Module transition 

coven-owned locality transitions: make_remote (Local → Remote) and make_local (Remote → Local), plus cancel_make_remote.

A blob-bearing root is Local (its blobs live on-device — a user-provided blob at the user’s path, a host-provided blob in coven’s local store — and the root’s gate is off) or Remote (its blobs live in the cloud fronted by coven’s cache, and the gate is on). coven owns moving between the two, with the durable-copy-before-delete ordering and a single atomic commit point each way:

• LocalBlobTransitions::make_remote journals every blob-bearing row beneath the root, then returns. The upload drain verifies each source while sealing it into its upload spool and creates each exact cloud object. Once every row has a created object, one Store write flips the gate true and drops external-file ownership. The intent and exact upload journals remain authoritative until that Store write activates, when activation consumes them atomically. Before publication starts, LocalBlobTransitions::cancel_make_remote marks the intent Cancelling; the upload drain exact-deletes every object and spool before atomically removing the last journal and intent, so the root remains Local.
• ConnectedBlobTransitions::make_local brings each blob back to a local file durability-first (read from cache/cloud → write the local copy → verify): a user-provided blob to its dest path (path required) registered as an external ref, a host-provided blob to coven’s local store (no path). Then it takes the single commit {flip the gate false + register the external refs + enqueue the cloud deletes}. The gate retract removes the subtree from peers; the tombstone drain reclaims the cloud blobs after the grace.

Both transitions operate on every exact blob-bearing row under the root and branch on provenance only to choose its Local filesystem home.

A SyncedTable::remote_root has no Local state in this model: its rows sync normally and its blobs are Remote by construction, so these transition APIs reject it.

Every destructive step is enqueued durably inside the one commit, and nothing destructive happens before it, so there is no representable half-state and retry after a crash is idempotent.

See the blob concept tree for how Local/Remote, provenance, and the cache fit together.

Structs

ConnectedBlobTransitions

LocalBlobTransitions

MakeRemoteRoot

MaterializedFileCleanupFailure

MaterializedFileCleanupFailures

Enums

ExactPlaintextFileError

MakeLocalError

Why a make_local could not complete.

MakeRemoteError

Why a make_remote (or its cancel) could not be started.

Traits

VerifiedLocalCopyStaging

Materializing a blob back to a local file needs one capability from the connected blob access the host composes: staging a verified local copy of an exact reference. Transitions name only this port.