1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
//! Host-side snapshot backup and same-release recovery for Internet Computer canisters.
//!
//! The library provides artifact checksums, no-follow traversal and staging,
//! verified durable directory publication, bounded JSON persistence and journal
//! locking, layout lifetime exclusion, durable restore dependencies and
//! inherited command custody. Local download journals retain exact snapshot
//! identity and verified publication progress. Local attempt journals bind exact
//! declared identity and finite mutation/observation allowances, retaining durable
//! reservations and qualified receipts. These mechanisms do not authorize canister
//! effects.
//! Explicit fresh download integrity checks bind the retained original plan and
//! exact selected set to published directory bytes without changing journals,
//! replenishing allowances or releasing dependencies. Stable byte custody and
//! backend transfer completeness remain integration-owned.
//! Bounded physical inventories retain canonical declared parent forests; pure
//! selection policy expands exact principals without live discovery or authority.
//! Explicit effect graphs retain validated operation dependencies and project
//! deterministic planning order/readiness without authorizing dispatch.
//! Immutable operation plans bind these declarations to exact target/request digests
//! and original attempt allowances, deriving journal authority under the full plan digest.
//! Pure execution progress joins exact retained journals to the original plan and
//! projects causal Applied evidence, pending attempts and exhaustion without dispatch.
//! The IC request boundary encodes closed host-ingress management operations and
//! binds exact method/routing/Candid bytes to original mutation or observation digests.
//! Codec qualification does not establish IC effects or fresh execution authority.
//! Bounded capture/inventory reply decoding preserves raw snapshot identity and
//! exact request/reply evidence without authenticating origin or settling effects.
//! Pure inventory comparison exposes new candidates and rejects baseline drift;
//! candidate cardinality never attributes or settles a lost capture.
//! Bounded lifecycle replies retain exact empty acknowledgements and required
//! status/controller projections without converting them into fresh authority.
//! A separate membership port binds ephemeral provider results to original intent,
//! exact current context/full inventory and an integration-owned challenge.
//! Pure matching views grant neither controller authority nor application continuity.
//! The separate control port checks direct caller-controller evidence for exact
//! IC mutation payloads; its matching views still grant no dispatch or restore safety.
//! A separate snapshot-read port checks current snapshot-list visibility and exact
//! caller read paths, without granting mutation control or settling lost replies.
//! Immutable consistency requirements retain the original requested guarantee;
//! current target/fence checks acquire or release no application obligations.
//!
//! Applications own membership, release identity, control routing, quiescence
//! and external-effect settlement. Capture/restore runners and an IC transport
//! have not been extracted yet. Filesystem access and credentials remain on the
//! operator host.