org.sigilaris.node.jvm.runtime.application.v2

Original forced material selected by the frozen ActivationPreparation. The auxiliary reference binds the complete inactive schema output as well as the original handover; it cannot turn preparation into an active decision.

Exclusive pre-start owner of the actual target DurableJournal. Only a complete authenticated decision exposes an active group. All namespaces remain immutable content-addressed images; there is no partial filesystem rename whose visibility can precede this one journal decision.

This configured lookup is rooted in authenticated manifest history. Its verifier must resolve and execute the selected historical proposal's actual transaction, source, input, state and profile evidence.

Actual untrusted evidence material, never a pre-approved ancestry result.

A local lookup budget. Exhaustion is Unavailable, never protocol invalidity.

Supplied from the authenticated installed checkpoint/bootstrap identity.

Live immutable artifact operations share the voting gate and failure fence. Recovery callbacks already hold that gate and must read their provided DurableJournal directly; retained vote/application evidence carries its complete canonical plan, so recovery never needs this live lookup adapter.

Capability constructors live inside the authenticated verifier. There is no apply/copy, package constructor, Boolean factory or decoded capability.

The configured state implementation decodes the complete payload, recomputes its root, and independently derives ordered results against authenticated parent state. Returning caller-supplied roots or results is not verification.

Read the actual local consensus state after bootstrap/recovery. The caller of lookup cannot supply an approved id or a Boolean. This initial policy selects the current pacemaker high-QC parent; other parent policies require their own authenticated consensus-state and branch evidence adapter.

Constructed only by checking canonical bytes against independently installed trust. The pin is an activation/configuration trust root, never a digest accepted from the same remote request that supplies these bytes. Once built, no mutable provider or wall-clock can relabel a retained height.

Re-authenticate original source and fixed evidence plus the CURRENT durable key controller. Called with immutable SafetyState under the safety gate; never invokes the installer or that SafetyStore again.

Original, immutable installation material. The inventory names actual bytes; the source root is independently recomputed by the installed transition verifier, never inferred from these storage digests.

Mandatory real lifecycle scope. Hold the actual old consensus/QC/listener, safety/index, pipeline and namespace writer gates throughout run, in their installed global order, then controller gate. Releasing before run completes is invalid. The original-group authenticator independently checks the fixed deployment/layout/mutation coverage. No permissive default is provided.

The root is an independently selected physical path, not a caller-selected namespace list at capture time. The exact record is bound into every backup.

A concrete gate for integrations which route every relevant mutation through one installed runtime coordinator. It neither owns keys nor stands in for a deployment's independent proof that all original mutation paths use it.

Explicit codec for one installed namespace format. semanticDigest is derived from fully decoded original logical records, not serialized layout bytes; any application-state root is derived by that actual application's codec.

Original source decoding must prove these two different frontiers from the actual stored namespaces and retained certified suffix replay. copied roots or a submitted manifest alone do not prove closure. fixedEvidence must parse every original present/absence artifact required by the fixed baseline; absent directories never synthesize historical absence certificates.

Every role must be covered by the independently installed complete layout. One actual journal namespace may implement several roles; duplicate physical paths cannot masquerade as independent namespaces.

Original forced vote material and fresh key-use permission are distinct. Recovery validates historical original evidence; authorize additionally checks current canonical state, live reservations, remaining future inclusion and every selected exact pipeline's actual successful mode/output/ancestry. Repositories/publication must read independently of the held safety gate.

Installed once with the controller. The actual canonical effect executes while its gate is held, after the exact write intent was forced. apply must perform an idempotent durable CAS from priorDigest to payload; after an unknown result it must recognize the already-written identical effect. verify rechecks the retained immutable effect proof after restart, even if newer writes superseded its current pointer. No arbitrary per-call closure can substitute another writer or bypass the guard.

Required configured interpreters, not caller-supplied success predicates. Recompute the precise existing sign bytes and historical profile/context from the actual canonical source/proposal and retained authorization. In particular HotStuff chain/set/height alone does not authenticate a manifest. initialHistory independently proves complete prior key use; an old key may not be initialized with a fabricated empty history. Unresolved historical writes/signing/enforcements require their original controller recovery; this completed seed format cannot silently drop them or invent signatures. It parses original proof bytes and retains all observed signatures, canonical writes and fences. These methods run under the controller gate and must not reacquire it or any outer voting gate already held by their caller.

Resolves every creation target from the signed complete declaration and authenticated entry state, including targets not used by the reducer.

Canonical authoritative history. A newly opened backend requires recovery before writes; an unknown write outcome fences it until recovery succeeds.

Candidate preparation retains safety promises and immutable working results. Actual finality later enters RecoverableApplicationStore; candidate execution cannot use its canonical overlap exception or mark an application field.

A successful decode may describe deterministic reducer rejection. The full actual execution must already be authenticated before this outcome can preserve reservations. Malformed output/reference evidence is a separate outer Left and never creates an execution capability.

A location hint, authenticated only by the actual canonical ancestry lookup.

Exact, voting and application evidence are authenticated against the same original immutable safety projection. Only the final operation-scope check uses a view excluding already authenticated exact records.

Decoded from the actual signed application transaction under its configured signature/replay contract. The root must be authenticated retained state or the result of deterministic authenticated preceding execution, never an arbitrary future root copied from a request. Authentication also verifies that admissionBase and the descriptor/deadline are bound by those signed transaction bytes under the selected family's source contract.

An independently executed entry, including every actual access and the authenticated authorization artifact root in owner.scope. Implementations execute against retained authenticated state; they must not echo requests.

Pre-certification fast execution. It deliberately contains no completed plan source or effect-certificate reference, so the first effect quorum can be formed using only its authenticated input-lock certificate.

Exclusive key/controller resource on a trusted local filesystem honoring JDK file force, atomic replacement and directory force. A partial pending snapshot is retained and fails closed; a complete descendant is replayed and forced before readiness. No failed fence/publication/restore removes history. Every use of this key and every selected canonical writer must be routed through this resource. Independent copied keys or rollback of the entire trusted controller disk require external enforcement, not a local heuristic.

Untrusted retained/backfilled finality, full plan, and complete state bytes. Source/input/execution evidence is independently resolved by the configured ApplicationRequestVerifier when this material is verified.

Observation only. Neither a target id nor these status fields are a voting capability. canonical is absent until an actual journal read/recovery.

Height and original-configuration dispatch for exact ancestry. A producer remains in the consumer's exact application context; M1/M2 entries never become V2 producers because they share header version 2. The producer's old justify QC is still authenticated in its own pinned historical range.

Release provenance is independent of the historical protocol integer and header tag. Both published milestones can carry header V2 with plan V1.

This is original immutable configuration evidence, not a request-selected version. The release determines the whole published protocol/signature/ plan/lock/effect/exact/journal tuple; headerVersion records its selected supported header language. A new application profile carries its complete canonical manifest rather than a caller-supplied protocol flag.

Canonical application of an OLD-profile block only after its real finality. This never becomes a target-context ApplicationBatch. Installed P remains a speculative working parent until these records actually advance F to P.

Sequence starts at 1, initial previousDigest is zero. A Prepared/Committed pair has identical sequence, previous digest, advance and advance digest. The next pair references the COMMITTED record digest. Recovery must verify every actual historical advance before completing a valid Prepared tail.