@cleocode/core 2026.10.7 → 2026.10.8

package/dist/store/sync/rebind.d.ts

@@ -0,0 +1,112 @@
+/**
+ * The rebind at the next pull to head (journal spec §3.5 Rule 2 D5, §1.5;
+ * T13278).
+ *
+ * Undo grows exactly while a replica cannot reach the stream. At 100% of its
+ * budget the store keeps writing undo and records `sync.undo_budget_exceeded`
+ * (`sequencing.ts`); a forced rebind then would need the network it does not
+ * have. So the rebind waits for the next pull that reaches the stream's head,
+ * and {@link rebindAtHead} runs it, in one transaction with the rebind:
+ *
+ * 1. segments of the old replica the server already holds (at or below the
+ *    pull cursor's replicaSeq for it) are marked pushed first, so they are
+ *    never mistaken for an unsent outbox;
+ * 2. the store rebinds to a new replica (`undo-budget`): the old outbox
+ *    (live captures, sealed transactions, unpushed segments) is inherited;
+ * 3. the undo log is emptied; every transaction of the old replica the
+ *    stream has not sequenced is inherited first;
+ * 4. the reconcile re-emits what the old replica changed and never sent,
+ *    under the new replica (`reconcileInPlace`, the §1.5 three-way rule);
+ * 5. a signed `retire` transaction for the old id is queued
+ *    (`queueRetireTxn`), naming the successor and the last replicaSeq the
+ *    server holds of the old replica; a replica that never landed a segment
+ *    pins nothing and retires with no journal transaction;
+ * 6. `sync.undo_budget_exceeded` is cleared. Only this clears it.
+ *
+ * The server half (attach the new replica to this device, sign the E31
+ * retirement, update the link) needs the network, so the transaction also
+ * records {@link REBIND_PENDING_KEY}: the cloud layer completes it before the
+ * store pushes or pulls again, and a crash in between resumes there.
+ *
+ * @task T13278
+ * @module store/sync/rebind
+ */
+import type { DatabaseSync } from 'node:sqlite';
+import type { TableScope } from '@cleocode/contracts';
+import type { StreamCursor } from './pull.js';
+import { type ReconcileReport } from './reconcile.js';
+import { type SyncOpenOptions } from './replica.js';
+/**
+ * `_sync_meta` key holding the server half of a rebind the store committed
+ * and the cloud has not completed yet ({@link PendingRebind}).
+ */
+export declare const REBIND_PENDING_KEY = "sync.rebind_pending";
+/** The server half of a committed rebind: attach `to`, retire `from` (E31). */
+export interface PendingRebind {
+    readonly stream: string;
+    readonly scope: TableScope;
+    /** The retired replica. */
+    readonly from: string;
+    /** Its successor, this store's replica now. */
+    readonly to: string;
+    /** The last replicaSeq of `from` the server holds, or null when it holds none. */
+    readonly lastReplicaSeq: number | null;
+    /** The journal `retire` transaction, or null when `from` landed nothing. */
+    readonly retireTxn: string | null;
+    /** When the store rebound. */
+    readonly at: string;
+}
+/** Options for {@link rebindAtHead}. */
+export interface RebindAtHeadOptions extends SyncOpenOptions {
+    /** The stream the pull reached the head of. */
+    readonly stream: string;
+    /** The pull cursor at head: the server's last replicaSeq per replica. */
+    readonly cursor: StreamCursor;
+}
+/** What {@link rebindAtHead} did. */
+export interface RebindAtHeadReport {
+    readonly previousReplicaId: string;
+    readonly replicaId: string;
+    /** The server half the cloud must complete. */
+    readonly pending: PendingRebind;
+    /** Old segments the server held, marked pushed before the rebind. */
+    readonly segmentsMarkedPushed: number;
+    /** Undo rows dropped (`_sync_undo` plus `_sync_row_undo`). */
+    readonly undoDropped: number;
+    readonly reconcile: ReconcileReport;
+}
+/**
+ * Whether the undo budget scheduled a rebind (D5): `sync.undo_budget_exceeded`
+ * is set. Read-only.
+ *
+ * @param db - The store.
+ * @returns True when the next pull to head must rebind.
+ */
+export declare function undoBudgetRebindDue(db: DatabaseSync): boolean;
+/**
+ * The server half of a rebind still to complete, or null. Read-only.
+ *
+ * @param db - The store.
+ * @returns The pending rebind, or null.
+ */
+export declare function pendingRebind(db: DatabaseSync): PendingRebind | null;
+/**
+ * Record that the server half of a rebind completed (the new replica is
+ * attached and the old one retired on the server).
+ *
+ * @param db - The store, outside a transaction.
+ * @param to - The replica the completed rebind bound; a newer pending rebind is kept.
+ */
+export declare function clearPendingRebind(db: DatabaseSync, to: string): void;
+/**
+ * Run the scheduled rebind after a pull reached the stream's head (module
+ * docs). Must run outside a transaction, and only after a pull that staged
+ * and applied everything up to the server's head.
+ *
+ * @param db - The store.
+ * @param o - The open options of the canonical store, the stream and the pull cursor.
+ * @returns What was done, or null when no rebind is due.
+ * @throws {Error} When the store has no active replica.
+ */
+export declare function rebindAtHead(db: DatabaseSync, o: RebindAtHeadOptions): RebindAtHeadReport | null;
+//# sourceMappingURL=rebind.d.ts.map

package/dist/store/sync/rebind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebind.d.ts","sourceRoot":"","sources":["../../../src/store/sync/rebind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,KAAK,eAAe,EAAoB,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAoC,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAStF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAWD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,YAAY,GAAG,aAAa,GAAG,IAAI,CAGpE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAOrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,IAAI,CA6EhG"}

package/dist/store/sync/rebind.js

@@ -0,0 +1,187 @@
+/**
+ * The rebind at the next pull to head (journal spec §3.5 Rule 2 D5, §1.5;
+ * T13278).
+ *
+ * Undo grows exactly while a replica cannot reach the stream. At 100% of its
+ * budget the store keeps writing undo and records `sync.undo_budget_exceeded`
+ * (`sequencing.ts`); a forced rebind then would need the network it does not
+ * have. So the rebind waits for the next pull that reaches the stream's head,
+ * and {@link rebindAtHead} runs it, in one transaction with the rebind:
+ *
+ * 1. segments of the old replica the server already holds (at or below the
+ *    pull cursor's replicaSeq for it) are marked pushed first, so they are
+ *    never mistaken for an unsent outbox;
+ * 2. the store rebinds to a new replica (`undo-budget`): the old outbox
+ *    (live captures, sealed transactions, unpushed segments) is inherited;
+ * 3. the undo log is emptied; every transaction of the old replica the
+ *    stream has not sequenced is inherited first;
+ * 4. the reconcile re-emits what the old replica changed and never sent,
+ *    under the new replica (`reconcileInPlace`, the §1.5 three-way rule);
+ * 5. a signed `retire` transaction for the old id is queued
+ *    (`queueRetireTxn`), naming the successor and the last replicaSeq the
+ *    server holds of the old replica; a replica that never landed a segment
+ *    pins nothing and retires with no journal transaction;
+ * 6. `sync.undo_budget_exceeded` is cleared. Only this clears it.
+ *
+ * The server half (attach the new replica to this device, sign the E31
+ * retirement, update the link) needs the network, so the transaction also
+ * records {@link REBIND_PENDING_KEY}: the cloud layer completes it before the
+ * store pushes or pulls again, and a crash in between resumes there.
+ *
+ * @task T13278
+ * @module store/sync/rebind
+ */
+import { withImmediateTransaction } from './clock-store.js';
+import { reconcileInPlace } from './reconcile.js';
+import { activeReplica, rebindReplicaWith } from './replica.js';
+import { queueRetireTxn } from './retire.js';
+import { hasTable } from './schema.js';
+import { FOREIGN_TOUCH_COUNT_KEY, FOREIGN_TOUCH_INCOMPLETE_KEY, UNDO_BUDGET_EXCEEDED_KEY, } from './sequencing.js';
+/**
+ * `_sync_meta` key holding the server half of a rebind the store committed
+ * and the cloud has not completed yet ({@link PendingRebind}).
+ */
+export const REBIND_PENDING_KEY = 'sync.rebind_pending';
+const metaGet = (db, key) => hasTable(db, '_sync_meta')
+    ? db.prepare('SELECT value FROM _sync_meta WHERE key = ?').get(key)?.value
+    : undefined;
+/**
+ * Whether the undo budget scheduled a rebind (D5): `sync.undo_budget_exceeded`
+ * is set. Read-only.
+ *
+ * @param db - The store.
+ * @returns True when the next pull to head must rebind.
+ */
+export function undoBudgetRebindDue(db) {
+    return metaGet(db, UNDO_BUDGET_EXCEEDED_KEY) !== undefined;
+}
+/**
+ * The server half of a rebind still to complete, or null. Read-only.
+ *
+ * @param db - The store.
+ * @returns The pending rebind, or null.
+ */
+export function pendingRebind(db) {
+    const raw = metaGet(db, REBIND_PENDING_KEY);
+    return raw === undefined ? null : JSON.parse(raw);
+}
+/**
+ * Record that the server half of a rebind completed (the new replica is
+ * attached and the old one retired on the server).
+ *
+ * @param db - The store, outside a transaction.
+ * @param to - The replica the completed rebind bound; a newer pending rebind is kept.
+ */
+export function clearPendingRebind(db, to) {
+    withImmediateTransaction(db, () => {
+        const now = pendingRebind(db);
+        if (now !== null && now.to === to) {
+            db.prepare('DELETE FROM _sync_meta WHERE key = ?').run(REBIND_PENDING_KEY);
+        }
+    });
+}
+/**
+ * Run the scheduled rebind after a pull reached the stream's head (module
+ * docs). Must run outside a transaction, and only after a pull that staged
+ * and applied everything up to the server's head.
+ *
+ * @param db - The store.
+ * @param o - The open options of the canonical store, the stream and the pull cursor.
+ * @returns What was done, or null when no rebind is due.
+ * @throws {Error} When the store has no active replica.
+ */
+export function rebindAtHead(db, o) {
+    if (!undoBudgetRebindDue(db))
+        return null;
+    const now = o.now?.() ?? new Date();
+    const nowIso = now.toISOString();
+    // 1. What the server holds of the old replica is pushed, whatever the
+    //    local state says (an upload whose answer was lost): never inherited.
+    //    Its own transaction, before the rebind's: true whatever follows.
+    const marked = withImmediateTransaction(db, () => {
+        const active = activeReplica(db, o.scope)?.replicaId;
+        const held = active ? o.cursor.replicas[active]?.replicaSeq : undefined;
+        if (!active || held === undefined || !hasTable(db, '_sync_segment'))
+            return 0;
+        return Number(db
+            .prepare(`UPDATE _sync_segment SET state = 'pushed', pushed_at = coalesce(pushed_at, ?)
+            WHERE stream = ? AND replica_id = ? AND replica_seq <= ? AND state = 'sealed'`)
+            .run(nowIso, o.stream, active, held).changes);
+    });
+    // 2–6, with the rebind, in one transaction.
+    const out = rebindReplicaWith(db, o, 'undo-budget', {}, (tx, { previous, current }) => {
+        const undoDropped = dropUndo(tx, previous.replicaId);
+        const reconcile = reconcileInPlace(tx, { scope: o.scope, previousReplica: previous.replicaId });
+        const serverHeld = o.cursor.replicas[previous.replicaId]?.replicaSeq ?? null;
+        const localPushed = hasTable(tx, '_sync_segment')
+            ? tx
+                .prepare("SELECT max(replica_seq) AS s FROM _sync_segment WHERE stream = ? AND replica_id = ? AND state = 'pushed'")
+                .get(o.stream, previous.replicaId).s
+            : null;
+        const candidates = [serverHeld, localPushed === null ? null : Number(localPushed)].filter((n) => n !== null);
+        const lastReplicaSeq = candidates.length > 0 ? Math.max(...candidates) : null;
+        const retireTxn = lastReplicaSeq === null
+            ? null
+            : queueRetireTxn(tx, {
+                scope: o.scope,
+                stream: o.stream,
+                retire: {
+                    replica: previous.replicaId,
+                    successor: current.replicaId,
+                    lastReplicaSeq,
+                },
+                nowMs: now.getTime(),
+            });
+        const pending = {
+            stream: o.stream,
+            scope: o.scope,
+            from: previous.replicaId,
+            to: current.replicaId,
+            lastReplicaSeq,
+            retireTxn,
+            at: nowIso,
+        };
+        tx.prepare('DELETE FROM _sync_meta WHERE key = ?').run(UNDO_BUDGET_EXCEEDED_KEY);
+        tx.prepare('INSERT INTO _sync_meta (key, value, updated_at) VALUES (?, ?, ?) ' +
+            'ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at').run(REBIND_PENDING_KEY, JSON.stringify(pending), nowIso);
+        return { undoDropped, reconcile, pending };
+    });
+    return {
+        previousReplicaId: out.previousReplicaId,
+        replicaId: out.replicaId,
+        pending: out.result.pending,
+        segmentsMarkedPushed: marked,
+        undoDropped: out.result.undoDropped,
+        reconcile: out.result.reconcile,
+    };
+}
+/**
+ * Empty the undo log in the rebind transaction (D5). First every transaction
+ * of the old replica the stream has not sequenced is inherited, including
+ * one carried by a segment the server stored after this pull reached head:
+ * its echo would arrive under a replica this store no longer is, so it could
+ * never be sequenced as its own. It lands as history instead, and the
+ * reconcile re-emits its fields. Nothing is left to rewind, so the
+ * foreign-touch index resets, as after the last echo.
+ *
+ * @returns The undo rows dropped.
+ */
+function dropUndo(db, previousReplica) {
+    if (hasTable(db, '_sync_txn') && hasTable(db, '_sync_sequenced')) {
+        db.prepare(`UPDATE _sync_txn SET state = 'inherited' WHERE replica = ? AND state IN ('sealed', 'segmented')
+         AND NOT EXISTS (SELECT 1 FROM _sync_sequenced s WHERE s.txn = _sync_txn.txn)`).run(previousReplica);
+    }
+    let dropped = 0;
+    if (hasTable(db, '_sync_undo')) {
+        dropped += Number(db.prepare('DELETE FROM _sync_undo').run().changes);
+    }
+    if (hasTable(db, '_sync_row_undo')) {
+        dropped += Number(db.prepare('DELETE FROM _sync_row_undo').run().changes);
+    }
+    if (hasTable(db, '_sync_foreign_touch')) {
+        db.prepare('DELETE FROM _sync_foreign_touch').run();
+        db.prepare('DELETE FROM _sync_meta WHERE key IN (?, ?)').run(FOREIGN_TOUCH_INCOMPLETE_KEY, FOREIGN_TOUCH_COUNT_KEY);
+    }
+    return dropped;
+}
+//# sourceMappingURL=rebind.js.map

package/dist/store/sync/rebind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebind.js","sourceRoot":"","sources":["../../../src/store/sync/rebind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAwB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAuCxD,MAAM,OAAO,GAAG,CAAC,EAAgB,EAAE,GAAW,EAAsB,EAAE,CACpE,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IACxB,CAAC,CACG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,GAAG,CAGjE,EAAE,KAAK;IACV,CAAC,CAAC,SAAS,CAAC;AAEhB;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAgB;IAClD,OAAO,OAAO,CAAC,EAAE,EAAE,wBAAwB,CAAC,KAAK,SAAS,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,EAAgB;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC5C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAgB,EAAE,EAAU;IAC7D,wBAAwB,CAAC,EAAE,EAAE,GAAG,EAAE;QAChC,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,EAAgB,EAAE,CAAsB;IACnE,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAEjC,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC;YAAE,OAAO,CAAC,CAAC;QAC9E,OAAO,MAAM,CACX,EAAE;aACC,OAAO,CACN;0FACgF,CACjF;aACA,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4CAA4C;IAC5C,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;QACpF,MAAM,WAAW,GAAG,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAChG,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;QAC7E,MAAM,WAAW,GAAG,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC;YAC/C,CAAC,CACG,EAAE;iBACC,OAAO,CACN,0GAA0G,CAC3G;iBACA,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CACpC,CAAC,CAAC;YACL,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CACvF,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAC/B,CAAC;QACF,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,MAAM,SAAS,GACb,cAAc,KAAK,IAAI;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE;gBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,SAAS;oBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,cAAc;iBACf;gBACD,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE;aACrB,CAAC,CAAC;QACT,MAAM,OAAO,GAAkB;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,QAAQ,CAAC,SAAS;YACxB,EAAE,EAAE,OAAO,CAAC,SAAS;YACrB,cAAc;YACd,SAAS;YACT,EAAE,EAAE,MAAM;SACX,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACjF,EAAE,CAAC,OAAO,CACR,mEAAmE;YACjE,yFAAyF,CAC5F,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,OAAO;QACL,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;QAC3B,oBAAoB,EAAE,MAAM;QAC5B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW;QACnC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,QAAQ,CAAC,EAAgB,EAAE,eAAuB;IACzD,IAAI,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACjE,EAAE,CAAC,OAAO,CACR;sFACgF,CACjF,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACxC,EAAE,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC;QACpD,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAC1D,4BAA4B,EAC5B,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/store/sync/reconcile.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The rebind reconcile (journal spec §1.5 N7; T12763, T13278).
+ *
+ * After a rebind, what the old replica changed and the stream never saw is
+ * `inherited` (`inherit.ts`): live captures, sealed transactions, and the
+ * transactions of segments it never pushed. The new replica re-emits those
+ * fields, deciding each one by the three-way rule
+ * ({@link decideReconcileField}):
+ *
+ * 1. changed by an inherited capture or an inherited sealed-but-unpushed op:
+ *    emit it at `tick(at_ms)` of that change, under the new replica;
+ * 2. untouched, and the local field HLC is below the merged one: adopt the
+ *    merged value locally, emitting nothing;
+ * 3. otherwise (a local HLC at or above the merged one that no inherited
+ *    change explains): emit it with that HLC unchanged.
+ *
+ * These are `repair` transactions with `via: 'rebind'`, and they break the
+ * per-replica monotonic-HLC promise on purpose (§1.3, K10).
+ *
+ * {@link reconcileInPlace} is the reconcile of a rebind of the SAME file
+ * after a pull to head (the undo-budget rebind, D5): the store itself is the
+ * merged state, since the pull applied the stream and rebased the old
+ * replica's unsequenced writes over it. Every field no inherited change
+ * touched therefore already equals the merged value (rule 2 has nothing left
+ * to adopt and rule 3 nothing to explain), and every touched field is rule 1.
+ * It writes the touched rows as the captures of one `rebind` frame, read
+ * from the live rows (the current value, which is what every replica must
+ * converge on, whichever side the rebase let win), at the time of the last
+ * inherited change of each row; the sealer seals the frame as one `repair`
+ * transaction, `via: 'rebind'`, ticking each op at its row's time. A copy's
+ * reconcile against a restored checkpoint (rules 2 and 3 over a scratch
+ * store) is a separate pass.
+ *
+ * @task T12763
+ * @task T13278
+ * @module store/sync/reconcile
+ */
+import type { DatabaseSync } from 'node:sqlite';
+import type { TableScope } from '@cleocode/contracts';
+/** What the three-way rule does with one differing field (§1.5 N7). */
+export type ReconcileRule = 'emit-tick' | 'adopt-merged' | 'emit-pinned';
+/** The facts the three-way rule decides one field by. */
+export interface ReconcileField {
+    /** An inherited capture, or an inherited sealed-but-unpushed op, changed the field. */
+    readonly touchedByInherited: boolean;
+    /** The field's HLC in this store's row meta, or null when the store has no meta for it. */
+    readonly localHlc: string | null;
+    /** The field's HLC in the merged state (checkpoint plus stream to head). */
+    readonly mergedHlc: string;
+}
+/**
+ * The three-way rule for one field that differs from the merged state.
+ * Pure.
+ *
+ * @param f - Whether an inherited change touched it, and both HLCs.
+ * @returns `emit-tick` (rule 1), `adopt-merged` (rule 2) or `emit-pinned` (rule 3).
+ */
+export declare function decideReconcileField(f: ReconcileField): ReconcileRule;
+/** What {@link reconcileInPlace} did. */
+export interface ReconcileReport {
+    /** The `rebind` frame the re-emitted rows were captured in, or null when nothing was touched. */
+    readonly frame: string | null;
+    /** Rows re-emitted as I, U and D, and re-keys re-emitted. */
+    readonly inserts: number;
+    readonly updates: number;
+    readonly deletes: number;
+    readonly rekeys: number;
+    /** Inherited captures consumed. */
+    readonly captures: number;
+    /** Inherited transactions whose ops were read. */
+    readonly txns: number;
+}
+/**
+ * Re-emit what the previous replica changed and the stream never saw, as the
+ * captures of one `rebind` frame, in the caller's (rebind) transaction
+ * (module docs). Afterwards:
+ * - the inherited captures are consumed (deleted): their changes now travel
+ *   in the frame;
+ * - the ledger forgets the row-count effect of the previous replica's
+ *   inherited sealed transactions, which the frame's I and D ops count again
+ *   when they seal;
+ * - while undo is on, each capture gets its undo row (a reconcile repair
+ *   keeps its undo until its echo, D1).
+ *
+ * @param db - The store, inside the rebind transaction.
+ * @param o - Scope and the previous (retired) replica.
+ * @returns What was re-emitted.
+ */
+export declare function reconcileInPlace(db: DatabaseSync, o: {
+    readonly scope: TableScope;
+    readonly previousReplica: string;
+}): ReconcileReport;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/store/sync/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/store/sync/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAStD,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,aAAa,CAAC;AAEzE,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,cAAc,GAAG,aAAa,CAIrE;AAyBD,yCAAyC;AACzC,MAAM,WAAW,eAAe;IAC9B,iGAAiG;IACjG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAkBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,YAAY,EAChB,CAAC,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAClE,eAAe,CA+NjB"}