@bjornpagen/bumbledb-log 0.19.2 → 0.20.0

package/src/writer.ts

@@ -17,10 +17,16 @@ import * as crypto from "node:crypto"
 import * as fs from "node:fs/promises"
 import * as path from "node:path"
 import {
+	type Admission,
 	type Fact,
+	type FactValue,
 	type FreshKeys,
+	type FreshRange,
 	internalBlake3,
+	type LogCodecHandle,
 	type MemberRelation,
+	type MutationReport,
+	rowOf,
 	type SchemaRelations,
 	type Violation
 } from "@bjornpagen/bumbledb"
@@ -31,10 +37,20 @@ import { bytesEqual, checkedAddU64, digest32, utf8Encoder, utf8StrictDecoder } f
 import { chainSum } from "#chain.ts"
 import type { Op } from "#codec.ts"
 import { decodeBatch, encodeBatch } from "#codec.ts"
-import type { Braid, RelationInfo } from "#descriptor.ts"
+import type { Braid, RelationInfo, Theory } from "#descriptor.ts"
 import { descriptorOf } from "#descriptor.ts"
-import { ErrSpanningCommit, refuseExhausted, refuseOverWidth, refuseSlotRetired, throwContention } from "#errors.ts"
-import type { Generation } from "#keys.ts"
+import {
+	ErrRefillNeeded,
+	ErrSpanningCommit,
+	refillNeededOf,
+	refuse,
+	refuseExhausted,
+	refuseOverWidth,
+	refuseSlotRetired,
+	throwContention,
+	throwRefillNeeded
+} from "#errors.ts"
+import type { Generation, StoreKey } from "#keys.ts"
 import {
 	CKPT_SCRATCH_LEASE,
 	checkpointMdbKey,
@@ -68,12 +84,14 @@ import {
 	withGate
 } from "#replica.ts"
 import type { ObjectStore } from "#store.ts"
-import type { Value } from "#value.ts"
-import { checkAgainst } from "#value.ts"
 
 /** 10 owns the width: one CAS amortizes counter traffic 4096× below slot traffic. */
 const LEASE_WIDTH = 4096n
-const ID_LEASE_COUNTER = regex("^\\d+$")
+
+/** The counter body's one grammar (`conformance/v3/counter/`): a
+ *  canonical u64 decimal — no sign, no leading zero, no trailing bytes. */
+const ID_LEASE_COUNTER = regex("^(?:0|[1-9][0-9]*)$")
+const U64_MAX = 0xffffffffffffffffn
 
 /** The live-loss bound (60): consecutive losses at the live tip, history never counts. */
 const LOSS_BOUND = 16
@@ -85,43 +103,55 @@ const BATCH_MAGIC = utf8Encoder.encode("BDBL")
 
 type Durability = "published" | "local-pending"
 
-type Commit<Rels extends SchemaRelations, R> =
-	| {
-			readonly tag: "accepted"
-			readonly value: R
-			readonly braid: Braid
-			readonly generation: Generation
-			readonly durability: Durability
-	  }
-	| { readonly tag: "rejected"; readonly violations: readonly Violation<Rels>[] }
-
-type BraidOutcome<Rels extends SchemaRelations> =
-	| {
-			readonly tag: "accepted"
-			readonly braid: Braid
-			readonly generation: Generation
-			readonly durability: Durability
-	  }
-	| { readonly tag: "rejected"; readonly braid: Braid; readonly violations: readonly Violation<Rels>[] }
-
-interface CommitSplit<Rels extends SchemaRelations, R> {
+/** Where an accepted commit landed on its braid: the slot (the braid
+ *  position — never the store-wide sum) and how durable the batch is. */
+interface Landing {
+	readonly slot: Generation
+	readonly durability: Durability
+}
+
+/** The accepted payload of `commit`: the body's value plus the landing. */
+interface CommitReceipt<R> extends Landing {
 	readonly value: R
-	readonly outcomes: readonly BraidOutcome<Rels>[]
+	readonly braid: Braid
 }
 
+/** The empty commit is not a commit: a body that records no ops names no
+ *  braid, so the refusal is its own outcome — never a slot, never a
+ *  thrown surprise. The body's value rides out, the way an abandoned
+ *  write's payload does in the engine. */
+interface EmptyCommit<R> {
+	readonly tag: "empty"
+	readonly value: R
+}
+
+/** The engine's Admission sum carrying the log's receipt in its accepted
+ *  arm; the rejected arm is the engine's violations, shell and payload. */
+type Commit<Rels extends SchemaRelations, R> = Admission<Rels, CommitReceipt<R>> | EmptyCommit<R>
+
+/** One braid's verdict inside a split commit: the engine's Admission
+ *  carrying the landing, beside the braid it judged. */
+interface BraidOutcome<Rels extends SchemaRelations> {
+	readonly braid: Braid
+	readonly admission: Admission<Rels, Landing>
+}
+
+type CommitSplit<Rels extends SchemaRelations, R> =
+	| { readonly tag: "split"; readonly value: R; readonly outcomes: readonly BraidOutcome<Rels>[] }
+	| EmptyCommit<R>
+
 /**
- * The recorder: typed inserts and deletes as raw-valued ops, `reserve`
- * drawing on the id lease (10) — reservations never appear in the log;
- * the resulting inserts carry concrete values. Pure and synchronous.
+ * The recorder: the engine `WriteTx`'s write surface, verbatim — insert,
+ * delete, and reserve carry the engine's own signatures, so a write-only
+ * body typechecks against both dialects. `contains`/`get` are absent by
+ * law: the journaled dialect is a pure recorder, and change is judged at
+ * commit, so a report's `changed` is 0n at record time. Reservations
+ * never appear in the log; the resulting inserts carry concrete values.
  */
 interface Batch<Rels extends SchemaRelations> {
-	insert<Rel extends MemberRelation<Rels>>(relation: Rel, facts: Iterable<Fact<Rel>>): void
-	delete<Rel extends MemberRelation<Rels>>(relation: Rel, facts: Iterable<Fact<Rel>>): void
-	reserve<Rel extends MemberRelation<Rels>>(
-		relation: Rel,
-		field: FreshKeys<Rel> & string,
-		count: bigint
-	): readonly bigint[]
+	insert<Rel extends MemberRelation<Rels>>(relation: Rel, facts: Iterable<Fact<Rel>>): MutationReport
+	delete<Rel extends MemberRelation<Rels>>(relation: Rel, facts: Iterable<Fact<Rel>>): MutationReport
+	reserve<Rel extends MemberRelation<Rels>>(relation: Rel, field: FreshKeys<Rel> & string, count: bigint): FreshRange
 }
 
 /** Ownership of a slot, read from the winner's header. */
@@ -190,7 +220,63 @@ function remainingOf(state: WriterState, relation: number, field: number): bigin
 	return remaining
 }
 
-function drawIds(state: WriterState, relation: number, field: number, count: bigint): bigint[] {
+/** The zero draw is the absence of a range (the engine's ruling). */
+const EMPTY_RANGE: FreshRange = Object.freeze({
+	empty: true,
+	count: 0n,
+	at(_index: bigint) {
+		return undefined
+	},
+	*[Symbol.iterator](): IterableIterator<bigint> {}
+})
+
+/** A drawn range as the engine's FreshRange value: contiguous, frozen. */
+function drawnRange(start: bigint, endExclusive: bigint): FreshRange {
+	const count = endExclusive - start
+	return Object.freeze({
+		empty: false,
+		start,
+		endExclusive,
+		count,
+		at(index: bigint) {
+			if (index < 0n || index >= count) {
+				return undefined
+			}
+			return start + index
+		},
+		*[Symbol.iterator](): IterableIterator<bigint> {
+			for (let id = start; id < endExclusive; id++) {
+				yield id
+			}
+		}
+	})
+}
+
+/** Untouched full-width blocks pooled for the key: the record loop's
+ *  guarantee unit — k full blocks serve any k draws, each at most one
+ *  width, whatever tails the draws abandon. */
+function fullBlocksOf(state: WriterState, relation: number, field: number): number {
+	const pool = state.pools.get(poolKey(relation, field)) ?? []
+	let full = 0
+	for (const range of pool) {
+		if (range.end - range.next >= LEASE_WIDTH) {
+			full += 1
+		}
+	}
+	return full
+}
+
+/** `Lease.draw(count)` = OverWidth | Exhausted | Drawn, the log-Rust
+ *  algebra: Exhausted names the u64 ceiling ONLY; a draw the pooled
+ *  tail cannot serve abandons the tail (unique, never dense) and falls
+ *  to the next block, and an empty pool signals a refill. */
+function drawIds(
+	state: WriterState,
+	draws: Map<string, number>,
+	relation: number,
+	field: number,
+	count: bigint
+): FreshRange {
 	if (count < 0n) {
 		throw errors.new(`id-lease count is unsigned: ${count}`)
 	}
@@ -198,31 +284,55 @@ function drawIds(state: WriterState, relation: number, field: number, count: big
 		refuseOverWidth({ requested: count }, `id-lease draw ${count} exceeds the lease width ${LEASE_WIDTH}`)
 	}
 	if (count === 0n) {
-		return []
-	}
-	const pool = state.pools.get(poolKey(relation, field)) ?? []
-	const range = pool[0]
-	if (range === undefined || range.end - range.next < count) {
-		refuseExhausted(
-			{ relation, field },
-			`id-lease relation ${relation} field ${field} cannot draw ${count} from the cached block`
-		)
+		return EMPTY_RANGE
+	}
+	const key = poolKey(relation, field)
+	const drawn = (draws.get(key) ?? 0) + 1
+	draws.set(key, drawn)
+	const pool = state.pools.get(key) ?? []
+	while (pool.length > 0) {
+		const range = pool[0]
+		if (range === undefined) {
+			break
+		}
+		const end = checkedAddU64(range.next, count)
+		if (end === undefined) {
+			refuseExhausted({ relation, field }, `id-lease relation ${relation} field ${field} would leave u64`)
+		}
+		if (end <= range.end) {
+			const start = range.next
+			range.next = end
+			if (range.next >= range.end) {
+				pool.shift()
+			}
+			return drawnRange(start, end)
+		}
+		pool.shift()
 	}
-	if (checkedAddU64(range.next, count) === undefined) {
-		refuseExhausted({ relation, field }, `id-lease relation ${relation} field ${field} would leave u64`)
+	throwRefillNeeded(
+		{ relation, field, requested: count },
+		`id-lease relation ${relation} field ${field} pool cannot serve ${count}`
+	)
+}
+
+/** The counter parse: canonical decimal within u64 or a typed Counter
+ *  refusal — leading zeros, signs, trailing bytes, non-UTF-8, and
+ *  values past u64 all refuse under the one pinned identity. */
+function parseCounter(key: StoreKey, bytes: Uint8Array): bigint {
+	const decoded = errors.trySync(function decodeCounter() {
+		return utf8StrictDecoder.decode(bytes)
+	})
+	if (decoded.error) {
+		refuse({ kind: "Counter", key }, `id-lease counter ${key} body is not UTF-8`)
 	}
-	const ids: bigint[] = []
-	let remaining = count
-	while (remaining > 0n && range.next < range.end) {
-		ids.push(range.next)
-		range.next += 1n
-		remaining -= 1n
+	if (!ID_LEASE_COUNTER.test(decoded.data)) {
+		refuse({ kind: "Counter", key }, `id-lease counter ${key} body is not a canonical decimal`)
 	}
-	if (range.next >= range.end) {
-		pool.shift()
+	const value = BigInt(decoded.data)
+	if (value > U64_MAX) {
+		refuse({ kind: "Counter", key }, `id-lease counter ${key} value leaves u64`)
 	}
-	state.pools.set(poolKey(relation, field), pool)
-	return ids
+	return value
 }
 
 /** `ids/{relation}/{field}`: birth claims [0, width); every later lease CAS-increments. */
@@ -243,11 +353,7 @@ async function acquireLease<Rels extends SchemaRelations>(
 			}
 			continue
 		}
-		const body = utf8StrictDecoder.decode(fetched.bytes)
-		if (!ID_LEASE_COUNTER.test(body)) {
-			throw errors.new(`id-lease counter ${key} is not a canonical decimal: ${body}`)
-		}
-		const next = BigInt(body)
+		const next = parseCounter(key, fetched.bytes)
 		const end = checkedAddU64(next, LEASE_WIDTH)
 		if (end === undefined) {
 			refuseExhausted({ relation, field }, `id-lease relation ${relation} field ${field} would leave u64`)
@@ -283,44 +389,10 @@ interface Recording {
 	readonly ops: Op[]
 }
 
-function lowerFact<Rels extends SchemaRelations>(
-	core: Core<Rels>,
-	info: RelationInfo,
-	fact: Record<string, unknown>
-): Value[] {
-	return info.fields.map(function lowerCell(field) {
-		const raw = fact[field.name]
-		if (raw === undefined) {
-			throw errors.new(`relation ${info.name}: fact is missing field ${field.name}`)
-		}
-		let value: Value
-		if (field.closedRef !== undefined) {
-			if (typeof raw !== "string") {
-				throw errors.new(`relation ${info.name} field ${field.name}: expected a ${field.closedRef} handle name`)
-			}
-			const roster = core.descriptor.relationByName.get(field.closedRef)
-			const id = roster?.handles.indexOf(raw) ?? -1
-			if (id === -1) {
-				throw errors.new(`relation ${info.name} field ${field.name}: "${raw}" is not in the ${field.closedRef} roster`)
-			}
-			value = BigInt(id)
-		} else if (typeof raw === "object" && raw !== null && !(raw instanceof Uint8Array)) {
-			const interval = raw as { start?: unknown; end?: unknown }
-			if (typeof interval.start !== "bigint" || typeof interval.end !== "bigint") {
-				throw errors.new(`relation ${info.name} field ${field.name}: expected an interval of bigints`)
-			}
-			value = { start: interval.start, end: interval.end }
-		} else {
-			value = raw as Value
-		}
-		checkAgainst(`relation ${info.name} field ${field.name}`, field.type, value)
-		return value
-	})
-}
-
 function recorderOf<Rels extends SchemaRelations>(
 	core: Core<Rels>,
-	state: WriterState
+	state: WriterState,
+	draws: Map<string, number>
 ): { batch: Batch<Rels>; recording: Recording } {
 	const recording: Recording = { ops: [] }
 	function infoOf(name: string): RelationInfo {
@@ -333,23 +405,28 @@ function recorderOf<Rels extends SchemaRelations>(
 		}
 		return info
 	}
-	function record(op: "insert" | "delete", relationName: string, facts: Iterable<unknown>): void {
-		const info = infoOf(relationName)
-		const rows: Value[][] = []
+	// The cell judge is the engine's `rowOf` — one marshal per language.
+	// The recorder applies nothing, so `changed` is 0n: change is judged
+	// at commit, when the recording meets the store.
+	function record<Rel extends MemberRelation<Rels>>(
+		op: "insert" | "delete",
+		relation: Rel,
+		facts: Iterable<Fact<Rel>>
+	): MutationReport {
+		const info = infoOf(relation.name)
+		const rows: FactValue[][] = []
 		for (const fact of facts) {
-			if (typeof fact !== "object" || fact === null) {
-				throw errors.new(`relation ${relationName}: a fact is not an object`)
-			}
-			rows.push(lowerFact(core, info, fact as Record<string, unknown>))
+			rows.push(rowOf(relation.data, fact))
 		}
-		recording.ops.push({ op, relation: relationName, rows })
+		recording.ops.push({ op, relation: info.name, rows })
+		return Object.freeze({ submitted: BigInt(rows.length), changed: 0n })
 	}
 	const batch: Batch<Rels> = {
 		insert(relation, facts) {
-			record("insert", relation.name, facts)
+			return record("insert", relation, facts)
 		},
 		delete(relation, facts) {
-			record("delete", relation.name, facts)
+			return record("delete", relation, facts)
 		},
 		reserve(relation, field, count) {
 			const info = infoOf(relation.name)
@@ -360,24 +437,51 @@ function recorderOf<Rels extends SchemaRelations>(
 			if (declared === undefined || !declared.fresh) {
 				throw errors.new(`relation ${relation.name}: field ${field} is not a fresh cell`)
 			}
-			return drawIds(state, info.id, ordinal, count)
+			return drawIds(state, draws, info.id, ordinal, count)
 		}
 	}
 	return { batch, recording }
 }
 
-/** Runs the recording body exactly once. The body is awaited to
- *  completion before the batch is sealed; reserve draws from the
- *  cached block (OverWidth | Exhausted | Drawn). */
+/** Runs the recording body against the cached pool. A draw the pool
+ *  cannot serve discards the attempt's recording, leases fresh blocks —
+ *  one full block per draw the attempt made on the starved key — and
+ *  runs the body again: the refill is a path, not an exhaustion
+ *  (Exhausted names the u64 ceiling only). Ids drawn by a discarded
+ *  attempt are abandoned — unique, never dense. Draw counts rise
+ *  strictly between refills of one key, so a body with finitely many
+ *  draws settles; a recurring signature screams. */
 async function recordWithLeases<Rels extends SchemaRelations, R>(
 	core: Core<Rels>,
 	state: WriterState,
 	body: (batch: Batch<Rels>) => R | Promise<R>
 ): Promise<{ value: R; ops: Op[] }> {
 	await ensureFreshLeases(core, state)
-	const { batch, recording } = recorderOf(core, state)
-	const value = await body(batch)
-	return { value, ops: recording.ops }
+	for (;;) {
+		const draws = new Map<string, number>()
+		const { batch, recording } = recorderOf(core, state, draws)
+		const ran = await errors.try(
+			(async function runBody() {
+				return body(batch)
+			})()
+		)
+		if (!ran.error) {
+			return { value: ran.data, ops: recording.ops }
+		}
+		if (!errors.is(ran.error, ErrRefillNeeded)) {
+			throw ran.error
+		}
+		const need = refillNeededOf(ran.error)
+		if (need === undefined) {
+			throw ran.error
+		}
+		// Draws this attempt made on the starved key, the missed one included.
+		const drawn = draws.get(poolKey(need.relation, need.field)) ?? 0
+		state.scream.attempt(`id-lease refill relation ${need.relation} field ${need.field} draws ${drawn}`)
+		while (fullBlocksOf(state, need.relation, need.field) < drawn) {
+			await acquireLease(core, state, need.relation, need.field)
+		}
+	}
 }
 
 function braidsTouched<Rels extends SchemaRelations>(core: Core<Rels>, ops: readonly Op[]): Map<Braid, Op[]> {
@@ -407,7 +511,9 @@ function u64leAt(bytes: Uint8Array, at: number): bigint | undefined {
 }
 
 /** The usurper is a fact in the header. A body that refuses to decode
- *  does not hide the slot's owner. */
+ *  does not hide the slot's owner. The Rust writer machine sniffs the
+ *  same fixed offset (`writer/loss.rs`); the batch grammar itself has
+ *  one reader — the codec seat. */
 function headerWriter(bytes: Uint8Array): bigint | undefined {
 	if (bytes.length < BATCH_MAGIC.length || !bytesEqual(bytes.subarray(0, BATCH_MAGIC.length), BATCH_MAGIC)) {
 		return undefined
@@ -415,10 +521,6 @@ function headerWriter(bytes: Uint8Array): bigint | undefined {
 	return u64leAt(bytes, WRITER_AT)
 }
 
-function headerTimestamp(bytes: Uint8Array): bigint | undefined {
-	return u64leAt(bytes, WRITER_AT + 8)
-}
-
 /** Header prev is 32 branded bytes. */
 function digestPrev(prev: Digest32 | Uint8Array): Digest32 {
 	return digest32(prev)
@@ -484,7 +586,7 @@ async function publishPending<Rels extends SchemaRelations>(
 	core: Core<Rels>,
 	state: WriterState,
 	ops: readonly Op[]
-): Promise<Commit<Rels, undefined>> {
+): Promise<Admission<Rels, Landing>> {
 	let losses = 0
 	for (;;) {
 		const pending = pendingOf(core)
@@ -494,39 +596,38 @@ async function publishPending<Rels extends SchemaRelations>(
 		const braid = pending.braid
 		// The floor is a write precondition: a slot at or below it is
 		// retired. A create must not touch the store (70/116/127).
-		if (belowFloor(core, braid, pending.gen)) {
-			refuseSlotRetired({ braid, slot: pending.gen }, "the slot is retired")
+		if (belowFloor(core, braid, pending.slot)) {
+			refuseSlotRetired({ braid, slot: pending.slot }, "the slot is retired")
 		}
-		const created = await core.store.putCreate(logKey(core.prefix, braid, pending.gen), pending.bytes)
+		const created = await core.store.putCreate(logKey(core.prefix, braid, pending.slot), pending.bytes)
 		let winnerBytes: Uint8Array | null = null
 		if (created.tag !== "created") {
-			const fetched = await core.store.get(logKey(core.prefix, braid, pending.gen))
+			const fetched = await core.store.get(logKey(core.prefix, braid, pending.slot))
 			if (fetched === null) {
 				// Exists then null: the occupant was swept. Refuse
 				// rather than loop back into putCreate.
-				refuseSlotRetired({ braid, slot: pending.gen }, "the slot is retired")
+				refuseSlotRetired({ braid, slot: pending.slot }, "the slot is retired")
 			}
 			if (!bytesEqual(fetched.bytes, pending.bytes)) {
 				winnerBytes = fetched.bytes
 			}
 		}
 		if (winnerBytes === null) {
-			const timestamp = headerTimestamp(pending.bytes)
-			if (timestamp === undefined) {
-				throw errors.new("pending batch header is shorter than the fixed layout")
+			if (pending.ts === null) {
+				throw errors.new("publish reached with an undecoded pending timestamp")
 			}
 			entriesOf(core).set(braid, {
-				g: pending.gen,
+				g: pending.slot,
 				prev: digest32(new Uint8Array(internalBlake3(pending.bytes))),
-				ts: timestamp
+				ts: pending.ts
 			})
 			await clearPending(core)
-			return { tag: "accepted", value: undefined, braid, generation: pending.gen, durability: "published" }
+			return { tag: "accepted", value: { slot: pending.slot, durability: "published" } }
 		}
 
 		losses += 1
 		state.scream.attempt("slot occupant is not ours")
-		noteDeposition(state, braid, pending.gen, winnerBytes)
+		noteDeposition(state, braid, pending.slot, winnerBytes)
 		await discardAndReopen(core)
 		const before = generationOf(core)
 		const rejudged = applyOps(core, ops)
@@ -539,13 +640,7 @@ async function publishPending<Rels extends SchemaRelations>(
 		}
 		if (rejudged.value.generation === before) {
 			await clearPending(core)
-			return {
-				tag: "accepted",
-				value: undefined,
-				braid,
-				generation: chainEntry(core, braid).g,
-				durability: "published"
-			}
+			return { tag: "accepted", value: { slot: chainEntry(core, braid).g, durability: "published" } }
 		}
 		const tip = chainEntry(core, braid)
 		entriesOf(core).set(braid, { g: tip.g, prev: digestPrev(tip.prev), ts: tip.ts })
@@ -564,13 +659,12 @@ async function disciplineCommit<Rels extends SchemaRelations>(
 	state: WriterState,
 	braid: Braid,
 	ops: readonly Op[]
-): Promise<Commit<Rels, undefined>> {
+): Promise<Admission<Rels, Landing>> {
 	const entry = chainEntry(core, braid)
 	const timestamp = maxBigint(BigInt(Date.now()), entry.ts)
 	const bytes = encodeBatch(
 		core.descriptor,
 		{
-			fingerprint: digest32(core.descriptor.fingerprintBytes),
 			braid,
 			braidGen: generation(entry.g + 1n),
 			prev: digestPrev(entry.prev),
@@ -580,7 +674,7 @@ async function disciplineCommit<Rels extends SchemaRelations>(
 		ops
 	)
 	// Pending → durable, before any apply.
-	holdPending(core, { braid, gen: generation(entry.g + 1n), bytes }, ops)
+	holdPending(core, { braid, slot: generation(entry.g + 1n), bytes }, ops, timestamp)
 	await persistSidecar(core)
 
 	const before = generationOf(core)
@@ -591,7 +685,7 @@ async function disciplineCommit<Rels extends SchemaRelations>(
 	}
 	if (outcome.value.generation === before) {
 		await clearPending(core)
-		return { tag: "accepted", value: undefined, braid, generation: entry.g, durability: "published" }
+		return { tag: "accepted", value: { slot: entry.g, durability: "published" } }
 	}
 	return publishPending(core, state, ops)
 }
@@ -612,7 +706,7 @@ async function settleInheritedPending<Rels extends SchemaRelations>(
 			generationOf(core),
 			null,
 			pending.bytes,
-			belowFloor(core, pending.braid, pending.gen)
+			belowFloor(core, pending.braid, pending.slot)
 		).tag === "below-floor"
 	) {
 		await clearPending(core)
@@ -628,6 +722,13 @@ async function settleInheritedPending<Rels extends SchemaRelations>(
 			return
 		}
 		ops = decoded.data.ops
+		// The decoded arm re-holds so publish reads the header facts once.
+		holdPending(
+			core,
+			{ braid: pending.braid, slot: pending.slot, bytes: pending.bytes },
+			ops,
+			decoded.data.header.timestamp
+		)
 	}
 	const published = await publishPending(core, state, ops)
 	if (published.tag === "rejected") {
@@ -689,7 +790,7 @@ async function releaseScratch(dir: string): Promise<void> {
 async function casPublish(
 	store: ObjectStore,
 	prefix: string,
-	known: ReadonlySet<Braid>,
+	codec: LogCodecHandle,
 	candidate: CheckpointFacts,
 	digest: Digest32,
 	bytes: Uint8Array
@@ -716,7 +817,7 @@ async function casPublish(
 				return { tag: "refused", reason: "checkpoint-doc-missing" }
 			}
 			const incumbentDoc = errors.trySync(function parseIncumbent() {
-				return parseCheckpoint(doc.bytes, known)
+				return parseCheckpoint(codec, doc.bytes)
 			})
 			if (incumbentDoc.error) {
 				return { tag: "refused", reason: "checkpoint" }
@@ -745,17 +846,18 @@ async function publishCheckpoint(
 	store: ObjectStore,
 	prefix: string,
 	dir: string,
-	known: ReadonlySet<Braid>,
+	theory: Theory,
 	candidate: CheckpointFacts,
 	mdb: Uint8Array
 ): Promise<Published> {
-	const bytes = renderCheckpoint(candidate)
+	const codec = descriptorOf(theory).codec
+	const bytes = renderCheckpoint(codec, candidate)
 	const digest = digest32(new Uint8Array(internalBlake3(bytes)))
 	await claimScratch(dir, digest)
 	const ran = await errors.try(
 		(async function publish() {
 			await putCreateOnce(store, checkpointMdbKey(prefix, digest), mdb)
-			return await casPublish(store, prefix, known, candidate, digest, bytes)
+			return await casPublish(store, prefix, codec, candidate, digest, bytes)
 		})()
 	)
 	if (ran.error) {
@@ -812,7 +914,7 @@ async function writerOn<Rels extends SchemaRelations>(replica: Replica<Rels>): P
 			return withGate(core, async function commitBody() {
 				const recorded = await recordWithLeases(core, state, body)
 				if (recorded.ops.length === 0) {
-					throw errors.new("commit recorded no ops — an empty transaction names no braid")
+					return { tag: "empty" as const, value: recorded.value }
 				}
 				const partitioned = braidsTouched(core, recorded.ops)
 				if (partitioned.size > 1) {
@@ -823,7 +925,10 @@ async function writerOn<Rels extends SchemaRelations>(replica: Replica<Rels>): P
 				if (outcome.tag === "rejected") {
 					return outcome
 				}
-				return { ...outcome, value: recorded.value }
+				return {
+					tag: "accepted" as const,
+					value: { value: recorded.value, braid, slot: outcome.value.slot, durability: outcome.value.durability }
+				}
 			})
 		},
 
@@ -831,24 +936,15 @@ async function writerOn<Rels extends SchemaRelations>(replica: Replica<Rels>): P
 			return withGate(core, async function splitBody() {
 				const recorded = await recordWithLeases(core, state, body)
 				if (recorded.ops.length === 0) {
-					throw errors.new("commitSplit recorded no ops — an empty transaction names no braid")
+					return { tag: "empty" as const, value: recorded.value }
 				}
 				const partitioned = braidsTouched(core, recorded.ops)
 				const outcomes: BraidOutcome<Rels>[] = []
 				for (const [braid, ops] of partitioned) {
-					const outcome = await disciplineCommit(core, state, braid, ops)
-					if (outcome.tag === "rejected") {
-						outcomes.push({ tag: "rejected", braid, violations: outcome.violations })
-					} else {
-						outcomes.push({
-							tag: "accepted",
-							braid: outcome.braid,
-							generation: outcome.generation,
-							durability: outcome.durability
-						})
-					}
+					const admission = await disciplineCommit(core, state, braid, ops)
+					outcomes.push({ braid, admission })
 				}
-				return { value: recorded.value, outcomes }
+				return { tag: "split" as const, value: recorded.value, outcomes }
 			})
 		}
 	}
@@ -866,5 +962,16 @@ async function openWriter<Rels extends SchemaRelations>(
 	return writerOn(await openReplica(source))
 }
 
-export type { Batch, BraidOutcome, Commit, CommitSplit, Deposition, Durability, Published, PublishRefusal, Writer }
+export type {
+	Batch,
+	BraidOutcome,
+	Commit,
+	CommitReceipt,
+	CommitSplit,
+	Deposition,
+	Durability,
+	EmptyCommit,
+	Landing,
+	Writer
+}
 export { openWriter, publishCheckpoint }