@feltdb/core 0.8.1 → 0.8.2

package/dist/create/server-source/crates/feltdb/src/lib.rs

@@ -1,69 +1,65 @@
 #[cfg(test)]
 mod acceptance_tests;
-#[cfg(test)]
-mod admission_contract_tests;
-#[cfg(test)]
-mod managed_cas_tests;
 mod acquisition;
 pub mod admission;
+#[cfg(test)]
+mod admission_contract_tests;
+pub mod adversarial_transport;
+pub mod analytics;
 pub mod application;
 pub mod application_runtime;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod authority;
+pub mod authority_failover;
 pub mod authorization;
-pub mod policy_evaluation;
 #[cfg(test)]
 mod authorization_security_tests;
 pub mod capabilities;
 mod capability;
+mod cardinality_diagnostics;
+pub mod cardinality_endpoint;
+pub mod causal_backlog_bound;
+pub mod causal_dependency_barrier;
+#[cfg(test)]
+mod causal_dependency_barrier_phase_7_1;
+pub mod concurrency_fuzzing;
+pub mod consistency_contract;
 mod content_distribution;
 pub mod convergence;
+pub mod crash_atomic_boundary;
+pub mod crash_injection;
+#[cfg(test)]
+mod crash_recovery_tests;
 mod cron;
+pub mod dedup_bound_investigation;
+pub mod distributed_indexing;
 #[cfg(test)]
 mod distributed_tests;
-mod execution;
-pub mod analytics;
-pub mod distributed_indexing;
-pub mod indexing;
-pub mod sharding;
-pub mod transaction_preconditions;
-pub mod transactions;
-pub mod state_hash;
-pub mod state_model;
-pub mod state_facade;
-pub mod crash_injection;
-pub mod concurrency_fuzzing;
-pub mod replay_fuzzing;
-pub mod permutation_scheduler;
-pub mod multi_node_convergence;
 pub mod distributed_transactions;
-pub mod durable_operation_log;
+pub mod durability_guarantees;
 pub mod durable_dedup_set;
-pub mod replication_protocol;
+pub mod durable_operation_identity;
+pub mod durable_operation_log;
+pub mod durable_sync;
+mod execution;
 pub mod in_process_transport;
-#[cfg(not(target_arch = "wasm32"))]
-pub mod tcp_transport;
-pub mod operation_algebra;
-pub mod crash_atomic_boundary;
+pub mod indexing;
+#[cfg(test)]
+mod managed_cas_tests;
+mod materialization;
+pub mod metrics;
+pub mod multi_node_convergence;
 pub mod multi_operation_transaction;
-pub mod p1_atomicity_acceptance;
+pub mod observability;
+mod operation;
+pub mod operation_algebra;
+pub mod operation_log;
 pub mod p1_application_atomicity;
-pub mod causal_backlog_bound;
-pub mod dedup_bound_investigation;
-pub mod durable_operation_identity;
-pub mod causal_dependency_barrier;
+pub mod p1_atomicity_acceptance;
 pub mod partition_reconciliation;
-pub mod consistency_contract;
+mod peer_registry;
+pub mod permutation_scheduler;
 pub mod persistence_reality;
-pub mod adversarial_transport;
-pub mod replica_membership;
-pub mod replica_acknowledgements;
-pub mod replication_manager;
-pub mod authority_failover;
-pub mod metrics;
-pub mod query_performance;
-pub mod durable_sync;
-pub mod production_api;
-pub mod observability;
-pub mod durability_guarantees;
 #[cfg(test)]
 mod phase1b_acceptance;
 #[cfg(test)]
@@ -71,9 +67,19 @@ mod phase1c1_acceptance;
 #[cfg(test)]
 mod phase1c2_acceptance;
 #[cfg(test)]
+mod phase1c3_acceptance;
+#[cfg(test)]
 mod phase1c_atomicity_proof;
 #[cfg(test)]
-mod phase1c3_acceptance;
+mod phase5_integration;
+#[cfg(test)]
+mod phase5_scenarios;
+#[cfg(test)]
+mod phase6_adversarial_scenarios;
+#[cfg(test)]
+mod phase6_convergence_validator;
+#[cfg(test)]
+mod phase6_persistence;
 #[cfg(test)]
 #[cfg(test)]
 mod phase_1c_real_tcp;
@@ -89,38 +95,34 @@ mod phase_3_durability;
 mod phase_4_baseline;
 #[cfg(test)]
 mod phase_5_soak;
-#[cfg(test)]
-mod phase5_integration;
-#[cfg(test)]
-mod phase5_scenarios;
-#[cfg(test)]
-mod phase6_persistence;
-#[cfg(test)]
-mod phase6_adversarial_scenarios;
-#[cfg(test)]
-mod phase6_convergence_validator;
-#[cfg(test)]
-mod transaction_invariants;
-#[cfg(test)]
-mod crash_recovery_tests;
-#[cfg(test)]
-mod causal_dependency_barrier_phase_7_1;
-mod cardinality_diagnostics;
-pub mod cardinality_endpoint;
-mod materialization;
-mod operation;
-pub mod operation_log;
-pub mod state_transition_store;
-pub mod submission;
-pub mod transaction_api;
-mod peer_registry;
+pub mod policy_evaluation;
+pub mod production_api;
 mod provenance;
+pub mod query_performance;
 mod references;
+pub mod replay_fuzzing;
+pub mod replica_acknowledgements;
+pub mod replica_membership;
+pub mod replication_manager;
+pub mod replication_protocol;
 mod routing;
+pub mod sharding;
 pub mod state_contract;
+pub mod state_facade;
+pub mod state_hash;
+pub mod state_model;
+pub mod state_transition_store;
 mod storage;
+pub mod submission;
 mod sync;
 pub mod sync_contract;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod tcp_transport;
+pub mod transaction_api;
+#[cfg(test)]
+mod transaction_invariants;
+pub mod transaction_preconditions;
+pub mod transactions;
 mod trigger;
 pub mod worker_mesh;
 mod workflow;
@@ -134,6 +136,14 @@ pub use acquisition::{
     AcquisitionDeduplicator, AcquisitionPolicy, AcquisitionResult, ContentRequest, ContentResponse,
     ContentTransferError,
 };
+pub use admission::{ProductionRetryPolicy, RejectionReason, SubmissionOutcome};
+pub use adversarial_transport::{
+    AdversarialTransport, ConnectionId, ConnectivityMatrix, FaultSeed, InMemoryTransport,
+    LinkState, MessageId, NetworkEvent, NetworkSchedule, NodeId, ReplicationTransport,
+};
+pub use analytics::{
+    AutoTuner, IndexAnalytics, IndexMetrics, PerformanceReport, QueryTrace, TuningRecommendation,
+};
 pub use capability::{
     CapabilityAccessModel, CapabilityCheckpoint, CapabilityContext, CapabilityExecutionContext,
     CapabilityExecutionResult, CapabilityId, CapabilityLifecycleState, CapabilityMetadata,
@@ -141,6 +151,15 @@ pub use capability::{
     CapabilityRegistry, CapabilityRequirements, CapabilityResolver, CapabilityRole,
     DistributedCapabilityAdvertisement, ExecutionRef, FlowCapability, StateRequirement,
 };
+pub use causal_dependency_barrier::{
+    ApplyResult, CausalDependencyBarrier, OperationState, PendingOperation, ReceiveResult,
+    StateCounters,
+};
+pub use consistency_contract::{
+    CommutativeVerificationResult, ConsensusEnforcementResult, ConsensusRequirementChecker,
+    ConsistencyContractEnforcer, DeterministicMergeVerificationResult,
+    NoDowngradeVerificationResult, OperationApplication,
+};
 pub use content_distribution::{
     CapabilityLocationRegistry, ContentAcquisitionManager, ContentAddressableStore,
     DistributedReferenceResolver, ProjectionDistribution,
@@ -149,74 +168,41 @@ pub use convergence::{
     CausalHistory, ConflictResolution, ConflictResolutionStrategy, MergeResult, StateVersion,
     VectorClock,
 };
-pub use analytics::{AutoTuner, IndexAnalytics, IndexMetrics, PerformanceReport, QueryTrace, TuningRecommendation};
+pub use crash_atomic_boundary::{
+    CrashAtomicExecutor, CrashBoundaryPoint, CrashRecoveryState, InvariantCheckResult,
+    RecoveryDecision,
+};
 pub use cron::{CronSchedule, CronScheduler};
 pub use distributed_indexing::{
     ConsistencyLevel, ConsistencyProtocol, DistributedIndexManager, DistributedSyncStatus,
     IndexOperation, IndexReplicationState, IndexSyncMessage, IndexVectorClock, RemoteIndexMetadata,
     RemoteIndexState, ReplicationStatus, VersionConflict,
 };
+pub use distributed_transactions::{
+    DistributedTransactionExecutor, EnvelopeId, ReplicaState, ReplicationMessage,
+    TransactionEnvelope,
+};
 pub use execution::{Execution, ExecutionQueue, ExecutionStatus, RetryPolicy};
 pub use indexing::{IndexConfig, IndexManager, IndexStats, IndexType};
-pub use submission::{SubmissionManager, SubmissionMetrics};
-pub use admission::{SubmissionOutcome, RejectionReason, ProductionRetryPolicy};
-pub use sharding::{
-    HotspotAlert, RebalanceOperation, ShardDistributionSummary, ShardId, ShardKey, ShardManager,
-    ShardMetrics, ShardRange, ShardingStrategy,
-};
-pub use transactions::{
-    CommitId, CommitValidator, ConsistencyContract, OperationCommand,
-    OperationId, StateTransition, StateDependency, TransactionExecutor,
-    TransitionResult,
-};
-pub use state_hash::{CanonicalState, StateHash};
-pub use state_model::{
-    StateId, StateRevision, StateTopology, Relationship, SemanticDiff, SemanticChange, 
-    ChangeKind, PathComponent, ConflictClassification, ConflictClass, PathConflict,
-    ReconciliationPlan, StateReconciliationResult, StateStore, STATE_MODEL_VERSION,
-};
-pub use state_facade::FeltDBStateSystem;
-pub use permutation_scheduler::{OperationSchedule, PermutationScheduler, ScheduleStrategy};
+pub use materialization::{MaterializationHandler, ReactiveCollectionIntegration};
 pub use multi_node_convergence::{
     ConvergenceAggregation, ConvergenceResult, MultiNodeConvergenceSimulator, NodeExecutionResult,
 };
-pub use distributed_transactions::{
-    DistributedTransactionExecutor, EnvelopeId, ReplicaState, ReplicationMessage, TransactionEnvelope,
-};
+pub use operation::{MutationOrder, Operation, OperationType, DEFAULT_MUTATION_ORDER};
 pub use operation_algebra::{
     ConflictType, ConvergenceSemantic, OperationAlgebra, OperationAlgebraRegistry,
 };
-pub use crash_atomic_boundary::{
-    CrashAtomicExecutor, CrashBoundaryPoint, CrashRecoveryState, InvariantCheckResult,
-    RecoveryDecision,
-};
-pub use causal_dependency_barrier::{
-    ApplyResult, CausalDependencyBarrier, OperationState, PendingOperation, ReceiveResult,
-    StateCounters,
-};
+pub use operation_log::{MemoryOperationLog, OperationLogEntry};
 pub use partition_reconciliation::{
     DeterminismCheckResult, PartitionDeterminismChecker, PartitionTrace, PartitionedReplica,
     ReconciliationResult, ReplicaPartition,
 };
-pub use consistency_contract::{
-    CommutativeVerificationResult, ConsensusEnforcementResult, ConsensusRequirementChecker,
-    ConsistencyContractEnforcer, DeterministicMergeVerificationResult, NoDowngradeVerificationResult,
-    OperationApplication,
-};
+pub use peer_registry::PeerRegistry;
+pub use permutation_scheduler::{OperationSchedule, PermutationScheduler, ScheduleStrategy};
 pub use persistence_reality::{
     CorruptionDetectionResult, DurablePersistenceLayer, FsyncDurabilityResult,
-    PersistenceCrashPoint, PersistenceContractVerifier, RecoveryResult, WriteResult, WALEntry,
-};
-pub use adversarial_transport::{
-    AdversarialTransport, ConnectionId, ConnectivityMatrix, FaultSeed, InMemoryTransport,
-    LinkState, MessageId, NetworkEvent, NetworkSchedule, NodeId, ReplicationTransport,
+    PersistenceContractVerifier, PersistenceCrashPoint, RecoveryResult, WALEntry, WriteResult,
 };
-pub use materialization::{MaterializationHandler, ReactiveCollectionIntegration};
-pub use operation::{MutationOrder, Operation, OperationType, DEFAULT_MUTATION_ORDER};
-pub use operation_log::{MemoryOperationLog, OperationLogEntry};
-pub use state_transition_store::{MemoryStateTransitionStore, StateTransitionRecord};
-pub use transaction_api::{TransactionManager, TxError, TxResult};
-pub use peer_registry::PeerRegistry;
 pub use provenance::{
     AcquisitionMetadata, DerivedState, DerivedStateProvenance, DerivedValue, OperationSource,
 };
@@ -228,8 +214,26 @@ pub use routing::{
     CapabilityRouter, ExecutionClaim, ExecutionClaimer, ExecutionResultPublisher, PeerStateVersion,
     RouteDecision,
 };
+pub use sharding::{
+    HotspotAlert, RebalanceOperation, ShardDistributionSummary, ShardId, ShardKey, ShardManager,
+    ShardMetrics, ShardRange, ShardingStrategy,
+};
+pub use state_facade::FeltDBStateSystem;
+pub use state_hash::{CanonicalState, StateHash};
+pub use state_model::{
+    ChangeKind, ConflictClass, ConflictClassification, PathComponent, PathConflict,
+    ReconciliationPlan, Relationship, SemanticChange, SemanticDiff, StateId,
+    StateReconciliationResult, StateRevision, StateStore, StateTopology, STATE_MODEL_VERSION,
+};
+pub use state_transition_store::{MemoryStateTransitionStore, StateTransitionRecord};
 pub use storage::{CheckpointData, FileStorage, MemoryStorage, Storage};
+pub use submission::{SubmissionManager, SubmissionMetrics};
 pub use sync::{ChangeLog, Conflict, ConflictDetector, PeerState, SyncMessage, SyncState};
+pub use transaction_api::{TransactionManager, TxError, TxResult};
+pub use transactions::{
+    CommitId, CommitValidator, ConsistencyContract, OperationCommand, OperationId, StateDependency,
+    StateTransition, TransactionExecutor, TransitionResult,
+};
 pub use trigger::{Trigger, TriggerFilter, TriggerRegistry};
 pub use workflow::{
     BlockedReason, WorkflowGraph, WorkflowInstance, WorkflowNode, WorkflowOperation, WorkflowRef,
@@ -240,6 +244,7 @@ pub use workflow_integration::{
 };
 pub use workflow_runtime::{WorkflowOperationEntry, WorkflowRuntime};
 
+use crate::state_contract::AuthorizationContext;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
@@ -247,16 +252,15 @@ use sha2::{Digest, Sha256};
 use std::any::type_name;
 use std::collections::hash_map::DefaultHasher;
 use std::collections::{BTreeMap, HashMap, HashSet};
-use std::ops::Bound::{Excluded, Unbounded};
 use std::fmt::{Display, Formatter};
 use std::fs::{self, OpenOptions};
 use std::hash::{Hash, Hasher};
 use std::io::{BufRead, BufReader, Write};
+use std::ops::Bound::{Excluded, Unbounded};
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex};
 use std::time::{SystemTime, UNIX_EPOCH};
 use tokio::sync::broadcast;
-use crate::state_contract::AuthorizationContext;
 
 pub type Result<T> = std::result::Result<T, FlowError>;
 
@@ -272,6 +276,11 @@ pub enum FlowError {
     /// outcome of a race and a caller is meant to branch on it, while a
     /// capability error is not.
     PreconditionFailed(Box<PreconditionFailure>),
+    /// The transaction was based on a revision which is no longer current.
+    RevisionConflict {
+        expected: u64,
+        actual: u64,
+    },
 }
 
 impl Display for FlowError {
@@ -282,6 +291,10 @@ impl Display for FlowError {
             FlowError::CorruptLogLine(line) => write!(f, "corrupt log line: {line}"),
             FlowError::CapabilityError(msg) => write!(f, "capability error: {msg}"),
             FlowError::PreconditionFailed(failure) => write!(f, "PRECONDITION_FAILED: {failure}"),
+            FlowError::RevisionConflict { expected, actual } => write!(
+                f,
+                "REVISION_CONFLICT: expected authority revision {expected}, current revision is {actual}"
+            ),
         }
     }
 }
@@ -322,6 +335,9 @@ struct Inner {
     adaptive_indexes: HashSet<String>,
     instance_id: String,
     sequence: u64,
+    /// Monotonic, authority-assigned commit order. Unlike `sequence`, one
+    /// transaction advances this exactly once regardless of its mutation count.
+    authority_revision: u64,
     sync_state: SyncState,
     change_log: ChangeLog,
     execution_queue: ExecutionQueue,
@@ -334,6 +350,7 @@ struct Inner {
     bootstrapped: bool,
     applied_transactions: HashSet<String>,
     transaction_payload_hashes: HashMap<String, String>,
+    transaction_revisions: HashMap<String, (u64, u64)>,
     collection_cardinality: HashMap<String, u64>,
 }
 
@@ -409,9 +426,24 @@ pub enum PreconditionFailure {
     Present { collection: String, key: String },
     /// A predicate was given for a record that does not exist.
     Missing { collection: String, key: String },
-    Version { collection: String, key: String, expected: u64, actual: u64 },
-    Epoch { collection: String, key: String, expected: u64, actual: u64 },
-    Lease { collection: String, key: String, expected: String, actual: Option<String> },
+    Version {
+        collection: String,
+        key: String,
+        expected: u64,
+        actual: u64,
+    },
+    Epoch {
+        collection: String,
+        key: String,
+        expected: u64,
+        actual: u64,
+    },
+    Lease {
+        collection: String,
+        key: String,
+        expected: String,
+        actual: Option<String>,
+    },
 }
 
 impl PreconditionFailure {
@@ -439,28 +471,58 @@ impl PreconditionFailure {
 impl Display for PreconditionFailure {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         match self {
-            Self::Present { collection, key } =>
-                write!(f, "{collection}/{key} was required to be absent but exists"),
-            Self::Missing { collection, key } =>
-                write!(f, "{collection}/{key} does not exist"),
-            Self::Version { collection, key, expected, actual } =>
-                write!(f, "{collection}/{key} is at version {actual}, expected {expected}"),
-            Self::Epoch { collection, key, expected, actual } =>
-                write!(f, "{collection}/{key} is at epoch {actual}, expected {expected}"),
-            Self::Lease { collection, key, expected, actual } =>
-                write!(f, "{collection}/{key} holds lease {actual:?}, expected {expected}"),
+            Self::Present { collection, key } => {
+                write!(f, "{collection}/{key} was required to be absent but exists")
+            }
+            Self::Missing { collection, key } => write!(f, "{collection}/{key} does not exist"),
+            Self::Version {
+                collection,
+                key,
+                expected,
+                actual,
+            } => write!(
+                f,
+                "{collection}/{key} is at version {actual}, expected {expected}"
+            ),
+            Self::Epoch {
+                collection,
+                key,
+                expected,
+                actual,
+            } => write!(
+                f,
+                "{collection}/{key} is at epoch {actual}, expected {expected}"
+            ),
+            Self::Lease {
+                collection,
+                key,
+                expected,
+                actual,
+            } => write!(
+                f,
+                "{collection}/{key} holds lease {actual:?}, expected {expected}"
+            ),
         }
     }
 }
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AtomicCommit {
     pub transaction_id: String,
+    pub base_revision: u64,
+    pub commit_revision: u64,
+    pub status: TransactionStatus,
     pub state_before: u64,
     pub state_after: u64,
     pub rows: Vec<StoredRow>,
     pub duplicate: bool,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum TransactionStatus {
+    Committed,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub enum JsonCasResult {
     Updated {
@@ -494,6 +556,10 @@ struct TransactionLogRecord {
     payload_hash: Option<String>,
     state_before: u64,
     state_after: u64,
+    #[serde(default)]
+    base_revision: u64,
+    #[serde(default)]
+    commit_revision: u64,
     rows: Vec<StoredRow>,
     #[serde(default)]
     audit: Option<Value>,
@@ -754,6 +820,7 @@ impl FeltDb {
                 operation: Some(operation.clone()),
             };
             append_event(&inner.path, &row)?;
+            inner.authority_revision += 1;
             inner.change_log.add_operation(operation);
             inner
                 .rows
@@ -828,9 +895,10 @@ impl FeltDb {
         if !context.writable_collections.is_empty()
             && !context.writable_collections.contains(&capability)
         {
-            return Err(FlowError::CapabilityError(
-                format!("AUTHORIZATION_DENIED:not_writable_collection:{}", capability),
-            ));
+            return Err(FlowError::CapabilityError(format!(
+                "AUTHORIZATION_DENIED:not_writable_collection:{}",
+                capability
+            )));
         }
 
         // Authorized: apply mutation
@@ -858,9 +926,10 @@ impl FeltDb {
         if !context.writable_collections.is_empty()
             && !context.writable_collections.contains(&capability)
         {
-            return Err(FlowError::CapabilityError(
-                format!("AUTHORIZATION_DENIED:not_writable_collection:{}", capability),
-            ));
+            return Err(FlowError::CapabilityError(format!(
+                "AUTHORIZATION_DENIED:not_writable_collection:{}",
+                capability
+            )));
         }
 
         // Authorized: apply mutation
@@ -888,9 +957,10 @@ impl FeltDb {
         if !context.writable_collections.is_empty()
             && !context.writable_collections.contains(&capability)
         {
-            return Err(FlowError::CapabilityError(
-                format!("AUTHORIZATION_DENIED:not_writable_collection:{}", capability),
-            ));
+            return Err(FlowError::CapabilityError(format!(
+                "AUTHORIZATION_DENIED:not_writable_collection:{}",
+                capability
+            )));
         }
 
         // Authorized: apply mutation
@@ -970,11 +1040,34 @@ impl FeltDb {
         Ok(inner.sequence)
     }
 
+    /// Revision of the snapshot held by this embedded authority instance.
+    /// In multi-process topology callers must use `AuthorityClient::read` to
+    /// cross the authority boundary and obtain a current authoritative value.
+    pub fn current_revision(&self) -> Result<u64> {
+        Ok(self.inner.lock().expect("lock poisoned").authority_revision)
+    }
+
+    /// Capture revision and rows under one lock. Authority reads must never
+    /// pair metadata from one commit with state from another.
+    pub(crate) fn authority_state(&self) -> (u64, Vec<StoredRow>) {
+        let inner = self.inner.lock().expect("lock poisoned");
+        let rows = inner
+            .rows
+            .values()
+            .flat_map(|bucket| bucket.values().cloned())
+            .collect();
+        (inner.authority_revision, rows)
+    }
+
     /// Get the maintained cardinality (record count) for a collection capability.
     /// Returns the count of non-deleted records in the collection.
     pub fn collection_cardinality(&self, capability: &str) -> Result<u64> {
         let inner = self.inner.lock().expect("lock poisoned");
-        Ok(inner.collection_cardinality.get(capability).copied().unwrap_or(0))
+        Ok(inner
+            .collection_cardinality
+            .get(capability)
+            .copied()
+            .unwrap_or(0))
     }
 
     /// Diagnostic: List all collection capabilities and their cardinalities.
@@ -1026,7 +1119,13 @@ impl FeltDb {
     }
 
     pub fn applied_transaction_payload_hash(&self, transaction_id: &str) -> Result<Option<String>> {
-        Ok(self.inner.lock().expect("lock poisoned").transaction_payload_hashes.get(transaction_id).cloned())
+        Ok(self
+            .inner
+            .lock()
+            .expect("lock poisoned")
+            .transaction_payload_hashes
+            .get(transaction_id)
+            .cloned())
     }
 
     /// Atomically validates and durably applies an ordered mutation batch.
@@ -1040,7 +1139,14 @@ impl FeltDb {
         mutations: &[AtomicMutation],
         audit: Option<Value>,
     ) -> Result<AtomicCommit> {
-        self.apply_atomic_transaction_content_addressed(transaction_id, None, expected_parent, preconditions, mutations, audit)
+        self.apply_atomic_transaction_content_addressed(
+            transaction_id,
+            None,
+            expected_parent,
+            preconditions,
+            mutations,
+            audit,
+        )
     }
 
     /// Applies a transaction whose identifier is durably bound to a canonical
@@ -1092,12 +1198,27 @@ impl FeltDb {
             let mut inner = self.inner.lock().expect("lock poisoned");
             if inner.applied_transactions.contains(transaction_id) {
                 if let Some(expected_hash) = payload_hash {
-                    if inner.transaction_payload_hashes.get(transaction_id).map(String::as_str) != Some(expected_hash) {
-                        return Err(FlowError::CapabilityError(format!("TRANSACTION_ID_PAYLOAD_MISMATCH:{transaction_id}")));
+                    if inner
+                        .transaction_payload_hashes
+                        .get(transaction_id)
+                        .map(String::as_str)
+                        != Some(expected_hash)
+                    {
+                        return Err(FlowError::CapabilityError(format!(
+                            "TRANSACTION_ID_PAYLOAD_MISMATCH:{transaction_id}"
+                        )));
                     }
                 }
+                let (base_revision, commit_revision) = inner
+                    .transaction_revisions
+                    .get(transaction_id)
+                    .copied()
+                    .unwrap_or((inner.authority_revision, inner.authority_revision));
                 return Ok(AtomicCommit {
                     transaction_id: transaction_id.into(),
+                    base_revision,
+                    commit_revision,
+                    status: TransactionStatus::Committed,
                     state_before: inner.sequence,
                     state_after: inner.sequence,
                     rows: vec![],
@@ -1146,7 +1267,12 @@ impl FeltDb {
                         .unwrap_or(1);
                     if actual != expected {
                         return Err(FlowError::PreconditionFailed(Box::new(
-                            PreconditionFailure::Version { collection, key, expected, actual },
+                            PreconditionFailure::Version {
+                                collection,
+                                key,
+                                expected,
+                                actual,
+                            },
                         )));
                     }
                 }
@@ -1158,14 +1284,22 @@ impl FeltDb {
                         .unwrap_or(0);
                     if actual != expected {
                         return Err(FlowError::PreconditionFailed(Box::new(
-                            PreconditionFailure::Epoch { collection, key, expected, actual },
+                            PreconditionFailure::Epoch {
+                                collection,
+                                key,
+                                expected,
+                                actual,
+                            },
                         )));
                     }
                 }
                 if let Some(expected) = &condition.expected_lease_id {
                     let lease = current.value.get("lease").filter(|lease| !lease.is_null());
                     let held = lease.and_then(|lease| {
-                        lease.get("leaseId").and_then(Value::as_str).map(str::to_string)
+                        lease
+                            .get("leaseId")
+                            .and_then(Value::as_str)
+                            .map(str::to_string)
                     });
                     // An expired lease is not held, so naming it is a conflict:
                     // the caller believes it owns something it no longer does.
@@ -1209,9 +1343,12 @@ impl FeltDb {
             let fenced: HashMap<(&str, &str), u64> = record_preconditions
                 .iter()
                 .filter_map(|condition| {
-                    condition
-                        .expected_version
-                        .map(|version| ((condition.capability.as_str(), condition.key.as_str()), version))
+                    condition.expected_version.map(|version| {
+                        (
+                            (condition.capability.as_str(), condition.key.as_str()),
+                            version,
+                        )
+                    })
                 })
                 .collect();
             let mutations: &[AtomicMutation] = if fenced.is_empty() && creates.is_empty() {
@@ -1248,12 +1385,13 @@ impl FeltDb {
                 &advanced
             };
 
+            let base_revision = inner.authority_revision;
             if let Some(expected) = expected_parent {
-                if expected != inner.sequence {
-                    return Err(FlowError::CapabilityError(format!(
-                        "PRECONDITION_FAILED:transaction_parent:{expected}:{}",
-                        inner.sequence
-                    )));
+                if expected != base_revision {
+                    return Err(FlowError::RevisionConflict {
+                        expected,
+                        actual: base_revision,
+                    });
                 }
             }
             for condition in preconditions {
@@ -1337,10 +1475,13 @@ impl FeltDb {
                 payload_hash: payload_hash.map(str::to_owned),
                 state_before,
                 state_after: next_sequence,
+                base_revision,
+                commit_revision: base_revision + 1,
                 rows: rows.clone(),
                 audit,
             };
             append_transaction(&inner.path, &record)?;
+            inner.authority_revision = base_revision + 1;
             inner.sequence = next_sequence;
             for row in &rows {
                 if let Some(operation) = row.operation.clone() {
@@ -1351,7 +1492,10 @@ impl FeltDb {
                         bucket.remove(&row.key);
                     }
                     // Decrement cardinality on delete
-                    let count = inner.collection_cardinality.entry(row.capability.clone()).or_default();
+                    let count = inner
+                        .collection_cardinality
+                        .entry(row.capability.clone())
+                        .or_default();
                     *count = count.saturating_sub(1);
                 } else {
                     // Track whether this is an insert (new row) or update (existing row)
@@ -1368,14 +1512,25 @@ impl FeltDb {
 
                     // Increment cardinality only on insert, not update
                     if is_insert {
-                        let count = inner.collection_cardinality.entry(row.capability.clone()).or_default();
+                        let count = inner
+                            .collection_cardinality
+                            .entry(row.capability.clone())
+                            .or_default();
                         *count = count.saturating_add(1);
                     }
                 }
             }
             inner.sync_state.merge_vector_clock(&vector_clock);
             inner.applied_transactions.insert(transaction_id.into());
-            if let Some(hash) = payload_hash { inner.transaction_payload_hashes.insert(transaction_id.into(), hash.into()); }
+            let commit_revision = inner.authority_revision;
+            inner
+                .transaction_revisions
+                .insert(transaction_id.into(), (base_revision, commit_revision));
+            if let Some(hash) = payload_hash {
+                inner
+                    .transaction_payload_hashes
+                    .insert(transaction_id.into(), hash.into());
+            }
             let events = rows
                 .iter()
                 .map(|row| ChangeEvent {
@@ -1388,6 +1543,9 @@ impl FeltDb {
             (
                 AtomicCommit {
                     transaction_id: transaction_id.into(),
+                    base_revision,
+                    commit_revision: inner.authority_revision,
+                    status: TransactionStatus::Committed,
                     state_before,
                     state_after: inner.sequence,
                     rows,
@@ -1428,7 +1586,13 @@ impl FeltDb {
         }
 
         // All authorized: proceed with atomic transaction (no partial application)
-        self.apply_atomic_transaction(transaction_id, expected_parent, preconditions, mutations, audit)
+        self.apply_atomic_transaction(
+            transaction_id,
+            expected_parent,
+            preconditions,
+            mutations,
+            audit,
+        )
     }
 
     fn insert_internal<T: Serialize>(
@@ -1480,6 +1644,7 @@ impl FeltDb {
             inner.change_log.add_operation(op.clone());
 
             append_event(&inner.path, &row)?;
+            inner.authority_revision += 1;
             inner
                 .rows
                 .entry(capability.clone())
@@ -1552,6 +1717,7 @@ impl FeltDb {
             inner.change_log.add_operation(op.clone());
 
             append_event(&inner.path, &row)?;
+            inner.authority_revision += 1;
             inner
                 .rows
                 .entry(capability.clone())
@@ -1620,6 +1786,7 @@ impl FeltDb {
                 operation: Some(op),
             };
             append_event(&inner.path, &tombstone)?;
+            inner.authority_revision += 1;
 
             // Remove from in-memory store
             if let Some(bucket) = inner.rows.get_mut(&capability) {
@@ -1723,20 +1890,39 @@ impl FeltDb {
     }
 
     /// Traverse one collection in immutable record-key order without materializing it.
-    pub fn list_collection_page(&self, capability: &str, after: Option<&str>, limit: usize) -> Result<Vec<StoredRow>> {
+    pub fn list_collection_page(
+        &self,
+        capability: &str,
+        after: Option<&str>,
+        limit: usize,
+    ) -> Result<Vec<StoredRow>> {
         let inner = self.inner.lock().expect("lock poisoned");
-        let Some(rows) = inner.rows.get(capability) else { return Ok(vec![]) };
+        let Some(rows) = inner.rows.get(capability) else {
+            return Ok(vec![]);
+        };
         let values: Box<dyn Iterator<Item = &StoredRow>> = match after {
-            Some(key) => Box::new(rows.range::<str, _>((Excluded(key), Unbounded)).map(|(_, row)| row)),
+            Some(key) => Box::new(
+                rows.range::<str, _>((Excluded(key), Unbounded))
+                    .map(|(_, row)| row),
+            ),
             None => Box::new(rows.values()),
         };
-        Ok(values.filter(|row| !row.deleted).take(limit).cloned().collect())
+        Ok(values
+            .filter(|row| !row.deleted)
+            .take(limit)
+            .cloned()
+            .collect())
     }
 
     /// Fetch one live collection record without materializing collection state.
     pub fn get_collection_record(&self, capability: &str, key: &str) -> Result<Option<StoredRow>> {
         let inner = self.inner.lock().expect("lock poisoned");
-        Ok(inner.rows.get(capability).and_then(|rows| rows.get(key)).filter(|row| !row.deleted).cloned())
+        Ok(inner
+            .rows
+            .get(capability)
+            .and_then(|rows| rows.get(key))
+            .filter(|row| !row.deleted)
+            .cloned())
     }
 
     /// Subscribe to canonical mutation events.
@@ -1820,6 +2006,22 @@ impl FeltDb {
             .collect())
     }
 
+    /// Materialized rows belonging to one application state namespace.
+    ///
+    /// State-contract capabilities are encoded as `<state namespace>:<collection>`.
+    /// Selecting the capability buckets before cloning prevents one application's
+    /// read snapshot from materializing every other application's durable rows.
+    pub fn state_rows_for_namespace(&self, state_namespace: &str) -> Result<Vec<StoredRow>> {
+        let inner = self.inner.lock().expect("lock poisoned");
+        let prefix = format!("{state_namespace}:");
+        Ok(inner
+            .rows
+            .iter()
+            .filter(|(capability, _)| capability.starts_with(&prefix))
+            .flat_map(|(_, bucket)| bucket.values().cloned())
+            .collect())
+    }
+
     pub fn can_install_snapshot(&self) -> Result<bool> {
         let inner = self.inner.lock().expect("lock poisoned");
         Ok(!inner.bootstrapped && inner.rows.is_empty() && inner.change_log.pending.is_empty())
@@ -2095,6 +2297,7 @@ impl FeltDb {
                 {
                     history_row.operation = Some(op.clone());
                     append_event(&inner.path, &history_row)?;
+                    inner.authority_revision += 1;
                 }
                 inner.change_log.add_operation(op);
                 inner.sync_state.increment_received(1);
@@ -2120,6 +2323,7 @@ impl FeltDb {
         match op_to_apply.op_type {
             OperationType::Insert | OperationType::Update => {
                 append_event(&inner.path, &row)?;
+                inner.authority_revision += 1;
                 inner
                     .rows
                     .entry(op_to_apply.capability.clone())
@@ -2128,6 +2332,7 @@ impl FeltDb {
             }
             OperationType::Delete => {
                 append_event(&inner.path, &row)?;
+                inner.authority_revision += 1;
                 if let Some(bucket) = inner.rows.get_mut(&op_to_apply.capability) {
                     bucket.remove(&op_to_apply.key);
                 }
@@ -2530,8 +2735,29 @@ fn replay_log(inner: &mut Inner) -> Result<()> {
         }
         if value.get("record_type").and_then(Value::as_str) == Some("feltdb.transaction.v1") {
             let transaction: TransactionLogRecord = serde_json::from_value(value)?;
+            // Older records did not carry a commit revision. Their durable
+            // order in the log supplies an unambiguous upgrade path.
+            inner.authority_revision =
+                inner
+                    .authority_revision
+                    .max(if transaction.commit_revision == 0 {
+                        inner.authority_revision + 1
+                    } else {
+                        transaction.commit_revision
+                    });
+            let base_revision = if transaction.commit_revision == 0 {
+                inner.authority_revision.saturating_sub(1)
+            } else {
+                transaction.base_revision
+            };
+            inner.transaction_revisions.insert(
+                transaction.transaction_id.clone(),
+                (base_revision, inner.authority_revision),
+            );
             if let Some(hash) = transaction.payload_hash.clone() {
-                inner.transaction_payload_hashes.insert(transaction.transaction_id.clone(), hash);
+                inner
+                    .transaction_payload_hashes
+                    .insert(transaction.transaction_id.clone(), hash);
             }
             if inner
                 .applied_transactions
@@ -2578,6 +2804,7 @@ fn replay_log(inner: &mut Inner) -> Result<()> {
             // store. Preserve a monotonic sequence when upgrading them.
             inner.sequence += 1;
         }
+        inner.authority_revision += 1;
         if let Some(id) = row
             .key
             .rsplit_once(':')
@@ -2605,7 +2832,9 @@ fn replay_log(inner: &mut Inner) -> Result<()> {
     // Compute collection cardinality from final row state (count non-deleted rows per capability)
     for (capability, bucket) in &inner.rows {
         let count = bucket.values().filter(|row| !row.deleted).count() as u64;
-        inner.collection_cardinality.insert(capability.clone(), count);
+        inner
+            .collection_cardinality
+            .insert(capability.clone(), count);
     }
 
     Ok(())
@@ -3331,7 +3560,8 @@ mod tests {
             },
         ];
 
-        db.apply_atomic_transaction("txn-1", None, &[], &mutations, None).unwrap();
+        db.apply_atomic_transaction("txn-1", None, &[], &mutations, None)
+            .unwrap();
 
         let cardinality = db.collection_cardinality(capability).unwrap();
         assert_eq!(cardinality, 2, "Cardinality should be 2 after 2 inserts");
@@ -3352,9 +3582,14 @@ mod tests {
                 value: Some(serde_json::json!({"id": i, "name": format!("Record {}", i)})),
             }];
 
-            db.apply_atomic_transaction(&format!("txn-{}", i), None, &[], &mutations, None).unwrap();
+            db.apply_atomic_transaction(&format!("txn-{}", i), None, &[], &mutations, None)
+                .unwrap();
             let cardinality = db.collection_cardinality(capability).unwrap();
-            assert_eq!(cardinality, i as u64, "Cardinality should be {} after {} inserts", i, i);
+            assert_eq!(
+                cardinality, i as u64,
+                "Cardinality should be {} after {} inserts",
+                i, i
+            );
         }
 
         let _ = fs::remove_file(path);
@@ -3384,19 +3619,23 @@ mod tests {
             },
         ];
 
-        db.apply_atomic_transaction("txn-insert", None, &[], &insert_mutations, None).unwrap();
+        db.apply_atomic_transaction("txn-insert", None, &[], &insert_mutations, None)
+            .unwrap();
         assert_eq!(db.collection_cardinality(capability).unwrap(), 3);
 
-        let delete_mutations = vec![
-            AtomicMutation {
-                capability: capability.to_string(),
-                key: "rec-1".to_string(),
-                value: None,
-            },
-        ];
+        let delete_mutations = vec![AtomicMutation {
+            capability: capability.to_string(),
+            key: "rec-1".to_string(),
+            value: None,
+        }];
 
-        db.apply_atomic_transaction("txn-delete", None, &[], &delete_mutations, None).unwrap();
-        assert_eq!(db.collection_cardinality(capability).unwrap(), 2, "Cardinality should be 2 after deleting 1 record");
+        db.apply_atomic_transaction("txn-delete", None, &[], &delete_mutations, None)
+            .unwrap();
+        assert_eq!(
+            db.collection_cardinality(capability).unwrap(),
+            2,
+            "Cardinality should be 2 after deleting 1 record"
+        );
 
         let _ = fs::remove_file(path);
     }
@@ -3413,7 +3652,8 @@ mod tests {
             value: Some(serde_json::json!({"id": 1, "status": "active"})),
         }];
 
-        db.apply_atomic_transaction("txn-insert", None, &[], &insert_mutations, None).unwrap();
+        db.apply_atomic_transaction("txn-insert", None, &[], &insert_mutations, None)
+            .unwrap();
         assert_eq!(db.collection_cardinality(capability).unwrap(), 1);
 
         let update_mutations = vec![AtomicMutation {
@@ -3422,8 +3662,13 @@ mod tests {
             value: Some(serde_json::json!({"id": 1, "status": "inactive"})),
         }];
 
-        db.apply_atomic_transaction("txn-update", None, &[], &update_mutations, None).unwrap();
-        assert_eq!(db.collection_cardinality(capability).unwrap(), 1, "Cardinality should remain 1 after update");
+        db.apply_atomic_transaction("txn-update", None, &[], &update_mutations, None)
+            .unwrap();
+        assert_eq!(
+            db.collection_cardinality(capability).unwrap(),
+            1,
+            "Cardinality should remain 1 after update"
+        );
 
         let _ = fs::remove_file(path);
     }
@@ -3449,14 +3694,18 @@ mod tests {
                 },
             ];
 
-            db.apply_atomic_transaction("txn-1", None, &[], &mutations, None).unwrap();
+            db.apply_atomic_transaction("txn-1", None, &[], &mutations, None)
+                .unwrap();
             assert_eq!(db.collection_cardinality(capability).unwrap(), 2);
         }
 
         let reopened = open(&path).unwrap();
         let capability = "test_collection";
         let cardinality = reopened.collection_cardinality(capability).unwrap();
-        assert_eq!(cardinality, 2, "Cardinality should survive restart and be recomputed from rows");
+        assert_eq!(
+            cardinality, 2,
+            "Cardinality should survive restart and be recomputed from rows"
+        );
 
         let _ = fs::remove_file(path);
     }
@@ -3488,9 +3737,13 @@ mod tests {
             });
         }
 
-        db.apply_atomic_transaction("txn-large", None, &[], &mutations, None).unwrap();
+        db.apply_atomic_transaction("txn-large", None, &[], &mutations, None)
+            .unwrap();
         let cardinality = db.collection_cardinality(capability).unwrap();
-        assert_eq!(cardinality, 100, "Large collection with 100 records should have cardinality 100");
+        assert_eq!(
+            cardinality, 100,
+            "Large collection with 100 records should have cardinality 100"
+        );
 
         let _ = fs::remove_file(path);
     }
@@ -3516,7 +3769,8 @@ mod tests {
             },
         ];
 
-        db.apply_atomic_transaction("txn-col1", None, &[], &mutations1, None).unwrap();
+        db.apply_atomic_transaction("txn-col1", None, &[], &mutations1, None)
+            .unwrap();
 
         let mutations2 = vec![
             AtomicMutation {
@@ -3536,7 +3790,8 @@ mod tests {
             },
         ];
 
-        db.apply_atomic_transaction("txn-col2", None, &[], &mutations2, None).unwrap();
+        db.apply_atomic_transaction("txn-col2", None, &[], &mutations2, None)
+            .unwrap();
 
         assert_eq!(db.collection_cardinality(col1).unwrap(), 2);
         assert_eq!(db.collection_cardinality(col2).unwrap(), 3);