@idleware/ringi 0.1.1 → 0.2.0

package/target/esm/store/git/index.js

@@ -1,10 +1,13 @@
 // git-store: the Store port on git. The store directory holds one bare repository (`store/.git`):
 //   refs/heads/main                       the shared contract, one commit per amendment
-//   refs/heads/<room>/control             the room's control record; its first commit is the room's genesis
-//   refs/heads/<room>/log/<agent>         one log per member; each message is a commit
-//   refs/tags/ringi/<genesis>/<agent>/<message>.<signal>   signals, annotated tags in their author's namespace
-//   refs/archive/<room>@<genesis8>/…      an archived room, read-only
-//   refs/ringi/accepted/<genesis>/<reader>/<log>   readers' pins of accepted heads
+//   refs/heads/<room>                     the room: one linear branch, like a chat. Its first commit is the room's genesis
+//                                         (the root's, on top of main); then every message is a commit by its author, and
+//                                         every control record (Kind: room) a commit by the root
+//   refs/tags/<agent>.<signal>.<message12>   signals: annotated tags without text on the message's commit
+//   refs/archive/<room>@<genesis8>        an archived room, read-only
+//   refs/ringi/accepted/<genesis>/<reader>/<author>   readers' pins of each author's accepted last message
+// A member's log is its own commits in the room's branch, in branch order. The control files at the root of a room's
+// tree (members, profile, signers) change only in the root's control records.
 // A signed hub signs every commit and tag with its author's key and verifies what it fetches (remote.ts).
 import fs from 'node:fs';
 import path from 'node:path';
@@ -12,8 +15,8 @@ import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { cannotWrite, mkdirIn, SANDBOX } from '../../lib/index.js';
 import * as Remote from './remote.js';
-import { fail, note } from '../../lib/index.js';
-import { TEXT_MAX, checkOutgoing, parse } from '../../protocol/index.js';
+import { fail, locked, note, strictJson, writeJsonAtomic } from '../../lib/index.js';
+import { AGENT_RE, ID_RE, TEXT_MAX, checkOutgoing, compose, parse } from '../../protocol/index.js';
 import { checkCollisions, checkPath } from '../../protocol/files.js';
 const ZERO = '0'.repeat(40);
 const ident = (id) => ({ GIT_AUTHOR_NAME: id, GIT_AUTHOR_EMAIL: `${id}@ringi`, GIT_COMMITTER_NAME: id, GIT_COMMITTER_EMAIL: `${id}@ringi` });
@@ -26,8 +29,8 @@ const runGitOk = (args, o = {}) => {
     Remote.checkGitTimeout(r.error);
     return r;
 };
-const runGitRaw = (args, where) => {
-    const r = spawnSync('git', args, { encoding: 'buffer', env: Remote.gitEnv(), maxBuffer: 1 << 30, timeout: Remote.gitTimeout() });
+const runGitRaw = (args, where, input) => {
+    const r = spawnSync('git', args, { input, encoding: 'buffer', env: Remote.gitEnv(), maxBuffer: 1 << 30, timeout: Remote.gitTimeout() });
     return check(args, r, where).stdout;
 };
 function check(args, r, where = 'the hub store') {
@@ -53,6 +56,9 @@ const splitBuf = (b, sep) => {
     return parts;
 };
 const REGULAR = new Set(['100644', '100755']);
+// The root's principal, and the files only its control records may change.
+const ROOT = 'operator';
+const CONTROL_FILES = new Set(['ROOM.md', 'members.json', 'profile.json', 'allowed_signers']);
 export class GitStore {
     type = 'git';
     trust;
@@ -81,14 +87,15 @@ export class GitStore {
     isRef(s) { return /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/.test(s ?? ''); }
     extends(older, newer) { return older === newer || this.isAncestor(older, newer); }
     // --- writing ---
-    emptyTree() { return this.git(['hash-object', '-w', '-t', 'tree', '--stdin'], { input: '' }).trim(); }
-    // A tree from a base tree with entries put on top; nested paths are fine.
-    tree(base, entries) {
+    // A tree from a base tree without the `drop` paths, with entries put on top; nested paths are fine.
+    tree(base, entries, drop = []) {
         const idx = path.join(this.home, 'tmp', `index.${process.pid}.${crypto.randomBytes(4).toString('hex')}`);
         mkdirIn(this.home, path.dirname(idx));
         const env = { GIT_INDEX_FILE: idx };
         try {
             this.git(['read-tree', ...(base ? [base] : ['--empty'])], { env });
+            if (drop.length)
+                this.git(['update-index', '--index-info'], { env, input: drop.map(p => `0 ${ZERO}\t${p}\n`).join('') });
             for (const e of entries) {
                 const sha = this.git(['hash-object', '-w', ...(e.file ? ['--', e.file] : ['--stdin'])], { input: e.content }).trim();
                 this.git(['update-index', '--add', '--cacheinfo', `${e.mode},${sha},${e.path}`], { env });
@@ -107,8 +114,7 @@ export class GitStore {
         if (this.gitOk(['update-ref', ref, sha, old ?? ZERO]).status !== 0)
             return false;
         // A signed hub publishes at once; a rejected push keeps the commit here and alarms (remote.ts).
-        Remote.push(this.h, ref);
-        return true;
+        return Remote.push(this.h, ref, { behind: !!old && ref !== 'refs/heads/main' });
     }
     static create(hubDir, d, home, contract, text) {
         const dir = path.join(hubDir, d.store.path, '.git');
@@ -150,31 +156,72 @@ export class GitStore {
         return sha;
     }
     // --- rooms ---
-    base(name) { return name.includes('@') ? `refs/archive/${name}` : `refs/heads/${name}`; }
+    ref(name) { return name.includes('@') ? `refs/archive/${name}` : `refs/heads/${name}`; }
+    transition(name) { return `refs/ringi/migrating/${name}`; }
+    tip(name) { return this.rev(this.ref(name)) ?? this.rev(this.transition(name)); }
+    // Rooms in ringi 0.1's layout (`<room>/control` and a branch per agent) are listed, and refused when opened.
     roomNames(archived) {
-        const re = archived ? /^refs\/archive\/([^/]+)\/control$/ : /^refs\/heads\/([^/]+)\/control$/;
-        return this.git(['for-each-ref', '--format=%(refname)', archived ? 'refs/archive/' : 'refs/heads/']).split('\n').map(r => re.exec(r)?.[1]).filter((x) => !!x).sort();
+        const prefix = archived ? 'refs/archive/' : 'refs/heads/';
+        const names = this.git(['for-each-ref', '--format=%(refname)', prefix]).split('\n').filter(Boolean).map(r => r.slice(prefix.length))
+            .map(n => n.replace(/\/control$/, '')).filter(n => !n.includes('/') && n !== 'main' && n.includes('@') === archived);
+        return [...new Set(names)].sort();
+    }
+    // A control record: the room's genesis, or a root commit of Kind: room.
+    isControl(room, sha, author, text) {
+        return sha === room.genesis || (author === ROOT && parse(text, x => this.isRef(x)).kind === 'room');
+    }
+    // The room's branch, oldest first, from its genesis. The last scan of each room is kept and grown by what the tip
+    // added on top of it.
+    scanned = new Map();
+    entries(room, tip) {
+        const last = this.scanned.get(room.genesis);
+        if (last?.tip === tip)
+            return last.entries;
+        const added = last ? this.scan(room, tip, last.tip) : [];
+        const entries = last && added.length && added[0].parent === last.tip ? [...last.entries, ...added] : this.scan(room, tip);
+        const judged = this.judged(room, tip, entries);
+        this.scanned.set(room.genesis, { tip, entries: judged });
+        return judged;
+    }
+    // On a signed hub the branch's verification says which commits are control records, and why the others that are no
+    // valid message are skipped; a commit off the branch's first parents is never a message (remote.ts).
+    judged(room, tip, entries) {
+        if (this.trust !== 'signed' || room.archived)
+            return entries;
+        const b = Remote.branch(this.h, { name: room.name, ref: this.ref(room.name), genesis: room.genesis }, tip);
+        const control = new Set(b.control);
+        return entries.map(e => ({ ...e, control: control.has(e.sha),
+            skipped: control.has(e.sha) || b.authors.has(e.sha) ? undefined : b.skipped.get(e.sha) ?? 'not on the room\'s branch' }));
+    }
+    scan(room, tip, after) {
+        const shas = this.git(['rev-list', '--topo-order', '--reverse', tip, '--not', after ?? `${room.genesis}^@`]).trim().split('\n').filter(Boolean);
+        return Remote.readCommits(this.h, shas).map(c => {
+            const text = c.body.toString('utf8');
+            return { sha: c.sha, parent: c.parents[0], author: c.author, text, control: this.isControl(room, c.sha, c.author, text) };
+        });
     }
     room(name) {
-        const control = `${this.base(name)}/control`;
-        const head = this.rev(control);
-        if (!head)
+        const ref = this.ref(name);
+        const tip = this.tip(name);
+        if (!tip && this.rev(`${ref}/control`))
+            fail(`room ${name} is in the layout of ringi 0.1; run ringi room migrate ${name} --hub ${this.d.name} to keep its history in one branch`);
+        if (!tip)
             return null;
-        const genesis = this.git(['rev-list', '--reverse', control, '^refs/heads/main']).split('\n')[0]
-            || this.git(['rev-list', '--reverse', control]).split('\n').filter(Boolean).at(-1);
-        const recs = this.git(['log', '--reverse', '--format=%H%x1f%B%x1e', control, `^${genesis}^`]).split('\x1e').map(s => s.trim()).filter(Boolean);
-        return { name, archived: name.includes('@'), head, genesis, base: this.git(['rev-parse', `${genesis}^`]).trim(),
-            control: recs.map(r => {
-                const [rev, text = ''] = r.split('\x1f');
-                return { rev: rev.trim(), text };
-            }) };
+        const genesis = this.git(['rev-list', '--first-parent', '--reverse', tip, '^refs/heads/main']).split('\n')[0]
+            || this.git(['rev-list', '--first-parent', '--reverse', tip]).split('\n').filter(Boolean).at(-1);
+        const archived = name.includes('@');
+        if (this.trust === 'signed' && !archived && this.h.remoteAlarms?.[ref])
+            fail(`ALARM ${this.h.remoteAlarms[ref]}; room ${name} is quarantined`);
+        const control = this.entries({ name, genesis, archived }, tip).filter(e => e.control).map(e => ({ rev: e.sha, text: e.text }));
+        return { name, archived, head: control.at(-1).rev, genesis, tip, base: this.rev(`${genesis}^`) ?? ZERO, control };
     }
+    // Control files are read at a control record, never at the branch's tip.
     controlFile(room, name, rev) {
         const r = this.gitOk(['show', `${rev ?? room.head}:${name}`]);
         return r.status === 0 ? r.stdout : null;
     }
     createRoom(name, who, text, files) {
-        const ref = `refs/heads/${name}/control`;
+        const ref = `refs/heads/${name}`;
         if (this.rev(ref))
             fail(`room ${name} exists in hub ${this.d.name}`);
         const sha = this.commit(who, text, this.tree(null, Object.entries(files).map(([p, c]) => ({ path: p, content: c, mode: '100644' }))), [this.contractHead()]);
@@ -182,54 +229,252 @@ export class GitStore {
             fail(`room ${name} was created meanwhile`);
         return sha;
     }
-    // Every other file of the control tree (a signed room's allowed_signers) is kept.
+    // Old messages keep their ids and parents. One control record joins the old tips, then all new writes share the
+    // room's branch. The transition ref makes the room readable even if the process exits between the two ref
+    // transactions (Git cannot create <room> and delete <room>/control in the same transaction).
+    migrateRoom(name) {
+        if (this.trust !== 'asserted')
+            fail('legacy room migration is only supported for local asserted hubs');
+        if (!ID_RE.test(name) || name === 'main')
+            fail('expected a room id');
+        const ref = this.ref(name), pending = this.transition(name);
+        const source = this.rev(pending) ?? this.rev(ref) ?? this.rev(`${ref}/control`) ?? fail(`no legacy room ${name}`);
+        const genesis = this.git(['rev-list', '--first-parent', '--reverse', source, '^refs/heads/main']).trim().split('\n')[0];
+        const readers = path.join(this.home, 'readers', this.d.name, genesis);
+        const files = fs.existsSync(readers) ? fs.readdirSync(readers).filter(f => f.endsWith('.json')).sort() : [];
+        // Readers pin tag objects while holding these same locks. Keep their state stable across both ref transactions
+        // and the explicit conversion of their old accepted objects; no new baseline is supplied.
+        const protect = (at) => at === files.length ? migrate() : locked(path.join(this.home, 'locks', `reader-${this.d.name}-${genesis.slice(0, 12)}-${files[at].slice(0, -5)}.lock`), () => protect(at + 1));
+        const migrate = () => {
+            if (!genesis || this.git(['show', '-s', '--format=%s', genesis]).trim() !== `room ${name}`)
+                fail('legacy room genesis does not name this room');
+            const finish = (sha) => {
+                this.git(['update-ref', '--stdin'], { input: `start\ncreate ${ref} ${sha}\ndelete ${pending} ${sha}\nprepare\ncommit\n` });
+                return sha;
+            };
+            const staged = this.rev(pending);
+            const current = this.rev(ref);
+            if (staged || current) {
+                const tip = staged ?? current;
+                const tags = this.migrateSignals(name, genesis, [tip], files.map(f => path.join(readers, f)));
+                if (staged)
+                    finish(staged);
+                tags();
+                return tip;
+            }
+            const ctl = `${ref}/control`, head = this.rev(ctl) ?? fail(`no legacy room ${name}`);
+            const logs = this.refsUnder(`${ref}/log/`);
+            for (const [r, sha] of [[ctl, head], ...logs]) {
+                const who = r === ctl ? ROOT : r.slice(`${ref}/log/`.length);
+                if (!ID_RE.test(who) || !this.extends(genesis, sha))
+                    fail(`ALARM ${r} does not descend from its room genesis`);
+                const commits = this.git(['rev-list', '--parents', '--reverse', sha, `^${genesis}`]).trim().split('\n').filter(Boolean);
+                let parent = genesis;
+                for (const row of commits) {
+                    const [id, ...parents] = row.split(' ');
+                    if (parents.length !== 1 || parents[0] !== parent)
+                        fail(`ALARM ${r} is not linear`);
+                    if (this.git(['show', '-s', '--format=%an', id]).trim() !== who)
+                        fail(`ALARM ${r} contains another author's message`);
+                    parent = id;
+                }
+            }
+            // Accepted heads must still be present before any ref moves. Migration never supplies a fresh baseline.
+            const byAuthor = new Map(logs.map(([r, sha]) => [r.slice(`${ref}/log/`.length), sha]));
+            const checkAccepted = (who, sha) => {
+                const tip = byAuthor.get(who);
+                if (!tip || !this.extends(sha, tip))
+                    fail(`ALARM log ${who} lost accepted history; migration stopped`);
+            };
+            for (const [r, sha] of this.refsUnder(`refs/ringi/accepted/${genesis}/`))
+                checkAccepted(r.split('/').at(-1), sha);
+            for (const f of files) {
+                const st = strictJson(fs.readFileSync(path.join(readers, f), 'utf8'), f);
+                if (st.control && !this.extends(st.control, head))
+                    fail('ALARM room control lost accepted history; migration stopped');
+                for (const [who, sha] of Object.entries(st.heads ?? {}))
+                    checkAccepted(who, sha);
+            }
+            const tags = this.migrateSignals(name, genesis, [head, ...logs.map(([, id]) => id)], files.map(f => path.join(readers, f)));
+            const sha = this.commit(ROOT, compose(`migrate room ${name}`, [['To', '*'], ['Kind', 'room'], ['Ringi-Layout', 'branch/1']]), this.git(['rev-parse', `${head}^{tree}`]).trim(), [...new Set([head, ...logs.map(([, id]) => id)])]);
+            const old = [[ctl, head], ...logs];
+            const backup = `refs/ringi/legacy/${genesis}/`;
+            this.git(['update-ref', '--stdin'], { input: ['start', `create ${pending} ${sha}`,
+                    ...old.flatMap(([r, id]) => [`create ${backup}${r.slice(`${ref}/`.length)} ${id}`, `delete ${r} ${id}`]),
+                    'prepare', 'commit', ''].join('\n') });
+            finish(sha);
+            tags();
+            return sha;
+        };
+        mkdirIn(this.home, path.join(this.home, 'locks'));
+        return protect(0);
+    }
+    // An asserted hub can explicitly convert its old tag annotations, keeping their target, tagger and date. The
+    // original objects and reader snapshots remain evidence. Ref changes are atomic; a repeat resumes reader writes
+    // after a crash without replacing an accepted object that changed or disappeared in either format.
+    migrateSignals(room, genesis, tips, readers) {
+        const prefix = `refs/tags/ringi/${genesis}/`, backup = `refs/ringi/legacy/${genesis}/signals/`;
+        const old = new Map(this.refsUnder(prefix)), saved = new Map(this.refsUnder(backup));
+        const liveTags = new Map(this.refsUnder('refs/tags/'));
+        const refs = [];
+        const changes = new Map();
+        const identities = new Map();
+        const targets = new Set(this.git(['rev-list', ...tips, `^${genesis}`]).trim().split('\n').filter(Boolean));
+        const kept = (sha) => tips.some(tip => this.extends(sha, tip));
+        for (const [ref, sha] of this.refsUnder(`refs/ringi/accepted/${genesis}/`)) {
+            if (!kept(sha))
+                fail(`ALARM ${ref} lost accepted history; migration stopped`);
+        }
+        for (const suffix of new Set([...old.keys()].map(r => r.slice(prefix.length)).concat([...saved.keys()].map(r => r.slice(backup.length))))) {
+            const before = saved.get(backup + suffix) ?? old.get(prefix + suffix);
+            const liveOld = old.get(prefix + suffix), recorded = saved.get(backup + suffix);
+            if (recorded && liveOld && recorded !== liveOld)
+                fail(`ALARM signal ${prefix + suffix} changed after migration; stopped`);
+            const m = /^([^/]+)\/((?:[0-9a-f]{40}|[0-9a-f]{64}))\.([a-z][a-z0-9.-]*)$/.exec(suffix);
+            if (!m || !AGENT_RE.test(m[1]))
+                return fail(`ALARM signal ${prefix + suffix} cannot be migrated to an unambiguous agent id`);
+            const [, actor, target, signal] = m;
+            if (this.git(['cat-file', '-t', before]).trim() !== 'tag')
+                fail(`ALARM signal ${prefix + suffix} is not annotated`);
+            const text = this.git(['cat-file', 'tag', before]);
+            const split = text.indexOf('\n\n'), header = text.slice(0, split), body = text.slice(split + 2);
+            const h = /^object ([0-9a-f]+)\ntype commit\ntag ([^\n]+)\n(tagger ([^<\n]+) <[^\n]*> \d+ [+-]\d{4})$/.exec(header);
+            if (!h || h[1] !== target || h[2] !== (prefix + suffix).slice('refs/tags/'.length) || h[4].trim() !== actor || !targets.has(target))
+                return fail(`ALARM signal ${prefix + suffix} disagrees with its name, actor or room target`);
+            if (body.includes('-----BEGIN'))
+                fail('signed legacy signals need their authors to sign the new names; migration stopped');
+            const p = parse(body, s => this.isRef(s));
+            for (const [k, value] of [['room', room], ['genesis', genesis], ['actor', actor], ['message', target], ['signal', signal]]) {
+                if (p.trailers[k]?.length !== 1 || p.trailers[k][0] !== value)
+                    fail(`ALARM signal ${prefix + suffix} has inconsistent legacy metadata`);
+            }
+            const key = `${actor}.${signal}.${target.slice(0, 12)}`, ref = `refs/tags/${key}`;
+            const after = this.git(['mktag'], { input: `object ${target}\ntype commit\ntag ${key}\n${h[3]}\n\n` }).trim();
+            const existing = changes.get(key), live = liveTags.get(ref);
+            if ((existing && existing.after !== after) || (live && live !== after))
+                fail(`ALARM signal ${key} collides with another tag; migration stopped`);
+            if (recorded && !live)
+                fail(`ALARM migrated signal ${key} was removed; migration stopped`);
+            changes.set(key, { before, after });
+            identities.set(before, { key, target, signal });
+            identities.set(after, { key, target, signal });
+            if (!recorded)
+                refs.push(`create ${backup + suffix} ${before}`);
+            if (!live)
+                refs.push(`create ${ref} ${after}`);
+            if (liveOld)
+                refs.push(`delete ${prefix + suffix} ${liveOld}`);
+        }
+        const planned = readers.map(file => {
+            const text = fs.readFileSync(file, 'utf8');
+            const st = strictJson(text, file);
+            if (typeof st.control === 'string' && !kept(st.control))
+                fail('ALARM room control lost accepted history; migration stopped');
+            for (const sha of Object.values(st.heads ?? {})) {
+                if (!kept(sha))
+                    fail('ALARM room log lost accepted history; migration stopped');
+            }
+            const next = {};
+            for (const [original, object] of Object.entries(st.signals ?? {})) {
+                const m = /(?:^|\/)([^/]+)\/((?:[0-9a-f]{40}|[0-9a-f]{64}))\.([a-z][a-z0-9.-]*)$/.exec(original);
+                // An early reader shortened a full ref to its last component and lost the actor. Its pinned object still
+                // proves the identity: recover it only from an exact, verified old object retained by this migration.
+                const bare = /^((?:[0-9a-f]{40}|[0-9a-f]{64}))\.([a-z][a-z0-9.-]*)$/.exec(original);
+                const identity = bare ? identities.get(object) : undefined;
+                if (bare && (!identity || identity.target !== bare[1] || identity.signal !== bare[2]))
+                    fail(`ALARM accepted signal ${original} lost its verified identity; migration stopped`);
+                const key = m ? `${m[1]}.${m[3]}.${m[2].slice(0, 12)}` : identity?.key ?? original;
+                const change = changes.get(key);
+                if (m && !change)
+                    fail(`ALARM accepted signal ${original} is missing; migration stopped`);
+                if (!change && /^[a-z0-9]+(?:[_-][a-z0-9]+)*\.[a-z][a-z0-9.-]*\.[0-9a-f]{12}$/.test(key)
+                    && liveTags.get(`refs/tags/${key}`) !== object)
+                    fail(`ALARM accepted signal ${original} is missing or replaced; migration stopped`);
+                if (change && object !== change.before && object !== change.after)
+                    fail(`ALARM accepted signal ${original} was replaced; migration stopped`);
+                const value = change?.after ?? object;
+                if (next[key] && next[key] !== value)
+                    fail(`ALARM accepted signal ${key} has conflicting objects; migration stopped`);
+                next[key] = value;
+            }
+            return { file, text, st, next, changed: JSON.stringify(st.signals ?? {}) !== JSON.stringify(next) };
+        });
+        return () => {
+            if (refs.length)
+                this.git(['update-ref', '--stdin'], { input: ['start', ...refs, 'prepare', 'commit', ''].join('\n') });
+            for (const p of planned) {
+                if (!p.changed)
+                    continue;
+                // Separate from the live readers directory so the snapshot is never mistaken for another reader.
+                const dir = path.join(this.home, 'migration', this.d.name, genesis, 'readers');
+                mkdirIn(this.home, dir);
+                const snapshot = path.join(dir, `${path.basename(p.file)}.${crypto.createHash('sha256').update(p.text).digest('hex')}`);
+                if (!fs.existsSync(snapshot))
+                    fs.writeFileSync(snapshot, p.text, { flag: 'wx', mode: 0o600 });
+                else if (fs.readFileSync(snapshot, 'utf8') !== p.text)
+                    fail('ALARM migration reader snapshot changed; migration stopped');
+                writeJsonAtomic(p.file, { ...p.st, signals: p.next });
+            }
+        };
+    }
+    // A control record on top of the branch: the control files come from the last control record, never from the tip,
+    // and the messages' files are kept.
     updateControl(room, who, text, files) {
-        const ref = `${this.base(room.name)}/control`;
-        const sha = this.commit(who, text, this.tree(`${room.head}^{tree}`, Object.entries(files).map(([p, c]) => ({ path: p, content: c, mode: '100644' }))), [room.head]);
-        if (!this.advance(ref, sha, room.head))
-            fail(`room ${room.name}: its control moved; retry`);
-        return sha;
+        const kept = [...CONTROL_FILES].flatMap(n => { const c = this.controlFile(room, n); return c === null ? [] : [[n, c]]; });
+        const all = { ...Object.fromEntries(kept), ...files };
+        return this.onTop(room, who, text, Object.entries(all).map(([p, c]) => ({ path: p, content: c, mode: '100644' })), [...CONTROL_FILES]);
     }
     refsUnder(prefix) {
         return this.git(['for-each-ref', '--format=%(refname) %(objectname)', prefix]).split('\n').filter(Boolean).map(l => l.split(' '));
     }
+    // The branch moves under the archive; its signals stay where they are, on its commits.
     archiveRoom(room, as) {
-        const moves = [[`${this.base(room.name)}/`, `refs/archive/${as}/`], [`refs/tags/ringi/${room.genesis}/`, `refs/archive/${as}/signals/`]];
-        for (const [from, to] of moves) {
-            for (const [ref, sha] of this.refsUnder(from)) {
-                this.git(['update-ref', `${to}${ref.slice(from.length)}`, sha, ZERO]);
-                this.git(['update-ref', '-d', ref, sha]);
-            }
-        }
+        const tip = this.rev(this.ref(room.name)) ?? fail(`room ${room.name} is gone`);
+        this.git(['update-ref', `refs/archive/${as}`, tip, ZERO]);
+        this.git(['update-ref', '-d', this.ref(room.name), tip]);
     }
     deleteRoom(room) {
-        for (const prefix of [`${this.base(room.name)}/`, `refs/ringi/accepted/${room.genesis}/`, `refs/tags/ringi/${room.genesis}/`]) {
-            for (const [ref] of this.refsUnder(prefix))
-                this.git(['update-ref', '-d', ref]);
-        }
+        const signals = this.signals(room);
+        this.gitOk(['update-ref', '-d', this.ref(room.name)]);
+        for (const [ref] of this.refsUnder(`refs/ringi/accepted/${room.genesis}/`))
+            this.git(['update-ref', '-d', ref]);
+        for (const s of signals)
+            this.gitOk(['update-ref', '-d', s.ref]);
     }
-    legacy(room) {
-        const base = this.base(room.name);
-        return { name: room.name, head: room.head, genesis: room.genesis, archived: room.archived, control: `${base}/control`, log: (who) => `${base}/log/${who}` };
+    remote(room) {
+        return { name: room.name, ref: this.ref(room.name), head: room.head, genesis: room.genesis, archived: room.archived };
     }
     roster(room) {
         if (this.trust !== 'signed' || room.archived)
             return null;
-        const v = Remote.verifyRoom(this.h, this.legacy(room));
+        const v = Remote.verifyRoom(this.h, this.remote(room));
         return { members: v.members, signers: v.entries };
     }
     // --- logs ---
-    logIds(room) {
-        const prefix = `${this.base(room.name)}/log/`;
-        return this.git(['for-each-ref', '--format=%(refname)', prefix]).split('\n').filter(Boolean).map(r => r.slice(prefix.length));
+    // Logs are read at the branch's live tip, as a reader sees the room now.
+    live(room) {
+        const tip = this.tip(room.name);
+        return tip ? this.entries(room, tip).filter(e => !e.control && !e.skipped) : [];
+    }
+    // What a signed hub skips in the room's branch, as alarms; the room reads on without it.
+    alarms(room) {
+        const tip = this.tip(room.name);
+        return tip ? this.entries(room, tip).filter(e => e.skipped).map(e => `commit ${e.sha.slice(0, 12)} by ${e.author || '(none)'}: ${e.skipped}`) : [];
     }
-    logHead(room, id) { return this.rev(`${this.base(room.name)}/log/${id}`); }
-    // The log's commits after the genesis, oldest first, read as bytes: the text is the commit message, the files are
-    // the explicit Ringi-Files list, or the changed paths for records without it.
+    logIds(room) { return [...new Set(this.live(room).map(e => e.author))]; }
+    logHead(room, id) { return this.live(room).filter(e => e.author === id).at(-1)?.sha ?? null; }
+    // One author's messages after the genesis up to `head`, oldest first, read as bytes: the text is the commit message,
+    // the files are the explicit Ringi-Files list, or the paths the commit adds or changes for records without it.
     messages(room, id, head) {
-        const raw = runGitRaw(this.args(['log', '--topo-order', '--reverse', '--no-renames', '--raw', '--no-abbrev', '--format=%x1e%H%x1f%P%x1f%ct%x1f%B%x1f', head, `^${room.genesis}`]), this.home);
-        return splitBuf(raw, 0x1e).filter(b => b.length).map(rec => {
-            const [sha, parent, ct, body, rest = Buffer.alloc(0)] = splitBuf(rec, 0x1f);
+        const tip = this.trust === 'signed' ? this.tip(room.name) : null;
+        const skipped = new Set(tip ? this.entries(room, tip).filter(e => e.skipped).map(e => e.sha) : []);
+        const raw = runGitRaw(this.args(['log', '--topo-order', '--reverse', '--no-renames', '--raw', '--no-abbrev', '--format=%x1e%H%x1f%P%x1f%ct%x1f', head, `^${room.genesis}`]), this.home);
+        const records = splitBuf(raw, 0x1e).filter(b => b.length).map(rec => splitBuf(rec, 0x1f));
+        const commits = new Map(Remote.readCommits(this.h, records.map(([sha]) => sha.toString())).map(c => [c.sha, c]));
+        return records.flatMap(([sha, parent, ct, rest = Buffer.alloc(0)]) => {
+            const { author, body } = commits.get(sha.toString());
+            if (author !== id || this.isControl(room, sha.toString(), id, body.toString('utf8')) || skipped.has(sha.toString()))
+                return [];
             let files = rest.toString('utf8').split('\n').map(l => /^:\d{6} (\d{6}) \S+ \S+ ([A-Z])\d*\t(.*)$/.exec(l)).filter((x) => !!x)
                 .filter(([, , status]) => status !== 'D').map(([, mode, , p]) => ({ path: p, mode }));
             const declared = parse(body.toString('utf8'), s => this.isRef(s)).trailers['ringi-files'];
@@ -258,34 +503,42 @@ export class GitStore {
                     for (const p of wanted)
                         files.push({ path: p, mode: 'missing' });
             }
-            return { id: sha.toString(), parent: parent.toString() || null, time: Number(ct.toString()), text: body,
-                files: files.filter(f => REGULAR.has(f.mode)), refused: [...refused, ...files.filter(f => !REGULAR.has(f.mode))] };
+            return [{ id: sha.toString(), parent: parent.toString() || null, time: Number(ct.toString()), text: body,
+                    files: files.filter(f => REGULAR.has(f.mode)), refused: [...refused, ...files.filter(f => !REGULAR.has(f.mode))] }];
         });
     }
-    // One commit on the author's log, compare-and-swap, so two writers of one log retry instead of forking it.
+    // One message on top of the room's branch.
     append(room, who, text, entries) {
         if (room.archived)
             fail(`room ${room.name} is archived: read-only`);
         if (checkOutgoing(text, s => this.isRef(s)).trailers['ringi-files'])
             fail('Ringi-Files is store metadata; supply attachments instead');
+        const own = entries.find(e => CONTROL_FILES.has(e.path));
+        if (own)
+            fail(`${own.path} is the room's own file; attach it under another path`);
         if (entries.length)
             text = `${text.trimEnd()}\nRingi-Files: ${JSON.stringify([...new Set(entries.map(e => e.path))])}\n`;
         if (Buffer.byteLength(text) > TEXT_MAX)
             fail('attachment list makes the message exceed 64 KiB; use fewer or shorter paths');
         checkOutgoing(text, s => this.isRef(s));
-        const ref = `${this.base(room.name)}/log/${who}`;
+        return this.onTop(room, who, text, entries);
+    }
+    // A commit on the branch's tip, compare-and-swap: when another writer got there first, it is made again on the new tip.
+    onTop(room, who, text, entries, drop = []) {
+        const ref = this.ref(room.name);
         for (let i = 0; i < 8; i++) {
-            const head = this.rev(ref);
-            const base = head ? `${head}^{tree}` : null;
-            const tree = entries.length ? this.tree(base, entries) : base ? this.git(['rev-parse', base]).trim() : this.emptyTree();
-            const sha = this.commit(who, text, tree, [head ?? room.genesis]);
-            if (this.advance(ref, sha, head))
+            const tip = this.rev(ref) ?? fail(`room ${room.name} is gone`);
+            if (drop.length && this.room(room.name)?.head !== room.head)
+                fail('room control moved while writing; retry the operation');
+            const tree = entries.length || drop.length ? this.tree(`${tip}^{tree}`, entries, drop) : this.git(['rev-parse', `${tip}^{tree}`]).trim();
+            const sha = this.commit(who, text, tree, [tip]);
+            if (this.advance(ref, sha, tip))
                 return sha;
         }
-        return fail(`the log ${who} kept moving while writing; retry`);
+        return fail(`room ${room.name} kept moving while writing; retry`);
     }
     verifyLog(room, id, head) {
-        return this.trust === 'signed' ? Remote.verify(this.h, this.legacy(room), id, head) : null;
+        return this.trust === 'signed' ? Remote.verify(this.h, this.remote(room), id, head) : null;
     }
     pin(room, reader, id, rev) {
         if (!room.archived)
@@ -304,10 +557,10 @@ export class GitStore {
             .filter(([, , p]) => wanted.has(p)).map(([, n, p]) => [p, Number(n)]));
     }
     // --- signals ---
-    // An annotated tag in its author's namespace under the room's genesis (a room recreated under the same name is
-    // another namespace), signed on a signed hub. Writing the same signal twice is a no-op.
-    signal(room, who, target, name, text) {
-        const tag = `ringi/${room.genesis}/${who}/${name}`;
+    // An annotated tag without text in its author's namespace, on the message's commit, signed on a signed hub. The
+    // message's id in the name keeps it unique, so writing the same signal twice is a no-op.
+    signal(room, who, target, name) {
+        const tag = `${who}.${name}`;
         const ref = `refs/tags/${tag}`;
         if (this.gitOk(['rev-parse', '-q', '--verify', ref]).status === 0) {
             Remote.push(this.h, ref);
@@ -315,31 +568,68 @@ export class GitStore {
         }
         const sign = Remote.sign(this.h, who, this.home);
         const key = sign[0]?.slice(2);
-        this.git([...(key ? ['-c', `user.signingkey=${key}`] : []), 'tag', key ? '-s' : '-a', '-F', '-', tag, target], { input: text, env: ident(who) });
+        this.git([...(key ? ['-c', `user.signingkey=${key}`] : []), 'tag', key ? '-s' : '-a', '-F', '-', tag, target], { input: '', env: ident(who) });
         Remote.push(this.h, ref);
     }
+    // The tags named `<actor>.<signal>.<message12>`, with the objects they name.
+    tags() {
+        return this.git(['for-each-ref', '--format=%(refname) %(objectname) %(objecttype)', 'refs/tags/']).split('\n').flatMap(line => {
+            const [ref, object, type] = line.split(' ');
+            const m = /^refs\/tags\/([a-z0-9]+(?:[_-][a-z0-9]+)*)\.([a-z][a-z0-9.-]*\.[0-9a-f]{12})$/.exec(ref ?? '');
+            return m ? [{ ref, actor: m[1], name: m[2], object, type }] : [];
+        });
+    }
+    // Annotated tag objects read whole, size-framed: their target, tagger and text are never split on bytes they hold.
+    tagObjects(shas) {
+        const out = new Map();
+        if (!shas.length)
+            return out;
+        const raw = runGitRaw(this.args(['cat-file', '--batch']), this.home, Buffer.from(shas.join('\n') + '\n'));
+        let at = 0;
+        for (const sha of shas) {
+            const nl = raw.indexOf(0x0a, at);
+            const [got, type, size] = raw.subarray(at, nl).toString('utf8').split(' ');
+            const body = raw.subarray(nl + 1, nl + 1 + Number(size));
+            at = nl + 1 + Number(size) + 1;
+            if (got !== sha || type !== 'tag')
+                continue;
+            const split = body.indexOf('\n\n');
+            const hdr = body.subarray(0, split < 0 ? body.length : split).toString('utf8');
+            const text = split < 0 ? '' : body.subarray(split + 2).toString('utf8').split('-----BEGIN SSH SIGNATURE-----')[0];
+            const target = /^object ([0-9a-f]+)\ntype commit$/m.exec(hdr)?.[1] ?? '';
+            out.set(sha, { target, tagger: /^tagger (.*?) <[^>\n]*> \d+ [+-]\d{4}$/m.exec(hdr)?.[1] ?? '', text });
+        }
+        return out;
+    }
+    // Every commit of the room's branch: a signal belongs to the room whose branch holds its message.
+    commitsOf(room) {
+        const tip = this.tip(room.name);
+        return new Set(tip ? this.entries(room, tip).map(e => e.sha) : []);
+    }
     signals(room) {
-        const prefix = room.archived ? `refs/archive/${room.name}/signals/` : `refs/tags/ringi/${room.genesis}/`;
-        const raw = this.git(['for-each-ref', '--format=%(refname)%1f%(objectname)%1f%(objecttype)%1f%(*objectname)%1f%(taggername)%1f%(contents)%1e', prefix]);
-        const records = raw.split('\x1e').map(s => s.replace(/^\n/, '')).filter(Boolean).map(rec => {
-            const [ref, object, type, target, tagger, text = ''] = rec.split('\x1f');
-            const [actor, ...rest] = ref.slice(prefix.length).split('/');
+        const tags = this.tags(), objects = this.tagObjects(tags.filter(t => t.type === 'tag').map(t => t.object));
+        const mine = this.commitsOf(room);
+        const records = tags.flatMap(t => {
+            const o = objects.get(t.object);
             // Only an annotated tag on a commit is a signal; anything else points nowhere.
-            return { ref, object, name: rest.join('/'), actor, target: type === 'tag' ? target : '', tagger, text };
+            if (!mine.has(o?.target || t.object))
+                return [];
+            return [{ ref: t.ref, object: t.object, name: t.name, actor: t.actor, target: o?.target ?? '', tagger: o?.tagger ?? '', text: o?.text ?? '' }];
         });
         if (this.trust !== 'signed' || room.archived)
             return records;
         return Remote.withVerification(this.h, () => records.filter(s => {
-            const why = Remote.verifySignal(this.h, this.legacy(room), s.ref, s.object);
+            const why = Remote.verifySignal(this.h, this.remote(room), s.ref, s.object);
             if (why)
                 note(`ALARM signal ${s.ref}: ${why}; quarantined and withheld`);
             return !why;
         }));
     }
     // --- signed stores ---
-    admit(room, who, key) { return Remote.roomAdmit(this.h, this.legacy(room), who, key, this.home); }
-    joinKey(room, who) { return Remote.join(this.h, this.legacy(room), who, this.home); }
-    forgetLog(room, id) { Remote.forget(this.h, this.legacy(room), id); }
+    admit(room, who, key) { return Remote.roomAdmit(this.h, this.remote(room), who, key, this.home); }
+    joinKey(room, who) { return Remote.join(this.h, this.remote(room), who, this.home); }
+    // A room's transport alarm is the room's, whichever author the operator forgets.
+    forgetLog(room, _id) { Remote.forget(this.h, this.remote(room)); }
     rootKey() { return this.d.root ?? fail(`hub ${this.d.name} has no pinned root`); }
     rootRoster() { return Remote.rootRoster(this.h); }
 }