amalgm 0.1.245 → 0.1.246

package/runtime/scripts/amalgm-mcp/workspace/transition.js

@@ -7,47 +7,23 @@
  * no shell, pinned cwd, no prompts, and config armor so repo-configured
  * programs (hooks, fsmonitor) can never run under an executed transition.
  *
- * The verbs are deliberately few and exact — import verified objects,
- * move Git metadata with expected-old guards, and replace file/index
- * state only when the observed local state is unchanged. Anything messier
- * is a human act on one machine; the rail carries its settled outcome.
- * Every execution, success or failure, lands as one line in a visible
- * journal before control returns.
+ * The verbs are deliberately few and exact — fetch one branch from a
+ * named remote, fast-forward to an exact commit, apply or reverse a
+ * captured patch. Anything messier is a human act on one machine; the
+ * rail carries its settled outcome. Every execution, success or failure,
+ * lands as one line in a visible journal before control returns.
  */
 
 const fs = require('fs');
 const path = require('path');
-const crypto = require('crypto');
-const { execFile, execFileSync } = require('child_process');
+const { execFile } = require('child_process');
 const { promisify } = require('util');
 const { AMALGM_DIR } = require('../config');
-const durable = require('./durable');
-const nativeFileTransaction = require('./native-file-transaction/client');
 
 const execFileAsync = promisify(execFile);
 
 const JOURNAL_FILE = path.join(AMALGM_DIR, 'state', 'workspace-transitions.jsonl');
-const FILE_TRANSACTION_CONTRACT = 'workspace-file-transaction@4';
-const GIT_METADATA_TRANSACTION_CONTRACT = 'workspace-git-metadata-transaction@1';
-const GIT_WORKTREE_NAMESPACE_GUARD_CONTRACT = 'workspace-git-worktree-namespace-guard@2';
-const APPLY_RECEIPT_DIRECTORY = /^\.amalgm-apply-[0-9a-f]{64}$/;
-const APPLY_RECEIPT_EXCLUDE = `.amalgm-apply-${'[0-9a-f]'.repeat(64)}/`;
-
-function processLifetime(pid) {
-  return nativeFileTransaction.processLifetime(pid);
-}
-
-const PROCESS_LIFETIME = processLifetime(process.pid);
-if (!PROCESS_LIFETIME?.live) {
-  throw new Error('workspace transitions cannot identify their process lifetime');
-}
-const PROCESS_START_IDENTITY = PROCESS_LIFETIME.identity;
-
-function guardOwnerIsActive(transaction) {
-  const owner = processLifetime(transaction.ownerPid);
-  if (owner === null) return true;
-  return owner.live && owner.identity === transaction.ownerStarted;
-}
+const HYDRATION_DIR = path.join(AMALGM_DIR, 'state', 'repo-hydration');
 
 const TRANSITION_ENV = {
   GIT_TERMINAL_PROMPT: '0',
@@ -78,43 +54,14 @@ function journal(entry) {
   }
 }
 
-function execFileWithInput(file, args, options, input) {
-  return new Promise((resolve, reject) => {
-    const child = execFile(file, args, options, (error, stdout, stderr) => {
-      if (error) {
-        error.stdout = stdout;
-        error.stderr = stderr;
-        reject(error);
-        return;
-      }
-      resolve({ stdout, stderr });
-    });
-    child.stdin.on('error', () => {});
-    child.stdin.end(input);
-  });
-}
-
-async function run(
-  action,
-  worktreeRoot,
-  args,
-  {
-    timeoutMs = 120_000,
-    journalResult = true,
-    input = null,
-    env = {},
-  } = {},
-) {
+async function run(action, worktreeRoot, args, { timeoutMs = 120_000, journalResult = true } = {}) {
   try {
-    const options = {
+    const { stdout } = await execFileAsync('git', args, {
       cwd: worktreeRoot,
-      env: { ...process.env, ...TRANSITION_ENV, ...env },
+      env: { ...process.env, ...TRANSITION_ENV },
       timeout: timeoutMs,
       maxBuffer: 32 * 1024 * 1024,
-    };
-    const { stdout } = input === null
-      ? await execFileAsync('git', args, options)
-      : await execFileWithInput('git', args, options, input);
+    });
     if (journalResult) journal({ action, worktree: worktreeRoot, args, ok: true });
     return stdout;
   } catch (error) {
@@ -126,6 +73,14 @@ async function run(
   }
 }
 
+/** Bring one branch's objects and remote-tracking ref in from a named remote. */
+function fetchBranch(worktreeRoot, remote, branch) {
+  return run('fetch-branch', worktreeRoot, [
+    '-C', worktreeRoot, 'fetch', '--no-tags', remote,
+    `+refs/heads/${branch}:refs/remotes/${remote}/${branch}`,
+  ]);
+}
+
 async function createBundle(worktreeRoot, oid, bundleFile, exportRef) {
   await run('prepare-bundle-ref', worktreeRoot, [
     '-C', worktreeRoot, 'update-ref', exportRef, oid,
@@ -173,18 +128,55 @@ async function initializeRepo(worktreeRoot, remote) {
   }
 }
 
-async function currentHead(worktreeRoot) {
-  let oid = null;
-  try {
-    oid = (await run(
-      'observe-head',
+async function checkoutInitialCard(worktreeRoot, { branch, oid }) {
+  await run('checkout-initial-card', worktreeRoot, branch
+    ? ['-C', worktreeRoot, 'checkout', '-B', branch, oid]
+    : ['-C', worktreeRoot, 'checkout', '--detach', oid], {
+    timeoutMs: 60_000,
+  });
+  const after = await currentHead(worktreeRoot);
+  if (after.branch !== (branch || null) || after.oid !== oid) {
+    throw new TransitionError(
+      'checkout-initial-card',
       worktreeRoot,
-      ['-C', worktreeRoot, 'rev-parse', '--verify', 'HEAD'],
-      { journalResult: false },
-    )).trim();
-  } catch (error) {
-    if (!(error instanceof TransitionError)) throw error;
+      `expected ${branch || '(detached)'}@${oid}, observed ${after.branch || '(detached)'}@${after.oid}`,
+    );
+  }
+}
+
+function holdInitialFiles(worktreeRoot) {
+  const entries = fs.readdirSync(worktreeRoot).filter((entry) => entry !== '.git');
+  if (!entries.length) return null;
+  fs.mkdirSync(HYDRATION_DIR, { recursive: true });
+  const holding = fs.mkdtempSync(path.join(HYDRATION_DIR, 'hold-'));
+  for (const entry of entries) {
+    fs.renameSync(path.join(worktreeRoot, entry), path.join(holding, entry));
   }
+  journal({ action: 'hold-initial-files', worktree: worktreeRoot, holding, entries, ok: true });
+  return holding;
+}
+
+function restoreInitialFiles(worktreeRoot, holding) {
+  if (!holding) return;
+  fs.cpSync(holding, worktreeRoot, { recursive: true, force: true, dereference: false });
+  fs.rmSync(holding, { recursive: true, force: true });
+  journal({ action: 'restore-initial-files', worktree: worktreeRoot, holding, ok: true });
+}
+
+/** Fast-forward the current branch to an exact commit. Refuses anything but a ff. */
+function fastForwardTo(worktreeRoot, oid) {
+  return run('fast-forward', worktreeRoot, ['-C', worktreeRoot, 'merge', '--ff-only', oid], {
+    timeoutMs: 60_000,
+  });
+}
+
+async function currentHead(worktreeRoot) {
+  const oid = (await run(
+    'observe-head',
+    worktreeRoot,
+    ['-C', worktreeRoot, 'rev-parse', '--verify', 'HEAD'],
+    { journalResult: false },
+  )).trim();
   let branch = null;
   try {
     branch = (await run(
@@ -199,1745 +191,211 @@ async function currentHead(worktreeRoot) {
   return { branch, oid };
 }
 
-async function branchOid(worktreeRoot, branch) {
-  try {
-    return (await run(
-      'observe-branch-oid',
-      worktreeRoot,
-      ['-C', worktreeRoot, 'rev-parse', '--verify', `refs/heads/${branch}`],
-      { journalResult: false },
-    )).trim();
-  } catch (error) {
-    if (error instanceof TransitionError) return null;
-    throw error;
-  }
-}
-
-function syncDirectory(directory) {
-  const descriptor = fs.openSync(directory, 'r');
-  try {
-    fs.fsyncSync(descriptor);
-  } finally {
-    fs.closeSync(descriptor);
-  }
-}
-
 /**
- * Change only HEAD's attachment, under Git's own HEAD lock. The index and
- * working files are deliberately untouched. A process death therefore
- * cannot discard local bytes; the reducer's durable apply record can replay
- * the remaining content-addressed steps.
+ * Materialize one exact card. Branch and OID are one instruction:
+ * either the expected old pair still exists and the target pair lands,
+ * or the command refuses without moving another branch.
  */
-async function compareAndSwapHead(worktreeRoot, {
+async function moveToCard(worktreeRoot, {
   expectedBranch,
   expectedOid,
   targetBranch,
   targetOid,
-  operation,
-}) {
-  if (!/^[0-9a-f]{64}$/.test(operation || '')) {
-    throw new Error('HEAD movement has no durable operation identity');
-  }
-  const expected = Buffer.from(expectedBranch
-    ? `ref: refs/heads/${expectedBranch}\n`
-    : `${expectedOid}\n`);
-  const target = Buffer.from(targetBranch
-    ? `ref: refs/heads/${targetBranch}\n`
-    : `${targetOid}\n`);
-  if (expected.equals(target)) return;
-  applyGitMetadataTransaction(
-    worktreeRoot,
-    'HEAD',
-    expected,
-    target,
-    operation,
-  );
-}
-
-/**
- * Move only repository metadata to an exact card.
- *
- * Branch refs use compare-and-swap. Switching attachment uses Git's HEAD
- * lock. Neither operation touches the index or working tree, so replay after
- * a crash is idempotent and cannot erase pending local work.
- */
-async function moveHeadToCard(worktreeRoot, {
-  expectedBranch,
-  expectedOid,
-  expectedTargetOid,
-  targetBranch,
-  targetOid,
-  operation,
 }) {
   const before = await currentHead(worktreeRoot);
-  if (before.branch === (targetBranch || null) && before.oid === targetOid) {
-    if (
-      expectedBranch === (targetBranch || null)
-      && expectedOid === targetOid
-    ) return;
-    if (
-      /^[0-9a-f]{64}$/.test(operation || '')
-      && (
-        (
-          expectedBranch === (targetBranch || null)
-          && await branchReceiptCrossed(worktreeRoot, operation, targetBranch)
-        )
-        || (
-          expectedBranch !== (targetBranch || null)
-          && gitMetadataReceiptCrossed(worktreeRoot, operation, 'HEAD')
-        )
-      )
-    ) return;
-    throw new TransitionError(
-      'move-head-to-card',
-      worktreeRoot,
-      'local HEAD reached the target without this ordered apply',
-    );
-  }
   if (before.branch !== expectedBranch || before.oid !== expectedOid) {
-    throw new TransitionError('move-head-to-card', worktreeRoot, 'local card changed before movement');
-  }
-
-  if (targetBranch) {
-    const observedTarget = await branchOid(worktreeRoot, targetBranch);
-    if (observedTarget !== targetOid) {
-      if (observedTarget !== (expectedTargetOid || null)) {
-        throw new TransitionError(
-          'move-head-to-card',
-          worktreeRoot,
-          `target branch changed from ${expectedTargetOid || '(absent)'} to ${observedTarget || '(absent)'}`,
-        );
-      }
-      await updateBranchRefs(worktreeRoot, [{
-        branch: targetBranch,
-        expectedOid: observedTarget,
-        oid: targetOid,
-      }], operation);
-    }
+    throw new TransitionError('move-to-card', worktreeRoot, 'local card changed before movement');
   }
 
-  if (!targetBranch || expectedBranch !== targetBranch) {
-    await compareAndSwapHead(worktreeRoot, {
-      expectedBranch,
-      expectedOid,
-      targetBranch,
-      targetOid,
-      operation,
-    });
+  if (before.branch === targetBranch) {
+    await fastForwardTo(worktreeRoot, targetOid);
+  } else {
+    await run(
+      'switch-card',
+      worktreeRoot,
+      ['-C', worktreeRoot, 'checkout', '-B', targetBranch, targetOid],
+      { timeoutMs: 60_000 },
+    );
   }
 
   const after = await currentHead(worktreeRoot);
-  if (after.branch !== (targetBranch || null) || after.oid !== targetOid) {
+  if (after.branch !== targetBranch || after.oid !== targetOid) {
     throw new TransitionError(
-      'move-head-to-card',
+      'move-to-card',
       worktreeRoot,
-      `expected ${targetBranch || '(detached)'}@${targetOid}, observed ${after.branch || '(detached)'}@${after.oid}`,
+      `expected ${targetBranch}@${targetOid}, observed ${after.branch}@${after.oid}`,
     );
   }
 }
 
-async function emptyTree(worktreeRoot) {
-  return (await run(
-    'empty-tree',
-    worktreeRoot,
-    ['-C', worktreeRoot, 'mktree'],
-    { input: '', journalResult: false },
-  )).trim();
+/** Keep a commit reachable under one content-derived internal ref. */
+function parkCommit(worktreeRoot, oid) {
+  const ref = `refs/amalgm/parked/${oid}`;
+  return run('park-commit', worktreeRoot, [
+    '-C', worktreeRoot, 'update-ref', ref, oid,
+  ]).then(() => ref);
 }
 
-async function ensureEmptyIndex(worktreeRoot, operation, testHooks = {}) {
-  if (!/^[0-9a-f]{64}$/.test(operation || '')) {
-    throw new Error('index initialization has no durable operation identity');
-  }
-  const value = (await run(
-    'observe-index-file',
-    worktreeRoot,
-    ['-C', worktreeRoot, 'rev-parse', '--git-path', 'index'],
-    { journalResult: false },
-  )).trim();
-  const file = path.isAbsolute(value) ? value : path.resolve(worktreeRoot, value);
-  if (gitMetadataReceiptCrossed(worktreeRoot, operation, 'index')) {
-    if (testHooks.retainReceipt !== true) {
-      releaseGitMetadataReceipts(worktreeRoot, operation, 'index');
-    }
-    return;
-  }
-  if (fs.existsSync(file)) return;
-  if (typeof testHooks.afterAbsent === 'function') {
-    await testHooks.afterAbsent();
-  }
-  const stateDir = path.join(AMALGM_DIR, 'state');
-  fs.mkdirSync(stateDir, { recursive: true });
-  const scratch = path.join(
-    stateDir,
-    `empty-index-${process.pid}-${crypto.randomBytes(8).toString('hex')}`,
-  );
-  try {
-    await run(
-      'prepare-empty-index',
-      worktreeRoot,
-      ['-C', worktreeRoot, 'read-tree', '--empty'],
-      { env: { GIT_INDEX_FILE: scratch } },
-    );
-    applyGitMetadataTransaction(
-      worktreeRoot,
-      'index',
-      null,
-      fs.readFileSync(scratch),
-      operation,
-    );
-    if (testHooks.retainReceipt !== true) {
-      releaseGitMetadataReceipts(worktreeRoot, operation, 'index');
-    }
-  } finally {
-    fs.rmSync(scratch, { force: true });
+/** Delete internal parked refs that are no longer part of shared checkpoint state. */
+async function pruneParkedCommits(worktreeRoot, keepOids) {
+  const output = await run('list-parked-commits', worktreeRoot, [
+    '-C', worktreeRoot, 'for-each-ref', '--format=%(refname)', 'refs/amalgm/parked',
+  ], { journalResult: false });
+  const prefix = 'refs/amalgm/parked/';
+  for (const ref of output.trim().split('\n').filter(Boolean)) {
+    if (!ref.startsWith(prefix) || keepOids.has(ref.slice(prefix.length))) continue;
+    await run('remove-parked-commit', worktreeRoot, [
+      '-C', worktreeRoot, 'update-ref', '-d', ref,
+    ]);
   }
 }
 
+function setBranchRef(worktreeRoot, branch, oid) {
+  return run('set-branch-ref', worktreeRoot, [
+    '-C', worktreeRoot, 'update-ref', `refs/heads/${branch}`, oid,
+  ]);
+}
+
+function deleteBranchRef(worktreeRoot, branch) {
+  return run('delete-branch-ref', worktreeRoot, [
+    '-C', worktreeRoot, 'update-ref', '-d', `refs/heads/${branch}`,
+  ]);
+}
+
 /**
- * Give an unborn repository its first exact card without checking out files.
- * Existing files remain local pending work and are materialized separately.
+ * Exact card movement after the caller has durably parked the old commit
+ * and captured the working tree. This deliberately discards the local
+ * checkout copy; the caller immediately pours the preserved work back as
+ * the checkpoint layer.
  */
-async function initializeHeadToCard(worktreeRoot, {
+async function forceMoveToCard(worktreeRoot, {
+  expectedBranch,
+  expectedOid,
   targetBranch,
   targetOid,
-  operation,
 }) {
-  try {
-    const current = await currentHead(worktreeRoot);
-    if (current.branch === (targetBranch || null) && current.oid === targetOid) return;
-    throw new TransitionError('initialize-head-to-card', worktreeRoot, 'repository already has another card');
-  } catch (error) {
-    if (!(error instanceof TransitionError) || error.action !== 'observe-head') throw error;
-  }
-
-  let expectedBranch = null;
-  try {
-    expectedBranch = (await run(
-      'observe-unborn-branch',
-      worktreeRoot,
-      ['-C', worktreeRoot, 'symbolic-ref', '--quiet', '--short', 'HEAD'],
-      { journalResult: false },
-    )).trim() || null;
-  } catch (error) {
-    if (!(error instanceof TransitionError)) throw error;
+  const before = await currentHead(worktreeRoot);
+  if (before.branch !== expectedBranch || before.oid !== expectedOid) {
+    throw new TransitionError('force-move-to-card', worktreeRoot, 'local card changed before movement');
   }
   if (targetBranch) {
-    const observedTarget = await branchOid(worktreeRoot, targetBranch);
-    if (observedTarget !== null && observedTarget !== targetOid) {
-      throw new TransitionError(
-        'initialize-head-to-card',
-        worktreeRoot,
-        'target branch already has another commit',
-      );
-    }
-    if (observedTarget === null) {
-      await updateBranchRefs(worktreeRoot, [{
-        branch: targetBranch,
-        expectedOid: null,
-        oid: targetOid,
-      }], operation);
-    }
+    await run('force-move-to-card', worktreeRoot, [
+      '-C', worktreeRoot, 'checkout', '--force', '-B', targetBranch, targetOid,
+    ], { timeoutMs: 60_000 });
+  } else {
+    await run('force-move-to-card', worktreeRoot, [
+      '-C', worktreeRoot, 'checkout', '--force', '--detach', targetOid,
+    ], { timeoutMs: 60_000 });
   }
-  await compareAndSwapHead(worktreeRoot, {
-    expectedBranch,
-    expectedOid: null,
-    targetBranch,
-    targetOid,
-    operation,
-  });
   const after = await currentHead(worktreeRoot);
   if (after.branch !== (targetBranch || null) || after.oid !== targetOid) {
-    throw new TransitionError('initialize-head-to-card', worktreeRoot, 'initial card did not land');
-  }
-}
-
-/**
- * Move a set of branch refs as one compare-and-swap transaction.
- * Each change is { branch, expectedOid, oid }; null expectedOid means create
- * only if absent, and null oid means delete only from the expected commit.
- */
-function branchReceiptPrefix(operation) {
-  if (!/^[0-9a-f]{64}$/.test(operation || '')) {
-    throw new Error('branch receipt has no operation identity');
-  }
-  return `refs/amalgm/apply/${operation}/branches`;
-}
-
-function branchReceiptRef(operation, branch) {
-  if (typeof branch !== 'string' || branch.length === 0) {
-    throw new Error('branch receipt has no branch identity');
-  }
-  const digest = crypto.createHash('sha256').update(branch).digest('hex');
-  return `${branchReceiptPrefix(operation)}/${digest}`;
-}
-
-async function updateBranchRefs(
-  worktreeRoot,
-  changes,
-  operation = null,
-  testHooks = {},
-) {
-  if (changes.length === 0) return Promise.resolve('');
-  const deletions = changes.filter((change) => change.oid === null);
-  const nonDeletions = changes.filter((change) => change.oid !== null);
-  if (deletions.length > 0 && nonDeletions.length > 0) {
-    const checked = new Set(
-      (await listedWorktreeHeads(worktreeRoot))
-        .map((entry) => entry.branch)
-        .filter(Boolean),
-    );
-    if (nonDeletions.some((change) => checked.has(change.branch))) {
-      await updateBranchRefs(worktreeRoot, nonDeletions, operation);
-      if (typeof testHooks.afterNonDeletionBatch === 'function') {
-        await testHooks.afterNonDeletionBatch();
-      }
-      return updateBranchRefs(worktreeRoot, deletions, operation, testHooks);
-    }
-  }
-  let input = 'start\0';
-  for (const { branch, expectedOid, oid } of changes) {
-    const ref = `refs/heads/${branch}`;
-    if (oid === null) {
-      input += `delete ${ref}\0${expectedOid}\0`;
-    } else if (expectedOid === null) {
-      input += `create ${ref}\0${oid}\0`;
-    } else {
-      input += `update ${ref}\0${oid}\0${expectedOid}\0`;
-    }
-  }
-  if (operation !== null) {
-    for (const change of changes) {
-      const receiptOid = change.oid || change.expectedOid;
-      if (!/^[0-9a-f]{40,64}$/.test(receiptOid || '')) {
-        throw new Error('branch receipt has no object');
-      }
-      input += `create ${branchReceiptRef(operation, change.branch)}\0${receiptOid}\0`;
-    }
-  }
-  input += 'prepare\0commit\0';
-  const apply = (commonRoot = null) => run(
-    'update-branch-refs',
-    worktreeRoot,
-    commonRoot === null
-      ? ['-C', worktreeRoot, 'update-ref', '--stdin', '-z']
-      : [`--git-dir=${commonRoot}`, 'update-ref', '--stdin', '-z'],
-    { input },
-  );
-  if (!changes.some((change) => change.oid === null)) return apply();
-  return withGitHeadGuard(
-    worktreeRoot,
-    changes,
-    testHooks,
-    apply,
-  );
-}
-
-async function branchReceiptCrossed(worktreeRoot, operation, branch = null) {
-  try {
-    if (branch === null) {
-      const observed = await run(
-        'observe-branch-receipts',
-        worktreeRoot,
-        [
-          '-C', worktreeRoot,
-          'for-each-ref',
-          '--count=1',
-          '--format=%(refname)',
-          `${branchReceiptPrefix(operation)}/`,
-        ],
-        { journalResult: false },
-      );
-      return observed.trim() !== '';
-    }
-    await run(
-      'observe-branch-receipt',
+    throw new TransitionError(
+      'force-move-to-card',
       worktreeRoot,
-      ['-C', worktreeRoot, 'rev-parse', '--verify', branchReceiptRef(operation, branch)],
-      { journalResult: false },
+      `expected ${targetBranch || '(detached)'}@${targetOid}, observed ${after.branch || '(detached)'}@${after.oid}`,
     );
-    return true;
-  } catch (error) {
-    if (error instanceof TransitionError) return false;
-    throw error;
   }
 }
 
-async function releaseBranchReceipt(worktreeRoot, operation) {
-  const observed = await run(
-    'observe-branch-receipts',
-    worktreeRoot,
-    [
-      '-C', worktreeRoot,
-      'for-each-ref',
-      '--format=%(refname)',
-      `${branchReceiptPrefix(operation)}/`,
-    ],
-    { journalResult: false },
-  );
-  for (const ref of observed.trim().split('\n').filter(Boolean)) {
-    await run('release-branch-receipt', worktreeRoot, [
-      '-C', worktreeRoot, 'update-ref', '-d', ref,
-    ]);
-  }
+/**
+ * Apply a captured worktree patch — or reverse one — from a file on disk.
+ * The patch file lives outside the repo (in the state dir), so what was
+ * applied stays inspectable after the fact.
+ */
+function applyPatch(worktreeRoot, patchFile, { reverse = false } = {}) {
+  return run(reverse ? 'reverse-patch' : 'apply-patch', worktreeRoot, [
+    '-C', worktreeRoot, 'apply', ...(reverse ? ['-R'] : []), '--whitespace=nowarn', patchFile,
+  ], { timeoutMs: 60_000 });
 }
 
 /**
- * Apply only the index change the reducer computed. The current exact index
- * bytes must first derive the reducer's sealed source tree. The patch must
- * then derive the named target tree before Git's index lock may replace those
- * exact bytes. A concurrent staged change therefore stops the movement
- * instead of becoming a new expected-old value.
+ * Apply only the index change the reducer computed. Git locks the index and
+ * verifies the patch's preimage, so a concurrent commit is serialized instead
+ * of being replaced by an old whole-index snapshot.
  */
-async function applyIndexPatch(
-  worktreeRoot,
-  patch,
-  operation,
-  { expectedTree, targetTree } = {},
-) {
+async function applyIndexPatch(worktreeRoot, patch) {
   if (!patch) return;
-  if (!/^[0-9a-f]{64}$/.test(operation || '')) {
-    throw new Error('index movement has no durable operation identity');
-  }
-  if (
-    !/^[0-9a-f]{40,64}$/.test(expectedTree || '')
-    || !/^[0-9a-f]{40,64}$/.test(targetTree || '')
-  ) {
-    throw new Error('index movement has no sealed tree endpoints');
-  }
   const stateDir = path.join(AMALGM_DIR, 'state');
   fs.mkdirSync(stateDir, { recursive: true });
   const dir = fs.mkdtempSync(path.join(stateDir, 'index-patch-'));
   const patchFile = path.join(dir, 'patch');
-  const scratchIndex = path.join(dir, 'index');
-  const index = gitPath(worktreeRoot, 'index');
   try {
     fs.writeFileSync(patchFile, patch);
-    const expected = fs.existsSync(index) ? fs.readFileSync(index) : null;
-    if (expected === null) {
-      await run(
-        'prepare-empty-index',
-        worktreeRoot,
-        ['-C', worktreeRoot, 'read-tree', '--empty'],
-        { env: { GIT_INDEX_FILE: scratchIndex } },
-      );
-    } else {
-      fs.writeFileSync(scratchIndex, expected);
-    }
-    const observedTree = (await run(
-      'verify-index-patch-source',
-      worktreeRoot,
-      ['-C', worktreeRoot, 'write-tree'],
-      {
-        env: { GIT_INDEX_FILE: scratchIndex },
-        journalResult: false,
-      },
-    )).trim();
-    if (observedTree !== expectedTree) {
-      throw new TransitionError(
-        'apply-index-patch',
-        worktreeRoot,
-        `local index changed from sealed tree ${expectedTree} to ${observedTree}`,
-      );
-    }
     await run('apply-index-patch', worktreeRoot, [
       '-C', worktreeRoot, 'apply', '--cached', '--whitespace=nowarn', patchFile,
-    ], { env: { GIT_INDEX_FILE: scratchIndex } });
-    const appliedTree = (await run(
-      'verify-index-patch-target',
-      worktreeRoot,
-      ['-C', worktreeRoot, 'write-tree'],
-      {
-        env: { GIT_INDEX_FILE: scratchIndex },
-        journalResult: false,
-      },
-    )).trim();
-    if (appliedTree !== targetTree) {
-      throw new Error(
-        `index patch target mismatch: expected ${targetTree}, derived ${appliedTree}`,
-      );
-    }
-    applyGitMetadataTransaction(
-      worktreeRoot,
-      'index',
-      expected,
-      fs.readFileSync(scratchIndex),
-      operation,
-    );
+    ]);
   } finally {
     fs.rmSync(dir, { recursive: true, force: true });
   }
 }
 
+/** Set only Git's index; working files are left exactly as they are. */
+function setIndexTree(worktreeRoot, treeOid) {
+  return run('set-index-tree', worktreeRoot, [
+    '-C', worktreeRoot, 'read-tree', treeOid,
+  ]);
+}
+
 /**
- * Apply one ordered file write set to a working tree. Each entry is
- * { path, content, mode } (content a
+ * Land a merged write set in a working tree — the coexistence engine's
+ * only mutation path. Each entry is { path, content, mode } (content a
  * Buffer, mode '100644' | '100755' | '120000') or { path, content: null }
  * for a deletion. Paths are confined to the worktree; the whole set lands
  * as one journal line.
  */
-function applyFiles(worktreeRoot, writes, label) {
-  const root = fs.realpathSync(worktreeRoot);
-  const operation = typeof label === 'string' && label
-    ? label
-    : `anonymous-${crypto.randomBytes(32).toString('hex')}`;
+function applyMergedFiles(worktreeRoot, writes, label) {
+  const root = path.resolve(worktreeRoot);
   const written = [];
   const removed = [];
   try {
-    ensureFileTransactionExcluded(root);
-    recoverFileTransactions(root);
     for (const write of writes) {
-      applyFileTransaction(root, write, operation);
-      if (write.content === null) removed.push(write.path);
-      else written.push(write.path);
-    }
-    journal({ action: 'apply-files', worktree: root, operation, written, removed, ok: true });
-    return { operation };
-  } catch (error) {
-    journal({
-      action: 'apply-files', worktree: root, operation, written, removed, ok: false,
-      error: String(error.message).slice(0, 500),
-    });
-    throw new TransitionError('apply-files', root, String(error.message));
-  }
-}
-
-function gitDirectory(worktreeRoot) {
-  const marker = path.join(worktreeRoot, '.git');
-  if (fs.statSync(marker).isDirectory()) return marker;
-  const match = fs.readFileSync(marker, 'utf8').trim().match(/^gitdir:\s*(.+)$/);
-  if (!match) throw new Error('worktree has no Git directory');
-  return path.resolve(worktreeRoot, match[1]);
-}
-
-function gitPath(worktreeRoot, relativePath) {
-  const value = execFileSync(
-    'git',
-    ['-C', worktreeRoot, 'rev-parse', '--git-path', relativePath],
-    {
-      cwd: worktreeRoot,
-      env: { ...process.env, ...TRANSITION_ENV },
-      encoding: 'utf8',
-      timeout: 120_000,
-      maxBuffer: 32 * 1024 * 1024,
-    },
-  ).trim();
-  return path.isAbsolute(value) ? value : path.resolve(worktreeRoot, value);
-}
-
-function fileTransactionDirectory(worktreeRoot) {
-  return path.join(gitDirectory(worktreeRoot), 'amalgm-apply');
-}
-
-/**
- * Receipts live beside their destination so the kernel can consume prepared
- * targets atomically even when a linked worktree's Git directory is on
- * another device. They are implementation state, never workspace content.
- */
-function isApplyReceiptPath(relativePath) {
-  return String(relativePath)
-    .split(/[\\/]/)
-    .some((component) => APPLY_RECEIPT_DIRECTORY.test(component));
-}
-
-function ensureFileTransactionExcluded(worktreeRoot) {
-  // Linked worktrees have a private Git directory, but Git reads exclusions
-  // from the common path named by `--git-path`. The command is the authority;
-  // reconstructing this path from `.git` makes receipt bytes look user-owned.
-  const exclude = gitPath(worktreeRoot, 'info/exclude');
-  let content = '';
-  let mode = 0o644;
-  try {
-    content = fs.readFileSync(exclude, 'utf8');
-    mode = fs.statSync(exclude).mode & 0o777;
-  } catch (error) {
-    if (error?.code !== 'ENOENT') throw error;
-  }
-  if (content.split(/\r?\n/).includes(APPLY_RECEIPT_EXCLUDE)) return;
-  fs.mkdirSync(path.dirname(exclude), { recursive: true });
-  // Append instead of replacing a read snapshot: a concurrent user edit to
-  // info/exclude must survive. A racing apply may append the same harmless
-  // rule twice, while every later call observes it and stops.
-  const descriptor = fs.openSync(exclude, 'a', mode);
-  try {
-    fs.writeFileSync(descriptor, `\n${APPLY_RECEIPT_EXCLUDE}\n`);
-    fs.fsyncSync(descriptor);
-  } finally {
-    fs.closeSync(descriptor);
-  }
-  syncDirectory(path.dirname(exclude));
-}
-
-function ensureDurableDirectory(directory) {
-  try {
-    fs.mkdirSync(directory);
-    syncDirectory(path.dirname(directory));
-  } catch (error) {
-    if (error?.code !== 'EEXIST') throw error;
-    if (!fs.statSync(directory).isDirectory()) {
-      throw new Error(`workspace transaction path is not a directory: ${directory}`);
-    }
-  }
-}
-
-function confinedPath(worktreeRoot, relativePath) {
-  if (
-    typeof relativePath !== 'string'
-    || !relativePath
-    || path.isAbsolute(relativePath)
-    || relativePath.split(/[\\/]/).includes('..')
-  ) throw new Error(`unsafe path: ${relativePath}`);
-  const root = fs.realpathSync(worktreeRoot);
-  const absolute = path.resolve(root, relativePath);
-  if (!absolute.startsWith(root + path.sep)) throw new Error(`unsafe path: ${relativePath}`);
-  let current = root;
-  for (const component of relativePath.split(/[\\/]/).slice(0, -1)) {
-    if (!component || component === '.') continue;
-    current = path.join(current, component);
-    let stat;
-    try {
-      stat = fs.lstatSync(current);
-    } catch (error) {
-      if (error?.code === 'ENOENT') break;
-      throw error;
-    }
-    if (stat.isSymbolicLink()) {
-      throw new Error(`unsafe symlink parent: ${relativePath}`);
-    }
-    if (!stat.isDirectory()) throw new Error(`unsafe non-directory parent: ${relativePath}`);
-  }
-  return absolute;
-}
-
-function fileStateIdentity(state) {
-  if (state === null) return null;
-  if (state?.kind === 'other') return { kind: 'other' };
-  if (!Buffer.isBuffer(state?.content)) throw new Error('file state has no exact bytes');
-  return {
-    kind: state.kind,
-    exec: state.exec === true,
-    bytes: state.content.length,
-    sha256: crypto.createHash('sha256').update(state.content).digest('hex'),
-  };
-}
-
-function transactionPaths(worktreeRoot, operation, relativePath, rootStat) {
-  const recordDirectory = fileTransactionDirectory(worktreeRoot);
-  ensureDurableDirectory(recordDirectory);
-  const id = crypto.createHash('sha256')
-    .update(
-      `${FILE_TRANSACTION_CONTRACT}\0${rootStat.dev}\0${rootStat.ino}`
-      + `\0${operation}\0${relativePath}`,
-    )
-    .digest('hex');
-  return {
-    id,
-    recordDirectory,
-    record: path.join(recordDirectory, `${id}.json`),
-  };
-}
-
-function removeTransactionRecord(record) {
-  try {
-    fs.unlinkSync(record);
-  } catch (error) {
-    if (error?.code !== 'ENOENT') throw error;
-  }
-  syncDirectory(path.dirname(record));
-}
-
-function readFileTransaction(record) {
-  try {
-    const value = JSON.parse(fs.readFileSync(record, 'utf8'));
-    if (
-      value?.contract !== FILE_TRANSACTION_CONTRACT
-      || typeof value.root !== 'string'
-      || !/^\d+$/.test(value.rootDev)
-      || !/^\d+$/.test(value.rootIno)
-      || typeof value.path !== 'string'
-      || typeof value.id !== 'string'
-      || typeof value.operation !== 'string'
-      || !value.operation
-      || value.id !== path.basename(record, '.json')
-      || !/^[a-f0-9]{64}$/.test(value.id)
-      || (value.expected !== null && typeof value.expected !== 'object')
-      || (value.target !== null && typeof value.target !== 'object')
-    ) throw new Error('invalid file transaction');
-    return { ...value, record };
-  } catch (error) {
-    throw new Error(`invalid workspace file transaction ${record}: ${error.message}`);
-  }
-}
-
-function runNativeFileTransaction(transaction, action, content = null, testHooks = {}) {
-  try {
-    return nativeFileTransaction.run(transaction, action, content, testHooks);
-  } catch (error) {
-    throw new Error(
-      String(error?.message || error).replace(
-        /^native file transaction/,
-        'native workspace file transaction',
-      ),
-    );
-  }
-}
-
-function fileTransactionRecords(worktreeRoot, operation = null) {
-  const directory = fileTransactionDirectory(worktreeRoot);
-  if (!fs.existsSync(directory)) return [];
-  return fs.readdirSync(directory)
-    .filter((name) => name.endsWith('.json'))
-    .sort()
-    .map((name) => readFileTransaction(path.join(directory, name)))
-    .filter((transaction) => operation === null || transaction.operation === operation);
-}
-
-/**
- * Resolve an interrupted expected-source → official-target file movement
- * before any new repo observation. The retained source is either the exact
- * expected floor (safe to finish/rollback) or a third value (a local save
- * that is restored without overwriting anything newer).
- */
-function recoverFileTransactions(worktreeRoot) {
-  const root = fs.realpathSync(worktreeRoot);
-  ensureFileTransactionExcluded(root);
-  for (const transaction of fileTransactionRecords(root)) {
-    if (transaction.root !== root) {
-      throw new Error(`workspace file transaction escaped its repository: ${transaction.record}`);
-    }
-    const result = runNativeFileTransaction(transaction, 'recover');
-    if (result.status === 'pending') {
-      throw new Error(
-        `workspace file transaction is waiting for local writer ownership: `
-        + `${transaction.path}: ${result.reason || 'pending'}`,
-      );
-    }
-    // A crossed operation is evidence until the verified cursor passes it.
-    // Only a transaction proven not to have crossed can retire here.
-    if (result.status === 'changed') removeTransactionRecord(transaction.record);
-  }
-}
-
-function sameTransaction(left, right) {
-  return (
-    left.contract === right.contract
-    && left.root === right.root
-    && left.rootDev === right.rootDev
-    && left.rootIno === right.rootIno
-    && left.path === right.path
-    && left.id === right.id
-    && left.operation === right.operation
-    && JSON.stringify(left.expected) === JSON.stringify(right.expected)
-    && JSON.stringify(left.target) === JSON.stringify(right.target)
-  );
-}
-
-function applyFileTransaction(worktreeRoot, write, operation) {
-  if (typeof operation !== 'string' || !operation || operation.length > 1024) {
-    throw new Error('workspace file transaction has no operation identity');
-  }
-  const rootStat = fs.statSync(worktreeRoot, { bigint: true });
-  const paths = transactionPaths(worktreeRoot, operation, write.path, rootStat);
-  const target = write.content === null
-    ? null
-    : {
-      ...fileStateIdentity({
-        kind: write.mode === '120000' ? 'symlink' : 'file',
-        content: write.content,
-        exec: write.mode === '100755',
-      }),
-    };
-  const transaction = {
-    contract: FILE_TRANSACTION_CONTRACT,
-    root: worktreeRoot,
-    rootDev: rootStat.dev.toString(),
-    rootIno: rootStat.ino.toString(),
-    path: write.path,
-    id: paths.id,
-    operation,
-    expected: fileStateIdentity(write.expected),
-    target,
-  };
-  if (fs.existsSync(paths.record)) {
-    const retained = readFileTransaction(paths.record);
-    if (!sameTransaction(retained, transaction)) {
-      throw new Error(`workspace file transaction identity changed: ${write.path}`);
-    }
-    const recovered = runNativeFileTransaction(retained, 'recover');
-    if (recovered.status === 'applied') return;
-    if (recovered.status === 'pending') {
-      throw new Error(
-        `local writer ownership is unresolved: ${write.path}: `
-        + `${recovered.reason || 'pending'}`,
-      );
-    }
-    removeTransactionRecord(paths.record);
-  }
-  durable.writeJson(paths.record, transaction);
-  const result = runNativeFileTransaction(
-    transaction,
-    'apply',
-    write.content,
-    {
-      pauseAfterParentOpen: Number(write.testPauseAfterParentOpenMillis || 0),
-      pauseAfterExtraction: Number(write.testPauseAfterExtractionMillis || 0),
-      pauseBeforeInstall: Number(write.testPauseBeforeInstallMillis || 0),
-      crashAfterExtraction: write.testCrashAfterExtraction === true,
-      crashBeforeInstall: write.testCrashBeforeInstall === true,
-    },
-  );
-  if (result.status === 'pending') {
-    throw new Error(
-      `local writer ownership is unresolved: ${write.path}: ${result.reason || 'pending'}`,
-    );
-  }
-  if (result.status === 'changed') {
-    removeTransactionRecord(paths.record);
-    throw new Error(`local file changed before ordered apply: ${write.path}`);
-  }
-}
-
-/**
- * The transaction artifact, not ambient file metadata, says whether an
- * operation crossed. A later local write may return the pathname to either
- * endpoint without changing this answer.
- */
-function crossedFileReceiptPaths(worktreeRoot, operation, relativePaths) {
-  const root = fs.realpathSync(worktreeRoot);
-  const requested = new Set(relativePaths);
-  const crossed = new Set();
-  recoverFileTransactions(root);
-  for (const transaction of fileTransactionRecords(root, operation)) {
-    if (!requested.has(transaction.path)) continue;
-    const result = runNativeFileTransaction(transaction, 'receipt');
-    if (result.status === 'crossed') crossed.add(transaction.path);
-    else if (result.status !== 'not-crossed') {
-      throw new Error(
-        `workspace file receipt is unresolved: ${transaction.path}: `
-        + `${result.reason || result.status}`,
-      );
-    }
-  }
-  return crossed;
-}
-
-/**
- * Receipt retirement is safe only after the caller's verified cursor is
- * durable. Repeating release after any crash is harmless.
- */
-function releaseFileReceipts(worktreeRoot, operation) {
-  const root = fs.realpathSync(worktreeRoot);
-  for (const transaction of fileTransactionRecords(root, operation)) {
-    const result = runNativeFileTransaction(transaction, 'release');
-    if (result.status === 'pending') {
-      throw new Error(
-        `workspace file receipt cannot be released: ${transaction.path}: `
-        + `${result.reason || 'pending'}`,
-      );
-    }
-    if (result.status !== 'released') {
-      throw new Error(
-        `workspace file receipt release failed: ${transaction.path}: ${result.status}`,
-      );
-    }
-    removeTransactionRecord(transaction.record);
-  }
-}
-
-function gitMetadataTransactionDirectoryForRoot(root) {
-  return path.join(fs.realpathSync(root), 'amalgm-metadata-apply');
-}
-
-function gitMetadataTransactionDirectory(worktreeRoot) {
-  return gitMetadataTransactionDirectoryForRoot(gitDirectory(worktreeRoot));
-}
-
-async function listedWorktreeHeads(worktreeRoot) {
-  const output = await run(
-    'observe-worktree-heads',
-    worktreeRoot,
-    ['-C', worktreeRoot, 'worktree', 'list', '--porcelain', '-z'],
-    { journalResult: false },
-  );
-  const entries = [];
-  let current = null;
-  for (const token of output.split('\0')) {
-    if (!token) {
-      if (current?.path) entries.push(current);
-      current = null;
-    } else if (token.startsWith('worktree ')) {
-      current = { path: token.slice('worktree '.length), branch: null };
-    } else if (current && token.startsWith('branch refs/heads/')) {
-      current.branch = token.slice('branch refs/heads/'.length);
-    }
-  }
-  if (current?.path) entries.push(current);
-  return entries;
-}
-
-async function withOneGitHeadGuard(
-  gitRoot,
-  label,
-  changes,
-  guarded,
-) {
-  const root = fs.realpathSync(gitRoot);
-  recoverGitMetadataTransactionsAtRoot(root, label);
-  const head = path.join(root, 'HEAD');
-  const expected = fs.readFileSync(head);
-  const attached = expected.toString('utf8').match(/^ref: refs\/heads\/(.+)\n$/)?.[1] || null;
-  const deleted = new Set(
-    changes.filter((change) => change.oid === null).map((change) => change.branch),
-  );
-  if (attached && deleted.has(attached)) {
-    throw new TransitionError(
-      'guard-branch-delete',
-      label,
-      `HEAD is attached to branch ${attached}`,
-    );
-  }
-  // A logical branch operation may be attempted concurrently. Its transient
-  // guard artifacts must still have exactly one process owner.
-  const guardOperation = crypto.randomBytes(32).toString('hex');
-  const rootStat = fs.statSync(root, { bigint: true });
-  const paths = gitMetadataTransactionPathsForRoot(
-    root,
-    guardOperation,
-    'HEAD',
-    rootStat,
-  );
-  const identity = gitMetadataIdentity(expected);
-  const transaction = {
-    contract: GIT_METADATA_TRANSACTION_CONTRACT,
-    backend: 'git-guard',
-    root,
-    rootDev: rootStat.dev.toString(),
-    rootIno: rootStat.ino.toString(),
-    path: 'HEAD',
-    id: paths.id,
-    operation: guardOperation,
-    ownerPid: process.pid,
-    ownerStarted: PROCESS_START_IDENTITY,
-    expected: identity,
-    target: identity,
-    record: paths.record,
-    prepared: paths.target,
-    claimed: paths.claimed,
-  };
-
-  if (fs.existsSync(paths.record)) {
-    const retained = readGitMetadataTransaction(paths.record);
-    if (!sameGitMetadataTransaction(retained, transaction)) {
-      throw new Error('Git HEAD guard identity changed');
-    }
-    if (guardOwnerIsActive(retained)) {
-      throw new TransitionError(
-        'recover-head-guard',
-        label,
-        `guard owner ${retained.ownerPid} is still active`,
-      );
-    }
-    const recovered = runNativeFileTransaction(retained, 'recover');
-    if (recovered.status !== 'released') {
-      throw new TransitionError(
-        'recover-head-guard',
-        label,
-        recovered.reason || recovered.status,
-      );
-    }
-    removeGitMetadataTransaction(retained);
-  }
-
-  durable.writeJson(paths.record, {
-    contract: transaction.contract,
-    backend: transaction.backend,
-    root: transaction.root,
-    rootDev: transaction.rootDev,
-    rootIno: transaction.rootIno,
-    path: transaction.path,
-    id: transaction.id,
-    operation: transaction.operation,
-    ownerPid: transaction.ownerPid,
-    ownerStarted: transaction.ownerStarted,
-    expected: transaction.expected,
-    target: transaction.target,
-  });
-  durable.writeFile(paths.target, expected, 0o644);
-  const claimed = runNativeFileTransaction(transaction, 'guard');
-  if (claimed.status !== 'guarded') {
-    removeGitMetadataTransaction(transaction);
-    throw new TransitionError(
-      'guard-branch-delete',
-      label,
-      claimed.reason || claimed.status,
-    );
-  }
-  try {
-    return await guarded();
-  } finally {
-    const released = runNativeFileTransaction(transaction, 'unguard');
-    if (released.status !== 'released') {
-      throw new Error(`Git HEAD guard release failed: ${released.reason || released.status}`);
-    }
-    removeGitMetadataTransaction(transaction);
-  }
-}
-
-function gitWorktreeNamespaceTransactionDirectory() {
-  return path.join(AMALGM_DIR, 'state', 'workspace-git-worktree-guards');
-}
-
-function physicalDirectoryIdentity(directory) {
-  const realpath = fs.realpathSync(directory);
-  const stat = fs.statSync(realpath, { bigint: true });
-  if (!stat.isDirectory()) {
-    throw new Error(`physical directory identity is not a directory: ${realpath}`);
-  }
-  return {
-    realpath,
-    dev: stat.dev.toString(),
-    ino: stat.ino.toString(),
-  };
-}
-
-function pinPhysicalDirectory(directory) {
-  const realpath = fs.realpathSync(directory);
-  const fd = fs.openSync(
-    realpath,
-    fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_DIRECTORY,
-  );
-  try {
-    const stat = fs.fstatSync(fd, { bigint: true });
-    if (!stat.isDirectory()) {
-      throw new Error(`physical directory pin is not a directory: ${realpath}`);
-    }
-    return {
-      fd,
-      realpath,
-      dev: stat.dev.toString(),
-      ino: stat.ino.toString(),
-    };
-  } catch (error) {
-    fs.closeSync(fd);
-    throw error;
-  }
-}
-
-function closePhysicalDirectoryPins(pins) {
-  for (const pin of [...pins].reverse()) fs.closeSync(pin.fd);
-}
-
-function samePhysicalDirectory(left, right) {
-  return (
-    left !== null
-    && right !== null
-    && left.dev === right.dev
-    && left.ino === right.ino
-  );
-}
-
-function gitCommonDirectory(worktreeRoot) {
-  const value = execFileSync(
-    'git',
-    ['-C', worktreeRoot, 'rev-parse', '--git-common-dir'],
-    {
-      cwd: worktreeRoot,
-      env: { ...process.env, ...TRANSITION_ENV },
-      encoding: 'utf8',
-      timeout: 120_000,
-      maxBuffer: 32 * 1024 * 1024,
-    },
-  ).trim();
-  return fs.realpathSync(path.isAbsolute(value) ? value : path.resolve(worktreeRoot, value));
-}
-
-function gitCommonDirectoryFromMarker(worktreeRoot) {
-  const root = fs.realpathSync(worktreeRoot);
-  const marker = path.join(root, '.git');
-  if (fs.statSync(marker).isDirectory()) return fs.realpathSync(marker);
-  const match = fs.readFileSync(marker, 'utf8').trim().match(/^gitdir:\s*(.+)$/);
-  if (!match) throw new Error('worktree has no Git directory');
-  const privateDirectory = path.resolve(root, match[1]);
-  const registrations = path.dirname(privateDirectory);
-  return fs.realpathSync(
-    path.basename(registrations) === 'worktrees'
-      ? path.dirname(registrations)
-      : privateDirectory,
-  );
-}
-
-function physicalGitWorktreeRegistrations(directory) {
-  return fs.readdirSync(directory)
-    .sort()
-    .map((name) => {
-      const stat = fs.lstatSync(path.join(directory, name), { bigint: true });
-      if (!stat.isDirectory()) {
-        throw new Error(`Git worktree registration is not a directory: ${name}`);
-      }
-      return {
-        name,
-        dev: stat.dev.toString(),
-        ino: stat.ino.toString(),
-      };
-    });
-}
-
-function ensureGitWorktreeNamespace(commonRoot) {
-  const directory = path.join(commonRoot, 'worktrees');
-  try {
-    fs.statSync(directory);
-  } catch (error) {
-    if (error?.code !== 'ENOENT') throw error;
-    fs.mkdirSync(directory, { mode: 0o755 });
-    syncDirectory(commonRoot);
-  }
-  return directory;
-}
-
-function pinGitWorktreeNamespace(commonRoot) {
-  const directory = ensureGitWorktreeNamespace(commonRoot);
-  const pins = [];
-  try {
-    const namespace = pinPhysicalDirectory(directory);
-    pins.push(namespace);
-    const entries = fs.readdirSync(directory)
-      .sort()
-      .map((name) => {
-        const pin = pinPhysicalDirectory(path.join(directory, name));
-        pins.push(pin);
-        return { name, dev: pin.dev, ino: pin.ino };
-      });
-    return { namespace, entries, pins };
-  } catch (error) {
-    closePhysicalDirectoryPins(pins);
-    throw error;
-  }
-}
-
-function gitWorktreeNamespacePaths(commonRoot, operation, rootStat) {
-  const receiptDirectory = path.join(commonRoot, 'amalgm-metadata-apply');
-  const recordDirectory = gitWorktreeNamespaceTransactionDirectory();
-  ensureDurableDirectory(receiptDirectory);
-  ensureDurableDirectory(AMALGM_DIR);
-  ensureDurableDirectory(path.join(AMALGM_DIR, 'state'));
-  ensureDurableDirectory(recordDirectory);
-  const id = crypto.createHash('sha256')
-    .update(
-      `${GIT_WORKTREE_NAMESPACE_GUARD_CONTRACT}\0${rootStat.dev}\0${rootStat.ino}`
-      + `\0${operation}\0worktrees`,
-    )
-    .digest('hex');
-  return {
-    id,
-    record: path.join(recordDirectory, `${id}.json`),
-    target: path.join(receiptDirectory, `${id}.target`),
-    claimed: path.join(receiptDirectory, `${id}.claimed`),
-  };
-}
-
-function readGitWorktreeNamespaceTransaction(record) {
-  try {
-    const value = JSON.parse(fs.readFileSync(record, 'utf8'));
-    if (
-      value?.contract !== GIT_WORKTREE_NAMESPACE_GUARD_CONTRACT
-      || value.backend !== 'git-worktree-guard'
-      || typeof value.worktree !== 'string'
-      || !path.isAbsolute(value.worktree)
-      || !/^\d+$/.test(value.worktreeDev)
-      || !/^\d+$/.test(value.worktreeIno)
-      || typeof value.root !== 'string'
-      || !path.isAbsolute(value.root)
-      || !/^\d+$/.test(value.rootDev)
-      || !/^\d+$/.test(value.rootIno)
-      || value.path !== 'worktrees'
-      || value.id !== path.basename(record, '.json')
-      || !/^[a-f0-9]{64}$/.test(value.id || '')
-      || !/^[a-f0-9]{64}$/.test(value.operation || '')
-      || !Number.isSafeInteger(value.ownerPid)
-      || value.ownerPid < 1
-      || typeof value.ownerStarted !== 'string'
-      || !value.ownerStarted
-      || value.expected?.kind !== 'directory'
-      || !/^\d+$/.test(value.expected?.dev || '')
-      || !/^\d+$/.test(value.expected?.ino || '')
-      || value.target?.kind !== 'file'
-      || !Array.isArray(value.entries)
-      || value.entries.some((entry) => (
-        entry === null
-        || typeof entry !== 'object'
-        || typeof entry.name !== 'string'
-        || !entry.name
-        || entry.name === '.'
-        || entry.name === '..'
-        || entry.name.includes('/')
-        || entry.name.includes('\\')
-        || !/^\d+$/.test(entry.dev || '')
-        || !/^\d+$/.test(entry.ino || '')
-      ))
-    ) throw new Error('invalid Git worktree namespace transaction');
-    return {
-      ...value,
-      record,
-      prepared: path.join(value.root, 'amalgm-metadata-apply', `${value.id}.target`),
-      claimed: path.join(value.root, 'amalgm-metadata-apply', `${value.id}.claimed`),
-    };
-  } catch (error) {
-    throw new Error(
-      `invalid workspace Git worktree namespace transaction ${record}: ${error.message}`,
-    );
-  }
-}
-
-function gitWorktreeNamespaceTransactionRecords(worktreeRoot) {
-  const directory = gitWorktreeNamespaceTransactionDirectory();
-  if (!fs.existsSync(directory)) return [];
-  const requested = physicalDirectoryIdentity(worktreeRoot);
-  let common = null;
-  try {
-    common = physicalDirectoryIdentity(gitCommonDirectoryFromMarker(worktreeRoot));
-  } catch {
-    // A nonstandard Git layout may require Git's own common-dir resolution.
-    // That is available whenever the shared registration namespace is open.
-    try {
-      common = physicalDirectoryIdentity(gitCommonDirectory(worktreeRoot));
-    } catch {
-      // The checkout identity may still surface a record for diagnosis, but
-      // only a resolved matching common repository can authorize recovery.
-    }
-  }
-  return fs.readdirSync(directory)
-    .filter((name) => name.endsWith('.json'))
-    .sort()
-    .map((name) => readGitWorktreeNamespaceTransaction(path.join(directory, name)))
-    .map((transaction) => {
-      const worktreeMatches = samePhysicalDirectory(
-        { dev: transaction.worktreeDev, ino: transaction.worktreeIno },
-        requested,
-      );
-      const commonMatches = samePhysicalDirectory(
-        { dev: transaction.rootDev, ino: transaction.rootIno },
-        common,
-      );
-      if (!worktreeMatches && !commonMatches) return null;
-      if (!commonMatches) {
-        throw new Error(
-          `workspace Git worktree guard belongs to another common repository: `
-          + `${transaction.record}`,
-        );
+      const abs = path.resolve(root, write.path);
+      if (abs !== root && !abs.startsWith(root + path.sep)) {
+        throw new Error(`unsafe path: ${write.path}`);
       }
-      return {
-        ...transaction,
-        root: common.realpath,
-        prepared: path.join(
-          common.realpath,
-          'amalgm-metadata-apply',
-          `${transaction.id}.target`,
-        ),
-        claimed: path.join(
-          common.realpath,
-          'amalgm-metadata-apply',
-          `${transaction.id}.claimed`,
-        ),
-      };
-    })
-    .filter(Boolean);
-}
-
-function removeGitWorktreeNamespaceTransaction(transaction) {
-  try {
-    fs.unlinkSync(transaction.record);
-  } catch (error) {
-    if (error?.code !== 'ENOENT') throw error;
-  }
-  if (fs.existsSync(path.dirname(transaction.record))) {
-    syncDirectory(path.dirname(transaction.record));
-  }
-}
-
-function recoverGitWorktreeNamespaceTransactions(worktreeRoot) {
-  for (const transaction of gitWorktreeNamespaceTransactionRecords(worktreeRoot)) {
-    if (guardOwnerIsActive(transaction)) {
-      throw new TransitionError(
-        'recover-git-worktree-guard',
-        transaction.worktree,
-        `guard owner ${transaction.ownerPid} is still active`,
-      );
-    }
-    const result = runNativeFileTransaction(transaction, 'recover');
-    if (result.status !== 'released') {
-      throw new TransitionError(
-        'recover-git-worktree-guard',
-        transaction.root,
-        result.reason || result.status,
-      );
-    }
-    removeGitWorktreeNamespaceTransaction(transaction);
-  }
-}
-
-function prepareGitWorktreeNamespaceGuard(worktreeRoot) {
-  recoverGitWorktreeNamespaceTransactions(worktreeRoot);
-  const worktree = physicalDirectoryIdentity(worktreeRoot);
-  const common = physicalDirectoryIdentity(gitCommonDirectory(worktree.realpath));
-  const root = common.realpath;
-  const pinned = pinGitWorktreeNamespace(root);
-  const guardOperation = crypto.randomBytes(32).toString('hex');
-  const paths = gitWorktreeNamespacePaths(root, guardOperation, {
-    dev: common.dev,
-    ino: common.ino,
-  });
-  const target = gitMetadataIdentity(Buffer.alloc(0));
-  return {
-    contract: GIT_WORKTREE_NAMESPACE_GUARD_CONTRACT,
-    backend: 'git-worktree-guard',
-    worktree: worktree.realpath,
-    worktreeDev: worktree.dev,
-    worktreeIno: worktree.ino,
-    root,
-    rootDev: common.dev,
-    rootIno: common.ino,
-    path: 'worktrees',
-    id: paths.id,
-    operation: guardOperation,
-    ownerPid: process.pid,
-    ownerStarted: PROCESS_START_IDENTITY,
-    expected: {
-      kind: 'directory',
-      dev: pinned.namespace.dev,
-      ino: pinned.namespace.ino,
-    },
-    target,
-    entries: pinned.entries,
-    pins: pinned.pins,
-    gitRoots: [
-      root,
-      ...pinned.pins.slice(1).map((pin) => pin.realpath),
-    ].sort(),
-    record: paths.record,
-    prepared: paths.target,
-    claimed: paths.claimed,
-  };
-}
-
-async function withGitWorktreeNamespaceGuard(transaction, testHooks, guarded) {
-  try {
-    durable.writeJson(transaction.record, {
-      contract: transaction.contract,
-      backend: transaction.backend,
-      worktree: transaction.worktree,
-      worktreeDev: transaction.worktreeDev,
-      worktreeIno: transaction.worktreeIno,
-      root: transaction.root,
-      rootDev: transaction.rootDev,
-      rootIno: transaction.rootIno,
-      path: transaction.path,
-      id: transaction.id,
-      operation: transaction.operation,
-      ownerPid: transaction.ownerPid,
-      ownerStarted: transaction.ownerStarted,
-      expected: transaction.expected,
-      target: transaction.target,
-      entries: transaction.entries,
-    });
-    durable.writeFile(transaction.prepared, Buffer.alloc(0), 0o644);
-    const result = runNativeFileTransaction(transaction, 'guard');
-    if (result.status !== 'guarded') {
-      throw new TransitionError(
-        'guard-git-worktree-namespace',
-        transaction.root,
-        result.reason || result.status,
-      );
-    }
-    const guardedEntries = physicalGitWorktreeRegistrations(transaction.prepared);
-    if (JSON.stringify(guardedEntries) !== JSON.stringify(transaction.entries)) {
-      throw new TransitionError(
-        'guard-git-worktree-namespace',
-        transaction.root,
-        'Git worktree registrations changed before namespace exclusion',
-      );
-    }
-    if (typeof testHooks.afterWorktreeNamespaceGuard === 'function') {
-      await testHooks.afterWorktreeNamespaceGuard();
-    }
-    return await guarded(transaction.root);
-  } finally {
-    const released = runNativeFileTransaction(transaction, 'unguard');
-    if (released.status !== 'released') {
-      throw new Error(
-        `Git worktree namespace guard release failed: ${released.reason || released.status}`,
-      );
-    }
-    removeGitWorktreeNamespaceTransaction(transaction);
-  }
-}
-
-async function withGitHeadGuard(
-  worktreeRoot,
-  changes,
-  testHooks,
-  guarded,
-) {
-  const namespace = prepareGitWorktreeNamespaceGuard(worktreeRoot);
-  try {
-    const acquire = (index) => (
-      index === namespace.gitRoots.length
-        ? (async () => {
-          if (typeof testHooks.afterHeadGuard === 'function') {
-            await testHooks.afterHeadGuard();
-          }
-          return withGitWorktreeNamespaceGuard(namespace, testHooks, guarded);
-        })()
-        : withOneGitHeadGuard(
-          namespace.gitRoots[index],
-          worktreeRoot,
-          changes,
-          () => acquire(index + 1),
-        )
-    );
-    return await acquire(0);
-  } finally {
-    closePhysicalDirectoryPins(namespace.pins);
-  }
-}
-
-function gitMetadataIdentity(content) {
-  if (content === null) return null;
-  if (!Buffer.isBuffer(content)) throw new Error('Git metadata has no exact bytes');
-  return {
-    kind: 'file',
-    exec: false,
-    bytes: content.length,
-    sha256: crypto.createHash('sha256').update(content).digest('hex'),
-  };
-}
-
-function gitMetadataTransactionPathsForRoot(root, operation, component, rootStat) {
-  if (!/^[0-9a-f]{64}$/.test(operation || '')) {
-    throw new Error('Git metadata transaction has no operation identity');
-  }
-  if (component !== 'index' && component !== 'HEAD') {
-    throw new Error(`unsupported Git metadata component: ${component}`);
-  }
-  const directory = gitMetadataTransactionDirectoryForRoot(root);
-  ensureDurableDirectory(directory);
-  const id = crypto.createHash('sha256')
-    .update(
-      `${GIT_METADATA_TRANSACTION_CONTRACT}\0${rootStat.dev}\0${rootStat.ino}`
-      + `\0${operation}\0${component}`,
-    )
-    .digest('hex');
-  return {
-    id,
-    directory,
-    record: path.join(directory, `${id}.json`),
-    target: path.join(directory, `${id}.target`),
-    claimed: path.join(directory, `${id}.claimed`),
-  };
-}
-
-function gitMetadataTransactionPaths(worktreeRoot, operation, component, rootStat) {
-  return gitMetadataTransactionPathsForRoot(
-    gitDirectory(worktreeRoot),
-    operation,
-    component,
-    rootStat,
-  );
-}
-
-function readGitMetadataTransaction(record) {
-  try {
-    const value = JSON.parse(fs.readFileSync(record, 'utf8'));
-    if (
-      value?.contract !== GIT_METADATA_TRANSACTION_CONTRACT
-      || (value.backend !== 'git-lock' && value.backend !== 'git-guard')
-      || typeof value.root !== 'string'
-      || !/^\d+$/.test(value.rootDev)
-      || !/^\d+$/.test(value.rootIno)
-      || (value.path !== 'index' && value.path !== 'HEAD')
-      || typeof value.id !== 'string'
-      || value.id !== path.basename(record, '.json')
-      || !/^[a-f0-9]{64}$/.test(value.id)
-      || !/^[a-f0-9]{64}$/.test(value.operation || '')
-      || (
-        value.backend === 'git-guard'
-        && (
-          !Number.isSafeInteger(value.ownerPid)
-          || value.ownerPid < 1
-          || typeof value.ownerStarted !== 'string'
-          || !value.ownerStarted
-        )
-      )
-      || (value.expected !== null && typeof value.expected !== 'object')
-      || typeof value.target !== 'object'
-    ) throw new Error('invalid Git metadata transaction');
-    return {
-      ...value,
-      record,
-      prepared: path.join(path.dirname(record), `${value.id}.target`),
-      claimed: path.join(path.dirname(record), `${value.id}.claimed`),
-    };
-  } catch (error) {
-    throw new Error(`invalid workspace Git metadata transaction ${record}: ${error.message}`);
-  }
-}
-
-function gitMetadataTransactionRecordsAtRoot(rootInput, operation = null, component = null) {
-  const root = physicalDirectoryIdentity(rootInput);
-  const directory = gitMetadataTransactionDirectoryForRoot(root.realpath);
-  if (!fs.existsSync(directory)) return [];
-  return fs.readdirSync(directory)
-    .filter((name) => name.endsWith('.json'))
-    .sort()
-    .map((name) => readGitMetadataTransaction(path.join(directory, name)))
-    .map((transaction) => {
-      if (!samePhysicalDirectory(
-        { dev: transaction.rootDev, ino: transaction.rootIno },
-        root,
-      )) {
-        throw new Error(`Git metadata transaction escaped its worktree: ${transaction.record}`);
+      if (write.content === null) {
+        fs.rmSync(abs, { force: true });
+        removed.push(write.path);
+        continue;
       }
-      return { ...transaction, root: root.realpath };
-    })
-    .filter((transaction) => operation === null || transaction.operation === operation)
-    .filter((transaction) => component === null || transaction.path === component);
-}
-
-function gitMetadataTransactionRecords(worktreeRoot, operation = null, component = null) {
-  return gitMetadataTransactionRecordsAtRoot(
-    gitDirectory(worktreeRoot),
-    operation,
-    component,
-  );
-}
-
-function sameGitMetadataTransaction(left, right) {
-  return (
-    left.contract === right.contract
-    && left.backend === right.backend
-    && left.rootDev === right.rootDev
-    && left.rootIno === right.rootIno
-    && left.path === right.path
-    && left.id === right.id
-    && left.operation === right.operation
-    && JSON.stringify(left.expected) === JSON.stringify(right.expected)
-    && JSON.stringify(left.target) === JSON.stringify(right.target)
-  );
-}
-
-function removeGitMetadataTransaction(transaction) {
-  for (const file of [transaction.record, transaction.prepared, transaction.claimed]) {
-    try {
-      fs.unlinkSync(file);
-    } catch (error) {
-      if (error?.code !== 'ENOENT') throw error;
-    }
-  }
-  if (fs.existsSync(path.dirname(transaction.record))) {
-    syncDirectory(path.dirname(transaction.record));
-  }
-}
-
-/**
- * Apply one exact index or HEAD byte transition through Git's canonical lock.
- * The prepared bytes stay in the per-worktree Git directory and are hard
- * linked to index.lock/HEAD.lock by the native helper, so even very large
- * indexes never travel through JSON.
- */
-function applyGitMetadataTransaction(
-  worktreeRoot,
-  component,
-  expected,
-  target,
-  operation,
-  testHooks = {},
-) {
-  if (expected !== null && !Buffer.isBuffer(expected)) {
-    throw new Error('Git metadata expected value has no exact bytes');
-  }
-  if (!Buffer.isBuffer(target)) throw new Error('Git metadata target has no exact bytes');
-  const root = fs.realpathSync(gitDirectory(worktreeRoot));
-  const rootStat = fs.statSync(root, { bigint: true });
-  const paths = gitMetadataTransactionPaths(worktreeRoot, operation, component, rootStat);
-  const transaction = {
-    contract: GIT_METADATA_TRANSACTION_CONTRACT,
-    backend: 'git-lock',
-    root,
-    rootDev: rootStat.dev.toString(),
-    rootIno: rootStat.ino.toString(),
-    path: component,
-    id: paths.id,
-    operation,
-    expected: gitMetadataIdentity(expected),
-    target: gitMetadataIdentity(target),
-    record: paths.record,
-    prepared: paths.target,
-    claimed: paths.claimed,
-  };
-
-  if (fs.existsSync(paths.record)) {
-    const retained = readGitMetadataTransaction(paths.record);
-    if (!sameGitMetadataTransaction(retained, transaction)) {
-      throw new Error(`Git metadata transaction identity changed: ${component}`);
-    }
-    const recovered = runNativeFileTransaction(retained, 'recover');
-    if (recovered.status === 'applied') return;
-    if (recovered.status === 'pending') {
-      throw new TransitionError(
-        'apply-git-metadata',
-        worktreeRoot,
-        `${component}: ${recovered.reason || 'ownership is pending'}`,
-      );
-    }
-    removeGitMetadataTransaction(retained);
-  }
-
-  durable.writeJson(paths.record, {
-    contract: transaction.contract,
-    backend: transaction.backend,
-    root: transaction.root,
-    rootDev: transaction.rootDev,
-    rootIno: transaction.rootIno,
-    path: transaction.path,
-    id: transaction.id,
-    operation: transaction.operation,
-    expected: transaction.expected,
-    target: transaction.target,
-  });
-  durable.writeFile(paths.target, target, 0o644);
-  const result = runNativeFileTransaction(transaction, 'apply', null, {
-    crashBeforeInstall: testHooks.crashBeforeInstall === true,
-    crashAfterInstall: testHooks.crashAfterInstall === true,
-  });
-  if (result.status === 'pending') {
-    throw new TransitionError(
-      'apply-git-metadata',
-      worktreeRoot,
-      `${component}: ${result.reason || 'ownership is pending'}`,
-    );
-  }
-  if (result.status === 'changed') {
-    removeGitMetadataTransaction(transaction);
-    throw new TransitionError(
-      'apply-git-metadata',
-      worktreeRoot,
-      `${component} changed before ordered apply`,
-    );
-  }
-}
-
-function recoverGitMetadataTransactionsAtRoot(root, label) {
-  for (const transaction of gitMetadataTransactionRecordsAtRoot(root)) {
-    if (transaction.backend === 'git-guard' && guardOwnerIsActive(transaction)) {
-      throw new TransitionError(
-        'recover-git-head-guard',
-        label,
-        `guard owner ${transaction.ownerPid} is still active`,
-      );
-    }
-    const result = runNativeFileTransaction(transaction, 'recover');
-    if (transaction.backend === 'git-guard') {
-      if (result.status !== 'released') {
-        throw new TransitionError(
-          'recover-git-head-guard',
-          label,
-          result.reason || result.status,
-        );
+      fs.mkdirSync(path.dirname(abs), { recursive: true });
+      if (write.mode === '120000') {
+        fs.rmSync(abs, { force: true });
+        fs.symlinkSync(write.content.toString('utf8'), abs);
+      } else {
+        fs.writeFileSync(abs, write.content);
+        fs.chmodSync(abs, write.mode === '100755' ? 0o755 : 0o644);
       }
-      removeGitMetadataTransaction(transaction);
-      continue;
+      written.push(write.path);
     }
-    if (result.status === 'pending') {
-      throw new TransitionError(
-        'recover-git-metadata',
-        label,
-        `${transaction.path}: ${result.reason || 'ownership is pending'}`,
-      );
-    }
-    if (result.status === 'changed') removeGitMetadataTransaction(transaction);
-  }
-}
-
-function gitHeadRoots(worktreeRoot) {
-  const common = gitCommonDirectoryFromMarker(worktreeRoot);
-  const registrations = path.join(common, 'worktrees');
-  let names = [];
-  try {
-    names = fs.readdirSync(registrations).sort();
+    journal({ action: 'merge-files', worktree: root, label, written, removed, ok: true });
   } catch (error) {
-    if (error?.code !== 'ENOENT') throw error;
-  }
-  return [
-    common,
-    ...names.map((name) => path.join(registrations, name)),
-  ];
-}
-
-function recoverGitMetadataTransactions(worktreeRoot) {
-  recoverGitWorktreeNamespaceTransactions(worktreeRoot);
-  for (const root of gitHeadRoots(worktreeRoot)) {
-    try {
-      recoverGitMetadataTransactionsAtRoot(root, worktreeRoot);
-    } catch (error) {
-      if (error?.code === 'ENOENT') continue;
-      throw error;
-    }
-  }
-}
-
-function gitMetadataReceiptCrossed(worktreeRoot, operation, component) {
-  recoverGitMetadataTransactions(worktreeRoot);
-  const records = gitMetadataTransactionRecords(worktreeRoot, operation, component);
-  if (records.length > 1) {
-    throw new Error(`multiple Git metadata receipts exist for ${component}`);
-  }
-  if (records.length === 0) return false;
-  const result = runNativeFileTransaction(records[0], 'receipt');
-  if (result.status === 'crossed') return true;
-  if (result.status === 'not-crossed') return false;
-  throw new Error(
-    `Git metadata receipt is unresolved: ${component}: ${result.reason || result.status}`,
-  );
-}
-
-function releaseGitMetadataReceipts(worktreeRoot, operation, component = null) {
-  for (const transaction of gitMetadataTransactionRecords(worktreeRoot, operation, component)) {
-    const result = runNativeFileTransaction(transaction, 'release');
-    if (result.status === 'pending') {
-      throw new Error(
-        `Git metadata receipt cannot be released: ${transaction.path}: `
-        + `${result.reason || 'pending'}`,
-      );
-    }
-    if (result.status !== 'released') {
-      throw new Error(
-        `Git metadata receipt release failed: ${transaction.path}: ${result.status}`,
-      );
-    }
-    removeGitMetadataTransaction(transaction);
+    journal({
+      action: 'merge-files', worktree: root, label, written, removed, ok: false,
+      error: String(error.message).slice(0, 500),
+    });
+    throw new TransitionError('merge-files', root, String(error.message));
   }
 }
 
 module.exports = {
   TransitionError,
-  applyGitMetadataTransaction,
   applyIndexPatch,
-  applyFiles,
-  branchReceiptCrossed,
-  confinedPath,
+  applyMergedFiles,
+  applyPatch,
+  checkoutInitialCard,
   createBundle,
-  emptyTree,
-  ensureEmptyIndex,
-  gitMetadataReceiptCrossed,
+  deleteBranchRef,
+  fastForwardTo,
+  fetchBranch,
+  forceMoveToCard,
+  holdInitialFiles,
   importBundle,
-  initializeHeadToCard,
   initializeRepo,
-  isApplyReceiptPath,
-  moveHeadToCard,
-  crossedFileReceiptPaths,
-  recoverFileTransactions,
-  recoverGitMetadataTransactions,
-  releaseBranchReceipt,
-  releaseFileReceipts,
-  releaseGitMetadataReceipts,
-  updateBranchRefs,
+  moveToCard,
+  parkCommit,
+  pruneParkedCommits,
+  restoreInitialFiles,
+  setBranchRef,
+  setIndexTree,
 };