Verify the content binding even on the first write. Existing refs remain byte-identical and storage errors are failures, never a missing value. Legacy inspect-rendered definitions cannot be verified and fail closed.

Open a connection to a peer. Stays open for subsequent fetch_refs batches — the selective-pull primitive’s session handle.

The one place a SyncError becomes a user sentence. The constructors carry the facts (which peer, what message, which ref conflicts); rendering them belongs here, with the type, rather than at each CLI call site — inspect output is a debug rendering and must never reach a user.

Fetch the attestations that cover these subjects. A package closure is definitions and manifests; the evidence that admits those definitions is separate content, so a peer installing by manifest hash had nothing to satisfy its own gate with and refused every install. Content addressing still applies: each chunk is verified against its ref on arrival, and the signature is checked locally by the trust policy, not by the peer.

Fetch exactly the given refs from an already-connected peer: request, unsolicited-chunk validation, conflict-checked accept. Returns the codebase with the chunks applied. This is the selective transfer primitive: the caller computes the ref set (e.g. a package manifest closure) and the wire moves nothing else.

Every received chunk must answer a ref we actually asked for. A peer sending unsolicited chunks fails the transfer loudly.