@feltdb/core 0.8.4 → 0.8.6

package/dist/create/server-source/crates/feltdb/src/state_model.rs

@@ -20,7 +20,7 @@ use std::collections::{BTreeMap, BTreeSet, HashMap};
 use std::sync::{Arc, Mutex};
 
 // Forward declaration to avoid circular imports
-pub struct FeltDb;  // Will be linked at compile time from lib.rs
+pub struct FeltDb; // Will be linked at compile time from lib.rs
 
 /// Version constant for state model contracts
 pub const STATE_MODEL_VERSION: u32 = 1;
@@ -66,15 +66,41 @@ impl std::fmt::Display for StateId {
 // StateRevision: Immutable State Snapshot with Ancestry
 // ============================================================================
 
-/// Immutable state revision with explicit ancestry
+/// An immutable, resource-scoped historical state.
+///
+/// A revision is a revision **of a resource**. Two resources holding identical
+/// content are distinct revisions, and a resource that returns to a value it
+/// previously held records a *new* revision rather than resurrecting the old
+/// one.
+///
+/// # Two identities, deliberately
+///
+/// `id` is the **revision identity**: what distinguishes one historical
+/// occurrence from another. It is computed over the resource, the content, the
+/// parent and a per-resource sequence, so content equality is not identity.
+///
+/// `content_id` is the **content identity**, the hash of the canonical content
+/// alone. It is what makes a revision verifiable against its own bytes, and it
+/// is what deduplicates *content* comparisons — two revisions of the same state
+/// share a `content_id` and differ in `id`.
+///
+/// Conflating these two was the defect the identity contract found: a revert
+/// produced a revision whose identity already existed, so committing it
+/// overwrote the earlier one and closed a cycle in the parent chain.
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct StateRevision {
-    /// Deterministic content-addressed identifier
+    /// Revision identity — resource, content, parent and sequence.
     pub id: StateId,
+    /// The resource this is a revision of.
+    pub resource: String,
     /// Canonical JSON representation (representation-sensitive)
     pub content: String,
-    /// Parent revision id (if any). Empty for initial state.
+    /// Content identity — the hash of `content` alone.
+    pub content_id: StateId,
+    /// Parent revision id. `None` only for a resource's first revision.
     pub parent_id: Option<StateId>,
+    /// Position in this resource's history. Strictly increasing, never reused.
+    pub sequence: u64,
     /// Authority that produced this revision
     pub authority: String,
     /// Timestamp when revision was created (informational only, not used for ordering)
@@ -83,60 +109,106 @@ pub struct StateRevision {
     pub metadata: BTreeMap<String, Value>,
 }
 
+/// Compute a revision identity.
+///
+/// Every component participates: the same content is a different revision on a
+/// different resource, from a different parent, or at a different point in the
+/// resource's history. The parts are length-prefixed so no two distinct tuples
+/// can produce the same input string.
+fn compute_revision_id(
+    resource: &str,
+    content_id: &StateId,
+    parent_id: Option<&StateId>,
+    sequence: u64,
+) -> StateId {
+    let parent = parent_id.map(StateId::as_hex).unwrap_or("");
+    let material = format!(
+        "feltdb.revision.v2\n{}:{}\n{}:{}\n{}:{}\n{}",
+        resource.len(),
+        resource,
+        content_id.as_hex().len(),
+        content_id.as_hex(),
+        parent.len(),
+        parent,
+        sequence,
+    );
+    StateId::compute(&material)
+}
+
 impl StateRevision {
-    /// Create initial state revision
-    pub fn initial(content: String, authority: String) -> Self {
-        let id = StateId::compute(&content);
-        let timestamp_ms = std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap()
-            .as_millis() as u64;
+    /// Create a resource's first revision.
+    pub fn initial(resource: String, content: String, authority: String) -> Self {
+        Self::at(resource, content, None, 0, authority)
+    }
 
-        StateRevision {
-            id,
+    /// Create a revision descending from `parent`, on the parent's resource.
+    pub fn child(content: String, parent: &StateRevision, authority: String) -> Self {
+        Self::at(
+            parent.resource.clone(),
             content,
-            parent_id: None,
+            Some(parent.id.clone()),
+            parent.sequence + 1,
             authority,
-            timestamp_ms,
-            metadata: BTreeMap::new(),
-        }
+        )
     }
 
-    /// Create child revision from parent
-    pub fn child(
+    /// Create a revision at an explicit position in a resource's history.
+    pub fn at(
+        resource: String,
         content: String,
-        parent: &StateRevision,
+        parent_id: Option<StateId>,
+        sequence: u64,
         authority: String,
     ) -> Self {
-        let id = StateId::compute(&content);
+        let content_id = StateId::compute(&content);
+        let id = compute_revision_id(&resource, &content_id, parent_id.as_ref(), sequence);
         let timestamp_ms = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
-            .unwrap()
+            .unwrap_or_default()
             .as_millis() as u64;
 
         StateRevision {
             id,
+            resource,
             content,
-            parent_id: Some(parent.id.clone()),
+            content_id,
+            parent_id,
+            sequence,
             authority,
             timestamp_ms,
             metadata: BTreeMap::new(),
         }
     }
 
-    /// Verify content matches id
+    /// Verify that both identities match what they are computed from.
     pub fn verify_integrity(&self) -> bool {
-        StateId::compute(&self.content) == self.id
+        self.content_id == StateId::compute(&self.content)
+            && self.id
+                == compute_revision_id(
+                    &self.resource,
+                    &self.content_id,
+                    self.parent_id.as_ref(),
+                    self.sequence,
+                )
     }
 
-    /// Get parent id if this is not initial state
+    /// Get parent id if this is not a resource's first revision.
     pub fn parent(&self) -> Option<&StateId> {
         self.parent_id.as_ref()
     }
 
-    /// Check if two revisions are the same
+    /// Whether two revisions are the same revision.
+    ///
+    /// Revision identity, not content equality: two revisions of the same state
+    /// on the same resource are not equal.
     pub fn equals(&self, other: &StateRevision) -> bool {
-        self.id == other.id && self.content == other.content
+        self.id == other.id
+    }
+
+    /// Whether two revisions hold the same state, regardless of where in
+    /// history they occur.
+    pub fn same_content_as(&self, other: &StateRevision) -> bool {
+        self.content_id == other.content_id
     }
 }
 
@@ -191,11 +263,19 @@ impl StateTopology {
         if a == b {
             return true;
         }
+        // The revision model makes this graph acyclic, so the visited set is a
+        // safety belt rather than the thing that makes the walk correct: a
+        // topology assembled by hand, or read from an older log, must not be
+        // able to hang a caller.
+        let mut visited = BTreeSet::new();
         let mut current = b.clone();
         while let Some(parent_id) = self.parents.get(&current) {
             if parent_id == a {
                 return true;
             }
+            if !visited.insert(current.clone()) {
+                return false;
+            }
             current = parent_id.clone();
         }
         false
@@ -204,9 +284,13 @@ impl StateTopology {
     /// Get all ancestors of a revision (excluding self)
     pub fn ancestors(&self, id: &StateId) -> Vec<StateId> {
         let mut ancestors = Vec::new();
+        let mut visited = BTreeSet::new();
         let mut current = id.clone();
 
         while let Some(parent_id) = self.parents.get(&current) {
+            if !visited.insert(current.clone()) {
+                break;
+            }
             ancestors.push(parent_id.clone());
             current = parent_id.clone();
         }
@@ -222,11 +306,15 @@ impl StateTopology {
 
         let ancestors_a: BTreeSet<_> = self.ancestors(a).iter().cloned().collect();
 
+        let mut visited = BTreeSet::new();
         let mut current = b.clone();
         while let Some(parent_id) = self.parents.get(&current) {
             if ancestors_a.contains(parent_id) {
                 return Some(parent_id.clone());
             }
+            if !visited.insert(current.clone()) {
+                break;
+            }
             current = parent_id.clone();
         }
 
@@ -275,6 +363,70 @@ pub enum PathComponent {
     Index(usize),
 }
 
+/// How two changed paths relate to one another.
+///
+/// Conflict classification needs this because two changes interact whenever one
+/// path contains the other, not only when the paths are equal. Comparison is
+/// structural, over whole [`PathComponent`]s: `["a", "b"]` and `["a", "bc"]` are
+/// [`PathRelation::Disjoint`], even though one rendering of them shares a string
+/// prefix, and `["a"]` with `Key("a")` never matches `Index(0)`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PathRelation {
+    /// The same path.
+    Same,
+    /// The first path contains the second: `a` against `a.b`.
+    Ancestor,
+    /// The first path is contained by the second: `a.b` against `a`.
+    Descendant,
+    /// Neither contains the other: siblings, or unrelated subtrees.
+    Disjoint,
+}
+
+/// Whether `candidate` begins with every component of `prefix`, structurally.
+fn path_starts_with(candidate: &[PathComponent], prefix: &[PathComponent]) -> bool {
+    candidate.len() >= prefix.len() && candidate[..prefix.len()] == *prefix
+}
+
+/// Classifies how two changed paths relate.
+///
+/// Pure, total, and independent of any state: it reads only the two paths.
+pub fn path_relation(one: &[PathComponent], two: &[PathComponent]) -> PathRelation {
+    if one == two {
+        PathRelation::Same
+    } else if path_starts_with(two, one) {
+        PathRelation::Ancestor
+    } else if path_starts_with(one, two) {
+        PathRelation::Descendant
+    } else {
+        PathRelation::Disjoint
+    }
+}
+
+/// Whether two changed paths interact: equal, or one containing the other.
+///
+/// This is the predicate conflict classification is defined over. Two changes
+/// at overlapping paths cannot both be applied — the outer one determines the
+/// value the inner one was editing — so they are never independent.
+pub fn paths_overlap(one: &[PathComponent], two: &[PathComponent]) -> bool {
+    !matches!(path_relation(one, two), PathRelation::Disjoint)
+}
+
+/// Reads the value a path names, or `None` when the path does not resolve.
+///
+/// Object members are addressed by [`PathComponent::Key`] and array elements by
+/// [`PathComponent::Index`], exactly as [`SemanticDiff`] emits them, so a path
+/// taken from a diff resolves in the state that diff was computed from.
+pub fn resolve_path<'a>(value: &'a Value, path: &[PathComponent]) -> Option<&'a Value> {
+    let mut current = value;
+    for component in path {
+        current = match component {
+            PathComponent::Key(key) => current.as_object()?.get(key)?,
+            PathComponent::Index(index) => current.as_array()?.get(*index)?,
+        };
+    }
+    Some(current)
+}
+
 /// Semantic change at a specific path (deterministically ordered)
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SemanticChange {
@@ -305,10 +457,7 @@ impl SemanticDiff {
         Self::diff_recursive(old, new, &mut vec![], &mut changes);
 
         // Sort deterministically
-        changes.sort_by(|a, b| {
-            a.path.cmp(&b.path)
-                .then_with(|| a.kind.cmp(&b.kind))
-        });
+        changes.sort_by(|a, b| a.path.cmp(&b.path).then_with(|| a.kind.cmp(&b.kind)));
 
         SemanticDiff {
             changes,
@@ -411,6 +560,11 @@ impl SemanticDiff {
 // ============================================================================
 
 /// Classification of conflict between two changes
+///
+/// `Independent` carries the strong meaning its name and the state-model
+/// graduation audit both assert: the two branches' changes at this path do not
+/// overlap, so both can be applied without either overwriting or invalidating
+/// the other. It is not merely "the paths differ" — see [`paths_overlap`].
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub enum ConflictClass {
     /// Changes don't overlap; can merge automatically
@@ -426,8 +580,18 @@ pub enum ConflictClass {
 pub struct PathConflict {
     pub path: Vec<PathComponent>,
     pub classification: ConflictClass,
+    /// The common ancestor's value at this path, or `None` when the path does
+    /// not resolve in the base.
+    ///
+    /// Read from the base state itself. It was previously read from the left
+    /// branch's change, which reported `None` for a path only the right branch
+    /// touched even when the base held a value there.
     pub base_value: Option<Value>,
+    /// The left branch's value at this path, or `None` if the left branch did
+    /// not change it or removed it.
     pub left_value: Option<Value>,
+    /// The right branch's value at this path, or `None` if the right branch did
+    /// not change it or removed it.
     pub right_value: Option<Value>,
 }
 
@@ -442,69 +606,96 @@ pub struct ConflictClassification {
 
 impl ConflictClassification {
     /// Classify conflicts from three-way merge
-    /// base: common ancestor, left: first branch, right: second branch
-    pub fn classify(
-        base: &StateRevision,
-        left: &StateRevision,
-        right: &StateRevision,
-    ) -> Self {
+    ///
+    /// `base` is the common ancestor, `left` the first branch, `right` the
+    /// second. Only each revision's `content` is read.
+    ///
+    /// Two changes interact whenever their paths **overlap** — equal, or one
+    /// containing the other — not only when they are equal. A branch that
+    /// replaces `o` and a branch that edits `o.a` cannot both be applied: the
+    /// first determines the value the second was editing. Both such paths are
+    /// reported as [`ConflictClass::Conflict`].
+    ///
+    /// An overlap that is not at the same path can never be convergent. For a
+    /// descendant path to exist, the base must hold a container there; a change
+    /// reported *at* the ancestor path means that branch no longer holds a
+    /// container of that kind, while the branch editing inside it still does.
+    /// The two values therefore always differ. `classify` does not rely on that
+    /// argument — it compares the two branches' resulting values — but the
+    /// conformance suite asserts it, so the reasoning stays checked.
+    pub fn classify(base: &StateRevision, left: &StateRevision, right: &StateRevision) -> Self {
         use serde_json::Value;
 
-        let base_json: Value = serde_json::from_str(&base.content)
-            .unwrap_or(Value::Null);
-        let left_json: Value = serde_json::from_str(&left.content)
-            .unwrap_or(Value::Null);
-        let right_json: Value = serde_json::from_str(&right.content)
-            .unwrap_or(Value::Null);
+        let base_json: Value = serde_json::from_str(&base.content).unwrap_or(Value::Null);
+        let left_json: Value = serde_json::from_str(&left.content).unwrap_or(Value::Null);
+        let right_json: Value = serde_json::from_str(&right.content).unwrap_or(Value::Null);
 
-        let base_diff = SemanticDiff::compute(&base_json, &left_json);
+        let left_diff = SemanticDiff::compute(&base_json, &left_json);
         let right_diff = SemanticDiff::compute(&base_json, &right_json);
 
         let mut path_conflicts = Vec::new();
         let mut has_conflict = false;
 
-        // Convert changes to map for easier lookup
-        let base_paths: BTreeMap<Vec<PathComponent>, &SemanticChange> =
-            base_diff.changes.iter()
-                .map(|c| (c.path.clone(), c))
-                .collect();
-        let right_paths: BTreeMap<Vec<PathComponent>, &SemanticChange> =
-            right_diff.changes.iter()
-                .map(|c| (c.path.clone(), c))
-                .collect();
+        let left_paths: BTreeMap<Vec<PathComponent>, &SemanticChange> = left_diff
+            .changes
+            .iter()
+            .map(|c| (c.path.clone(), c))
+            .collect();
+        let right_paths: BTreeMap<Vec<PathComponent>, &SemanticChange> = right_diff
+            .changes
+            .iter()
+            .map(|c| (c.path.clone(), c))
+            .collect();
 
         // Find all unique paths
-        let all_paths: BTreeSet<_> = base_paths.keys()
+        let all_paths: BTreeSet<_> = left_paths
+            .keys()
             .chain(right_paths.keys())
             .cloned()
             .collect();
 
         for path in all_paths {
-            let left_change = base_paths.get(&path);
+            let left_change = left_paths.get(&path);
             let right_change = right_paths.get(&path);
 
             let classification = match (left_change, right_change) {
-                (None, None) => ConflictClass::Independent,
-                (Some(lc), None) => ConflictClass::Independent,
-                (None, Some(rc)) => ConflictClass::Independent,
                 (Some(lc), Some(rc)) => {
-                    if lc.kind == rc.kind
-                        && lc.new_value == rc.new_value
-                    {
+                    if lc.kind == rc.kind && lc.new_value == rc.new_value {
                         ConflictClass::Convergent
                     } else {
                         has_conflict = true;
                         ConflictClass::Conflict
                     }
                 }
+                // Only one branch changed this path. It is independent only if
+                // the other branch changed nothing that contains it or that it
+                // contains.
+                (Some(_), None) => {
+                    if overlapping_change_exists(&right_paths, &path) {
+                        has_conflict = true;
+                        ConflictClass::Conflict
+                    } else {
+                        ConflictClass::Independent
+                    }
+                }
+                (None, Some(_)) => {
+                    if overlapping_change_exists(&left_paths, &path) {
+                        has_conflict = true;
+                        ConflictClass::Conflict
+                    } else {
+                        ConflictClass::Independent
+                    }
+                }
+                // Unreachable: every path came from one of the two maps.
+                (None, None) => ConflictClass::Independent,
             };
 
             path_conflicts.push(PathConflict {
-                path,
+                path: path.clone(),
                 classification,
-                base_value: left_change.map(|c| c.old_value.clone()).flatten(),
-                left_value: left_change.map(|c| c.new_value.clone()).flatten(),
-                right_value: right_change.map(|c| c.new_value.clone()).flatten(),
+                base_value: resolve_path(&base_json, &path).cloned(),
+                left_value: left_change.and_then(|c| c.new_value.clone()),
+                right_value: right_change.and_then(|c| c.new_value.clone()),
             });
         }
 
@@ -513,7 +704,10 @@ impl ConflictClassification {
 
         let overall = if has_conflict {
             ConflictClass::Conflict
-        } else if path_conflicts.iter().any(|c| c.classification == ConflictClass::Convergent) {
+        } else if path_conflicts
+            .iter()
+            .any(|c| c.classification == ConflictClass::Convergent)
+        {
             ConflictClass::Convergent
         } else {
             ConflictClass::Independent
@@ -526,6 +720,28 @@ impl ConflictClassification {
     }
 }
 
+/// Whether `changes` holds any change at a path overlapping `path`, other than
+/// at `path` itself.
+///
+/// Ancestors are the proper prefixes of `path`, so there are at most as many as
+/// the path is deep. Descendants are contiguous in sorted order — every
+/// sequence beginning with `path` sorts together, directly after `path` — so the
+/// first key strictly greater than `path` decides whether any exists.
+fn overlapping_change_exists(
+    changes: &BTreeMap<Vec<PathComponent>, &SemanticChange>,
+    path: &[PathComponent],
+) -> bool {
+    for depth in 0..path.len() {
+        if changes.contains_key(&path[..depth].to_vec()) {
+            return true;
+        }
+    }
+    changes
+        .range(path.to_vec()..)
+        .find(|(candidate, _)| candidate.as_slice() != path)
+        .is_some_and(|(candidate, _)| path_starts_with(candidate, path))
+}
+
 // ============================================================================
 // Reconciliation: Explicit Parent Choice Mechanism
 // ============================================================================
@@ -547,12 +763,7 @@ pub struct ReconciliationPlan {
 
 impl ReconciliationPlan {
     /// Create reconciliation plan with explicit parent choice
-    pub fn new(
-        left_id: StateId,
-        right_id: StateId,
-        base_id: StateId,
-        parent_choice: bool,
-    ) -> Self {
+    pub fn new(left_id: StateId, right_id: StateId, base_id: StateId, parent_choice: bool) -> Self {
         ReconciliationPlan {
             left_id,
             right_id,
@@ -586,301 +797,928 @@ pub struct StateReconciliationResult {
     pub plan: ReconciliationPlan,
 }
 
+// ----------------------------------------------------------------------------
+// Applying a reconciliation plan
+// ----------------------------------------------------------------------------
+//
+// The plan says what the caller decided. Application produces the state that
+// decision names, and nothing else:
+//
+//     Classification  — which changes can coexist?
+//     Plan            — what happens to the ones that cannot?
+//     Application     — produce the resulting state from that decision.
+//
+// Nothing here merges. Nothing here resolves a conflict on the caller's behalf.
+// A path the plan does not mention keeps whatever the *selected parent* holds,
+// which is the caller's decision too — it is what `parent_choice` selects.
+
+/// The plan does not reference three usable revisions.
+pub const RECONCILE_PLAN_INVALID: &str = "RECONCILE_PLAN_INVALID";
+/// A supplied revision is not the one the plan names.
+pub const RECONCILE_REVISION_MISMATCH: &str = "RECONCILE_REVISION_MISMATCH";
+/// The selected parent's content is not JSON, so there is no state to start from.
+pub const RECONCILE_CONTENT_UNPARSEABLE: &str = "RECONCILE_CONTENT_UNPARSEABLE";
+/// Two override paths overlap, so the plan does not say what the result is.
+pub const RECONCILE_OVERRIDE_PATHS_OVERLAP: &str = "RECONCILE_OVERRIDE_PATHS_OVERLAP";
+/// An override path does not name an assignable location in the selected parent.
+pub const RECONCILE_OVERRIDE_UNADDRESSABLE: &str = "RECONCILE_OVERRIDE_UNADDRESSABLE";
+
+impl ReconciliationPlan {
+    /// The branch this plan selects as the state to start from.
+    ///
+    /// `parent_choice` is a `bool` and so has exactly two values: `true` is the
+    /// left branch, `false` the right. The ancestor is not a choice, and there
+    /// is no third value for this to reject.
+    pub fn selected_parent<'a>(
+        &self,
+        left: &'a StateRevision,
+        right: &'a StateRevision,
+    ) -> &'a StateRevision {
+        if self.parent_choice {
+            left
+        } else {
+            right
+        }
+    }
+
+    /// The conflicting paths this plan supplies no override for.
+    ///
+    /// Descriptive, not enforced. Application does **not** require an override
+    /// for every conflict: leaving one unaddressed resolves it to whatever the
+    /// selected parent holds, and selecting that parent is itself an explicit
+    /// caller decision. A caller that wants every conflict addressed
+    /// individually can require this to be empty before applying.
+    pub fn unresolved_conflicts(
+        &self,
+        classification: &ConflictClassification,
+    ) -> Vec<Vec<PathComponent>> {
+        classification
+            .path_conflicts
+            .iter()
+            .filter(|entry| entry.classification == ConflictClass::Conflict)
+            .map(|entry| entry.path.clone())
+            .filter(|path| !self.path_overrides.contains_key(path))
+            .collect()
+    }
+}
+
+/// Applies a reconciliation plan, producing canonical reconciled content.
+///
+/// Pure and total with respect to its inputs: it reads the three revisions and
+/// the plan, mutates none of them, consults no clock, filesystem, network or
+/// global state, and returns either canonical JSON or a stable error code.
+///
+/// # What it does
+///
+/// 1. Checks the plan validates and names the three revisions supplied.
+/// 2. Takes the state of the branch `parent_choice` selects.
+/// 3. Assigns each override into it.
+/// 4. Serializes the result canonically.
+///
+/// # What it does not do
+///
+/// It does not merge, and it does not consult the other branch or the ancestor
+/// for anything but identity. A conflicting path with no override keeps the
+/// selected parent's value.
+///
+/// # Overrides
+///
+/// `path_overrides` is a map keyed by structural path, so a repeated path
+/// cannot exist — the type forecloses it. What the type does not foreclose is
+/// two paths where one *contains* the other, and such a plan does not say what
+/// the result should be: does the inner override refine the outer value, or was
+/// the outer one meant to stand? Rather than invent a precedence the plan never
+/// stated, overlapping override paths are rejected. Overlap is the same
+/// structural relation conflict classification uses, so `a.b` and `a.bc` are
+/// not an overlap.
+///
+/// Because overlaps are rejected, the order overrides are applied in cannot
+/// affect the result.
+///
+/// An override path must be *addressable* in the selected state: every proper
+/// prefix must already resolve to a container of the matching kind. Assigning a
+/// member to an existing object is allowed whether or not the member is already
+/// there, because it creates no structure. Assigning past the end of an array is
+/// not, because it would require inventing the elements in between. To change an
+/// array's length, or to remove a member, override the container itself — a
+/// `Value` cannot express absence, so removal has no other encoding in this
+/// plan.
+pub fn apply_reconciliation_plan(
+    base: &StateRevision,
+    left: &StateRevision,
+    right: &StateRevision,
+    plan: &ReconciliationPlan,
+) -> Result<String, String> {
+    if !plan.validate() {
+        return Err(format!(
+            "{RECONCILE_PLAN_INVALID}: the plan does not reference three revisions"
+        ));
+    }
+    for (label, expected, supplied) in [
+        ("base", &plan.base_id, &base.id),
+        ("left", &plan.left_id, &left.id),
+        ("right", &plan.right_id, &right.id),
+    ] {
+        if expected != supplied {
+            return Err(format!(
+                "{RECONCILE_REVISION_MISMATCH}: the plan names a different {label} revision"
+            ));
+        }
+    }
+
+    let parent = plan.selected_parent(left, right);
+    let mut state: Value = serde_json::from_str(&parent.content).map_err(|error| {
+        // Classification tolerates unparseable content by reading it as JSON
+        // null, because it only describes. Materializing a state from content
+        // nobody can parse would be producing arbitrary state, so this refuses.
+        format!(
+            "{RECONCILE_CONTENT_UNPARSEABLE}: the selected parent's content is not JSON: {error}"
+        )
+    })?;
+
+    // `BTreeMap` sorts its keys, and every sequence with a given prefix sorts
+    // contiguously after it, so any containment relation shows up between two
+    // consecutive keys.
+    let paths: Vec<&Vec<PathComponent>> = plan.path_overrides.keys().collect();
+    for pair in paths.windows(2) {
+        if paths_overlap(pair[0], pair[1]) {
+            return Err(format!(
+                "{RECONCILE_OVERRIDE_PATHS_OVERLAP}: {:?} and {:?} overlap, so the plan does \
+                 not say what the result is",
+                pair[0], pair[1]
+            ));
+        }
+    }
+
+    for (path, value) in &plan.path_overrides {
+        assign_path(&mut state, path, value.clone())?;
+    }
+
+    serde_json::to_string(&state)
+        .map_err(|error| format!("{RECONCILE_CONTENT_UNPARSEABLE}: {error}"))
+}
+
+/// Assigns `value` at `path`, or reports why the path is not assignable.
+fn assign_path(state: &mut Value, path: &[PathComponent], value: Value) -> Result<(), String> {
+    let Some((last, prefix)) = path.split_last() else {
+        // The empty path is the state itself.
+        *state = value;
+        return Ok(());
+    };
+
+    let mut current = state;
+    for (depth, component) in prefix.iter().enumerate() {
+        current = match component {
+            PathComponent::Key(key) => current.as_object_mut().and_then(|o| o.get_mut(key)),
+            PathComponent::Index(index) => current.as_array_mut().and_then(|a| a.get_mut(*index)),
+        }
+        .ok_or_else(|| {
+            format!(
+                "{RECONCILE_OVERRIDE_UNADDRESSABLE}: {path:?} does not resolve at \
+                 component {depth} ({component:?})"
+            )
+        })?;
+    }
+
+    match last {
+        // A new member of an existing object creates no structure.
+        PathComponent::Key(key) => match current.as_object_mut() {
+            Some(members) => {
+                members.insert(key.clone(), value);
+                Ok(())
+            }
+            None => Err(format!(
+                "{RECONCILE_OVERRIDE_UNADDRESSABLE}: {path:?} names a member of \
+                 something that is not an object"
+            )),
+        },
+        // An index past the end would require inventing the elements before it.
+        PathComponent::Index(index) => match current.as_array_mut() {
+            Some(items) if *index < items.len() => {
+                items[*index] = value;
+                Ok(())
+            }
+            Some(items) => Err(format!(
+                "{RECONCILE_OVERRIDE_UNADDRESSABLE}: {path:?} is past the end of an \
+                 array of length {}",
+                items.len()
+            )),
+            None => Err(format!(
+                "{RECONCILE_OVERRIDE_UNADDRESSABLE}: {path:?} indexes something that \
+                 is not an array"
+            )),
+        },
+    }
+}
+
+/// Applies a plan and materializes the result as a new revision.
+///
+/// The revision is built with the existing [`StateRevision::child`] constructor,
+/// so it carries the existing content-addressed identity and takes the selected
+/// parent as its parent. Nothing here is a new identity algorithm, and nothing
+/// here moves a branch head, writes to a store, or touches replication: the
+/// result is a value the caller decides what to do with.
+///
+/// Unlike [`apply_reconciliation_plan`], this is not pure — `StateRevision`
+/// timestamps come from the clock, as they do for every other revision this
+/// model creates. The application semantics stay in the pure function.
+pub fn reconcile(
+    base: &StateRevision,
+    left: &StateRevision,
+    right: &StateRevision,
+    plan: &ReconciliationPlan,
+    authority: String,
+) -> Result<StateReconciliationResult, String> {
+    let content = apply_reconciliation_plan(base, left, right, plan)?;
+    let parent = plan.selected_parent(left, right);
+    Ok(StateReconciliationResult {
+        materialized_state: StateRevision::child(content, parent, authority),
+        plan: plan.clone(),
+    })
+}
+
 // ============================================================================
 // ============================================================================
 // StateStore: Durable State Persistence and Retrieval
 // ============================================================================
 
-/// State storage and retrieval operations
-/// 
-/// StateStore integrates with FeltDB's canonical persistence layer for durability.
-/// Revisions are persisted through FeltDB's operation log with key schema:
-/// - "state:revision:{hex_id}" → StateRevision
-/// - "state:current" → current pointer
-/// - "state:branch:{name}" → branch pointers
+/// Durable, content-addressed revision storage.
+///
+/// `StateStore` answers exactly one question:
 ///
-/// For production use, StateStore MUST be initialized with FeltDB via
-/// `StateStore::with_feltdb()`. This ensures all mutations are persisted
-/// through FeltDB's canonical operation log.
+/// > **Do I have revision X?**
 ///
-/// For testing and validation of state semantics alone, StateStore::new_volatile()
-/// creates a non-persistent in-memory store.
+/// It deliberately does **not** answer *"what is the current revision?"*. That
+/// separation is the point of this type. State history and currentness are
+/// different concerns, and conflating them is what produced the two defects the
+/// branching audit recorded: a global `current` that moved on every commit
+/// regardless of which parent was named, and a branch map sharing one replicated
+/// record with it. Both lived in a single `state:current` row that nothing in
+/// the reconciliation chain ever read.
+///
+/// # The contract
+///
+/// | operation | method |
+/// | --- | --- |
+/// | put | [`create`](Self::create), [`commit`](Self::commit) |
+/// | get | [`get`](Self::get) |
+///
+/// Ancestry is not a third operation: it is [`get`](Self::get) followed by
+/// `parent_id`, repeated. [`parent`](Self::parent), [`exists`](Self::exists) and
+/// [`metadata`](Self::metadata) are conveniences over `get`, not new powers.
+///
+/// # Key schema
+///
+/// - `state:revision:{hex_id}` → [`StateRevision`]
+///
+/// That is the entire schema. A record keyed by the hash of its own content
+/// cannot be stale and needs no reconstruction, so there is **no recovery
+/// path**: [`with_feltdb`](Self::with_feltdb) does not scan, rebuild an index,
+/// or validate history before returning.
+///
+/// # What this deliberately does not provide
+///
+/// No `current`, no branches, no branch heads, no "latest". Nothing above the
+/// history layer is invented here. Something must eventually own *"which
+/// revision represents the current application state"* — a ref, an application
+/// record, a per-resource pointer, a transaction head — and that owner is not
+/// this type. Until it exists, callers hold the ids they care about.
+///
+/// # Non-claims
+///
+/// Proven for this type: durable single-writer append, retrieval by identity
+/// across restart, ancestry by parent traversal, and independence between
+/// records. **Not** proven and not claimed: multi-writer persistence semantics,
+/// concurrent revision creation, authorization, resource isolation, garbage
+/// collection, server lifecycle integration, current/head semantics, and
+/// distributed replication of revision history.
 pub struct StateStore {
-    revisions: Arc<Mutex<HashMap<StateId, StateRevision>>>,
-    current_id: Arc<Mutex<Option<StateId>>>,
-    branches: Arc<Mutex<HashMap<String, StateId>>>,
-    /// FeltDB reference for durable persistence
-    /// For production: REQUIRED (Some)
-    /// For testing: Optional (None)
-    /// Mutations silently succeed with None, losing persistence.
-    /// Production code must verify Some before use.
-    feltdb: Option<Arc<crate::FeltDb>>,
+    backing: Backing,
 }
 
-impl StateStore {
-    /// Create a new volatile (in-memory) state store
-    ///
-    /// This is for testing state semantics in isolation. Mutations
-    /// are stored in memory only and lost when the store is dropped.
-    ///
-    /// Do NOT use in production. Production must use `with_feltdb()`.
-    pub fn new_volatile() -> Self {
-        StateStore {
-            revisions: Arc::new(Mutex::new(HashMap::new())),
-            current_id: Arc::new(Mutex::new(None)),
-            branches: Arc::new(Mutex::new(HashMap::new())),
-            feltdb: None,
+/// Where revisions actually live.
+///
+/// There is exactly one copy of a revision in either mode. The durable mode
+/// keeps no second in-memory index beside FeltDB's own rows.
+enum Backing {
+    /// In-memory only, for testing state semantics in isolation.
+    Volatile(Arc<Mutex<VolatileState>>),
+    /// FeltDB is the storage, and keyed reads are the authoritative read path.
+    Durable(Arc<crate::FeltDb>),
+}
+
+/// The volatile backing's contents: revisions, and per-resource retention.
+#[derive(Default)]
+struct VolatileState {
+    revisions: HashMap<StateId, StateRevision>,
+    retention: HashMap<String, RetentionState>,
+}
+
+impl Clone for Backing {
+    fn clone(&self) -> Self {
+        match self {
+            Backing::Volatile(map) => Backing::Volatile(map.clone()),
+            Backing::Durable(db) => Backing::Durable(db.clone()),
         }
     }
+}
 
-    /// Create a new state store backed by FeltDB's canonical persistence
-    ///
-    /// This will:
-    /// - Recover all previously persisted state revisions from FeltDB
-    /// - Restore the current pointer
-    /// - Restore all branch references
-    /// - Validate recovered state integrity
-    /// - Persist all subsequent mutations through FeltDB's operation log
-    ///
-    /// # Arguments
-    /// * `feltdb` - Arc<FeltDb> instance for durable storage
-    ///
-    /// # Returns
-    /// * `Ok(StateStore)` - Successfully initialized store with FeltDB backing and recovered state
-    /// * `Err(String)` - If initialization or recovery fails
-    ///
-    /// # Recovery Process
-    ///
-    /// Recovery reconstructs the full state model from FeltDB records:
-    /// 1. Queries all StateRevision objects and deserializes them
-    /// 2. Retrieves "state:current" to restore the current pointer and branches
-    /// 3. Validates all parent references point to existing revisions
-    /// 4. Validates each StateRevision's content matches its StateId
-    /// 5. Validates topology consistency
+/// The durable key for a revision.
+fn revision_key(id: &StateId) -> String {
+    format!("state:revision:{}", id.as_hex())
+}
+
+/// Where a resource's retention watermark lives.
+fn retention_key(resource: &str) -> String {
+    format!("_retention:{resource}")
+}
+
+/// How much of a resource's history is kept.
+///
+/// Count-based only. Age-based retention is deliberately not implemented:
+/// nothing in the system needs it yet, and inventing a second policy dimension
+/// before the first has been measured would be guesswork.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RetentionPolicy {
+    /// Newest revisions to keep, or `None` to keep every revision.
     ///
-    /// If recovery encounters any malformed records or missing references,
-    /// it returns an error and does not create a partially-recovered store.
-    pub fn with_feltdb(feltdb: Arc<crate::FeltDb>) -> Result<Self, String> {
-        // Step 1: Recover all state revisions from FeltDB
-        // Query returns all StateRevision objects stored in FeltDB
-        let revisions: Vec<StateRevision> = feltdb
-            .query(|_rev: &StateRevision| true)
-            .map_err(|e| format!("Failed to query revisions from FeltDB: {}", e))?;
-
-        let mut revisions_map = HashMap::new();
-        for revision in revisions {
-            // Validate content matches id (this is the integrity check)
-            if !revision.verify_integrity() {
-                return Err(format!(
-                    "StateId mismatch during recovery: stored={}, content_hash={}",
-                    revision.id.as_hex(),
-                    StateId::compute(&revision.content).as_hex()
-                ));
-            }
+    /// Clamped to at least 1: **a resource's current revision always survives.**
+    pub keep_last: Option<usize>,
+}
 
-            // Validate parent references exist (if parent is specified)
-            if let Some(_parent_id) = &revision.parent_id {
-                // Parent will be validated once all revisions are loaded
-                // (parent may be recovered after child in query result)
-            }
+impl RetentionPolicy {
+    /// Keep everything. The default, because silently discarding history would
+    /// be a worse surprise than unbounded growth.
+    pub const fn unbounded() -> Self {
+        RetentionPolicy { keep_last: None }
+    }
 
-            revisions_map.insert(revision.id.clone(), revision);
+    /// Keep the newest `count` revisions of a resource.
+    pub fn keep_last(count: usize) -> Self {
+        RetentionPolicy {
+            keep_last: Some(count.max(1)),
         }
+    }
+}
 
-        // Step 2: Validate parent references after all revisions are loaded
-        for revision in revisions_map.values() {
-            if let Some(parent_id) = &revision.parent_id {
-                if !revisions_map.contains_key(parent_id) {
-                    return Err(format!(
-                        "Parent reference missing during recovery: revision={}, parent={}",
-                        revision.id.as_hex(),
-                        parent_id.as_hex()
-                    ));
-                }
-            }
-        }
+impl Default for RetentionPolicy {
+    fn default() -> Self {
+        Self::unbounded()
+    }
+}
 
-        // Step 3: Recover current pointer and branches from FeltDB
-        // Current pointer is stored as: ("state:current", (current_id_hex, branches_map))
-        let mut current_id = None;
-        let mut branches_map = HashMap::new();
+/// A resource's retention state: its policy, and how far its history has been
+/// expired.
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+struct RetentionState {
+    policy: RetentionPolicy,
+    /// The lowest sequence still retained. Everything below it was expired on
+    /// purpose, and is distinguishable from a parent that never existed.
+    horizon: u64,
+}
 
-        if let Ok(Some((current_id_hex, recovered_branches))) =
-            feltdb.get::<(String, HashMap<String, String>)>("state:current")
-        {
-            // Parse current ID
-            if !current_id_hex.is_empty() {
-                let parsed_id = StateId::from_hex(current_id_hex.clone());
-
-                // Validate current pointer exists in revisions
-                if !revisions_map.contains_key(&parsed_id) {
-                    return Err(format!(
-                        "Current pointer references non-existent revision during recovery: {}",
-                        current_id_hex
-                    ));
-                }
+/// Decide what a retention policy expires, given a resource's history.
+///
+/// Pure, and the single definition of what retention *means*, so the explicit
+/// store API and the automatic mint at the write boundary cannot drift apart.
+///
+/// `history` is `(id, sequence)` oldest first. Returns the revisions to expire
+/// and the new horizon — the lowest sequence still retained.
+///
+/// Deletion is from the oldest end only, so what survives is always a suffix of
+/// the resource's timeline and **the current revision always survives**.
+pub fn revisions_to_expire(
+    history: &[(StateId, u64)],
+    keep_last: Option<usize>,
+) -> (Vec<StateId>, Option<u64>) {
+    let Some(keep) = keep_last else {
+        return (Vec::new(), None);
+    };
+    let keep = keep.max(1);
+    if history.len() <= keep {
+        return (Vec::new(), None);
+    }
+    let split = history.len() - keep;
+    let expire = history[..split].iter().map(|(id, _)| id.clone()).collect();
+    let horizon = history[split].1;
+    (expire, Some(horizon))
+}
+
+/// Why a revision could not be minted.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum RevisionError {
+    /// Invariant 2: the named parent is not a revision this store holds.
+    UnknownParent(StateId),
+    /// Invariant 1: that identity is already committed, and commits are final.
+    ///
+    /// Under the resource-scoped model this should be unreachable through
+    /// `mint`, because the sequence is allocated from the resource's own head.
+    /// It is enforced anyway: immutability is the invariant, not a consequence.
+    AlreadyCommitted(StateId),
+    /// A parent belonging to a different resource.
+    ForeignParent { expected: String, found: String },
+    /// The resource already has a first revision; a resource has one beginning.
+    ResourceAlreadyBegun { resource: String, head: StateId },
+    /// The revision's own identity does not match what it is computed from.
+    IntegrityFailed,
+    /// The backing store could not be read or written.
+    Storage(String),
+}
 
-                current_id = Some(parsed_id);
+impl std::fmt::Display for RevisionError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            RevisionError::UnknownParent(id) => {
+                write!(f, "parent {id} is not a revision this store holds")
+            }
+            RevisionError::AlreadyCommitted(id) => {
+                write!(
+                    f,
+                    "revision {id} is already committed and cannot be rewritten"
+                )
+            }
+            RevisionError::ForeignParent { expected, found } => {
+                write!(f, "parent belongs to resource {found}, not {expected}")
             }
+            RevisionError::ResourceAlreadyBegun { resource, head } => {
+                write!(f, "resource {resource} already begins at revision {head}")
+            }
+            RevisionError::IntegrityFailed => write!(f, "state integrity verification failed"),
+            RevisionError::Storage(message) => write!(f, "{message}"),
+        }
+    }
+}
 
-            // Parse branch references
-            for (branch_name, branch_id_hex) in recovered_branches {
-                let parsed_id = StateId::from_hex(branch_id_hex.clone());
+impl std::error::Error for RevisionError {}
 
-                // Validate branch target exists in revisions
-                if !revisions_map.contains_key(&parsed_id) {
-                    return Err(format!(
-                        "Branch references non-existent revision during recovery: branch={}, target={}",
-                        branch_name, branch_id_hex
-                    ));
-                }
+/// What following a revision's parent link found.
+///
+/// The three outcomes are deliberately distinct. An **expired** parent is a
+/// retention decision the system made on purpose; an **unknown** one is a bug.
+/// Collapsing them would recreate the dangling-parent defect at the other end
+/// of the system, where retention rather than minting produced it.
+#[derive(Clone, Debug)]
+pub enum ParentLookup {
+    /// This revision began its resource's history.
+    Root,
+    /// The parent, still retained.
+    Revision(Box<StateRevision>),
+    /// The parent was expired by retention. Its identity is still named by the
+    /// child, and the child's ancestry is still true — it is simply no longer
+    /// stored.
+    Expired(StateId),
+    /// The parent is named but absent and *not* below the retention horizon.
+    /// The model does not permit minting one; finding one means damage.
+    Missing(StateId),
+}
 
-                branches_map.insert(branch_name, parsed_id);
-            }
+impl ParentLookup {
+    /// The identity this lookup names, if it names one.
+    pub fn id(&self) -> Option<&StateId> {
+        match self {
+            ParentLookup::Root => None,
+            ParentLookup::Revision(revision) => Some(&revision.id),
+            ParentLookup::Expired(id) | ParentLookup::Missing(id) => Some(id),
         }
+    }
+}
 
-        // Step 4: Validate topology consistency
-        // If there are revisions but no current pointer, that's an error
-        if !revisions_map.is_empty() && current_id.is_none() {
-            return Err("Recovered revisions but current pointer is missing".to_string());
+/// Equality is over the outcome and the identity named, not the whole revision.
+impl PartialEq for ParentLookup {
+    fn eq(&self, other: &Self) -> bool {
+        std::mem::discriminant(self) == std::mem::discriminant(other) && self.id() == other.id()
+    }
+}
+
+impl StateStore {
+    /// A volatile (in-memory) store, for testing state semantics in isolation.
+    ///
+    /// Revisions are lost when the store is dropped. Production must use
+    /// [`with_feltdb`](Self::with_feltdb).
+    pub fn new_volatile() -> Self {
+        StateStore {
+            backing: Backing::Volatile(Arc::new(Mutex::new(VolatileState::default()))),
         }
+    }
 
-        // Step 5: Return recovered StateStore
+    /// A store backed by FeltDB's canonical persistence.
+    ///
+    /// This performs **no recovery**. Revisions are records under
+    /// `state:revision:{hex}`; they are already durable, so there is no index to
+    /// rebuild and nothing to validate up front. A revision's integrity is
+    /// checked when it is written, and can be rechecked by whoever reads it.
+    ///
+    /// The `Result` is retained because callers depend on it; today it is always
+    /// `Ok`.
+    pub fn with_feltdb(feltdb: Arc<crate::FeltDb>) -> Result<Self, String> {
         Ok(StateStore {
-            revisions: Arc::new(Mutex::new(revisions_map)),
-            current_id: Arc::new(Mutex::new(current_id)),
-            branches: Arc::new(Mutex::new(branches_map)),
-            feltdb: Some(feltdb),
+            backing: Backing::Durable(feltdb),
         })
     }
 
-    /// Create and store initial state
+    // -- minting ------------------------------------------------------------
+
+    /// Begin a resource's history.
+    ///
+    /// Refused if the resource already has one. A resource has a single
+    /// beginning; without that, `history_of` would return a forest rather than
+    /// a chain and "the previous state of this resource" would be ambiguous
+    /// again. To extend an existing history, use [`commit`](Self::commit) or
+    /// [`mint`](Self::mint).
     pub fn create(
         &self,
+        resource: &str,
         content: String,
         authority: String,
-    ) -> Result<StateRevision, String> {
-        let revision = StateRevision::initial(content, authority);
-        self.commit_revision(revision)
+    ) -> Result<StateRevision, RevisionError> {
+        if let Some(head) = self.head_of(resource) {
+            return Err(RevisionError::ResourceAlreadyBegun {
+                resource: resource.to_string(),
+                head: head.id,
+            });
+        }
+        self.mint(resource, content, None, authority)
     }
 
-    /// Commit a new revision
+    /// Commit a revision descending from `parent`, on the parent's resource.
     pub fn commit(
         &self,
         content: String,
         parent: &StateRevision,
         authority: String,
-    ) -> Result<StateRevision, String> {
-        let revision = StateRevision::child(content, parent, authority);
-        self.commit_revision(revision)
+    ) -> Result<StateRevision, RevisionError> {
+        let resource = parent.resource.clone();
+        self.mint(&resource, content, Some(parent), authority)
     }
 
-    /// Internal: commit revision and update current pointer
-    fn commit_revision(&self, revision: StateRevision) -> Result<StateRevision, String> {
-        if !revision.verify_integrity() {
-            return Err("State integrity verification failed".to_string());
+    /// Mint a revision of `resource`, optionally descending from `parent`.
+    ///
+    /// Enforces both invariants at the only point where they can be enforced:
+    ///
+    /// 1. A parent must resolve to a revision this store holds, and must belong
+    ///    to the same resource. Parent existence is part of what makes a
+    ///    revision valid, not a lookup applied afterwards.
+    /// 2. A committed revision is never rewritten. The sequence is allocated
+    ///    from the resource's own head, so a state reached twice is two
+    ///    revisions with two identities.
+    ///
+    /// Retention is applied to the resource afterwards, so a configured policy
+    /// bounds history at the moment history is created rather than at some
+    /// later maintenance pass that may never run.
+    pub fn mint(
+        &self,
+        resource: &str,
+        content: String,
+        parent: Option<&StateRevision>,
+        authority: String,
+    ) -> Result<StateRevision, RevisionError> {
+        if let Some(parent) = parent {
+            if parent.resource != resource {
+                return Err(RevisionError::ForeignParent {
+                    expected: resource.to_string(),
+                    found: parent.resource.clone(),
+                });
+            }
+            if !self.exists(&parent.id) {
+                return Err(RevisionError::UnknownParent(parent.id.clone()));
+            }
         }
 
-        let mut revisions = self.revisions.lock().unwrap();
-        let id = revision.id.clone();
-        revisions.insert(id.clone(), revision.clone());
+        let sequence = match parent {
+            Some(parent) => parent.sequence + 1,
+            None => 0,
+        };
+        let revision = StateRevision::at(
+            resource.to_string(),
+            content,
+            parent.map(|parent| parent.id.clone()),
+            sequence,
+            authority,
+        );
+        let committed = self.commit_revision(revision)?;
+        self.apply_retention(resource)?;
+        Ok(committed)
+    }
 
-        let mut current = self.current_id.lock().unwrap();
-        *current = Some(id.clone());
+    /// Store a revision, after checking its integrity and that it is new.
+    fn commit_revision(&self, revision: StateRevision) -> Result<StateRevision, RevisionError> {
+        if !revision.verify_integrity() {
+            return Err(RevisionError::IntegrityFailed);
+        }
+        // Re-committing an identical historical fact is a no-op, not a rewrite:
+        // the identity is a function of the resource, the content, the parent
+        // and the sequence, so an existing revision with this identity records
+        // exactly what is being committed. Returning it keeps immutability
+        // without making a harmless repeat an error.
+        if let Some(existing) = self.get(&revision.id) {
+            let same = existing.resource == revision.resource
+                && existing.content_id == revision.content_id
+                && existing.parent_id == revision.parent_id
+                && existing.sequence == revision.sequence;
+            return if same {
+                Ok(existing)
+            } else {
+                Err(RevisionError::AlreadyCommitted(revision.id.clone()))
+            };
+        }
+        match &self.backing {
+            Backing::Volatile(state) => {
+                state
+                    .lock()
+                    .unwrap()
+                    .revisions
+                    .insert(revision.id.clone(), revision.clone());
+            }
+            Backing::Durable(feltdb) => {
+                feltdb
+                    .insert(&revision_key(&revision.id), revision.clone())
+                    .map_err(|error| {
+                        RevisionError::Storage(format!(
+                            "Failed to persist revision to FeltDB: {error}"
+                        ))
+                    })?;
+            }
+        }
+        Ok(revision)
+    }
 
-        // Persist through FeltDB if available (production must provide FeltDB)
-        if let Some(feltdb) = &self.feltdb {
-            let revision_key = format!("state:revision:{}", id.as_hex());
-             
-            // Persist the revision through FeltDB's operation log
-            feltdb.insert(&revision_key, revision.clone())
-                .map_err(|e| format!("Failed to persist revision to FeltDB: {}", e))?;
+    // -- reading ------------------------------------------------------------
 
-            // Persist current pointer through FeltDB
-            let branches = self.branches.lock().unwrap();
-            let current_pointer = (id.as_hex().to_string(), branches.clone());
-            feltdb.insert("state:current", current_pointer)
-                .map_err(|e| format!("Failed to persist current pointer to FeltDB: {}", e))?;
+    /// Retrieve a revision by identity. This is the authoritative read path.
+    pub fn get(&self, id: &StateId) -> Option<StateRevision> {
+        match &self.backing {
+            Backing::Volatile(state) => state.lock().unwrap().revisions.get(id).cloned(),
+            Backing::Durable(feltdb) => feltdb
+                .get::<StateRevision>(&revision_key(id))
+                .ok()
+                .flatten(),
         }
+    }
 
-        Ok(revision)
+    /// Whether a revision is present.
+    pub fn exists(&self, id: &StateId) -> bool {
+        self.get(id).is_some()
     }
 
-    /// Get current state
-    pub fn current(&self) -> Option<StateRevision> {
-        let current_id = self.current_id.lock().unwrap();
-        if let Some(id) = &*current_id {
-            let revisions = self.revisions.lock().unwrap();
-            revisions.get(id).cloned()
+    /// Metadata for a revision.
+    pub fn metadata(&self, id: &StateId) -> Option<BTreeMap<String, Value>> {
+        self.get(id).map(|revision| revision.metadata)
+    }
+
+    /// The parent of a revision, and — when it is not there — why.
+    pub fn parent_of(&self, id: &StateId) -> Option<ParentLookup> {
+        let revision = self.get(id)?;
+        let Some(parent_id) = revision.parent_id else {
+            return Some(ParentLookup::Root);
+        };
+        if let Some(parent) = self.get(&parent_id) {
+            return Some(ParentLookup::Revision(Box::new(parent)));
+        }
+        let horizon = self.retention_state(&revision.resource).horizon;
+        Some(if revision.sequence <= horizon {
+            ParentLookup::Expired(parent_id)
         } else {
-            None
+            ParentLookup::Missing(parent_id)
+        })
+    }
+
+    /// The parent of a revision, if it is still retained.
+    ///
+    /// Repeating this walks the ancestry. It is a traversal, not a primitive.
+    /// Use [`parent_of`](Self::parent_of) to tell a resource's beginning from a
+    /// horizon.
+    pub fn parent(&self, id: &StateId) -> Option<StateRevision> {
+        match self.parent_of(id)? {
+            ParentLookup::Revision(parent) => Some(*parent),
+            _ => None,
         }
     }
 
-    /// Get revision by id
-    pub fn get(&self, id: &StateId) -> Option<StateRevision> {
-        let revisions = self.revisions.lock().unwrap();
-        revisions.get(id).cloned()
+    /// Every retained revision of one resource, oldest first.
+    pub fn history_of(&self, resource: &str) -> Vec<StateRevision> {
+        let mut history: Vec<StateRevision> = self
+            .all_revisions()
+            .into_iter()
+            .filter(|revision| revision.resource == resource)
+            .collect();
+        history.sort_by_key(|revision| revision.sequence);
+        history
     }
 
-    /// Check if revision exists
-    pub fn exists(&self, id: &StateId) -> bool {
-        let revisions = self.revisions.lock().unwrap();
-        revisions.contains_key(id)
+    /// A resource's newest retained revision.
+    ///
+    /// Automatic minting produces a chain, so this is unambiguous for anything
+    /// the write path created. Explicit `commit` may fork a resource — which is
+    /// exactly what divergence and three-way reconciliation need — and where it
+    /// has, this is the newest by sequence, ties broken by identity so the
+    /// answer is deterministic rather than incidental.
+    pub fn head_of(&self, resource: &str) -> Option<StateRevision> {
+        self.history_of(resource).into_iter().max_by(|one, two| {
+            one.sequence
+                .cmp(&two.sequence)
+                .then_with(|| one.id.as_hex().cmp(two.id.as_hex()))
+        })
     }
 
-    /// Get metadata for a revision
-    pub fn metadata(&self, id: &StateId) -> Option<BTreeMap<String, Value>> {
-        let revisions = self.revisions.lock().unwrap();
-        revisions.get(id).map(|r| r.metadata.clone())
+    /// Every resource this store holds history for.
+    pub fn resources(&self) -> Vec<String> {
+        let mut names: Vec<String> = self
+            .all_revisions()
+            .into_iter()
+            .map(|revision| revision.resource)
+            .collect();
+        names.sort();
+        names.dedup();
+        names
+    }
+
+    fn all_revisions(&self) -> Vec<StateRevision> {
+        match &self.backing {
+            Backing::Volatile(state) => state.lock().unwrap().revisions.values().cloned().collect(),
+            Backing::Durable(feltdb) => feltdb
+                .list_collection("state")
+                .unwrap_or_default()
+                .into_iter()
+                .filter(|row| row.key.starts_with("state:revision:") && !row.deleted)
+                .filter_map(|row| serde_json::from_value::<StateRevision>(row.value).ok())
+                .collect(),
+        }
     }
 
-    /// Get parent of a revision
-    pub fn parent(&self, id: &StateId) -> Option<StateRevision> {
-        let revisions = self.revisions.lock().unwrap();
-        if let Some(revision) = revisions.get(id) {
-            if let Some(parent_id) = &revision.parent_id {
-                return revisions.get(parent_id).cloned();
-            }
+    /// A digest of this store's **history**: the revision graph and retention
+    /// state, and nothing else.
+    ///
+    /// Deliberately independent of a digest over current records. Two databases
+    /// can hold identical current state and completely different histories —
+    /// one that recorded every step and one that only ever saw the last — and
+    /// any equivalence check that cannot tell those apart is not checking
+    /// history at all.
+    ///
+    /// Covers, for every revision: its resource, identity, parent, sequence,
+    /// content identity and the authority that committed it; and for every
+    /// resource: its retention policy and horizon. It excludes wall-clock
+    /// timestamps, which two authorities holding the same history legitimately
+    /// disagree about.
+    pub fn history_digest(&self) -> String {
+        let mut entries: Vec<String> = self
+            .all_revisions()
+            .into_iter()
+            .map(|revision| {
+                format!(
+                    "{}|{}|{}|{}|{}|{}",
+                    revision.resource,
+                    revision.id.as_hex(),
+                    revision
+                        .parent_id
+                        .as_ref()
+                        .map(StateId::as_hex)
+                        .unwrap_or("-"),
+                    revision.sequence,
+                    revision.content_id.as_hex(),
+                    revision.authority,
+                )
+            })
+            .collect();
+        for resource in self.resources() {
+            let state = self.retention_state(&resource);
+            entries.push(format!(
+                "retention|{}|{:?}|{}",
+                resource, state.policy.keep_last, state.horizon
+            ));
         }
-        None
+        entries.sort();
+
+        let mut hasher = Sha256::new();
+        hasher.update(b"feltdb.history.v1");
+        for entry in entries {
+            hasher.update(entry.as_bytes());
+            hasher.update([0u8]);
+        }
+        format!("{:x}", hasher.finalize())
     }
 
-    /// Create a named branch
-    pub fn create_branch(&self, name: String, revision_id: StateId) -> Result<(), String> {
-        let mut branches = self.branches.lock().unwrap();
-        branches.insert(name.clone(), revision_id.clone());
+    // -- retention ----------------------------------------------------------
 
-        // Persist branches through FeltDB if available
-        if let Some(feltdb) = &self.feltdb {
-            let current_id = self.current_id.lock().unwrap();
-            
-            // Update state:current with new branches map to ensure recovery captures all branches
-            let current_pointer = (
-                current_id.as_ref().map(|id| id.as_hex().to_string()).unwrap_or_default(),
-                branches.clone()
-            );
-            feltdb.insert("state:current", current_pointer)
-                .map_err(|e| format!("Failed to persist branch to state:current: {}", e))?;
+    /// The retention policy in force for a resource.
+    pub fn retention_policy(&self, resource: &str) -> RetentionPolicy {
+        self.retention_state(resource).policy
+    }
+
+    /// The lowest sequence still retained for a resource.
+    ///
+    /// Revisions below it were expired deliberately. This is what separates an
+    /// expired parent from a missing one.
+    pub fn retention_horizon(&self, resource: &str) -> u64 {
+        self.retention_state(resource).horizon
+    }
+
+    /// Set a resource's retention policy, and apply it immediately.
+    ///
+    /// Returns how many revisions the policy expired on application.
+    pub fn set_retention_policy(
+        &self,
+        resource: &str,
+        policy: RetentionPolicy,
+    ) -> Result<usize, RevisionError> {
+        let mut state = self.retention_state(resource);
+        state.policy = policy;
+        self.write_retention_state(resource, &state)?;
+        self.apply_retention(resource)
+    }
+
+    /// Expire whatever the resource's policy no longer retains.
+    ///
+    /// Deletes from the **oldest** end only, so the surviving history is always
+    /// a suffix of the resource's timeline and the current revision always
+    /// survives. A surviving revision's `parent_id` is never rewritten — that
+    /// would violate immutability — so the horizon is recorded instead, and the
+    /// oldest survivor reports an `Expired` parent rather than a missing one.
+    pub fn apply_retention(&self, resource: &str) -> Result<usize, RevisionError> {
+        let mut state = self.retention_state(resource);
+        if state.policy.keep_last.is_none() {
+            return Ok(0);
+        }
+        let history: Vec<(StateId, u64)> = self
+            .history_of(resource)
+            .into_iter()
+            .map(|revision| (revision.id, revision.sequence))
+            .collect();
+        let (expire, horizon) = revisions_to_expire(&history, state.policy.keep_last);
+        if expire.is_empty() {
+            return Ok(0);
+        }
+        for id in &expire {
+            self.remove(id)?;
         }
+        if let Some(horizon) = horizon {
+            state.horizon = horizon;
+        }
+        self.write_retention_state(resource, &state)?;
+        Ok(expire.len())
+    }
 
+    fn remove(&self, id: &StateId) -> Result<(), RevisionError> {
+        match &self.backing {
+            Backing::Volatile(state) => {
+                state.lock().unwrap().revisions.remove(id);
+            }
+            Backing::Durable(feltdb) => {
+                feltdb.delete(&revision_key(id)).map_err(|error| {
+                    RevisionError::Storage(format!("Failed to expire revision: {error}"))
+                })?;
+            }
+        }
         Ok(())
     }
 
-    /// Get branch head
-    pub fn branch_head(&self, name: &str) -> Option<StateId> {
-        let branches = self.branches.lock().unwrap();
-        branches.get(name).cloned()
+    fn retention_state(&self, resource: &str) -> RetentionState {
+        match &self.backing {
+            Backing::Volatile(state) => state
+                .lock()
+                .unwrap()
+                .retention
+                .get(resource)
+                .cloned()
+                .unwrap_or_default(),
+            Backing::Durable(feltdb) => feltdb
+                .get::<RetentionState>(&retention_key(resource))
+                .ok()
+                .flatten()
+                .unwrap_or_default(),
+        }
+    }
+
+    fn write_retention_state(
+        &self,
+        resource: &str,
+        state: &RetentionState,
+    ) -> Result<(), RevisionError> {
+        match &self.backing {
+            Backing::Volatile(volatile) => {
+                volatile
+                    .lock()
+                    .unwrap()
+                    .retention
+                    .insert(resource.to_string(), state.clone());
+            }
+            Backing::Durable(feltdb) => {
+                feltdb
+                    .insert(&retention_key(resource), state.clone())
+                    .map_err(|error| {
+                        RevisionError::Storage(format!(
+                            "Failed to persist retention state: {error}"
+                        ))
+                    })?;
+            }
+        }
+        Ok(())
     }
 }
 
 impl Clone for StateStore {
     fn clone(&self) -> Self {
         StateStore {
-            revisions: self.revisions.clone(),
-            current_id: self.current_id.clone(),
-            branches: self.branches.clone(),
-            feltdb: self.feltdb.clone(),
+            backing: self.backing.clone(),
         }
     }
 }
@@ -921,6 +1759,7 @@ mod tests {
     #[test]
     fn test_state_revision_initial() {
         let rev = StateRevision::initial(
+            "docs:1".to_string(),
             r#"{"key":"value"}"#.to_string(),
             "test-authority".to_string(),
         );
@@ -932,6 +1771,7 @@ mod tests {
     #[test]
     fn test_state_revision_child() {
         let parent = StateRevision::initial(
+            "docs:1".to_string(),
             r#"{"key":"value"}"#.to_string(),
             "test-authority".to_string(),
         );
@@ -949,14 +1789,11 @@ mod tests {
         let mut topo = StateTopology::new();
 
         let rev1 = StateRevision::initial(
+            "docs:1".to_string(),
             r#"{"v":1}"#.to_string(),
             "auth".to_string(),
         );
-        let rev2 = StateRevision::child(
-            r#"{"v":2}"#.to_string(),
-            &rev1,
-            "auth".to_string(),
-        );
+        let rev2 = StateRevision::child(r#"{"v":2}"#.to_string(), &rev1, "auth".to_string());
 
         topo.add_revision(rev1.clone());
         topo.add_revision(rev2.clone());
@@ -979,50 +1816,142 @@ mod tests {
     }
 
     #[test]
-    fn test_conflict_classification_independent() {
-        let base = StateRevision::initial(
-            r#"{"a":1,"b":1}"#.to_string(),
-            "auth".to_string(),
+    fn path_relation_is_structural() {
+        let key = |name: &str| PathComponent::Key(name.to_string());
+
+        assert_eq!(path_relation(&[key("a")], &[key("a")]), PathRelation::Same);
+        assert_eq!(
+            path_relation(&[key("a")], &[key("a"), key("b")]),
+            PathRelation::Ancestor
+        );
+        assert_eq!(
+            path_relation(&[key("a"), key("b")], &[key("a")]),
+            PathRelation::Descendant
+        );
+        assert_eq!(
+            path_relation(&[key("a"), key("b")], &[key("a"), key("c")]),
+            PathRelation::Disjoint
+        );
+        // Components are compared whole. `a.b` and `a.bc` share a string prefix
+        // under any flattened rendering and are still disjoint.
+        assert_eq!(
+            path_relation(&[key("a"), key("b")], &[key("a"), key("bc")]),
+            PathRelation::Disjoint
+        );
+        // A key never matches an index, whatever they look like as text.
+        assert_eq!(
+            path_relation(&[key("0")], &[PathComponent::Index(0)]),
+            PathRelation::Disjoint
+        );
+        // The empty path is the whole state, and contains every other path.
+        assert_eq!(path_relation(&[], &[key("a")]), PathRelation::Ancestor);
+        assert_eq!(path_relation(&[], &[]), PathRelation::Same);
+
+        assert!(paths_overlap(&[key("a")], &[key("a"), key("b")]));
+        assert!(paths_overlap(&[key("a"), key("b")], &[key("a")]));
+        assert!(!paths_overlap(
+            &[key("a"), key("b")],
+            &[key("a"), key("bc")]
+        ));
+        assert!(!paths_overlap(&[key("a")], &[key("b")]));
+    }
+
+    #[test]
+    fn resolve_path_reads_objects_and_arrays() {
+        let value = json!({"o": {"a": [10, {"b": 1}]}, "n": null});
+        let key = |name: &str| PathComponent::Key(name.to_string());
+
+        assert_eq!(resolve_path(&value, &[]), Some(&value));
+        assert_eq!(resolve_path(&value, &[key("n")]), Some(&Value::Null));
+        assert_eq!(
+            resolve_path(&value, &[key("o"), key("a"), PathComponent::Index(0)]),
+            Some(&json!(10))
+        );
+        assert_eq!(
+            resolve_path(
+                &value,
+                &[key("o"), key("a"), PathComponent::Index(1), key("b")]
+            ),
+            Some(&json!(1))
+        );
+        // A path that does not resolve, and one that uses the wrong component
+        // kind for the container it meets.
+        assert_eq!(resolve_path(&value, &[key("missing")]), None);
+        assert_eq!(resolve_path(&value, &[PathComponent::Index(0)]), None);
+        assert_eq!(
+            resolve_path(&value, &[key("o"), key("a"), PathComponent::Index(9)]),
+            None
         );
-        let left = StateRevision::child(
-            r#"{"a":2,"b":1}"#.to_string(),
-            &base,
+        assert_eq!(resolve_path(&value, &[key("o"), key("a"), key("0")]), None);
+    }
+
+    #[test]
+    fn overlapping_changes_are_never_independent() {
+        // The reported defect: a branch replacing `o` and a branch editing
+        // `o.a` cannot both be applied, so neither path is independent.
+        let base = StateRevision::initial(
+            "docs:1".to_string(),
+            r#"{"o":{"a":1}}"#.to_string(),
             "auth".to_string(),
         );
-        let right = StateRevision::child(
-            r#"{"a":1,"b":2}"#.to_string(),
-            &base,
+        let left = StateRevision::child(r#"{"o":7}"#.to_string(), &base, "auth".to_string());
+        let right = StateRevision::child(r#"{"o":{"a":2}}"#.to_string(), &base, "auth".to_string());
+
+        let classification = ConflictClassification::classify(&base, &left, &right);
+        assert_eq!(classification.overall, ConflictClass::Conflict);
+        assert!(classification
+            .path_conflicts
+            .iter()
+            .all(|entry| entry.classification == ConflictClass::Conflict));
+    }
+
+    #[test]
+    fn test_conflict_classification_independent() {
+        let base = StateRevision::initial(
+            "docs:1".to_string(),
+            r#"{"a":1,"b":1}"#.to_string(),
             "auth".to_string(),
         );
+        let left = StateRevision::child(r#"{"a":2,"b":1}"#.to_string(), &base, "auth".to_string());
+        let right = StateRevision::child(r#"{"a":1,"b":2}"#.to_string(), &base, "auth".to_string());
 
         let classification = ConflictClassification::classify(&base, &left, &right);
         assert_eq!(classification.overall, ConflictClass::Independent);
     }
 
     #[test]
-    fn test_state_store_create_and_current() {
+    fn test_state_store_create_and_get() {
         let store = StateStore::new_volatile();
         let rev = store
-            .create(r#"{"data":"initial"}"#.to_string(), "auth".to_string())
+            .create(
+                "docs:1",
+                r#"{"data":"initial"}"#.to_string(),
+                "auth".to_string(),
+            )
             .unwrap();
 
-        let current = store.current().unwrap();
-        assert_eq!(current.id, rev.id);
+        // The store answers "do I have revision X?", not "what is current?".
+        let stored = store.get(&rev.id).unwrap();
+        assert_eq!(stored.id, rev.id);
+        assert_eq!(stored.content, rev.content);
     }
 
     #[test]
     fn test_state_store_commit() {
         let store = StateStore::new_volatile();
         let rev1 = store
-            .create(r#"{"v":1}"#.to_string(), "auth".to_string())
+            .create("docs:1", r#"{"v":1}"#.to_string(), "auth".to_string())
             .unwrap();
         let rev2 = store
             .commit(r#"{"v":2}"#.to_string(), &rev1, "auth".to_string())
             .unwrap();
 
         assert_eq!(rev2.parent_id, Some(rev1.id.clone()));
-        let current = store.current().unwrap();
-        assert_eq!(current.id, rev2.id);
+        // Both revisions remain retrievable; committing a child does not
+        // displace its parent, because there is no pointer to displace.
+        assert_eq!(store.get(&rev2.id).unwrap().id, rev2.id);
+        assert_eq!(store.get(&rev1.id).unwrap().id, rev1.id);
+        assert_eq!(store.parent(&rev2.id).unwrap().id, rev1.id);
     }
 
     #[test]
@@ -1048,29 +1977,35 @@ mod tests {
         let db_path = std::env::temp_dir().join("test_recovery_root.log");
         let _ = std::fs::remove_file(&db_path); // Clean up any previous test
 
+        let initial_id;
+
         // Phase 1: Create and persist root state
         {
             let db = crate::FeltDb::open(&db_path).expect("open db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let initial = store.create(r#"{"data":"root"}"#.to_string(), "auth".to_string())
+            let initial = store
+                .create(
+                    "docs:1",
+                    r#"{"data":"root"}"#.to_string(),
+                    "auth".to_string(),
+                )
                 .expect("create initial");
 
-            assert!(store.current().is_some());
-            assert_eq!(store.current().unwrap().id, initial.id);
+            assert_eq!(store.get(&initial.id).unwrap().id, initial.id);
+            initial_id = initial.id;
         } // Database closes, data persists to disk
 
-        // Phase 2: Reopen and verify recovery
+        // Phase 2: Reopen and read it back by identity. No recovery step runs.
         {
             let db = crate::FeltDb::open(&db_path).expect("open db again");
-            let store = StateStore::with_feltdb(Arc::new(db)).expect("create store from recovered db");
+            let store = StateStore::with_feltdb(Arc::new(db)).expect("create store over same log");
 
-            // Verify root exists and is current
-            assert!(store.current().is_some());
-            let current = store.current().unwrap();
-            assert_eq!(current.content, r#"{"data":"root"}"#);
-            assert_eq!(current.authority, "auth");
-            assert!(current.parent_id.is_none());
+            let root = store.get(&initial_id).expect("the root survives restart");
+            assert_eq!(root.content, r#"{"data":"root"}"#);
+            assert_eq!(root.authority, "auth");
+            assert!(root.parent_id.is_none());
+            assert!(root.verify_integrity());
         }
 
         let _ = std::fs::remove_file(&db_path); // Clean up
@@ -1092,20 +2027,23 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("open db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let rev1 = store.create(r#"{"v":1}"#.to_string(), "auth".to_string())
+            let rev1 = store
+                .create("docs:1", r#"{"v":1}"#.to_string(), "auth".to_string())
                 .expect("create rev1");
             rev1_id = rev1.id.clone();
 
-            let rev2 = store.commit(r#"{"v":2}"#.to_string(), &rev1, "auth".to_string())
+            let rev2 = store
+                .commit(r#"{"v":2}"#.to_string(), &rev1, "auth".to_string())
                 .expect("create rev2");
             rev2_id = rev2.id.clone();
 
-            let rev3 = store.commit(r#"{"v":3}"#.to_string(), &rev2, "auth".to_string())
+            let rev3 = store
+                .commit(r#"{"v":3}"#.to_string(), &rev2, "auth".to_string())
                 .expect("create rev3");
             rev3_id = rev3.id.clone();
 
             // Verify before close
-            assert_eq!(store.current().unwrap().id, rev3_id);
+            assert_eq!(store.get(&rev3_id).unwrap().id, rev3_id);
             assert_eq!(store.parent(&rev3_id).unwrap().id, rev2_id);
             assert_eq!(store.parent(&rev2_id).unwrap().id, rev1_id);
         }
@@ -1113,7 +2051,8 @@ mod tests {
         // Phase 2: Reopen and verify full history recovered
         {
             let db = crate::FeltDb::open(&db_path).expect("open db again");
-            let store = StateStore::with_feltdb(Arc::new(db)).expect("create store from recovered db");
+            let store =
+                StateStore::with_feltdb(Arc::new(db)).expect("create store from recovered db");
 
             // Verify all three revisions exist
             assert!(store.exists(&rev1_id));
@@ -1121,7 +2060,7 @@ mod tests {
             assert!(store.exists(&rev3_id));
 
             // Verify ancestry
-            assert_eq!(store.current().unwrap().id, rev3_id);
+            assert_eq!(store.get(&rev3_id).unwrap().id, rev3_id);
             assert_eq!(store.parent(&rev3_id).unwrap().id, rev2_id);
             assert_eq!(store.parent(&rev2_id).unwrap().id, rev1_id);
             assert!(store.parent(&rev1_id).is_none());
@@ -1136,7 +2075,7 @@ mod tests {
     }
 
     #[test]
-    fn test_recovery_branches() {
+    fn test_divergent_siblings_survive_restart_independently() {
         use std::sync::Arc;
 
         let db_path = std::env::temp_dir().join("test_recovery_branches.log");
@@ -1150,36 +2089,35 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("open db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let root = store.create(r#"{"base":true}"#.to_string(), "auth".to_string())
+            let root = store
+                .create("docs:1", r#"{"base":true}"#.to_string(), "auth".to_string())
                 .expect("create root");
             root_id = root.id.clone();
 
-            let branch1 = store.commit(r#"{"path":"a"}"#.to_string(), &root, "auth".to_string())
+            let branch1 = store
+                .commit(r#"{"path":"a"}"#.to_string(), &root, "auth".to_string())
                 .expect("create branch1");
             branch1_id = branch1.id.clone();
-
-            // Create named branch reference
-            store.create_branch("feature-a".to_string(), branch1_id.clone()).expect("create feature-a");
         }
 
-        // Phase 2: Reopen and verify branch recovered
+        // Phase 2: Reopen. There is no branch to recover, and none is needed:
+        // a divergent revision is reachable by its own identity, and its
+        // ancestry is its parent link.
         {
             let db = crate::FeltDb::open(&db_path).expect("open db again");
-            let store = StateStore::with_feltdb(Arc::new(db)).expect("create store from recovered db");
+            let store = StateStore::with_feltdb(Arc::new(db)).expect("create store over same log");
 
-            // Verify branch exists and points correctly
-            assert_eq!(store.branch_head("feature-a"), Some(branch1_id.clone()));
-
-            // Verify both revisions exist
             assert!(store.exists(&root_id));
             assert!(store.exists(&branch1_id));
+            assert_eq!(store.parent(&branch1_id).unwrap().id, root_id);
+            assert_eq!(store.get(&branch1_id).unwrap().content, r#"{"path":"a"}"#);
         }
 
         let _ = std::fs::remove_file(&db_path);
     }
 
     #[test]
-    fn test_recovery_current_pointer() {
+    fn test_every_revision_stays_retrievable_by_identity_after_restart() {
         use std::sync::Arc;
 
         let db_path = std::env::temp_dir().join("test_recovery_current.log");
@@ -1188,34 +2126,36 @@ mod tests {
         let rev1_id;
         let rev2_id;
 
-        // Phase 1: Create and move current pointer
+        // Phase 1: Two revisions, one descending from the other.
         {
             let db = crate::FeltDb::open(&db_path).expect("open db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let rev1 = store.create(r#"{"state":"1"}"#.to_string(), "auth".to_string())
+            let rev1 = store
+                .create("docs:1", r#"{"state":"1"}"#.to_string(), "auth".to_string())
                 .expect("create rev1");
             rev1_id = rev1.id.clone();
 
-            // Current should be rev1
-            assert_eq!(store.current().unwrap().id, rev1_id);
+            assert_eq!(store.get(&rev1_id).unwrap().id, rev1_id);
 
-            let rev2 = store.commit(r#"{"state":"2"}"#.to_string(), &rev1, "auth".to_string())
+            let rev2 = store
+                .commit(r#"{"state":"2"}"#.to_string(), &rev1, "auth".to_string())
                 .expect("create rev2");
             rev2_id = rev2.id.clone();
 
-            // Current should move to rev2
-            assert_eq!(store.current().unwrap().id, rev2_id);
+            // Committing a child does not displace the parent.
+            assert_eq!(store.get(&rev2_id).unwrap().id, rev2_id);
+            assert_eq!(store.get(&rev1_id).unwrap().id, rev1_id);
         }
 
-        // Phase 2: Verify current pointer survived restart
+        // Phase 2: both survive, and neither is privileged over the other.
         {
             let db = crate::FeltDb::open(&db_path).expect("open db again");
-            let store = StateStore::with_feltdb(Arc::new(db)).expect("create store from recovered db");
+            let store = StateStore::with_feltdb(Arc::new(db)).expect("create store over same log");
 
-            // Current should still be rev2
-            assert_eq!(store.current().unwrap().id, rev2_id);
-            assert_eq!(store.current().unwrap().content, r#"{"state":"2"}"#);
+            assert_eq!(store.get(&rev1_id).unwrap().content, r#"{"state":"1"}"#);
+            assert_eq!(store.get(&rev2_id).unwrap().content, r#"{"state":"2"}"#);
+            assert_eq!(store.parent(&rev2_id).unwrap().id, rev1_id);
         }
 
         let _ = std::fs::remove_file(&db_path);
@@ -1237,27 +2177,35 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("open db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let root = store.create(r#"{"v":0}"#.to_string(), "auth".to_string())
+            let root = store
+                .create("docs:1", r#"{"v":0}"#.to_string(), "auth".to_string())
                 .expect("create root");
             root_id = root.id.clone();
 
-            let rev_a = store.commit(r#"{"v":1,"stage":"a"}"#.to_string(), &root, "auth".to_string())
+            let rev_a = store
+                .commit(
+                    r#"{"v":1,"stage":"a"}"#.to_string(),
+                    &root,
+                    "auth".to_string(),
+                )
                 .expect("create rev_a");
             rev_a_id = rev_a.id.clone();
 
-            let rev_b = store.commit(r#"{"v":2,"stage":"b"}"#.to_string(), &rev_a, "auth".to_string())
+            let rev_b = store
+                .commit(
+                    r#"{"v":2,"stage":"b"}"#.to_string(),
+                    &rev_a,
+                    "auth".to_string(),
+                )
                 .expect("create rev_b");
             rev_b_id = rev_b.id.clone();
-
-            // Create named branches at different points in history
-            store.create_branch("checkpoint-a".to_string(), rev_a_id.clone()).expect("create checkpoint-a");
-            store.create_branch("checkpoint-b".to_string(), rev_b_id.clone()).expect("create checkpoint-b");
         }
 
         // Phase 2: Verify complex topology recovered
         {
             let db = crate::FeltDb::open(&db_path).expect("open db again");
-            let store = StateStore::with_feltdb(Arc::new(db)).expect("create store from recovered db");
+            let store =
+                StateStore::with_feltdb(Arc::new(db)).expect("create store from recovered db");
 
             // Verify all revisions
             assert!(store.exists(&root_id));
@@ -1268,67 +2216,75 @@ mod tests {
             assert_eq!(store.parent(&rev_b_id).unwrap().id, rev_a_id);
             assert_eq!(store.parent(&rev_a_id).unwrap().id, root_id);
 
-            // Verify branches
-            assert_eq!(store.branch_head("checkpoint-a"), Some(rev_a_id.clone()));
-            assert_eq!(store.branch_head("checkpoint-b"), Some(rev_b_id.clone()));
-
-            // Verify current is at rev_b
-            assert_eq!(store.current().unwrap().id, rev_b_id);
+            // Any point in the history is a checkpoint, addressed by its own
+            // identity. Naming one adds nothing the id does not already give.
+            assert_eq!(
+                store.get(&rev_a_id).unwrap().content,
+                r#"{"v":1,"stage":"a"}"#
+            );
+            assert_eq!(
+                store.get(&rev_b_id).unwrap().content,
+                r#"{"v":2,"stage":"b"}"#
+            );
         }
 
         let _ = std::fs::remove_file(&db_path);
     }
 
     #[test]
-    fn test_recovery_multiple_restart_cycles() {
+    fn test_revisions_survive_multiple_restart_cycles() {
         use std::sync::Arc;
 
         let db_path = std::env::temp_dir().join("test_recovery_cycles.log");
         let _ = std::fs::remove_file(&db_path);
 
+        // The caller carries the identities it cares about across restarts.
+        // That is the whole of what replaces a `current` pointer here.
+        let rev1_id;
+        let rev2_id;
+
         // Cycle 1: Create root
         {
             let db = crate::FeltDb::open(&db_path).expect("open db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
-            store.create(r#"{"cycle":1}"#.to_string(), "auth".to_string()).expect("create");
+            rev1_id = store
+                .create("docs:1", r#"{"cycle":1}"#.to_string(), "auth".to_string())
+                .expect("create")
+                .id;
         }
 
-        // Cycle 2: Restart, verify, and commit
+        // Cycle 2: Restart, read by identity, and commit onto it
         {
             let db = crate::FeltDb::open(&db_path).expect("open db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
-            assert!(store.current().is_some());
 
-            let rev1 = store.current().unwrap();
+            let rev1 = store.get(&rev1_id).expect("rev1 survives");
             assert_eq!(rev1.content, r#"{"cycle":1}"#);
-            
-            store.commit(r#"{"cycle":2}"#.to_string(), &rev1, "auth".to_string()).expect("commit 2");
+
+            rev2_id = store
+                .commit(r#"{"cycle":2}"#.to_string(), &rev1, "auth".to_string())
+                .expect("commit 2")
+                .id;
         }
 
-        // Cycle 3: Restart, create branch
+        // Cycle 3: Restart, both are still there
         {
             let db = crate::FeltDb::open(&db_path).expect("open db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
-            assert!(store.current().is_some());
 
-            let current = store.current().unwrap();
-            assert_eq!(current.content, r#"{"cycle":2}"#);
-            
-            store.create_branch("stable".to_string(), current.id.clone()).expect("create branch");
+            assert_eq!(store.get(&rev2_id).unwrap().content, r#"{"cycle":2}"#);
+            assert_eq!(store.parent(&rev2_id).unwrap().id, rev1_id);
         }
 
-        // Cycle 4: Final restart and verify everything survived
+        // Cycle 4: Final restart, ancestry intact end to end
         {
             let db = crate::FeltDb::open(&db_path).expect("open db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            // Should have current with parent
-            let current = store.current().expect("get current");
-            assert_eq!(current.content, r#"{"cycle":2}"#);
-            assert!(current.parent_id.is_some());
-
-            // Should have branch
-            assert_eq!(store.branch_head("stable"), Some(current.id.clone()));
+            let rev2 = store.get(&rev2_id).expect("rev2 survives every cycle");
+            assert_eq!(rev2.content, r#"{"cycle":2}"#);
+            assert_eq!(rev2.parent_id, Some(rev1_id.clone()));
+            assert!(store.parent(&rev1_id).is_none(), "the root has no parent");
         }
 
         let _ = std::fs::remove_file(&db_path);
@@ -1357,10 +2313,13 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("create db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let rev = store.create(
-                r#"{"task":"write PR18 proof"}"#.to_string(),
-                "system".to_string(),
-            ).expect("write");
+            let rev = store
+                .create(
+                    "docs:1",
+                    r#"{"task":"write PR18 proof"}"#.to_string(),
+                    "system".to_string(),
+                )
+                .expect("write");
 
             rev.id.clone()
         }; // Force drop of database, persist to disk
@@ -1370,15 +2329,19 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("reopen db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("recover store");
 
-            // VERIFY: Data exists after restart
-            assert!(store.current().is_some(), "State should exist after restart");
-            let current = store.current().unwrap();
-            assert_eq!(current.id, written_id, "State ID should match");
+            // VERIFY: the revision is retrievable by identity after restart
+            let recovered = store
+                .get(&written_id)
+                .expect("State should exist after restart");
+            assert_eq!(recovered.id, written_id, "State ID should match");
             assert_eq!(
-                current.content,
-                r#"{"task":"write PR18 proof"}"#,
+                recovered.content, r#"{"task":"write PR18 proof"}"#,
                 "State content should survive restart"
             );
+            assert!(
+                recovered.verify_integrity(),
+                "content must still hash to its identity"
+            );
         }
 
         let _ = std::fs::remove_file(&db_path);
@@ -1398,24 +2361,31 @@ mod tests {
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
             // Create project
-            let project = store.create(
-                r#"{"type":"project","name":"FeltDB"}"#.to_string(),
-                "system".to_string(),
-            ).expect("create project");
+            let project = store
+                .create(
+                    "docs:1",
+                    r#"{"type":"project","name":"FeltDB"}"#.to_string(),
+                    "system".to_string(),
+                )
+                .expect("create project");
 
             // Create membership (parent = project)
-            let membership = store.commit(
-                r#"{"type":"membership","project":"FeltDB","user":"alice"}"#.to_string(),
-                &project,
-                "system".to_string(),
-            ).expect("create membership");
+            let membership = store
+                .commit(
+                    r#"{"type":"membership","project":"FeltDB","user":"alice"}"#.to_string(),
+                    &project,
+                    "system".to_string(),
+                )
+                .expect("create membership");
 
             // Write audit event (parent = membership)
-            let event = store.commit(
-                r#"{"type":"audit","action":"project_created"}"#.to_string(),
-                &membership,
-                "system".to_string(),
-            ).expect("create event");
+            let event = store
+                .commit(
+                    r#"{"type":"audit","action":"project_created"}"#.to_string(),
+                    &membership,
+                    "system".to_string(),
+                )
+                .expect("create event");
 
             (project.id.clone(), membership.id.clone(), event.id.clone())
         }; // Force persist
@@ -1425,12 +2395,13 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("reopen db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("recover store");
 
-            let current = store.current().expect("current should exist");
-            assert_eq!(current.id, event_id, "Event should be current");
+            let event = store.get(&event_id).expect("event should exist");
+            assert_eq!(event.id, event_id);
 
             // Verify chain: event → membership → project
             assert_eq!(
-                current.parent_id, Some(membership_id.clone()),
+                event.parent_id,
+                Some(membership_id.clone()),
                 "Event parent should be membership"
             );
 
@@ -1454,22 +2425,29 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("create db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let root = store.create(
-                r#"{"generation":"root"}"#.to_string(),
-                "genesis".to_string(),
-            ).expect("create root");
-
-            let child = store.commit(
-                r#"{"generation":"child"}"#.to_string(),
-                &root,
-                "genesis".to_string(),
-            ).expect("create child");
+            let root = store
+                .create(
+                    "docs:1",
+                    r#"{"generation":"root"}"#.to_string(),
+                    "genesis".to_string(),
+                )
+                .expect("create root");
 
-            let grandchild = store.commit(
-                r#"{"generation":"grandchild"}"#.to_string(),
-                &child,
-                "genesis".to_string(),
-            ).expect("create grandchild");
+            let child = store
+                .commit(
+                    r#"{"generation":"child"}"#.to_string(),
+                    &root,
+                    "genesis".to_string(),
+                )
+                .expect("create child");
+
+            let grandchild = store
+                .commit(
+                    r#"{"generation":"grandchild"}"#.to_string(),
+                    &child,
+                    "genesis".to_string(),
+                )
+                .expect("create grandchild");
 
             (root.id.clone(), child.id.clone(), grandchild.id.clone())
         };
@@ -1479,12 +2457,12 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("reopen db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("recover store");
 
-            let current = store.current().expect("current exists");
-            assert_eq!(current.id, grandchild_id, "Grandchild is current");
+            let grandchild = store.get(&grandchild_id).expect("grandchild exists");
+            assert_eq!(grandchild.id, grandchild_id);
 
             // Trace ancestry: grandchild → child → root
             let mut ancestry_count = 0;
-            let mut current_id = Some(current.id.clone());
+            let mut current_id = Some(grandchild.id.clone());
 
             // Count links in ancestry (stop after finding root)
             while let Some(id) = current_id {
@@ -1517,10 +2495,9 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("create db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let rev = store.create(
-                r#"{"cycle":1}"#.to_string(),
-                "system".to_string(),
-            ).expect("create initial");
+            let rev = store
+                .create("docs:1", r#"{"cycle":1}"#.to_string(), "system".to_string())
+                .expect("create initial");
 
             rev.id.clone()
         };
@@ -1530,16 +2507,18 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("reopen db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("recover store");
 
-            // Verify previous state exists
-            let current = store.current().expect("current exists");
-            assert_eq!(current.id, state_id, "Previous state should exist");
+            // Verify previous state exists, read back by the id we carried
+            let previous = store.get(&state_id).expect("previous state should exist");
+            assert_eq!(previous.id, state_id);
 
             // Update state
-            let rev = store.commit(
-                format!(r#"{{"cycle":{}}}"#, cycle),
-                &current,
-                "system".to_string(),
-            ).expect("create update");
+            let rev = store
+                .commit(
+                    format!(r#"{{"cycle":{}}}"#, cycle),
+                    &previous,
+                    "system".to_string(),
+                )
+                .expect("create update");
 
             state_id = rev.id.clone();
         }
@@ -1549,7 +2528,7 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("final reopen");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("final recovery");
 
-            let final_state = store.current().expect("final state exists");
+            let final_state = store.get(&state_id).expect("final state exists");
             assert_eq!(final_state.id, state_id, "Final state should match");
         }
 
@@ -1569,10 +2548,13 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("create db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let rev = store.create(
-                r#"{"status":"initial"}"#.to_string(),
-                "system".to_string(),
-            ).expect("create initial");
+            let rev = store
+                .create(
+                    "docs:1",
+                    r#"{"status":"initial"}"#.to_string(),
+                    "system".to_string(),
+                )
+                .expect("create initial");
 
             rev.id.clone()
         };
@@ -1586,11 +2568,18 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("reopen");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("recover");
 
-            if let Some(current) = store.current() {
+            if let Some(recovered) = store.get(&initial_id) {
                 // State exists: must be complete
-                assert!(current.content.contains("status"), "State must be complete");
-                assert!(current.content.contains("initial"), "Attributes must be present");
-                assert_eq!(current.id, initial_id, "ID must match");
+                assert!(
+                    recovered.content.contains("status"),
+                    "State must be complete"
+                );
+                assert!(
+                    recovered.content.contains("initial"),
+                    "Attributes must be present"
+                );
+                assert_eq!(recovered.id, initial_id, "ID must match");
+                assert!(recovered.verify_integrity(), "and never partially written");
             } else {
                 // State doesn't exist: acceptable
                 // But not: partially exist with missing fields
@@ -1614,10 +2603,13 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("create db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
 
-            let rev = store.create(
-                expected_content.to_string(),
-                "integrity_check".to_string(),
-            ).expect("create");
+            let rev = store
+                .create(
+                    "docs:1",
+                    expected_content.to_string(),
+                    "integrity_check".to_string(),
+                )
+                .expect("create");
 
             rev.id.clone()
         };
@@ -1627,14 +2619,15 @@ mod tests {
             let db = crate::FeltDb::open(&db_path).expect("reopen");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("recover");
 
-            let current = store.current().expect("state exists");
+            let recovered = store.get(&state_id).expect("state exists");
 
             // Verify integrity: ID should still match content
-            assert_eq!(current.content, expected_content, "Content should match");
-            assert_eq!(current.id, state_id, "ID should match");
-
-            // In real implementation: verify_integrity() would recompute hash
-            // assert!(current.verify_integrity(), "Content hash should be valid");
+            assert_eq!(recovered.content, expected_content, "Content should match");
+            assert_eq!(recovered.id, state_id, "ID should match");
+            assert!(
+                recovered.verify_integrity(),
+                "Content hash should still be valid"
+            );
         }
 
         let _ = std::fs::remove_file(&db_path);
@@ -1644,59 +2637,72 @@ mod tests {
     fn pr19_proof_concurrent_write_safety() {
         // PROVES: Concurrent writes don't produce impossible partial states
         // Simulates multiple threads writing to the same StateStore
-        
+
         use std::sync::{Arc, Mutex};
         use std::thread;
-        
+
         let db_path = std::env::temp_dir().join("pr19_concurrent_writes.log");
         let _ = std::fs::remove_file(&db_path);
-        
+
         let db = crate::FeltDb::open(&db_path).expect("create db");
         let store = Arc::new(StateStore::with_feltdb(Arc::new(db)).expect("create store"));
-        
+
         let write_count = Arc::new(Mutex::new(0usize));
         let mut handles = vec![];
-        
+
         // Spawn multiple writers
         for i in 0..5 {
             let store_clone = Arc::clone(&store);
             let count_clone = Arc::clone(&write_count);
-            
+
             let handle = thread::spawn(move || {
                 let content = format!(r#"{{"writer":{},"timestamp":{}}}"#, i, 1000 + i);
-                let rev = store_clone.create(content, format!("writer_{}", i))
+                let rev = store_clone
+                    .create(&format!("writer:{i}"), content, format!("writer_{}", i))
                     .expect("write should succeed");
-                
+
                 let mut count = count_clone.lock().unwrap();
                 *count += 1;
-                
+
                 rev.id.clone()
             });
-            
+
             handles.push(handle);
         }
-        
+
         // Wait for all writers
         let mut written_ids = vec![];
         for handle in handles {
             let id = handle.join().expect("thread should complete");
             written_ids.push(id);
         }
-        
-        // Verify no partial states were created
-        let current = store.current().expect("current state should exist");
-        
-        // The current state should be one of the written states, not partial
-        assert!(written_ids.contains(&current.id), "Current state should match one of the written states");
-        
+
+        // Verify no partial states were created: every id a writer returned is
+        // readable, complete, and hashes to its own content.
+        for id in &written_ids {
+            let written = store
+                .get(id)
+                .expect("every concurrently written revision should exist");
+            assert!(
+                written.verify_integrity(),
+                "no writer produced a partial revision"
+            );
+        }
+
         // Verify we can still write after concurrent writes
-        let final_write = store.create(
-            r#"{"final":"write","success":true}"#.to_string(),
-            "system".to_string(),
-        ).expect("final write should succeed");
-        
-        assert!(final_write.verify_integrity(), "Final write should be valid");
-        
+        let final_write = store
+            .create(
+                "docs:1",
+                r#"{"final":"write","success":true}"#.to_string(),
+                "system".to_string(),
+            )
+            .expect("final write should succeed");
+
+        assert!(
+            final_write.verify_integrity(),
+            "Final write should be valid"
+        );
+
         let _ = std::fs::remove_file(&db_path);
     }
 
@@ -1706,23 +2712,26 @@ mod tests {
         // Simulates: write → sync starts → crash → restart
         // Expected: Either data is on disk (fully recovered) or not (nothing recovered)
         // Never: Partial/corrupted data
-        
+
         let db_path = std::env::temp_dir().join("pr19_crash_during_sync.log");
         let _ = std::fs::remove_file(&db_path);
-        
+
         // First write: known-good state
         let initial_id = {
             let db = crate::FeltDb::open(&db_path).expect("create db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
-            
-            let rev = store.create(
-                r#"{"status":"pre-crash","integrity":"good"}"#.to_string(),
-                "system".to_string(),
-            ).expect("write");
-            
+
+            let rev = store
+                .create(
+                    "docs:1",
+                    r#"{"status":"pre-crash","integrity":"good"}"#.to_string(),
+                    "system".to_string(),
+                )
+                .expect("write");
+
             rev.id.clone()
         };
-        
+
         // After restart, verify state is either:
         // A) Initial state is still there (sync didn't complete), OR
         // B) New state is there and fully valid (sync completed), OR
@@ -1730,12 +2739,17 @@ mod tests {
         {
             let db = crate::FeltDb::open(&db_path).expect("reopen");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("recover");
-            
-            let current = store.current().expect("state should exist");
-            
+
+            let current = store
+                .get(&initial_id)
+                .expect("the initial state should still exist");
+
             // Verify state integrity
-            assert!(current.verify_integrity(), "State should be internally consistent");
-            
+            assert!(
+                current.verify_integrity(),
+                "State should be internally consistent"
+            );
+
             // State should either be the initial write or a valid new write
             // But never partial or corrupted
             assert!(
@@ -1743,7 +2757,7 @@ mod tests {
                 "Recovered state must be either initial (sync failed) or new+valid (sync succeeded)"
             );
         }
-        
+
         let _ = std::fs::remove_file(&db_path);
     }
 
@@ -1752,30 +2766,31 @@ mod tests {
         // PROVES: Query execution uses indexes to reduce complexity
         // Currently this is unproven - indexes are data structures but
         // query execution path is not proven to use them
-        
+
         let db_path = std::env::temp_dir().join("pr19_query_index.log");
         let _ = std::fs::remove_file(&db_path);
-        
+
         let db = crate::FeltDb::open(&db_path).expect("create db");
         let store = Arc::new(StateStore::with_feltdb(Arc::new(db)).expect("create store"));
-        
+
         // Create records with indexed fields
         for i in 0..100 {
             let content = format!(r#"{{"user_id":"user_{}","active":true}}"#, i % 10);
-            let _ = store.create(content, format!("creator_{}", i))
+            let _ = store
+                .create(&format!("record:{i}"), content, format!("creator_{}", i))
                 .expect("write record");
         }
-        
+
         // Query by indexed field (user_id in this case)
         // If indexes are used, this should be O(log n)
         // If not, this is O(n)
-        
+
         // LIMITATION: No way to measure index usage in this test
         // This proves index data structures exist, not that they're used
-        
+
         // TODO: Measure query latency and verify index benefit
         // TODO: Add query optimizer tracing to prove index selection
-        
+
         let _ = std::fs::remove_file(&db_path);
     }
 
@@ -1784,36 +2799,45 @@ mod tests {
         // PROVES: Basic multi-tenant isolation at storage layer
         // Note: This tests storage isolation, not authorization layer
         // Authorization layer tests are in authorization_security_tests.rs
-        
+
         let db_path = std::env::temp_dir().join("pr19_multi_tenant.log");
         let _ = std::fs::remove_file(&db_path);
-        
+
         let db = crate::FeltDb::open(&db_path).expect("create db");
         let store = Arc::new(StateStore::with_feltdb(Arc::new(db)).expect("create store"));
-        
+
         // Create tenant-scoped records
         // Tenant A writes a record
-        let tenant_a_record = store.create(
-            r#"{"tenant":"tenant_a","data":"secret_a"}"#.to_string(),
-            "tenant_a".to_string(),
-        ).expect("tenant_a write");
-        
+        let tenant_a_record = store
+            .create(
+                "tenant_a:1",
+                r#"{"tenant":"tenant_a","data":"secret_a"}"#.to_string(),
+                "tenant_a".to_string(),
+            )
+            .expect("tenant_a write");
+
         // Tenant B writes a record
-        let tenant_b_record = store.create(
-            r#"{"tenant":"tenant_b","data":"secret_b"}"#.to_string(),
-            "tenant_b".to_string(),
-        ).expect("tenant_b write");
-        
+        let tenant_b_record = store
+            .create(
+                "tenant_b:1",
+                r#"{"tenant":"tenant_b","data":"secret_b"}"#.to_string(),
+                "tenant_b".to_string(),
+            )
+            .expect("tenant_b write");
+
         // Verify both records are stored (this proves storage works)
-        assert_ne!(tenant_a_record.id, tenant_b_record.id, "Records should have different IDs");
-        
+        assert_ne!(
+            tenant_a_record.id, tenant_b_record.id,
+            "Records should have different IDs"
+        );
+
         // Current limitation: StateStore doesn't enforce tenant boundaries
         // Tenant isolation is enforced at authorization layer, not storage layer
         // This test proves that separate StateIds are created for each record
-        
+
         // TODO: Test authorization layer rejection of cross-tenant access
         // See authorization_security_tests.rs
-        
+
         let _ = std::fs::remove_file(&db_path);
     }
 
@@ -1821,36 +2845,41 @@ mod tests {
     fn pr19_proof_atomicity_requires_sync_return() {
         // PROVES: Atomicity guarantee only holds if sync() succeeds
         // If sync() fails, no durability guarantee
-        
+
         let db_path = std::env::temp_dir().join("pr19_atomicity_sync.log");
         let _ = std::fs::remove_file(&db_path);
-        
+
         let rev_id = {
             let db = crate::FeltDb::open(&db_path).expect("create db");
             let store = StateStore::with_feltdb(Arc::new(db)).expect("create store");
-            
+
             // Write should be durable only if it returns Ok
             let result = store.create(
+                "docs:1",
                 r#"{"atomicity":"requires_sync_success"}"#.to_string(),
                 "system".to_string(),
             );
-            
+
             // If create() returns Ok, durability is guaranteed
             match result {
                 Ok(rev) => Some(rev.id.clone()),
                 Err(_) => None,
             }
         }; // Force drop of db to simulate restart
-        
+
         if let Some(rev_id) = rev_id {
             // Durability guaranteed: restart should see this
             let db2 = crate::FeltDb::open(&db_path).expect("reopen");
             let store2 = StateStore::with_feltdb(Arc::new(db2)).expect("recover");
-            
-            assert_eq!(store2.current().unwrap().id, rev_id, "Durability guaranteed");
+
+            assert_eq!(
+                store2.get(&rev_id).unwrap().id,
+                rev_id,
+                "Durability guaranteed"
+            );
         }
         // If None, no durability guarantee - sync failed
-        
+
         let _ = std::fs::remove_file(&db_path);
     }
 }