0-9a-f]{64}$/.test(value.predecessorIntentDigest)
+      && validPhysicalState(value.provenanceBase)
+    )
+  ) return false;
+  return true;
+}
+
+function validPhysicalState(value) {
+  return Boolean(
+    value
+    && validTree(value.head?.oid)
+    && Array.isArray(value.branches)
+    && validTree(value.indexTree)
+    && validTree(value.worktreeTree)
+  );
+}
+
+function sameOid(left, right) {
+  return (left ?? null) === (right ?? null);
+}
+
+function sameReceiptPlan(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+function headAttachment(head) {
+  return head?.branch
+    ? { branch: head.branch }
+    : { branch: null, oid: head?.oid ?? null };
+}
+
+function sameHeadAttachment(left, right) {
+  return JSON.stringify(headAttachment(left)) === JSON.stringify(headAttachment(right));
+}
+
+async function sourceReceipts(worktreeRoot, source, target) {
+  const worktreePaths = source.worktreeTree === target.worktreeTree
+    ? []
+    : await merge.changedPaths(worktreeRoot, source.worktreeTree, target.worktreeTree);
+  const sourceRefs = new Map(branchState(source.branches).map((ref) => [ref.name, ref.oid]));
+  const targetRefs = new Map(branchState(target.branches).map((ref) => [ref.name, ref.oid]));
+  const branchNames = [...new Set([...sourceRefs.keys(), ...targetRefs.keys()])]
+    .filter((name) => !sameOid(sourceRefs.get(name), targetRefs.get(name)))
+    .sort();
+  return {
+    worktree: worktreePaths,
+    index: source.indexTree !== target.indexTree,
+    head: !sameHeadAttachment(source.head, target.head),
+    branches: branchNames,
+  };
+}
+
+async function crossedSourceReceipts(worktreeRoot, operationId, receipts) {
+  const worktree = transition.crossedFileReceiptPaths(
+    worktreeRoot,
+    operationId,
+    receipts.worktree,
+  );
+  const crossedBranches = await Promise.all(
+    receipts.branches.map(async (name) => (
+      await transition.branchReceiptCrossed(worktreeRoot, operationId, name)
+        ? name
+        : null
+    )),
+  );
+  const branches = new Set(crossedBranches.filter(Boolean));
+  return {
+    worktree,
+    index: receipts.index
+      && transition.gitMetadataReceiptCrossed(worktreeRoot, operationId, 'index'),
+    head: receipts.head
+      && transition.gitMetadataReceiptCrossed(worktreeRoot, operationId, 'HEAD'),
+    branches,
+  };
+}
+
+function receiptProvenHeadReturn(current, source, headCrossed) {
+  return (
+    headCrossed
+    && source?.branch
+    && sameCardPosition({ head: current }, { head: source })
+  ) ? source.branch : null;
+}
+
+function reconcileApplyingBranches(
+  currentRefs,
+  sourceRefs,
+  targetRefs,
+  crossed = new Set(),
+  retainedHeadBranch = null,
+) {
+  const current = new Map(branchState(currentRefs).map((ref) => [ref.name, ref.oid]));
+  const source = new Map(branchState(sourceRefs).map((ref) => [ref.name, ref.oid]));
+  const target = new Map(branchState(targetRefs).map((ref) => [ref.name, ref.oid]));
+  const names = new Set([...current.keys(), ...source.keys(), ...target.keys()]);
+  return [...names].sort().flatMap((name) => {
+    const currentOid = current.get(name) ?? null;
+    const sourceOid = source.get(name) ?? null;
+    const targetOid = target.get(name) ?? null;
+    const oid = name === retainedHeadBranch
+      ? currentOid
+      : sameOid(currentOid, targetOid)
+      ? targetOid
+      : sameOid(currentOid, sourceOid) && !crossed.has(name)
+        ? targetOid
+        : currentOid;
+    return oid === null ? [] : [{ name, oid }];
+  });
+}
+
+function headAfterRefPlan(sealedHead, postRefBranches) {
+  const postRefMap = new Map(
+    branchState(postRefBranches).map((ref) => [ref.name, ref.oid]),
+  );
+  return sealedHead.branch
+    ? {
+      branch: sealedHead.branch,
+      oid: postRefMap.get(sealedHead.branch) ?? null,
+    }
+    : headAttachment(sealedHead);
+}
+
+function branchRefApplyPlan(sealedHead, currentBranches, targetBranches) {
+  const current = new Map(
+    branchState(currentBranches)
+      .filter((ref) => ref.oid !== null)
+      .map((ref) => [ref.name, ref.oid]),
+  );
+  const target = new Map(
+    branchState(targetBranches)
+      .filter((ref) => ref.oid !== null)
+      .map((ref) => [ref.name, ref.oid]),
+  );
+  const changes = [...new Set([...current.keys(), ...target.keys()])]
+    .sort()
+    .flatMap((name) => {
+      const expectedOid = current.get(name) ?? null;
+      const oid = target.get(name) ?? null;
+      return expectedOid === oid ? [] : [{ branch: name, expectedOid, oid }];
+    });
+  const deferred = sealedHead?.branch
+    ? changes.find((change) => (
+      change.branch === sealedHead.branch
+      && change.oid === null
+    )) || null
+    : null;
+  if (!deferred) {
+    return {
+      beforeHead: changes,
+      headBranches: branchMapState(target),
+      afterHead: [],
+    };
+  }
+  const headBranches = new Map(target);
+  headBranches.set(deferred.branch, deferred.expectedOid);
+  return {
+    beforeHead: changes.filter((change) => change !== deferred),
+    headBranches: branchMapState(headBranches),
+    afterHead: [deferred],
+  };
+}
+
+async function advanceBranchRefChanges(worktreeRoot, changes, operationId) {
+  if (changes.length === 0) return { state: 'ready' };
+  try {
+    await transition.updateBranchRefs(worktreeRoot, changes, operationId);
+    return { state: 'ready' };
+  } catch (error) {
+    if (error instanceof transition.TransitionError) {
+      return { state: 'waiting', reason: 'local-refs-moving' };
+    }
+    throw error;
+  }
+}
+
+async function advanceBranchesAndHead(
+  worktreeRoot,
+  sealedHead,
+  currentBranches,
+  targetBranches,
+  targetHead,
+  operationId,
+) {
+  const plan = branchRefApplyPlan(
+    sealedHead,
+    currentBranches,
+    targetBranches,
+  );
+  const beforeHead = await advanceBranchRefChanges(
+    worktreeRoot,
+    plan.beforeHead,
+    operationId,
+  );
+  if (beforeHead.state !== 'ready') return beforeHead;
+  const head = await advanceHeadAfterSealedRefPlan(
+    worktreeRoot,
+    sealedHead,
+    plan.headBranches,
+    targetHead,
+    operationId,
+  );
+  if (head.state !== 'ready') return head;
+  return advanceBranchRefChanges(
+    worktreeRoot,
+    plan.afterHead,
+    operationId,
+  );
+}
+
+function reconcileApplyingHead(
+  current,
+  source,
+  target,
+  branches,
+  {
+    headCrossed = false,
+    branchCrossed = new Set(),
+    plannedPostRefBranches = [],
+  } = {},
+) {
+  const postRefSource = headAfterRefPlan(source, plannedPostRefBranches);
+  const sourceBranchCrossed = source?.branch
+    ? branchCrossed.has(source.branch)
+    : false;
+  const selected = sameCardPosition({ head: current }, { head: target })
+    ? headAttachment(target)
+    : sameCardPosition({ head: current }, { head: postRefSource }) && !headCrossed
+      ? headAttachment(target)
+      : sameCardPosition({ head: current }, { head: source })
+        && !headCrossed
+        && !sourceBranchCrossed
+        ? headAttachment(target)
+        : headAttachment(current);
+  if (!selected.branch) return selected;
+  const attached = branches.find((branch) => branch.name === selected.branch);
+  if (!attached) {
+    return {
+      branch: null,
+      oid: current?.oid ?? target?.oid ?? null,
+    };
+  }
+  return {
+    branch: selected.branch,
+    oid: attached.oid,
+  };
+}
+
+async function advanceHeadAfterSealedRefPlan(
+  worktreeRoot,
+  sealedHead,
+  postRefBranches,
+  targetHead,
+  operationId,
+) {
+  const postRefMap = new Map(
+    branchState(postRefBranches).map((ref) => [ref.name, ref.oid]),
+  );
+  const expectedHead = headAfterRefPlan(sealedHead, postRefBranches);
+  if (sameCardPosition({ head: expectedHead }, { head: targetHead })) {
+    return { state: 'ready' };
+  }
+  try {
+    await transition.moveHeadToCard(worktreeRoot, {
+      expectedBranch: expectedHead.branch,
+      expectedOid: expectedHead.oid,
+      expectedTargetOid: targetHead.branch
+        ? postRefMap.get(targetHead.branch) ?? null
+        : null,
+      targetBranch: targetHead.branch,
+      targetOid: targetHead.oid,
+      operation: operationId,
+    });
+    return { state: 'ready' };
+  } catch (error) {
+    if (error instanceof transition.TransitionError) {
+      return { state: 'waiting', reason: 'local-head-moving' };
+    }
+    throw error;
+  }
+}
+
+async function applyingAnchors(
+  localCard,
+  plan,
+  prepared,
+  intent,
+  successor,
+  observed,
+  through,
+) {
+  const official = targetRepoState(plan, through, prepared);
+  const covered = intent && intentFoldedThrough(intent, through);
+  if (covered) {
+    const predecessor = successor?.base || intent.local;
+    const retained = successor?.local || observed.value;
+    const staged = await merge.reduceTree(
+      localCard.path,
+      official.indexTree,
+      predecessor.indexTree,
+      retained.indexTree,
+    );
+    const working = await merge.reduceTree(
+      localCard.path,
+      official.worktreeTree,
+      predecessor.worktreeTree,
+      retained.worktreeTree,
+    );
+    const sourceHead = cardState(predecessor.card);
+    const currentHead = retained.card?.head || retained.head;
+    const head = (
+      sameCardPosition({ head: currentHead }, { head: sourceHead })
+      || sameCardPosition({ head: currentHead }, { head: official.head })
+    ) ? official.head : currentHead;
+    const branches = reconcileApplyingBranches(
+      retained.card?.branches || retained.branches,
+      predecessor.card.branches,
+      official.branches,
+    );
+    if (head.branch) {
+      const attached = branches.find((branch) => branch.name === head.branch);
+      if (attached) attached.oid = head.oid;
+      else branches.push({ name: head.branch, oid: head.oid });
+      branches.sort((left, right) => left.name.localeCompare(right.name));
+    }
+    return {
+      source: observed.value,
+      target: {
+        head,
+        branches,
+        indexTree: staged.tree,
+        worktreeTree: working.tree,
+      },
+      official,
+      provenanceBase: {
+        head: sourceHead,
+        branches: branchState(intent.local.card.branches),
+        indexTree: intent.local.indexTree,
+        worktreeTree: intent.local.worktreeTree,
+      },
+      predecessorIntentDigest: intent.semanticDigest,
+    };
+  }
+  const retainedIntent = successor
+    ? { ...intent, local: successor.local, terminal: successor.terminal }
+    : intent;
+  const staged = intent
+    ? await merge.reduceTree(
+      localCard.path,
+      prepared.indexTree,
+      retainedIntent.base.indexTree,
+      retainedIntent.local.indexTree,
+    )
+    : { tree: prepared.indexTree };
+  const working = intent
+    ? await merge.reduceTree(
+      localCard.path,
+      prepared.worktreeTree,
+      retainedIntent.base.worktreeTree,
+      retainedIntent.local.worktreeTree,
+    )
+    : { tree: prepared.worktreeTree };
+  const refs = classifyBranchRefs(plan, observed.value.branches, retainedIntent);
+  const pendingCard = intentOwnsHead(retainedIntent)
+    ? cardState(retainedIntent.local.card)
+    : null;
+  return {
+    source: observed.value,
+    target: physicalRepoState({
+      plan,
+      pendingCard,
+      expectedBranches: refs.expected,
+      indexTree: staged.tree,
+      worktreeTree: working.tree,
+    }),
+    official,
+  };
+}
+
+function applyingIntentBase(applying) {
+  return {
+    through: applying.through,
+    card: {
+      head: {
+        branch: applying.official.head.branch,
+        oid: applying.official.head.oid,
+        detached: !applying.official.head.branch,
+      },
+      branches: branchState(applying.official.branches),
+    },
+    indexTree: applying.official.indexTree,
+    worktreeTree: applying.official.worktreeTree,
+  };
+}
+
+/**
+ * Recover one interrupted ordered apply without guessing.
+ *
+ * Source is the observed checkout before apply; target is the official state
+ * with proven local intent preserved. An uncrossed source or the planned
+ * post-ref HEAD resolves to target. A receipt-proven return to source and any
+ * third value are retained and durably captured as successor intent over the
+ * official target.
+ */
+async function recoverApplyingIntent(project, localCard, previous) {
+  const applying = previous?.applying;
+  if (!validApplying(applying)) return { state: 'ready', card: localCard };
+  const observed = await observePhysicalRepo(localCard.path);
+  if (observed.state !== 'ready') {
+    return { state: 'waiting', reason: 'local-state-moving' };
+  }
+  const crossed = await crossedSourceReceipts(
+    localCard.path,
+    applying.operationId,
+    applying.sourceReceipts,
+  );
+  const index = await merge.reconcileApplyingTree(
+    localCard.path,
+    observed.value.indexTree,
+    applying.source.indexTree,
+    applying.target.indexTree,
+    { sourceCrossed: crossed.index },
+  );
+  const worktree = await merge.reconcileApplyingTree(
+    localCard.path,
+    observed.value.worktreeTree,
+    applying.source.worktreeTree,
+    applying.target.worktreeTree,
+    { crossedPaths: crossed.worktree },
+  );
+  const branches = reconcileApplyingBranches(
+    observed.value.branches,
+    applying.source.branches,
+    applying.target.branches,
+    crossed.branches,
+    receiptProvenHeadReturn(
+      observed.value.head,
+      applying.source.head,
+      crossed.head,
+    ),
+  );
+  const head = reconcileApplyingHead(
+    observed.value.head,
+    applying.source.head,
+    applying.target.head,
+    branches,
+    {
+      headCrossed: crossed.head,
+      branchCrossed: crossed.branches,
+      plannedPostRefBranches: applying.target.branches,
+    },
+  );
+  const resolved = {
+    head,
+    branches,
+    indexTree: index.tree,
+    worktreeTree: worktree.tree,
+  };
+
+  const headResult = await advanceBranchesAndHead(
+    localCard.path,
+    observed.value.head,
+    observed.value.branches,
+    resolved.branches,
+    head,
+    applying.operationId,
+  );
+  if (headResult.state !== 'ready') return headResult;
+
+  const worktreeResult = await advanceWorktree(
+    localCard.path,
+    observed.value.worktreeTree,
+    resolved.worktreeTree,
+    { label: applying.operationId },
+  );
+  if (worktreeResult.state !== 'ready') return worktreeResult;
+  const indexResult = await advanceIndex(
+    localCard.path,
+    observed.value.indexTree,
+    resolved.indexTree,
+    applying.operationId,
+  );
+  if (indexResult.state !== 'ready') return indexResult;
+
+  const recovered = await observePhysicalRepo(localCard.path);
+  if (recovered.state !== 'ready' || recovered.digest !== stateDigest(resolved)) {
+    return { state: 'waiting', reason: 'local-state-moving' };
+  }
+  const refreshed = await refreshRepoCard(localCard.replica) || {
+    ...localCard,
+    head: {
+      branch: resolved.head.branch,
+      oid: resolved.head.oid,
+      detached: !resolved.head.branch,
+    },
+    refs: resolved.branches,
+  };
+  const retainedThirdValue = stateDigest(resolved) !== stateDigest(applying.target);
+  const heldIntent = project
+    ? require('./intent').readOwnedIntent(project)
+    : null;
+  const rebaseUnnumberedIntent = Boolean(
+    heldIntent
+    && !heldIntent.publication
+    && heldIntent.base.through < applying.through
+  );
+  if (
+    applying.predecessorIntentDigest
+    || retainedThirdValue
+    || rebaseUnnumberedIntent
+  ) {
+    if (!project) return { state: 'waiting', reason: 'unknown-local-state' };
+    const captured = await captureIntentAgainst(
+      project,
+      {
+        ...refreshed,
+        head: {
+          branch: resolved.head.branch,
+          oid: resolved.head.oid,
+          detached: !resolved.head.branch,
+        },
+        refs: resolved.branches.map((branch) => {
+          const source = [
+            ...(refreshed.refs || refreshed.branches || []),
+            ...(localCard.refs || localCard.branches || []),
+          ].find((ref) => ref.name === branch.name && ref.oid === branch.oid);
+          return source ? { ...source, ...branch } : branch;
+        }),
+      },
+      applyingIntentBase(applying),
+      recovered,
+      {
+        replaceAnchoredIntent: applying.predecessorIntentDigest,
+        preserveNoEffectIntent: rebaseUnnumberedIntent,
+        preserveBirthMutationId: rebaseUnnumberedIntent,
+      },
+    );
+    if (captured.state === 'waiting' || captured.state === 'rejected') return captured;
+  }
+
+  const settledReceipts = await sourceReceipts(
+    localCard.path,
+    resolved,
+    resolved,
+  );
+  saveRepoState(previous.repoKey, refreshed, previous, {
+    ...previous,
+    applying: {
+      ...applying,
+      source: resolved,
+      target: resolved,
+      sourceReceipts: settledReceipts,
+    },
+    materialized: false,
+  });
+  return { state: 'ready', card: refreshed };
+}
+
+async function finishApplying(project, localCard, previous) {
+  const applying = previous?.applying;
+  if (!validApplying(applying)) {
+    return { state: 'waiting', reason: 'apply-wal-missing' };
+  }
+  const observed = await observePhysicalRepo(localCard.path);
+  if (
+    observed.state !== 'ready'
+    || observed.digest !== stateDigest(applying.target)
+  ) {
+    return {
+      state: 'waiting',
+      reason: observed.state === 'ready'
+        ? 'local-intent-capture-required'
+        : 'local-state-moving',
+    };
+  }
+  const reduced = applying.reduced;
+  const official = targetRepoState(applying.plan, applying.through, reduced);
+  const indexDiff = await merge.diffOfTree(
+    localCard.path,
+    applying.plan.card.head.oid,
+    reduced.indexTree,
+  );
+  const worktreeDiff = await merge.diffOfTree(
+    localCard.path,
+    reduced.indexTree,
+    reduced.worktreeTree,
+  );
+  const verified = saveRepoState(previous.repoKey, localCard, previous, {
+    verificationContract: VERIFICATION_CONTRACT,
+    resourceId: project?.resourceId || null,
+    path: localCard.path,
+    replica: localCard.replica,
+    branch: applying.plan.card.head.branch,
+    baseOid: applying.plan.card.head.oid,
+    cardVersion: applying.plan.card.positionVersion,
+    cardMutationId: applying.plan.card.positionMutationId,
+    targetCard: {
+      branch: applying.plan.card.head.branch,
+      oid: applying.plan.card.head.oid,
+      version: applying.plan.card.positionVersion,
+      mutationId: applying.plan.card.positionMutationId,
+    },
+    appliedThrough: applying.through,
+    checkpointRevision: reduced.checkpointRevision,
+    indexDiff,
+    worktreeDiff,
+    checkpointVersions: applying.plan.transitions.map((entry) => entry.version),
+    branches: applying.plan.branches || [],
+    heldTree: reduced.worktreeTree,
+    heldIndexTree: reduced.indexTree,
+    targetDigest: stateDigest(official),
+    expectedPhysicalDigest: observed.digest,
+    observedPhysicalDigest: observed.digest,
+    materialized: true,
+    receiptOperationId: applying.operationId,
+  });
+  await releaseVerifiedReceipts(previous.repoKey, verified);
+  const foldedIntent = require('./intent').readIntent(project);
+  if (
+    foldedIntent?.publication?.foldedAt
+    && foldedIntent.publication.numberedVersion <= applying.through
+  ) {
+    provenance.requireTransition(
+      provenance.STATE.FOLDED,
+      provenance.ACTION.APPLY,
+      provenance.STATE.OFFICIAL,
+      [
+        'official-target',
+        'apply-wal',
+        'physical-verification',
+        'applied-cursor',
+        'intent-retired',
+      ],
+    );
+    require('./intent').clearIntent(project);
+  }
+  return { state: 'in-sync', reason: null, moved: true };
+}
+
+function refMap(refs) {
+  return new Map((refs || []).filter((ref) => ref?.name).map((ref) => [ref.name, ref]));
+}
+
+/**
+ * A ref differs for only two reasons:
+ *
+ *   - it still equals the last verified official value, so it must advance;
+ *   - it is an explicit local intent created after that verified value.
+ *
+ * Acknowledgement ends local ownership. From then on, a later official value
+ * wins like any other ordered write.
+ */
+function classifyBranchRefs(
+  plan,
+  currentRefs,
+  intent = null,
+) {
+  const current = refMap(currentRefs);
+  const target = refMap(plan.branches);
+  const base = refMap(intent?.base?.card?.branches);
+  const local = refMap(intent?.local?.card?.branches);
+  const ownedHeadBranch = intentOwnsHead(intent)
+    ? intent.local.card.head?.branch ?? null
+    : null;
+  const checked = plan.card.head?.branch || null;
+  if (checked) {
+    target.set(checked, {
+      name: checked,
+      oid: plan.card.head.oid,
+      mutationId: plan.card.positionMutationId,
+      version: plan.card.positionVersion,
+    });
+  }
+  const names = [...new Set([
+    ...current.keys(),
+    ...target.keys(),
+    ...base.keys(),
+    ...local.keys(),
+  ])].sort();
+  const intents = [];
+  const changes = [];
+
+  for (const name of names) {
+    const currentOid = current.get(name)?.oid ?? null;
+    const targetOid = target.get(name)?.oid ?? null;
+    const baseOid = base.get(name)?.oid ?? null;
+    const localOid = local.get(name)?.oid ?? null;
+    const owned = Boolean(
+      intent
+      && (
+        localOid !== baseOid
+        || name === ownedHeadBranch
+      )
+    );
+    const desiredOid = owned ? localOid : targetOid;
+    if (owned) intents.push({ name, oid: localOid });
+    if (currentOid !== desiredOid) {
+      changes.push({ branch: name, expectedOid: currentOid, oid: desiredOid });
+    }
+  }
+
+  const expected = new Map([...target].map(([name, ref]) => [name, ref.oid ?? null]));
+  for (const intent of intents) expected.set(intent.name, intent.oid);
+  return { changes, expected, pending: intents };
+}
+
+async function obtainBranchObjects(localCard, ref) {
+  if (ref.oid === null || await hasCommit(localCard.path, ref.oid)) return null;
+  if (ref.objects?.kind === 'bundle') {
+    const imported = await require('./objects').importFromLocator(localCard.path, ref.objects);
+    if (imported.state !== 'imported') return imported.state;
+  } else {
+    throw new Error(`official branch ${ref.name} has no complete bundle`);
+  }
+  if (!await hasCommit(localCard.path, ref.oid)) {
+    throw new Error(`official branch bundle does not contain ${ref.oid}`);
+  }
+  return null;
+}
+
+async function reduceCheckpoint(localCard, plan) {
+  const baseOid = plan.card.head.oid;
+  const baseTree = await merge.treeOf(localCard.path, baseOid);
+  let indexTree = baseTree;
+  let worktreeTree = baseTree;
+
+  for (const operation of plan.transitions) {
+    const from = readCheckpointValue(baseOid, operation.from);
+    const to = readCheckpointValue(baseOid, operation.to);
+    if (from.state !== 'ready' || to.state !== 'ready') {
+      const incomplete = from.state !== 'ready' ? from.state : to.state;
+      if (incomplete === 'downloading') {
+        return { state: 'waiting', reason: 'checkpoint-downloading' };
+      }
+      throw new Error(`official checkpoint is ${incomplete}`);
+    }
+    const fromIndexTree = await merge.treeOfPatch(localCard.path, baseOid, from.indexDiff);
+    const toIndexTree = await merge.treeOfPatch(localCard.path, baseOid, to.indexDiff);
+    const reducedIndex = await merge.reduceTree(
+      localCard.path,
+      indexTree,
+      fromIndexTree,
+      toIndexTree,
+    );
+    indexTree = reducedIndex.tree;
+
+    const fromWorktreeTree = await merge.treeOfPatch(localCard.path, fromIndexTree, from.worktreeDiff);
+    const toWorktreeTree = await merge.treeOfPatch(localCard.path, toIndexTree, to.worktreeDiff);
+    const reducedWorktree = await merge.reduceTree(
+      localCard.path,
+      worktreeTree,
+      fromWorktreeTree,
+      toWorktreeTree,
+    );
+    worktreeTree = reducedWorktree.tree;
+  }
+
+  const indexDiff = await merge.diffOfTree(localCard.path, baseOid, indexTree);
+  const worktreeDiff = await merge.diffOfTree(localCard.path, indexTree, worktreeTree);
+  return {
+    state: 'ready',
+    indexTree,
+    worktreeTree,
+    indexDiff,
+    worktreeDiff,
+    checkpointRevision: revisionOf(baseOid, indexDiff, worktreeDiff),
+  };
+}
+
+/**
+ * Official state is all-or-nothing. Download every referenced object and
+ * reduce every checkpoint payload before changing HEAD, refs, files, or the
+ * verified cursor.
+ */
+async function preparePlan(localCard, plan) {
+  const card = await obtainCardObjects(localCard, plan.card);
+  if (card.state !== 'ready') {
+    return { state: 'waiting', reason: card.state };
+  }
+  for (const ref of plan.branches || []) {
+    if (ref.oid === null) continue;
+    const reason = await obtainBranchObjects(localCard, ref);
+    if (reason) return { state: 'waiting', reason: `branch-${reason}` };
+  }
+  return reduceCheckpoint(localCard, plan);
+}
+
+function canonicalValue(value) {
+  if (Array.isArray(value)) return value.map(canonicalValue);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(
+    Object.keys(value).sort().map((key) => [key, canonicalValue(value[key])]),
+  );
+}
+
+function stateDigest(value) {
+  return crypto.createHash('sha256')
+    .update(JSON.stringify(canonicalValue(value)))
+    .digest('hex');
+}
+
+function branchState(refs) {
+  return (refs || [])
+    .map((ref) => ({ name: ref.name, oid: ref.oid ?? null }))
+    .sort((left, right) => left.name.localeCompare(right.name));
+}
+
+function branchMapState(refs) {
+  return [...refs.entries()]
+    .map(([name, oid]) => ({ name, oid }))
+    .sort((left, right) => left.name.localeCompare(right.name));
+}
+
+async function observePhysicalRepo(worktreeRoot) {
+  transition.recoverFileTransactions(worktreeRoot);
+  transition.recoverGitMetadataTransactions(worktreeRoot);
+  const beforeHead = await headAndDirty(worktreeRoot);
+  const beforeBranches = await localBranches(worktreeRoot);
+  const captured = await captureCheckpoint(worktreeRoot);
+  if (captured.indexDiff === null || captured.baseOid !== beforeHead.head.oid) {
+    return { state: 'moving' };
+  }
+  const indexTree = await merge.treeOfPatch(
+    worktreeRoot,
+    captured.baseOid,
+    captured.indexDiff,
+  );
+  const worktreeTree = await merge.treeOfPatch(
+    worktreeRoot,
+    indexTree,
+    captured.worktreeDiff,
+  );
+  const afterHead = await headAndDirty(worktreeRoot);
+  const afterBranches = await localBranches(worktreeRoot);
+  if (
+    !sameCardPosition(beforeHead, afterHead)
+    || JSON.stringify(branchState(beforeBranches)) !== JSON.stringify(branchState(afterBranches))
+  ) return { state: 'moving' };
+  const value = {
+    head: {
+      branch: afterHead.head.branch,
+      oid: afterHead.head.oid,
+    },
+    branches: branchState(afterBranches),
+    indexTree,
+    worktreeTree,
+  };
+  return { state: 'ready', value, digest: stateDigest(value), captured };
+}
+
+/**
+ * Close the only gap between local observation and ordered apply.
+ *
+ * A mismatch is only a stop signal here. It never becomes authorship. Once
+ * the lock is released, checkpoint capture may record the change, but only
+ * against the same verified baseline that was already durable before apply.
+ */
+async function verifyApplyBoundary(project, localCard, receivedThrough) {
+  const previous = readRepoState(project.repoKey, project.resourceId);
+  if (
+    previous?.path !== localCard.path
+    || previous.replica !== localCard.replica
+  ) return { state: 'ready' };
+
+  const observed = await observePhysicalRepo(localCard.path);
+  if (observed.state !== 'ready') {
+    return { state: 'waiting', reason: 'local-state-moving' };
+  }
+
+  const intents = require('./intent');
+  const held = intents.readIntent(project);
+  const successor = held?.successor || null;
+  const owned = intents.readOwnedIntent(project);
+  if (successor) {
+    return observed.digest === successor.local.physicalDigest
+      ? { state: 'ready' }
+      : { state: 'waiting', reason: 'local-intent-capture-required' };
+  }
+  if (owned) {
+    return observed.digest === owned.local.physicalDigest
+      ? { state: 'ready' }
+      : { state: 'waiting', reason: 'local-intent-capture-required' };
+  }
+
+  const acknowledgement = held
+    ? intents.officialAcknowledgement(project, held)
+    : null;
+  if (acknowledgement) {
+    if (acknowledgement.version > receivedThrough) {
+      return { state: 'waiting', reason: 'official-ack-settling' };
+    }
+    return { state: 'ready' };
+  }
+
+  if (
+    previous.verificationContract === VERIFICATION_CONTRACT
+    && previous.materialized === true
+    && observed.digest !== previous.observedPhysicalDigest
+  ) {
+    return { state: 'waiting', reason: 'local-intent-capture-required' };
+  }
+  return { state: 'ready' };
+}
+
+function targetRepoState(plan, through, reduced) {
+  const branches = refMap(plan.branches);
+  if (plan.card.head?.branch) {
+    branches.set(plan.card.head.branch, {
+      name: plan.card.head.branch,
+      oid: plan.card.head.oid,
+    });
+  }
+  return {
+    through,
+    head: {
+      branch: plan.card.head?.branch ?? null,
+      oid: plan.card.head?.oid ?? null,
+    },
+    branches: branchState([...branches.values()]),
+    indexTree: reduced.indexTree,
+    worktreeTree: reduced.worktreeTree,
+  };
+}
+
+function intentFoldedThrough(intent, through) {
+  return Boolean(
+    intent?.publication
+    && Number.isInteger(intent.publication.numberedVersion)
+    && intent.publication.numberedVersion <= through
+    && typeof intent.publication.foldedAt === 'string'
+  );
+}
+
+function physicalRepoState({
+  plan,
+  pendingCard,
+  expectedBranches,
+  indexTree,
+  worktreeTree,
+}) {
+  const branches = new Map(expectedBranches);
+  const head = pendingCard || {
+    branch: plan.card.head?.branch ?? null,
+    oid: plan.card.head?.oid ?? null,
+  };
+  if (head.branch) branches.set(head.branch, head.oid);
+  return {
+    head: { branch: head.branch, oid: head.oid },
+    branches: branchMapState(branches),
+    indexTree,
+    worktreeTree,
+  };
+}
+
+function officialPhysicalState(official) {
+  return {
+    head: official.head,
+    branches: official.branches,
+    indexTree: official.indexTree,
+    worktreeTree: official.worktreeTree,
+  };
+}
+
+async function materializeRepoOnce(localCardInput, plan, appliedThrough = null) {
+  const refreshed = localCardInput;
+  const project = require('./wall').projectForRepo(plan.repoKey);
+  const stored = readRepoState(plan.repoKey, project?.resourceId);
+  let previous = stored?.path === refreshed.path
+    && stored.replica === refreshed.replica
+    ? stored
+    : null;
+  const resolvedIntent = await usableIntent(project, previous, refreshed);
+  if (resolvedIntent.state === 'blocked') {
+    return { state: 'waiting', reason: 'local-intent-provenance-unverified' };
+  }
+  const intent = resolvedIntent.intent;
+  const successor = resolvedIntent.successor;
+  const requestedThrough = Number.isInteger(appliedThrough) && appliedThrough >= 0
+    ? appliedThrough
+    : planThrough(plan);
+  const requestedDigest = applyingRequestDigest(requestedThrough, plan);
+  const prepared = await preparePlan(refreshed, plan);
+  if (prepared.state !== 'ready') return prepared;
+  const expectedTargetDigest = stateDigest(
+    targetRepoState(plan, requestedThrough, prepared),
+  );
+  const official = targetRepoState(plan, requestedThrough, prepared);
+  const alreadyVerified = previous?.verificationContract === VERIFICATION_CONTRACT
+    && previous.materialized === true
+    && previous.appliedThrough === requestedThrough
+    && previous.targetDigest === expectedTargetDigest;
+  if (alreadyVerified) {
+    const observed = await observePhysicalRepo(refreshed.path);
+    if (observed.state !== 'ready') {
+      return { state: 'waiting', reason: 'local-state-moving' };
+    }
+    const provenDigests = new Set([
+      previous.observedPhysicalDigest,
+      successor?.local?.physicalDigest,
+      intent?.base?.through === requestedThrough
+        ? intent.local.physicalDigest
+        : null,
+    ].filter(Boolean));
+    if (!provenDigests.has(observed.digest)) {
+      return { state: 'waiting', reason: 'local-intent-capture-required' };
+    }
+    return { state: 'in-sync', reason: null, moved: false };
+  }
+  const observed = await observePhysicalRepo(refreshed.path);
+  if (observed.state !== 'ready') {
+    return { state: 'waiting', reason: 'local-state-moving' };
+  }
+  const retainedDigest = successor?.local?.physicalDigest
+    || intent?.local?.physicalDigest;
+  if (intent && observed.digest !== retainedDigest) {
+    return { state: 'waiting', reason: 'local-intent-capture-required' };
+  }
+  if (
+    !intent
+    && previous?.verificationContract === VERIFICATION_CONTRACT
+    && previous.materialized === true
+    && observed.digest !== previous.observedPhysicalDigest
+  ) {
+    return { state: 'waiting', reason: 'local-intent-capture-required' };
+  }
+  if (
+    !intent
+    && !(
+      previous?.verificationContract === VERIFICATION_CONTRACT
+      && previous.materialized === true
+    )
+    && observed.digest !== stateDigest(officialPhysicalState(official))
+  ) {
+    return { state: 'waiting', reason: 'unknown-local-state' };
+  }
+  const anchors = await applyingAnchors(
+    refreshed,
+    plan,
+    prepared,
+    intent,
+    successor,
+    observed,
+    requestedThrough,
+  );
+  const receipts = await sourceReceipts(
+    refreshed.path,
+    anchors.source,
+    anchors.target,
+  );
+  const sealed = await observePhysicalRepo(refreshed.path);
+  const sealedReceipts = await sourceReceipts(
+    refreshed.path,
+    anchors.source,
+    anchors.target,
+  );
+  if (
+    sealed.state !== 'ready'
+    || sealed.digest !== stateDigest(anchors.source)
+    || !sameReceiptPlan(receipts, sealedReceipts)
+  ) {
+    return { state: 'waiting', reason: 'local-state-moving' };
+  }
+  const operationId = applyingId(requestedDigest, anchors.source, anchors.target);
+  saveRepoState(plan.repoKey, refreshed, previous, {
+    ...(previous || {}),
+    resourceId: project?.resourceId || null,
+    path: refreshed.path,
+    replica: refreshed.replica,
+    applying: {
+      contract: APPLYING_CONTRACT,
+      through: requestedThrough,
+      requestDigest: requestedDigest,
+      plan: recoveryPlan(plan),
+      reduced: {
+        state: 'ready',
+        indexTree: prepared.indexTree,
+        worktreeTree: prepared.worktreeTree,
+        checkpointRevision: prepared.checkpointRevision,
+      },
+      ...anchors,
+      operationId,
+      sourceReceipts: sealedReceipts,
+    },
+    materialized: false,
+  });
+  return materializeRepo(refreshed, plan, requestedThrough);
+}
+
+/**
+ * One durable apply is finished before any newer rail target. Its stored
+ * source, official state, and local-preserving target let restart finish the
+ * same transition without reclassifying partial output as a new local write.
+ */
+async function materializeRepo(localCardInput, plan, appliedThrough = null) {
+  const project = require('./wall').projectForRepo(plan.repoKey);
+  let stored = readRepoState(plan.repoKey, project?.resourceId);
+  if (stored?.receiptOperationId) {
+    stored = await releaseVerifiedReceipts(plan.repoKey, stored);
+  }
+  if (validHydrating(stored?.hydrating, plan.repoKey, stored?.path)) {
+    return hydrateRepo({ ...project, path: stored.path }, plan);
+  }
+  let previous = stored?.path === localCardInput.path
+    && stored.replica === localCardInput.replica
+    ? stored
+    : null;
+  if (!validApplying(previous?.applying)) {
+    return materializeRepoOnce(localCardInput, plan, appliedThrough);
+  }
+  const interruptedRequest = previous.applying;
+  let recoveryCard = localCardInput;
+  const recovery = await recoverApplyingIntent(project, recoveryCard, previous);
+  if (recovery.state !== 'ready') return recovery;
+  recoveryCard = recovery.card;
+  previous = readRepoState(plan.repoKey, project?.resourceId) || previous;
+
+  const recovered = await finishApplying(project, recoveryCard, previous);
+  if (recovered.state !== 'in-sync') return recovered;
+
+  const requestedThrough = Number.isInteger(appliedThrough) && appliedThrough >= 0
+    ? appliedThrough
+    : interruptedRequest.through;
+  if (
+    interruptedRequest.requestDigest
+    === applyingRequestDigest(requestedThrough, plan)
+  ) return recovered;
+
+  const refreshed = await refreshRepoCard(recoveryCard.replica) || recoveryCard;
+  return materializeRepoOnce(refreshed, plan, appliedThrough);
+}
+
+async function advanceIndex(worktreeRoot, observedTree, targetTree, operationId = null) {
+  if (observedTree === targetTree) return { state: 'ready', moved: false };
+  const patch = await merge.diffOfTree(worktreeRoot, observedTree, targetTree);
+  try {
+    await transition.applyIndexPatch(
+      worktreeRoot,
+      patch,
+      operationId,
+      {
+        expectedTree: observedTree,
+        targetTree,
+      },
+    );
+    return { state: 'ready', moved: true };
+  } catch (error) {
+    if (error instanceof transition.TransitionError) {
+      return { state: 'waiting', reason: 'local-index-moving', moved: false };
+    }
+    throw error;
+  }
+}
+
+function localCardMayMaterialize(publishedCard, publication) {
+  return Boolean(publishedCard)
+    || publication?.mayMaterialize === true;
+}
+
+function pathForRepo(localCard, project) {
+  return localCard?.path || project?.path || null;
+}
+
+function snapshotIsCurrent(receivedThrough, snapshotThrough) {
+  return Number.isInteger(receivedThrough)
+    && receivedThrough >= 0
+    && snapshotThrough === receivedThrough;
+}
+
+/**
+ * A pass either proved the repo current, exposed terminal corruption, or has
+ * more ordinary work to do. Every non-terminal wait uses the same bounded
+ * retry; reasons are diagnostics, never control flow.
+ */
+function repairDelayForPass(outcomes, moved = false) {
+  return moved || outcomes.some((outcome) => outcome?.state === 'waiting')
+    ? REPAIR_RETRY_MS
+    : null;
+}
+
+function readOfficialPlan(repoKey, project, wall) {
+  const receivedThrough = wall.publicationStatus(repoKey).receivedThrough;
+  const snapshot = require('./project-stream').readSnapshot(
+    project.file,
+    project.resourceId,
+  );
+  const snapshotThrough = snapshot.version;
+  if (!snapshotIsCurrent(receivedThrough, snapshotThrough)) {
+    return {
+      state: 'waiting',
+      reason: 'official-snapshot-behind',
+      receivedThrough,
+      snapshotThrough,
+    };
+  }
+  const plan = reduceWall(wall.readWall(repoKey)).get(repoKey);
+  if (!plan?.card) {
+    return {
+      state: 'waiting',
+      reason: 'official-card-settling',
+      receivedThrough,
+      snapshotThrough,
+    };
+  }
+  return { state: 'ready', receivedThrough, snapshotThrough, plan };
+}
+
+async function runReducer() {
+  service.counters.passes += 1;
   const startedAt = Date.now();
   const wall = require('./wall');
   const plans = reduceWall(wall.readWall());
   const locals = new Map();
+  const visited = new Set();
   for (const card of listRepoCards()) {
     if (card.kind !== 'primary' || card.health !== 'healthy') continue;
-    const repoKey = repoKeyOfCard(card);
+    const repoKey = wall.projectForPath(card.path)?.repoKey;
     if (repoKey && !locals.has(repoKey)) locals.set(repoKey, card);
   }
 
   let moved = false;
-  for (const [repoKey, plan] of plans) {
+  for (const [repoKey] of plans) {
+    visited.add(repoKey);
     let local = locals.get(repoKey);
     const project = wall.projectForRepo(repoKey);
-    if (!plan.card) continue;
     try {
+      const official = readOfficialPlan(repoKey, project, wall);
+      if (official.state !== 'ready') {
+        const outcome = { ...official, moved: false };
+        service.repos.set(repoKey, {
+          repoKey,
+          path: pathForRepo(local, project),
+          ...outcome,
+          at: new Date().toISOString(),
+        });
+        service.counters.waiting += 1;
+        continue;
+      }
       if (!local?.head?.oid) {
         const hydrated = await withMaterialization(
           repoKey,
-          () => hydrateRepo(project, plan),
+          () => hydrateRepo(project, official.plan),
         );
         service.repos.set(repoKey, {
           repoKey,
@@ -819,10 +2193,9 @@ async function runReducer() {
         continue;
       }
       const refreshed = await refreshRepoCard(local.replica) || local;
-      const publishedCard = wall.publishedCardFor(refreshed);
-      const publication = publishedCard ? null : wall.publishWall(repoKey);
-      if (!localCardMayMaterialize(publishedCard, publication)) {
-        const outcome = { state: 'waiting', reason: 'local-card-publishing', moved: false };
+      const capture = await captureIntentForCard(project, refreshed);
+      if (capture.state === 'waiting' && capture.mayMaterialize !== true) {
+        const outcome = { state: 'waiting', reason: capture.reason, moved: false };
         service.repos.set(repoKey, {
           repoKey,
           path: refreshed.path,
@@ -832,10 +2205,19 @@ async function runReducer() {
         service.counters.waiting += 1;
         continue;
       }
-      const receivedThrough = wall.publicationStatus(repoKey).receivedThrough;
-      const currentPlan = reduceWall(wall.readWall(repoKey)).get(repoKey);
-      if (!currentPlan?.card) {
-        const outcome = { state: 'waiting', reason: 'official-card-settling', moved: false };
+      if (capture.state === 'rejected') {
+        throw new Error(
+          capture.intent?.terminal?.message
+          || `local code intent rejected: ${capture.reason}`,
+        );
+      }
+      const publishedCard = wall.publishedCardFor(refreshed);
+      const publication = publishedCard ? null : wall.publishWall(repoKey);
+      if (publication?.terminalError) {
+        throw new Error(`code publication failed: ${publication.terminalError}`);
+      }
+      if (!localCardMayMaterialize(publishedCard, publication)) {
+        const outcome = { state: 'waiting', reason: 'local-card-publishing', moved: false };
         service.repos.set(repoKey, {
           repoKey,
           path: refreshed.path,
@@ -845,10 +2227,25 @@ async function runReducer() {
         service.counters.waiting += 1;
         continue;
       }
-      const outcome = await withMaterialization(
-        repoKey,
-        () => materializeRepo(refreshed, currentPlan, receivedThrough),
-      );
+      const outcome = await withMaterialization(repoKey, async () => {
+        const boundary = await verifyApplyBoundary(
+          project,
+          refreshed,
+          official.receivedThrough,
+        );
+        if (boundary.state !== 'ready') return { ...boundary, moved: false };
+        return materializeRepo(refreshed, official.plan, official.receivedThrough);
+      });
+      if (outcome.reason === 'local-intent-capture-required') {
+        const latest = await refreshRepoCard(refreshed.replica) || refreshed;
+        const retryCapture = await captureIntentForCard(project, latest);
+        if (retryCapture.state === 'rejected') {
+          throw new Error(
+            retryCapture.intent?.terminal?.message
+            || `local code intent rejected: ${retryCapture.reason}`,
+          );
+        }
+      }
       service.repos.set(repoKey, { repoKey, path: local.path, ...outcome, at: new Date().toISOString() });
       if (outcome.state === 'waiting') service.counters.waiting += 1;
       if (outcome.moved) {
@@ -870,6 +2267,10 @@ async function runReducer() {
   }
   service.lastPass = { at: new Date().toISOString(), durationMs: Date.now() - startedAt, moved };
   if (moved) refreshRepoCards().catch(() => {});
+  return repairDelayForPass(
+    [...visited].map((repoKey) => service.repos.get(repoKey)),
+    moved,
+  );
 }
 
 let running = null;
@@ -880,23 +2281,25 @@ function reduceNow() {
     queued = true;
     return running;
   }
+  let repairDelay = null;
   running = (async () => {
     do {
       queued = false;
-      await runReducer();
+      repairDelay = await runReducer();
     } while (queued);
   })().finally(() => {
     running = null;
+    if (repairDelay !== null) scheduleReduce(repairDelay);
   });
   return running;
 }
 
-function scheduleReduce() {
+function scheduleReduce(delayMs = REDUCE_QUIET_MS) {
   if (!service.started || service.timer) return;
   service.timer = setTimeout(() => {
     service.timer = null;
     reduceNow().catch((error) => console.warn('[WorkspaceReducer] pass failed:', error.message));
-  }, REDUCE_QUIET_MS);
+  }, delayMs);
   service.timer.unref?.();
 }
 
@@ -909,8 +2312,7 @@ function startWorkspaceReducer() {
     const acknowledged = event.resource === 'shared-mutations'
       && wallState.projects.some((project) => project.resourceId === event.sharedResourceId);
     if (
-      event.resource === 'repo-cards'
-      || event.resource === 'repo-checkpoints'
+      event.resource === 'repo-checkpoints'
       || wallPaths.includes(event.id)
       || acknowledged
     ) scheduleReduce();
@@ -942,19 +2344,26 @@ function reducerStats() {
 
 module.exports = {
   advanceIndex,
-  captureIsOnRail,
+  applyHydrationBootstrap,
+  classifyBranchRefs,
   hydrateRepo,
   isMaterializing,
   localCardMayMaterialize,
   materializeRepo,
+  observePhysicalRepo,
   pathForRepo,
-  parkedForState,
   readRepoState,
   reduceCheckpoint,
   reduceNow,
   reduceWall,
+  readOfficialPlan,
+  repairDelayForPass,
   reducerStats,
+  snapshotIsCurrent,
+  stateDigest,
   startWorkspaceReducer,
   stopWorkspaceReducer,
+  verifyApplyBoundary,
   withMaterialization,
+  withRepoTurn,
 };