A registry that exists, recorded well enough to find it again and to refuse to use the wrong one.

One reference-script output: what it carries, where it is, and the hash a node must agree it holds.

Read a manifest, naming the file when it will not parse.

Write a manifest, formatted for a person to read in review.

The manifest a command line names, if any. --deployment PATH and --deployment=PATH are both accepted; absent, the caller keeps its existing behaviour of booting its own registry.

deploymentPathFromArgs for this process, falling back to SINGULAR_DEPLOYMENT.

The compiled bytes a release ships. The manifest records their hashes; the bytes themselves come from the blueprints in hand, so a manifest can never be used to smuggle in a different validator.

The cage configuration a manifest describes: this release's compiled scripts, with the seed and the economics the deployment was booted with.

Refuses when the release in hand compiles the state validator to a different hash than the deployment was made with — the manifest then belongs to another release and attaching to it would spend against a registry whose validator this code does not implement.

Ask a node whether it still agrees with a manifest, and return what it answered, one line per claim.

Every claim is about the chain or about the compiled release, never about the file restating itself: the seed determines the recorded token, this release compiles to the recorded state hash, every recorded reference output is live at its recorded address carrying the hash the manifest pins, and the registry's state output carries the recorded token under the recorded policy. The first claim that fails is raised by name.

What a run gets instead of booting and publishing.

Attach a run to a recorded deployment: the release, token and reference/state resolution verifyDeployment performs, plus the resolved outputs a runner needs in hand. The live state's active policy and windows are not checked here; verification is the operation that reads them.

Where the proof mirror for a manifest lives: the manifest's own path with a .mirror.json extension, so the two travel together and neither is guessed from a separate flag.

Read the mirror beside a manifest. A missing file is the empty mirror, which is what a registry booted a moment ago actually has — the caller that attaches compares the loaded root with the chain's, so an empty mirror against a registry that has grown is refused by that comparison rather than assumed.

Write the mirror beside a manifest, replacing what was there whole or not at all (replaceDurably).

Replace a file whole, durably: the bytes go to a sibling PATH.partial, synchronised to disk, which is then renamed over PATH, and the directory is synchronised. A process killed at any point leaves PATH holding either its previous bytes or the new ones, never a prefix; a killed replacement may leave the .partial sibling, which the next replacement overwrites.

txid#index, the spelling every Cardano tool prints.

Parse txid#index back, naming what was wrong with it.

An address as the manifest records it: exact bytes, in hex.