Module reclaim 

Signed reclaim targets, claims, evidence, authorizations, and receipts.

Structs

AudienceBlobReclaimClaim

Evidence that a row blob is no longer bound by any live row. The claim carries nothing but the target: the verifier re-reads the publishing package to confirm it bound this blob, then re-derives from its own materialized rows that none still binds it.

AudienceBlobReclaimTarget

The exact ciphertext of one row blob that no live row still binds in its audience. Moving a row to another audience republishes its blob under a new locator and drops the old binding, leaving the source ciphertext addressed to an audience nothing reads from any more.

CircleBootstrapImageReclaimClaim

Evidence that one Circle bootstrap image is no longer a live seed for its recipient: the target image and the recipient-coverage or lost-authority proof.

CircleBootstrapImageReclaimTarget

The exact Circle bootstrap image a reclaim deletes: the retained bootstrap coverage a recipient device’s live projection was seeded from names the image object, its activating Store commit, and the cut the seed covers. The coverage is recovered from the recipient’s own signed acknowledgement (seeded_from), never fabricated by the reclaiming Owner.

CirclePackageBeyondCutoffClaim

Evidence that one Circle package lies beyond the accepted cutoff of the epoch it was addressed to: the named successor control activated with a closed-epoch origin whose cutoff does not cover the package’s activating commit. Such a package is invalid by construction — no device materializes it — so it needs no snapshot coverage or acknowledgement evidence. The successor control is an exact coordinate the verifier re-resolves from retained activations.

CirclePackageReclaimTarget

CirclePackageSnapshotCoverageClaim

Evidence that one Circle package is covered by an acknowledgement-stable Circle snapshot: the snapshot’s cut covers the package’s activating commit, and every device holding active Circle access has acknowledged coverage that dominates the cut. The acknowledgements are exact per-device references, readable by the Owner as a Circle member.

CircleSnapshotImageReclaimClaim

Evidence that a later generation of the same device’s Circle snapshot stream supersedes the reclaimed one. The claim names only the exact superseding generation — that generation’s own signed metadata, its stability against every active-access device’s acknowledgement, and its coverage of the reclaimed cut are all re-derived from live state at verification.

CircleSnapshotImageReclaimTarget

The exact image of one generation of a device’s standalone Circle snapshot stream.

CircleSnapshotLocator

The exact author, Circle, control, and standalone-snapshot reference of the stable Circle snapshot whose cut covers a reclaimed Circle package.

CircleSnapshotStreamActivation

One generation of a device’s per-Circle snapshot stream, named by the exact metadata object whose signature vouches for the image that generation published. The stream is anchored on the author’s Store device registration and the Circle, which is all a Store member outside the Circle can check; a member inside re-walks the stream itself.

PackageBlobBindingActivation

The exact package whose row-blob bindings carry a reclaimed blob’s locator, together with the Store commit that activated it. A blob rides inside a package addressed to one audience and is never named by the commit body, so the package is the signed statement a verifier re-reads to confirm the blob was published where the claim says.

ReclaimAuthorizationBody

The wire body of an Owner’s authorization to reclaim. Every field here is signed.

ReclaimAuthorizationRef

ReclaimEvidenceBody

The wire body of a reclaim claim’s evidence. Every field here is signed.

ReclaimEvidenceRef

ReclaimReceiptBody

The wire body of a reclaim receipt: what was reclaimed, and under whose authority. Every field here is signed.

ReclaimReceiptRef

StoreMembershipRollupReclaimClaim

Evidence that a later generation of the same device’s Store snapshot stream supersedes the reclaimed one.

StoreMembershipRollupReclaimTarget

One superseded generation’s membership rollup, named beside the generation that published it.

StorePackageReclaimClaim

StorePackageReclaimTarget

StoreReclaimAuthority

StoreSnapshotStreamActivation

One generation of a device’s Store snapshot stream, named by the exact metadata object whose signature vouches for what that generation published beside its image. The Store stream is anchored on the author’s device registration alone, which every Store member can check.

Enums

AudienceBlobBindingPackage

The exact package whose row-blob bindings published one blob, in whichever audience the row was written to. Reading the package back needs its audience: a Store package is sealed to the Store, a Circle package to the Circle epoch.

CircleBootstrapReclaimProof

The two proofs an Owner can present that a recipient no longer needs its seed image. Both carry the recipient device’s own activated Circle acknowledgement, whose seeded_from names the target coverage — binding the proof to the exact image being deleted. The authorization verifier re-loads and re-checks the acknowledgement; nothing here is trusted from the claim alone.

CirclePackageReclaimClaim

The two ways one Circle package stops being live history. Either a stable Circle snapshot covers it and every active-access device acknowledged that coverage, or the package lies beyond its epoch’s accepted close cutoff — in which case it never materialized anywhere and needs no coverage evidence.

ReclaimActivation

The signed statement that put a reclaim target into the shared live set — the authority a verifier re-reads to confirm the Owner is deleting what its claim says. It follows how the object was published: a Store commit names packages and the bootstrap images its Circle-control activations carry; a device’s per-Circle snapshot stream names its own images through signed metadata that rides no commit at all; and a row blob is named by the bindings of the package that published the row, not by the commit body.

ReclaimClaim

The eligibility proof an Owner signs to authorize one reclaim. The claim kind matches its ReclaimTarget kind and carries the exact coverage and acknowledgement references verified before the target is deleted.

ReclaimTarget

The exact object a reclaim authorizes the deletion of, together with the kind-specific locator needed to physically delete it and confirm its absence. Every kind shares one signed evidence → authorization → receipt chain; the kind selects only the eligibility proof and the readback prefix.

Functions

reclaim_authorization_semantic_prefix

reclaim_evidence_semantic_prefix

reclaim_receipt_semantic_prefix

Type Aliases

ReclaimAuthorization

ReclaimEvidence

ReclaimReceipt