1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
//! Host-side snapshot backup and same-release recovery for Internet Computer canisters.
//!
//! The library provides artifact checksums, no-follow traversal and staging,
//! verified durable directory publication, bounded JSON persistence and journal
//! locking, layout lifetime exclusion, durable restore dependencies and
//! inherited command custody. Local download journals retain exact snapshot
//! identity and verified publication progress. Local attempt journals bind exact
//! declared identity and finite mutation/observation allowances, retaining durable
//! reservations and qualified receipts. These mechanisms do not authorize canister
//! effects.
//! Explicit fresh download integrity checks bind the retained original plan and
//! exact selected set to published directory bytes without changing journals,
//! replenishing allowances or releasing dependencies. Stable byte custody and
//! backend transfer completeness remain integration-owned.
//! Immutable local download manifests reuse that exact v1 journal schema after
//! fresh byte verification. Exact replay reads original retained records only,
//! preserving snapshot/checksum provenance even when artifact trees are absent.
//! Explicit local restore-source verification joins both original plans, retained
//! safety requirement and exact local manifest before checking every source tree.
//! Borrowed same-ID selection views grant no upload/load, application or release authority.
//! Private operation-bound artifact copies check original and copied checksums;
//! explicit retained-copy verification recovers without re-reading source trees.
//! Failed copies and drop retain evidence, spending and source references without cleanup.
//! Bounded physical inventories retain canonical declared parent forests; pure
//! selection policy expands exact principals without live discovery or authority.
//! Explicit effect graphs retain validated operation dependencies and project
//! deterministic planning order/readiness without authorizing dispatch.
//! Immutable operation plans bind these declarations to exact target/request digests
//! and original attempt allowances, deriving journal authority under the full plan digest.
//! Pure execution progress joins exact retained journals to the original plan and
//! projects causal Applied evidence, pending attempts and exhaustion without dispatch.
//! The IC request boundary encodes closed host-ingress management operations and
//! binds exact method/routing/Candid bytes to original mutation or observation digests.
//! Codec qualification does not establish IC effects or fresh execution authority.
//! Bounded capture/inventory reply decoding preserves raw snapshot identity and
//! exact request/reply evidence without authenticating origin or settling effects.
//! Bounded snapshot metadata reads preserve ordered globals, optional timer/hook
//! values and exact chunk identities, without attesting complete data transfer.
//! Metadata-bound data reads admit checked ranges, exact reply lengths and chunk
//! hashes while retaining original evidence without effects. Incremental coverage
//! checks reject gaps and repeated chunks without retaining or publishing bytes.
//! Snapshot upload payloads preserve representable metadata and bind exact bounded
//! source slices to a distinct new ID. Explicit local preparation checks retained
//! source bytes; passive original-attempt reply admission supplies no dispatch,
//! settlement, complete upload or new spending. A single-update upload provider
//! contract reuses original accounting and passive replies; no provider is installed.
//! Local verification/upload preparation expose per-guard host duration and chunk-size
//! summaries using registry ic-metrics arithmetic. Metrics are diagnostic in-memory
//! samples, start empty on reopen and change no retained progress or spending.
//! Pure inventory comparison exposes new candidates and rejects baseline drift;
//! candidate cardinality never attributes or settles a lost capture.
//! Bounded lifecycle replies retain exact empty acknowledgements and required
//! status/controller projections without converting them into fresh authority.
//! Exact IC mutation envelopes bind already reserved original updates; a single-call
//! provider contract and bounded passive reply association preserve pending spending.
//! Existing codecs decode replies without automatic settlement, retries or release.
//! Exact staged restore copies have separate durable publication/recovery and fresh
//! canonical-copy verification, retaining original accounting and source references.
//! Exact reserved status/list observations also retain both original attempt identities;
//! passive association leaves lost observations pending and proves no effect outcome.
//! A separate membership port binds ephemeral provider results to original intent,
//! exact current context/full inventory and an integration-owned challenge.
//! Pure matching views grant neither controller authority nor application continuity.
//! The separate control port checks direct caller-controller evidence for exact
//! IC mutation payloads; its matching views still grant no dispatch or restore safety.
//! A separate snapshot-read port checks current snapshot-list visibility and exact
//! caller read paths, without granting mutation control or settling lost replies.
//! Immutable consistency requirements retain the original requested guarantee;
//! current target/fence checks acquire or release no application obligations.
//! Immutable restore safety requirements bind exact original source and same-release
//! targets; fresh application evidence checks load/start safety without effects,
//! lost-load settlement or fence/reference release.
//! Immutable fence obligations retain original scope and acquisition identity;
//! recovery joins their exact original attempt journals without new accounting,
//! automatic release or a claim of current Active custody.
//! Reserved fence-acquisition reconciliation matches original-request attribution
//! under exact pending mutation and observation identities. Passive claims and
//! late-reply admission perform no automatic settlement, redispatch or release;
//! authenticated providers and actual application effects remain integration-owned.
//! Exact application acquisition envelopes bind receiver, update mode, method and
//! opaque bytes to already reserved original mutations. Passive acknowledgement
//! association establishes no acquisition outcome or fresh dispatch permission.
//! Immutable execution settlement checkpoints bind complete original Applied
//! journals and their exact chronological histories for local replay. They prove
//! no full backup/restore completion, command quiescence or fence/reference release.
//!
//! Applications own membership, release identity, control routing, quiescence
//! and external-effect settlement. Capture/restore runners and an IC transport
//! have not been extracted yet. Filesystem access and credentials remain on the
//! operator host.
//! Bounded Unix record reads reuse ic-host-tools regular-file admission while
//! publication, record validation, confinement and command custody remain local.