@amalgm/shell 0.1.48 → 0.1.50

package/dist/user-ground-host.js

@@ -3,14 +3,13 @@ import { existsSync, lstatSync, realpathSync, readFileSync, readdirSync, readlin
 import { open } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { buildUserHomeManifest, buildUserManifest, liveMachineStateDir, scopedAmalgmDir, shippedUserHomeDeclaration, } from "@amalgm/core/identity";
-import { CHUNK_BYTES, CONTENT_CONTRACT, ENTITY_CLOUD_CONTRACT, ENTITY_CLOUD_SCHEMA_VERSION, artifactForRecord, canonicalVersion, checkContentManifest, classifyDirectory, classifyFile, classifyRegisteredRoot, convergeUserGround, createUserGroundEnrollmentPolicy, isRepositoryMetadataEntry, download as downloadArtifact, membershipHash, parseSnapshot, pathIsSuspect, privateEntityResourceId, sameRecords, snapshotFromRecords, stableJson, travelingRecords, upload as uploadArtifact, userGroundRecords, } from "@amalgm/live";
+import { CHUNK_BYTES, CONTENT_CONTRACT, ENTITY_CLOUD_CONTRACT, ENTITY_CLOUD_SCHEMA_VERSION, artifactForRecord, acceptOutboxRow, canonicalVersion, checkContentManifest, classifyDirectory, classifyFile, classifyRegisteredRoot, createLocalEntityRecord, convergeUserGround, createUserGroundEnrollmentPolicy, isRepositoryMetadataEntry, download as downloadArtifact, decodeAcceptedEntityRecord, decodeLocalEntityRecord, encodeEntityRecord, membershipHash, parseSnapshot, pathIsSuspect, privateEntityResourceId, nextEntitySends, receiveEntityRecord, sameRecords, snapshotFromRecords, stableJson, travelingRecords, upload as uploadArtifact, userGroundRecords, } from "@amalgm/live";
 import Database from "better-sqlite3";
 import { atomicCopy, atomicWrite, ensurePrivateDir } from "./filesystem.js";
 import { ContentCacheDownload, captureContentFile, hashContentFile, sealCapturedArtifact, } from "./content-cache-host.js";
 import { decodeContentWireBytes, encodeContentWireBytes } from "./content-wire-codec.js";
 import { exactTextReplay, planGroundDetection, reconcileGroundUUIDs, } from "./detection/portable.js";
 import { NamedDetectRuntime } from "./detection/runtime.js";
-import { decodeMutationOperation, encodeMutationOperation, } from "./detection/journal-codec.js";
 import { WORKSPACE_UUID as UUID, createFilesRegisterPorts, ensureWorkspaceBinding, ensureWorkspaceReference, pathExists, pathWithin, referenceWorkspaceId, selectKnownRegistrationId, workspaceBindingDir, } from "./files-register-host.js";
 import { applyRepositoryFiles, captureRepository, inspectRepositoryTransportFile, hasGitMarker, } from "./git-repository-host.js";
 import { inspectGitRegistration, } from "./git-registration-host.js";
@@ -27,6 +26,9 @@ const FILE_BATCH_DOWNLOAD_CONCURRENCY = 2;
 const DETECT_QUIET_MS = 12;
 const DETECT_MAX_DEFERRAL_MS = 75;
 const DETECT_RETRY_MS = 250;
+const RECORD_RETRY_MS = 1_000;
+const RECORD_POLL_MS = 1_000;
+const RECORD_TAIL_LIMIT = 256;
 const GROUND_ROW_COLUMNS = [
     "uuid", "resource_id", "root_uuid", "type", "parent_uuid", "name", "status", "version",
     "payload_version", "transport_version", "relative_path", "absolute_path", "device_number",
@@ -46,6 +48,9 @@ export class UserGroundHost {
     cloudState = null;
     converged = false;
     syncing = null;
+    recordSyncing = null;
+    recordSyncTimer = null;
+    recordSyncStopped = false;
     namedDetect = null;
     coldOperation = false;
     closing = false;
@@ -90,6 +95,7 @@ export class UserGroundHost {
                     watching: true,
                 };
                 this.converged = true;
+                this.scheduleRecordSync();
                 return evidence;
             },
         };
@@ -255,13 +261,13 @@ export class UserGroundHost {
             assertHealthyWatch(watch, workspaceId);
         }
         catch (error) {
-            this.coldOperation = false;
+            this.finishColdOperation();
             throw stageError("Watch coverage", error);
         }
         let rows = readRows(this.databasePath(identity));
         if (rows.some((row) => row.uuid === workspaceId)
             && this.cloudState.records.some((record) => record.uuid === workspaceId)) {
-            this.coldOperation = false;
+            this.finishColdOperation();
             return {
                 registered: true,
                 entityCount: descendantRows(rows, workspaceId).length,
@@ -307,7 +313,7 @@ export class UserGroundHost {
             throw stageError("entity registration or cloud publication", error);
         }
         finally {
-            this.coldOperation = false;
+            this.finishColdOperation();
         }
         try {
             this.ensureWatchers(identity);
@@ -344,6 +350,7 @@ export class UserGroundHost {
         // remain a later generation; flush never waits for global Watch silence.
         this.watchDirty = false;
         await this.syncNow();
+        await this.syncRecordsNow();
         if (!this.closing)
             this.ensureWatchers(identity);
     }
@@ -367,6 +374,32 @@ export class UserGroundHost {
         if (this.syncing)
             await this.syncing;
     }
+    scheduleRecordSync(delay = 0) {
+        if (this.closing || this.recordSyncStopped || this.recordSyncTimer)
+            return;
+        this.recordSyncTimer = setTimeout(() => {
+            this.recordSyncTimer = null;
+            void this.syncRecordsNow().then(() => {
+                if (!this.closing && !this.recordSyncStopped)
+                    this.scheduleRecordSync(RECORD_POLL_MS);
+            }).catch(() => {
+                if (!this.closing && !this.recordSyncStopped)
+                    this.scheduleRecordSync(RECORD_RETRY_MS);
+            });
+        }, delay);
+        this.recordSyncTimer.unref();
+    }
+    async syncRecordsNow() {
+        const identity = this.activeIdentity;
+        if (this.recordSyncStopped || !identity || !this.cloudState)
+            return;
+        if (!this.recordSyncing) {
+            this.recordSyncing = this.syncRecordQueues(identity).finally(() => {
+                this.recordSyncing = null;
+            });
+        }
+        await this.recordSyncing;
+    }
     async activateRuntimeTunnel(gatewayPort, runtimeToken) {
         // Files convergence and Watch/Detect own ground currency. Advertising an
         // HTTP tunnel must never trigger or wait for a second filesystem pass.
@@ -379,14 +412,23 @@ export class UserGroundHost {
     async close(options = {}) {
         if (options.catchUp === false) {
             this.closing = true;
+            this.recordSyncStopped = true;
             if (this.rescanTimer)
                 clearTimeout(this.rescanTimer);
             this.rescanTimer = null;
             this.rescanGenerationStartedAt = null;
+            if (this.recordSyncTimer)
+                clearTimeout(this.recordSyncTimer);
+            this.recordSyncTimer = null;
             this.watchHost.close({ catchUp: false });
             this.namedDetect?.close();
             this.namedDetect = null;
             await this.wire.close();
+            await this.recordSyncing?.catch(() => undefined);
+            // An upload already inside its retry helper may have reopened the wire
+            // after the first close. The stopped flag prevents new queue work; this
+            // second close seals that finite in-flight boundary.
+            await this.wire.close();
             return;
         }
         // Command shutdown is the last catch-up boundary. A filesystem callback
@@ -398,12 +440,17 @@ export class UserGroundHost {
             clearTimeout(this.rescanTimer);
         this.rescanTimer = null;
         this.rescanGenerationStartedAt = null;
+        if (this.recordSyncTimer)
+            clearTimeout(this.recordSyncTimer);
+        this.recordSyncTimer = null;
         // Full suspicion already contains every callback that could still be
         // queued. Retire physical coverage before the final observation so native
         // backends cannot continuously widen a finite shutdown pass. Changes
         // after this cutoff belong to the next startup blind interval.
         this.watchHost.close();
         await this.flushObservedChanges();
+        await this.syncRecordsNow();
+        this.recordSyncStopped = true;
         this.namedDetect?.close();
         this.namedDetect = null;
         await this.wire.close();
@@ -461,19 +508,17 @@ export class UserGroundHost {
                 if (readRows(database).length === 0)
                     return null;
                 const local = localValue(identity, userRoot, database);
-                if (!hasDetectedChanges(database))
+                if (!hasRecordsBeyondSnapshot(database))
                     return local;
                 if (!this.cloudState) {
                     throw new Error("pending local mutations have no accepted cloud baseline");
                 }
-                // The official local projection remains the accepted cloud graph;
-                // Detect's newer materialization is represented exactly once by its
-                // durable journal records. Returning that baseline prevents login
-                // convergence from overwriting saved-local work before Send accepts it.
+                // The cold graph snapshot is only a bootstrap image. Any retained
+                // outbox row proves this machine has materialized entity records after
+                // that image, whether those records are pending or already accepted.
                 return {
                     ...local,
-                    records: this.cloudState.records,
-                    pendingMutations: true,
+                    recordsBeyondSnapshot: true,
                 };
             },
             initialize: async () => {
@@ -777,6 +822,14 @@ export class UserGroundHost {
         }, delay);
         this.rescanTimer.unref();
     }
+    /** A finite cold command may suppress Detect while it owns publication, but
+     * it may never consume a Watch generation that arrived during that window. */
+    finishColdOperation() {
+        this.coldOperation = false;
+        if (!this.closing && (this.watchDirty || this.watchHost.hasPending)) {
+            this.scheduleRescan();
+        }
+    }
     async syncLocalChanges(identity) {
         if (!this.cloudState)
             throw new Error("cloud state is unavailable for user-ground Watch");
@@ -802,10 +855,11 @@ export class UserGroundHost {
                         durationMs: evidence.durationMs,
                         plannedRows: evidence.plannedRows,
                         records: evidence.records,
-                        journalBytes: evidence.journalBytes,
+                        recordBytes: evidence.recordBytes,
                     });
                 }
                 this.watchHost.settle(observations);
+                this.scheduleRecordSync();
                 return;
             }
         }
@@ -836,8 +890,15 @@ export class UserGroundHost {
         if (retry?.kind === "retry") {
             throw pipelineStageError("detection", new Error(retry.reasons.join("; ")));
         }
+        const authorityId = this.cloudState.resourceId;
+        const received = readEntityReceiveCursors(this.databasePath(identity), authorityId);
         const detectedRecords = detection.flatMap((plan) => plan.kind === "ready"
-            ? plan.proposals.map((proposal) => ({ mutationId: randomUUID(), proposal }))
+            ? plan.proposals.map((proposal) => ({
+                mutationId: randomUUID(),
+                authorityId,
+                lastSeenGlobalSequence: received.get(proposal.entityId) ?? 0,
+                proposal,
+            }))
             : []);
         commitDetectedState(this.databasePath(identity), {
             acceptedMaterializedRows,
@@ -848,15 +909,99 @@ export class UserGroundHost {
         });
         this.namedDetect?.refreshEnrollmentPolicy();
         this.watchHost.settle(observations);
+        this.scheduleRecordSync();
+    }
+    async syncRecordQueues(identity) {
+        if (this.recordSyncStopped)
+            return;
+        await this.receiveAcceptedRecords();
+        while (!this.recordSyncStopped) {
+            const selected = nextEntitySends(readOutbox(this.databasePath(identity)));
+            if (selected.length === 0)
+                break;
+            const sent = await Promise.allSettled(selected.map(async (row) => {
+                if (this.recordSyncStopped)
+                    return;
+                await this.uploadSnapshotContent(identity, row.record.authorityId, [row.record.change.result]);
+                if (this.recordSyncStopped)
+                    return;
+                const frame = await this.wire.request({
+                    type: "entity.record.submit",
+                    record_json: encodeEntityRecord(row.record),
+                }, ["entity.record.ack"]);
+                const accepted = decodeAcceptedEntityRecord(String(frame.record_json ?? ""));
+                stampOutboxAcceptance(this.databasePath(identity), row, accepted);
+            }));
+            const failed = sent.find((result) => result.status === "rejected");
+            if (failed)
+                throw pipelineStageError("entity record send", failed.reason);
+        }
+        if (!this.recordSyncStopped)
+            await this.receiveAcceptedRecords();
+    }
+    async receiveAcceptedRecords() {
+        const identity = this.activeIdentity;
+        const authorityId = this.cloudState?.resourceId;
+        if (!identity || !authorityId)
+            return;
+        const database = this.databasePath(identity);
+        while (!this.recordSyncStopped) {
+            const after = readAuthorityDeliveryCursor(database, authorityId);
+            const frame = await this.wire.request({
+                type: "entity.record.tail",
+                authority_id: authorityId,
+                after_delivery_sequence: after,
+                limit: RECORD_TAIL_LIMIT,
+            }, ["entity.record.tail-result"]);
+            const deliveries = decodeDeliveredRecords(frame.records);
+            if (this.recordSyncStopped)
+                return;
+            if (deliveries.length === 0)
+                return;
+            for (const delivery of deliveries) {
+                await this.receiveDelivery(database, authorityId, delivery);
+            }
+            if (deliveries.length < RECORD_TAIL_LIMIT)
+                return;
+        }
+    }
+    async receiveDelivery(database, authorityId, delivery) {
+        if (delivery.record.authorityId !== authorityId) {
+            throw new Error(`entity record authority ${delivery.record.authorityId} does not match ${authorityId}`);
+        }
+        let decision = storeReceivedRecord(database, delivery);
+        if (decision.kind === "gap") {
+            const frame = await this.wire.request({
+                type: "entity.record.entity-tail",
+                authority_id: authorityId,
+                entity_id: decision.entityId,
+                after_global_sequence: decision.after,
+                through_global_sequence: decision.received,
+            }, ["entity.record.entity-tail-result"]);
+            const missing = decodeDeliveredRecords(frame.records);
+            if (missing.length === 0) {
+                throw new Error(`entity ${decision.entityId} is missing sequence ${decision.after + 1}`);
+            }
+            for (const record of missing) {
+                decision = storeReceivedRecord(database, record);
+                if (decision.kind === "gap") {
+                    throw new Error(`entity ${decision.entityId} history remained gapped after backfill`);
+                }
+            }
+            decision = storeReceivedRecord(database, delivery);
+            if (decision.kind === "gap") {
+                throw new Error(`entity ${decision.entityId} history did not reach ${decision.received}`);
+            }
+        }
+        advanceAuthorityDeliveryCursor(database, authorityId, delivery.deliverySequence);
     }
     async publishPendingSnapshotsBeforeLookup(identity, resourceId) {
-        const pending = readJournal(this.databasePath(identity))
-            .filter((entry) => entry.kind === "entity.snapshot.replace");
+        const pending = readSnapshotPublications(this.databasePath(identity));
         if (pending.length === 0)
             return;
         const first = pending[0];
         if (first.resourceId !== resourceId) {
-            throw new Error("local snapshot journal belongs to a different user-ground resource");
+            throw new Error("local snapshot publication belongs to a different user-ground resource");
         }
         this.cloudState = {
             resourceId: first.resourceId,
@@ -889,8 +1034,7 @@ export class UserGroundHost {
         const checksum = sha256Hex(snapshotJson);
         if (checksum === state.checksum)
             return;
-        const pending = readJournal(this.databasePath(identity))
-            .filter((entry) => entry.kind === "entity.snapshot.replace");
+        const pending = readSnapshotPublications(this.databasePath(identity));
         const identical = pending.find((entry) => entry.resourceId === state.resourceId
             && entry.snapshotChecksum === checksum);
         if (identical) {
@@ -901,7 +1045,6 @@ export class UserGroundHost {
             throw new Error("a different graph snapshot is already pending publication");
         }
         appendSnapshotJournal(this.databasePath(identity), {
-            kind: "entity.snapshot.replace",
             mutationId: randomUUID(),
             resourceId: state.resourceId,
             authorityEpoch: state.authorityEpoch,
@@ -912,9 +1055,7 @@ export class UserGroundHost {
         await this.publishPendingSnapshots(identity);
     }
     async publishPendingSnapshots(identity) {
-        for (const pending of readJournal(this.databasePath(identity))) {
-            if (pending.kind !== "entity.snapshot.replace")
-                continue;
+        for (const pending of readSnapshotPublications(this.databasePath(identity))) {
             const snapshot = snapshotFromRecords(JSON.parse(pending.snapshotJson).records || []);
             const locallyMaterializedIds = new Set(readRows(this.databasePath(identity))
                 .map((row) => row.uuid));
@@ -956,6 +1097,15 @@ export class UserGroundHost {
     }
 }
 const sha256Hex = (input) => createHash("sha256").update(input).digest("hex");
+function encodedRecordBytes(authorityId, proposal, lastSeenGlobalSequence = 0) {
+    return Buffer.byteLength(encodeEntityRecord(createLocalEntityRecord({
+        mutationId: "00000000-0000-4000-8000-000000000000",
+        authorityId,
+        lastSeenGlobalSequence,
+        change: proposal,
+        createdAt: 0,
+    })));
+}
 function contentCacheFile(cacheDir, contentHash) {
     return join(cacheDir, `${contentHash}.bin`);
 }
@@ -1086,13 +1236,46 @@ function initializeDatabase(file) {
       filesystem_mode INTEGER,
       content_verified_at_ms REAL
     );
-    CREATE TABLE IF NOT EXISTS mutation_journal (
+    CREATE TABLE IF NOT EXISTS record_outbox (
+      local_sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+      mutation_id TEXT NOT NULL UNIQUE,
+      authority_id TEXT NOT NULL,
+      entity_id TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      status TEXT NOT NULL CHECK(status IN ('pending', 'accepted')),
+      global_sequence INTEGER,
+      created_at INTEGER NOT NULL,
+      accepted_at INTEGER,
+      CHECK((status = 'pending' AND global_sequence IS NULL AND accepted_at IS NULL)
+         OR (status = 'accepted' AND global_sequence > 0 AND accepted_at IS NOT NULL))
+    );
+    CREATE TABLE IF NOT EXISTS record_inbox (
+      authority_id TEXT NOT NULL,
+      entity_id TEXT NOT NULL,
+      global_sequence INTEGER NOT NULL CHECK(global_sequence > 0),
+      delivery_sequence INTEGER NOT NULL CHECK(delivery_sequence > 0),
+      mutation_id TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      received_at INTEGER NOT NULL,
+      PRIMARY KEY(entity_id, global_sequence),
+      UNIQUE(entity_id, mutation_id),
+      UNIQUE(authority_id, delivery_sequence)
+    );
+    CREATE TABLE IF NOT EXISTS entity_receive_cursors (
+      entity_id TEXT PRIMARY KEY,
+      authority_id TEXT NOT NULL,
+      received_through INTEGER NOT NULL CHECK(received_through >= 0)
+    );
+    CREATE TABLE IF NOT EXISTS authority_delivery_cursors (
+      authority_id TEXT PRIMARY KEY,
+      received_through INTEGER NOT NULL CHECK(received_through >= 0)
+    );
+    CREATE TABLE IF NOT EXISTS snapshot_publications (
       sequence INTEGER PRIMARY KEY AUTOINCREMENT,
       mutation_id TEXT NOT NULL UNIQUE,
       resource_id TEXT NOT NULL,
-      operation_kind TEXT NOT NULL,
-      operation_json TEXT NOT NULL,
-      created_at TEXT NOT NULL
+      publication_json TEXT NOT NULL,
+      created_at INTEGER NOT NULL
     );
     CREATE TABLE IF NOT EXISTS workspace_add_intents (
       workspace_uuid TEXT PRIMARY KEY,
@@ -1113,9 +1296,11 @@ function initializeDatabase(file) {
       ON detection_notebook(absolute_path);
     CREATE INDEX IF NOT EXISTS detection_notebook_by_physical_identity
       ON detection_notebook(device_number, inode);
-    CREATE INDEX IF NOT EXISTS mutation_journal_by_kind
-      ON mutation_journal(operation_kind);
+    CREATE INDEX IF NOT EXISTS record_outbox_pending
+      ON record_outbox(status, local_sequence);
   `);
+    database.exec("DROP INDEX IF EXISTS record_inbox_delivery");
+    database.exec("DROP TABLE IF EXISTS mutation_journal");
     return database;
 }
 function readGroundRows(file, table) {
@@ -1272,51 +1457,205 @@ function findKnownEntityId(file, absolutePath, deviceNumber, inode) {
         database.close();
     }
 }
-function readJournal(file) {
+function readOutbox(file) {
+    if (!existsSync(file))
+        return [];
+    const database = initializeDatabase(file);
+    try {
+        return database.prepare(`
+      SELECT local_sequence AS localSequence, record_json AS recordJson,
+             status, global_sequence AS globalSequence
+        FROM record_outbox WHERE status = 'pending' ORDER BY local_sequence
+    `).all().map((row) => ({
+            localSequence: row.localSequence,
+            record: decodeLocalEntityRecord(row.recordJson),
+            status: "pending",
+            globalSequence: null,
+        }));
+    }
+    finally {
+        database.close();
+    }
+}
+function readSnapshotPublications(file) {
     if (!existsSync(file))
         return [];
     const database = initializeDatabase(file);
     try {
         return database.prepare(`
       SELECT mutation_id AS mutationId, resource_id AS resourceId,
-             operation_kind AS kind, operation_json AS operationJson
-        FROM mutation_journal ORDER BY sequence
+             publication_json AS publicationJson
+        FROM snapshot_publications ORDER BY sequence
     `).all().map((row) => {
-            const operation = decodeMutationOperation(row.operationJson);
-            if (row.kind === "entity.snapshot.replace") {
-                return {
-                    kind: row.kind,
-                    mutationId: row.mutationId,
-                    resourceId: row.resourceId,
-                    authorityEpoch: Number(operation.authorityEpoch),
-                    baseVersion: Number(operation.baseVersion),
-                    snapshotChecksum: String(operation.snapshotChecksum),
-                    snapshotJson: String(operation.snapshotJson),
-                };
+            const publication = JSON.parse(row.publicationJson);
+            return {
+                mutationId: row.mutationId,
+                resourceId: row.resourceId,
+                authorityEpoch: Number(publication.authorityEpoch),
+                baseVersion: Number(publication.baseVersion),
+                snapshotChecksum: String(publication.snapshotChecksum),
+                snapshotJson: String(publication.snapshotJson),
+            };
+        });
+    }
+    finally {
+        database.close();
+    }
+}
+function readEntityReceiveCursor(file, authorityId, entityId) {
+    if (!existsSync(file))
+        return 0;
+    const database = initializeDatabase(file);
+    try {
+        const row = database.prepare(`
+      SELECT received_through AS receivedThrough
+        FROM entity_receive_cursors
+       WHERE authority_id = ? AND entity_id = ?
+    `).get(authorityId, entityId);
+        return row?.receivedThrough ?? 0;
+    }
+    finally {
+        database.close();
+    }
+}
+function readEntityReceiveCursors(file, authorityId) {
+    if (!existsSync(file))
+        return new Map();
+    const database = initializeDatabase(file);
+    try {
+        return new Map(database.prepare(`
+      SELECT entity_id AS entityId, received_through AS receivedThrough
+        FROM entity_receive_cursors WHERE authority_id = ?
+    `).all(authorityId)
+            .map((row) => [row.entityId, row.receivedThrough]));
+    }
+    finally {
+        database.close();
+    }
+}
+function readAuthorityDeliveryCursor(file, authorityId) {
+    if (!existsSync(file))
+        return 0;
+    const database = initializeDatabase(file);
+    try {
+        const row = database.prepare(`
+      SELECT received_through AS receivedThrough
+        FROM authority_delivery_cursors WHERE authority_id = ?
+    `).get(authorityId);
+        return row?.receivedThrough ?? 0;
+    }
+    finally {
+        database.close();
+    }
+}
+function decodeDeliveredRecords(value) {
+    if (!Array.isArray(value))
+        throw new Error("entity record tail did not return a records array");
+    return value.map((item) => {
+        if (item === null || typeof item !== "object") {
+            throw new Error("entity record tail contained a non-record delivery");
+        }
+        const delivered = item;
+        const deliverySequence = Number(delivered.delivery_sequence);
+        if (!Number.isSafeInteger(deliverySequence) || deliverySequence < 1
+            || typeof delivered.record_json !== "string") {
+            throw new Error("entity record delivery has invalid sequence or bytes");
+        }
+        return {
+            deliverySequence,
+            record: decodeAcceptedEntityRecord(delivered.record_json),
+        };
+    });
+}
+function stampOutboxAcceptance(file, row, accepted) {
+    const receipt = acceptOutboxRow(row, accepted);
+    if (receipt.status !== "accepted")
+        throw new Error("authority acknowledgement was not accepted");
+    const database = initializeDatabase(file);
+    try {
+        database.transaction(() => {
+            const updated = database.prepare(`
+        UPDATE record_outbox
+           SET status = 'accepted', global_sequence = ?, accepted_at = ?
+         WHERE mutation_id = ? AND status = 'pending'
+      `).run(accepted.globalSequence, accepted.acceptedAt, accepted.mutationId);
+            if (updated.changes === 1)
+                return;
+            const existing = database.prepare(`
+        SELECT status, global_sequence AS globalSequence
+          FROM record_outbox WHERE mutation_id = ?
+      `).get(accepted.mutationId);
+            if (existing?.status !== "accepted"
+                || existing.globalSequence !== accepted.globalSequence) {
+                throw new Error("outbox acknowledgement did not match its retained row");
             }
-            if (row.kind === "detected.change") {
-                return {
-                    kind: row.kind,
-                    mutationId: row.mutationId,
-                    resourceId: row.resourceId,
-                    proposal: operation.proposal,
-                };
+        })();
+    }
+    finally {
+        database.close();
+    }
+}
+function storeReceivedRecord(file, delivery) {
+    const database = initializeDatabase(file);
+    try {
+        return database.transaction(() => {
+            const cursor = database.prepare(`
+        SELECT authority_id AS authorityId, received_through AS receivedThrough
+          FROM entity_receive_cursors WHERE entity_id = ?
+      `).get(delivery.record.entityId);
+            if (cursor && cursor.authorityId !== delivery.record.authorityId) {
+                throw new Error(`entity ${delivery.record.entityId} cannot change authority channels`);
             }
-            throw new Error(`unknown mutation journal operation: ${String(row.kind)}`);
-        });
+            const existingRow = database.prepare(`
+        SELECT record_json AS recordJson FROM record_inbox
+         WHERE authority_id = ? AND entity_id = ? AND global_sequence = ?
+      `).get(delivery.record.authorityId, delivery.record.entityId, delivery.record.globalSequence);
+            const existing = existingRow
+                ? decodeAcceptedEntityRecord(existingRow.recordJson)
+                : null;
+            const decision = receiveEntityRecord(cursor?.receivedThrough ?? 0, delivery.record, existing);
+            if (decision.kind !== "insert")
+                return decision;
+            database.prepare(`
+        INSERT INTO record_inbox(
+          authority_id, entity_id, global_sequence, delivery_sequence,
+          mutation_id, record_json, received_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+      `).run(delivery.record.authorityId, delivery.record.entityId, delivery.record.globalSequence, delivery.deliverySequence, delivery.record.mutationId, encodeEntityRecord(delivery.record), Date.now());
+            database.prepare(`
+        INSERT INTO entity_receive_cursors(authority_id, entity_id, received_through)
+        VALUES (?, ?, ?)
+        ON CONFLICT(entity_id) DO UPDATE SET
+          received_through = excluded.received_through
+      `).run(delivery.record.authorityId, delivery.record.entityId, decision.receivedThrough);
+            return decision;
+        })();
+    }
+    finally {
+        database.close();
+    }
+}
+function advanceAuthorityDeliveryCursor(file, authorityId, deliverySequence) {
+    const database = initializeDatabase(file);
+    try {
+        database.prepare(`
+      INSERT INTO authority_delivery_cursors(authority_id, received_through)
+      VALUES (?, ?)
+      ON CONFLICT(authority_id) DO UPDATE SET
+        received_through = MAX(received_through, excluded.received_through)
+    `).run(authorityId, deliverySequence);
     }
     finally {
         database.close();
     }
 }
-function hasDetectedChanges(file) {
+function hasRecordsBeyondSnapshot(file) {
     if (!existsSync(file))
         return false;
     const database = initializeDatabase(file);
     try {
         return database.prepare(`
-      SELECT 1 AS present FROM mutation_journal
-       WHERE operation_kind = 'detected.change' LIMIT 1
+      SELECT 1 AS present FROM record_outbox LIMIT 1
     `).get() !== undefined;
     }
     finally {
@@ -1325,19 +1664,27 @@ function hasDetectedChanges(file) {
 }
 /** Record is the SQLite transaction that accepts Detect's exact proposals and
  * advances the last-verified notebook. Watch may settle only after this
- * function returns. The mutation journal is the one durable queue. */
+ * function returns. The record table is the local-only outbox. */
 function commitDetectedState(file, input) {
     const database = initializeDatabase(file);
     try {
         database.transaction(() => {
             const append = database.prepare(`
-        INSERT INTO mutation_journal(
-          mutation_id, resource_id, operation_kind, operation_json, created_at
-        ) VALUES (?, ?, ?, ?, ?)
+        INSERT INTO record_outbox(
+          mutation_id, authority_id, entity_id, record_json, status,
+          global_sequence, created_at, accepted_at
+        ) VALUES (?, ?, ?, ?, 'pending', NULL, ?, NULL)
       `);
             for (const entry of input.proposals ?? []) {
-                const proposal = entry.proposal;
-                append.run(entry.mutationId, String(proposal.resourceId ?? ""), "detected.change", encodeMutationOperation({ proposal: entry.proposal }), new Date().toISOString());
+                const createdAt = Date.now();
+                const record = createLocalEntityRecord({
+                    mutationId: entry.mutationId,
+                    authorityId: entry.authorityId,
+                    lastSeenGlobalSequence: entry.lastSeenGlobalSequence,
+                    change: entry.proposal,
+                    createdAt,
+                });
+                append.run(record.mutationId, record.authorityId, record.entityId, encodeEntityRecord(record), createdAt);
             }
             const remove = database.prepare("DELETE FROM detection_notebook WHERE uuid = ?");
             const removeMaterialized = database.prepare("DELETE FROM entities WHERE uuid = ?");
@@ -1362,15 +1709,15 @@ function appendSnapshotJournal(file, entry) {
     const database = initializeDatabase(file);
     try {
         database.prepare(`
-      INSERT INTO mutation_journal(
-        mutation_id, resource_id, operation_kind, operation_json, created_at
-      ) VALUES (?, ?, ?, ?, ?)
-    `).run(entry.mutationId, entry.resourceId, entry.kind, stableJson({
+      INSERT INTO snapshot_publications(
+        mutation_id, resource_id, publication_json, created_at
+      ) VALUES (?, ?, ?, ?)
+    `).run(entry.mutationId, entry.resourceId, stableJson({
             authorityEpoch: entry.authorityEpoch,
             baseVersion: entry.baseVersion,
             snapshotChecksum: entry.snapshotChecksum,
             snapshotJson: entry.snapshotJson,
-        }), new Date().toISOString());
+        }), Date.now());
     }
     finally {
         database.close();
@@ -1379,7 +1726,7 @@ function appendSnapshotJournal(file, entry) {
 function deleteJournalEntry(file, mutationId) {
     const database = initializeDatabase(file);
     try {
-        database.prepare("DELETE FROM mutation_journal WHERE mutation_id = ?").run(mutationId);
+        database.prepare("DELETE FROM snapshot_publications WHERE mutation_id = ?").run(mutationId);
     }
     finally {
         database.close();
@@ -1758,7 +2105,7 @@ async function reconcileGround(input) {
             durationMs: performance.now() - started,
             plannedRows: proposals.length,
             records: proposals.length,
-            journalBytes: proposals.reduce((bytes, proposal) => bytes + Buffer.byteLength(encodeMutationOperation({ proposal })), 0),
+            recordBytes: proposals.reduce((bytes, proposal) => bytes + encodedRecordBytes(parameters.resourceId, proposal), 0),
         });
         // Each root commits its local projection before Detect yields. Native
         // callbacks can therefore preserve new suspicion between large roots.
@@ -1832,12 +2179,9 @@ async function reconcileRoot(input) {
         return [[local, row]];
     }));
     const registeredBoundaries = input.registeredBoundaries ?? new Map();
-    const completeRepositoryEvidence = existingRows.every((row) => row.type !== "repo.git"
-        || (Boolean(row.payloadVersion) && Boolean(row.transportVersion)));
     if (suspects !== null
         && suspects.length === 0
-        && existingRows.length > 0
-        && completeRepositoryEvidence) {
+        && existingRows.length > 0) {
         const rows = existingRows.map((row) => ({
             record: portableRecord(row),
             relativePath: row.relativePath,