@indigoai-us/hq-cloud 6.16.65 → 6.16.67

package/dist/journal.js

@@ -17,7 +17,7 @@ import * as os from "os";
 import * as path from "path";
 import * as crypto from "crypto";
 import { JournalRowOverlay, JournalRowStore, journalEntryFingerprint, } from "./journal-row-store.js";
-import { createJournalRecordProxy } from "./journal-record-proxy.js";
+import { createJournalRecordProxy, journalRecordRows } from "./journal-record-proxy.js";
 import { decodeJournalSnapshot, decodedJournalRows } from "./journal-snapshot-decoder.js";
 import { forgetSharedAreaJournalRows } from "./journal-snapshot-rows.js";
 import { encodeV4JournalSnapshotChunks } from "./journal-snapshot-v4.js";
@@ -114,6 +114,9 @@ export function journalRows(journal) {
     const backing = storeBackedJournals.get(journal);
     if (backing)
         return backing.store;
+    const proxied = journalRecordRows(journal.files);
+    if (proxied)
+        return proxied;
     const decoded = decodedJournalRows(journal);
     if (decoded)
         return decoded.rows;
@@ -146,9 +149,12 @@ export function closeCachedAreaJournalMigration(slug) {
     closeCachedAreaMigration(getStateDir(), slug);
 }
 /**
- * Release all process-local area bridges after a completed runner pass.
- * They hold lazy StateStore/aggregate caches but no file descriptors; durable
- * state is authoritative, so a later pass can safely construct a fresh bridge.
+ * Release all process-local area bridges at runner shutdown.
+ *
+ * A bridge owns one packed aggregate per authoritative journal. It is retained
+ * through ordinary watch passes so a later scoped callback cannot re-pack the
+ * whole journal synchronously. Durable layout/phase changes use the narrower
+ * close helper above; shutdown is the terminal memory boundary.
  */
 export function releaseCachedAreaJournalMigrations() {
     for (const [cacheKey, cached] of cachedAreaMigrations) {
@@ -191,7 +197,8 @@ function readStoreBackedJournal(journal, options = {}) {
         existing.pullsJson = JSON.stringify(journal.pulls ?? []);
         return journal;
     }
-    const decoded = decodedJournalRows(journal);
+    const proxied = journalRecordRows(journal.files);
+    const decoded = proxied ?? decodedJournalRows(journal);
     if (decoded) {
         if (options.privateOverlay) {
             const store = new JournalRowOverlay(decoded);
@@ -207,7 +214,22 @@ function readStoreBackedJournal(journal, options = {}) {
             });
             return result;
         }
-        decoded.enableChangeTracking();
+        if (decoded instanceof JournalRowStore)
+            decoded.enableChangeTracking();
+        else {
+            const store = new JournalRowOverlay(decoded);
+            const result = { ...journal, files: createJournalRecordProxy(store) };
+            if (Object.hasOwn(journal, "pulls"))
+                result.pulls = structuredClone(journal.pulls);
+            storeBackedJournals.set(result, {
+                store,
+                version: result.version,
+                lastSync: result.lastSync,
+                pullsJson: JSON.stringify(result.pulls ?? []),
+                keysNormalized: false,
+            });
+            return result;
+        }
         storeBackedJournals.set(journal, {
             store: decoded,
             version: journal.version,
@@ -279,11 +301,27 @@ function journalDeltaFromStoreDirtyLog(backing, next) {
 }
 function checkpointStoreBackedJournal(backing, journal) {
     backing.store.drainDirtyLog();
-    backing.store.clearCommittedChanges?.();
     backing.version = journal.version;
     backing.lastSync = journal.lastSync;
     backing.pullsJson = JSON.stringify(journal.pulls ?? []);
 }
+/**
+ * Move one full-pass facade onto the immutable durable revision it just
+ * published. Its prior private overlay contains the now-committed rows; merely
+ * clearing that overlay would make the caller's journal roll back to the old
+ * packed base. The StateStore reducer publishes a fresh overlay for every
+ * delta, so later scoped writes replace the aggregate instead of mutating this
+ * pass's newly established base.
+ */
+function rebaseStoreBackedJournal(backing, journal, durable) {
+    const rows = journalRecordRows(durable.files) ?? decodedJournalRows(durable);
+    const store = new JournalRowOverlay(rows ?? new RecordJournalRows(durable.files));
+    journal.version = durable.version;
+    journal.lastSync = durable.lastSync;
+    journal.pulls = structuredClone(durable.pulls ?? []);
+    journal.files = createJournalRecordProxy(store);
+    backing.store = store;
+}
 function storeBackedJournalNeedsMigration(backing, journal) {
     return journal.version !== JOURNAL_VERSION_CURRENT ||
         !Array.isArray(journal.pulls) ||
@@ -357,16 +395,15 @@ function entryFingerprint(entry) {
  */
 export function journalDeltaFromBaseline(baseline, next) {
     const upserts = {};
-    const files = next.files;
-    for (const key of Object.keys(files)) {
-        const entry = files[key];
+    const nextRows = journalRows(next);
+    for (const [key, entry] of nextRows.entries()) {
         if (baseline.rows.get(key) === entryFingerprint(entry))
             continue;
         upserts[key] = entry;
     }
     const deletes = [];
     for (const key of baseline.rows.keys()) {
-        if (!Object.hasOwn(files, key))
+        if (!nextRows.has(key))
             deletes.push(key);
     }
     const delta = {
@@ -510,7 +547,11 @@ export function readJournal(slug) {
         // mutable without deep-cloning the aggregate before every pass.
         return readStoreBackedJournal(areaMigration.readAreaJournalCached().journal, { privateOverlay: true });
     }
-    return readStoreBackedJournal(readJournalAggregateWith(slug, areaMigration));
+    // The retained keyed projection and this full-pass facade can borrow the
+    // same immutable packed rows. Each owns only its own overlay, so an
+    // uncommitted full pass is never visible to a scoped reader (and a scoped
+    // delta cannot dirty the full pass).
+    return readStoreBackedJournal(readJournalAggregateWith(slug, areaMigration, true), { privateOverlay: true });
 }
 /**
  * Read the mutable outer shell required by a full pull without detaching every
@@ -521,9 +562,8 @@ export function readJournal(slug) {
  * own changes in a private overlay. `writeJournal()` drains that overlay's
  * dirty log, avoiding a full-ledger fingerprint at every download checkpoint.
  *
- * Legacy journals deliberately keep `readJournal()`'s packed-record boundary.
- * That path has different ownership and dirty-log semantics, and does not make
- * the area-authoritative structured-clone copy that this reader avoids.
+ * Legacy and area-authoritative journals both borrow immutable packed rows and
+ * put their caller-owned mutations in a private overlay.
  *
  * @internal Full-pull boundary; not a public journal record API.
  */
@@ -559,49 +599,55 @@ export function readJournalForPass(slug) {
 function readJournalAggregate(slug) {
     return readJournalAggregateWith(slug, openAreaMigrationIfAuthoritative(slug));
 }
-function readJournalAggregateWith(slug, areaMigration) {
+function readJournalAggregateWith(slug, areaMigration, retainScopedProjection = false) {
     if (areaMigration)
         return areaMigration.readAreaJournal();
-    if (StateStore.exists(getStateDir(), journalScopeId(slug))) {
-        return openJournalStore(slug, emptyJournal()).getState().journal;
-    }
-    return openJournalStore(slug, readLegacyJournal(slug)).getState().journal;
+    const store = StateStore.exists(getStateDir(), journalScopeId(slug))
+        ? openJournalStore(slug, emptyJournal())
+        : openJournalStore(slug, readLegacyJournal(slug));
+    if (retainScopedProjection) {
+        // A full pass has already paid to recover this packed snapshot. Retain its
+        // projection for the next scoped pass instead of making that pass decode
+        // the same vault before it looks up even one named row. Read-only
+        // enumeration deliberately does not retain: watcher warm-up may inspect
+        // every locator and must not evict the hot personal projection.
+        retainScopedJournalStore(slug, new JournalStore(slug, store));
+    }
+    return store.getState().journal;
 }
 /**
  * Read a mutable, detached snapshot for named rows in a scoped pass.
  *
- * Area-authoritative journals use the ledger's keyed reader so the work is
- * proportional to the named keys rather than the full cached aggregate. The
- * legacy store has no keyed persistence surface, so it reads the named keys
- * straight out of the aggregate (O(K)) and, only when delete roots are named,
- * makes one linear pass over the rows with an ancestor-set lookup per row. It
- * must never be rows x roots: a watch-mode batch names one delete root per
- * changed path, and a warm-up catch-up hands the pass ~10k of them against a
- * 70k-row vault journal.
+ * Area-authoritative journals use the ledger's keyed reader. Other journals
+ * retain one refreshed packed projection after the preceding full pass, so a
+ * scoped read is proportional to named keys rather than a fresh snapshot
+ * recovery. Only named delete roots require a linear row scan, with an
+ * ancestor-set lookup per row; it must never be rows x roots.
  */
 export function readJournalScoped(slug, keys, deleteScopeRoots = []) {
     const areaMigration = openAreaMigrationIfAuthoritative(slug);
     if (areaMigration) {
         return rememberJournalBaseline(areaMigration.readAreaJournalScoped(keys, deleteScopeRoots));
     }
-    const full = readJournalAggregate(slug);
-    const fullRows = journalRows(full);
+    const store = scopedJournalStore(slug);
+    store.refresh();
+    const metadata = store.metadata();
     const files = {};
     const roots = new Set(deleteScopeRoots);
     if (roots.has("")) {
-        for (const [key, entry] of fullRows.entries()) {
+        for (const [key, entry] of store.scanPrefix("")) {
             files[key] = structuredClone(entry);
         }
     }
     else {
         for (const key of new Set(keys)) {
-            const entry = fullRows.get(key);
+            const entry = store.get(key);
             if (entry === undefined)
                 continue;
             files[key] = structuredClone(entry);
         }
         if (roots.size > 0) {
-            for (const [key, entry] of fullRows.entries()) {
+            for (const [key, entry] of store.scanPrefix("")) {
                 if (Object.hasOwn(files, key))
                     continue;
                 if (isUnderAnyRoot(key, roots))
@@ -610,10 +656,10 @@ export function readJournalScoped(slug, keys, deleteScopeRoots = []) {
         }
     }
     return rememberJournalBaseline({
-        version: full.version,
-        lastSync: full.lastSync,
+        version: metadata.version,
+        lastSync: metadata.lastSync,
         files,
-        pulls: structuredClone(full.pulls ?? []),
+        pulls: structuredClone(metadata.pulls),
     });
 }
 /**
@@ -694,9 +740,22 @@ function journalStoreOptions(slug, initialJournal) {
             }
             if (record.type === JOURNAL_DELTA_RECORD_TYPE) {
                 const delta = record.payload;
-                for (const key of delta.deletes)
-                    delete state.journal.files[key];
-                Object.assign(state.journal.files, delta.upserts);
+                const existingRows = journalRecordRows(state.journal.files) ?? decodedJournalRows(state.journal);
+                if (existingRows) {
+                    // StateStore's aggregate is also the immutable source for any
+                    // full-pass facade opened before this append. Once a first delta is
+                    // observed, put durable changes in a separate overlay rather than
+                    // mutating that shared packed row store.
+                    const rows = existingRows instanceof JournalRowOverlay
+                        ? existingRows.withCommittedDelta(delta.upserts, delta.deletes)
+                        : new JournalRowOverlay(existingRows).withCommittedDelta(delta.upserts, delta.deletes);
+                    state.journal.files = createJournalRecordProxy(rows);
+                }
+                else {
+                    for (const key of delta.deletes)
+                        delete state.journal.files[key];
+                    Object.assign(state.journal.files, delta.upserts);
+                }
                 state.journal.version = delta.version;
                 state.journal.lastSync = delta.lastSync ?? state.journal.lastSync;
                 state.journal.pulls = delta.pulls ?? state.journal.pulls;
@@ -735,6 +794,10 @@ function openAreaMigrationIfAuthoritative(slug) {
         closeCachedAreaMigration(stateDir, slug);
         return undefined;
     }
+    // Area authority replaces the legacy v3 aggregate. Drop any retained legacy
+    // projection before a scoped reader can accidentally keep both generations
+    // resident (or use the obsolete writer after cutover).
+    releaseScopedJournalStore(slug);
     const resolverPath = path.join(areaLayoutDirectory(stateDir, slug), "area-resolver.json");
     let resolverJson;
     try {
@@ -799,19 +862,20 @@ export function openJournalStateStoreForMigration(slug) {
 async function openJournalStoreAsync(slug, initialJournal) {
     return StateStore.openAsync(journalStoreOptions(slug, initialJournal));
 }
-/**
- * Long-lived keyed projection over the v3 snapshot/WAL authority.
- *
- * The first open recovers once. Subsequent refreshes consume only authenticated
- * complete WAL frames, rebuilding the projection solely after a generation
- * publication or invalid-tail fallback.
- */
 export class JournalStore {
     slug;
     store;
     areaMigration;
     files = new JournalRowStore({ trackChanges: false });
     usesSharedRows = false;
+    /**
+     * Durable deltas this keyed session has observed after its base snapshot.
+     * The base can be shared with a full-pass facade, so publishing a scoped
+     * delta here must never mutate it in place.
+     */
+    committedOverlay = new Map();
+    /** Base keys deleted then reinserted by durable records move to the tail. */
+    committedMoved = new Set();
     /**
      * Pass-local rows that have not reached the shared projection yet. A missing
      * value represents a staged delete; every other value is a frozen copy of
@@ -841,27 +905,56 @@ export class JournalStore {
         this.assertOpen();
         if (this.overlay.has(key))
             return this.overlay.get(key);
+        if (this.committedOverlay.has(key))
+            return this.committedOverlay.get(key);
         return this.files.get(key);
     }
     scanPrefix(prefix) {
         this.assertOpen();
-        const rows = new Map(this.files.entriesForPrefix(prefix));
         const normalizedPrefix = prefix.replace(/\/+$/, "");
-        for (const [key, entry] of this.overlay) {
-            if (!isJournalStorePrefixMatch(key, normalizedPrefix))
-                continue;
-            if (entry === undefined)
-                rows.delete(key);
-            else
-                rows.set(key, entry);
-        }
-        return Array.from(rows.entries());
+        const files = this.files;
+        const committedOverlay = this.committedOverlay;
+        const committedMoved = this.committedMoved;
+        const overlay = this.overlay;
+        const iterate = function* () {
+            for (const [key, entry] of files.entriesForPrefix(normalizedPrefix)) {
+                if (committedMoved.has(key))
+                    continue;
+                const replacement = overlay.has(key)
+                    ? overlay.get(key)
+                    : committedOverlay.has(key)
+                        ? committedOverlay.get(key)
+                        : entry;
+                if (replacement !== undefined)
+                    yield [key, replacement];
+            }
+            // A Map replacement preserves the base row's position and appends newly
+            // introduced overlay rows. Preserve that observable order without holding
+            // a materialized JournalEntry for every base row at once.
+            const additions = new Map(committedOverlay);
+            for (const [key, entry] of overlay)
+                additions.set(key, entry);
+            for (const [key, entry] of additions) {
+                if (entry === undefined || (files.has(key) && !committedMoved.has(key)))
+                    continue;
+                if (isJournalStorePrefixMatch(key, normalizedPrefix))
+                    yield [key, entry];
+            }
+        };
+        const scan = {
+            [Symbol.iterator]: iterate,
+            filter: ((predicate, thisArg) => Array.from(iterate()).filter(predicate, thisArg)),
+        };
+        return scan;
     }
     rowCount() {
         if (this.disposed)
             return 0;
+        const replacements = new Map(this.committedOverlay);
+        for (const [key, entry] of this.overlay)
+            replacements.set(key, entry);
         let count = this.files.size;
-        for (const [key, entry] of this.overlay) {
+        for (const [key, entry] of replacements) {
             const existsInSharedStore = this.files.has(key);
             if (entry === undefined) {
                 if (existsInSharedStore)
@@ -877,7 +970,9 @@ export class JournalStore {
     set(key, entry) {
         this.assertOpen();
         const ownedEntry = immutableCopy(entry);
-        const sharedEntry = this.files.get(key);
+        const sharedEntry = this.committedOverlay.has(key)
+            ? this.committedOverlay.get(key)
+            : this.files.get(key);
         if (sharedEntry !== undefined && sameEntry(sharedEntry, ownedEntry)) {
             this.overlay.delete(key);
             return;
@@ -890,12 +985,12 @@ export class JournalStore {
         if (this.overlay.has(key)) {
             if (this.overlay.get(key) === undefined)
                 return false;
-            if (!this.files.has(key)) {
+            if (!this.committedOverlay.has(key) && !this.files.has(key)) {
                 this.overlay.delete(key);
                 return true;
             }
         }
-        else if (!this.files.has(key)) {
+        else if (this.get(key) === undefined) {
             return false;
         }
         this.overlay.set(key, undefined);
@@ -934,6 +1029,17 @@ export class JournalStore {
             pulls: this.pulls,
         });
     }
+    /**
+     * The StateStore aggregate after a durable append. Its row view is immutable
+     * across later deltas, which lets a full-pass facade rebase without exposing
+     * its completed checkpoint to subsequent scoped writers.
+     */
+    durableJournalForRebase() {
+        this.assertOpen();
+        if (this.areaMigration)
+            return this.areaMigration.readAreaJournalCached().journal;
+        return this.store.getState().journal;
+    }
     refresh() {
         this.assertOpen();
         if (this.areaMigration) {
@@ -960,12 +1066,10 @@ export class JournalStore {
         this.applyRefresh(result);
     }
     applyRefresh(result) {
-        if (result.recovered) {
+        if (result.recovered || result.records.length > 0) {
             this.replaceFromJournal(this.store.getState().journal);
             return;
         }
-        for (const record of result.records)
-            this.applyRecord(record.type, record.payload);
     }
     applyDelta(delta) {
         this.assertOpen();
@@ -1025,13 +1129,11 @@ export class JournalStore {
         this.applyCommitted(appended);
         ensureJournalLocator(this.slug);
     }
-    applyCommitted(appended) {
-        if (appended.refresh.recovered)
-            this.replaceFromJournal(this.store.getState().journal);
-        else
-            for (const record of appended.refresh.records)
-                this.applyRecord(record.type, record.payload);
-        this.applyRecord(appended.type, appended.payload);
+    applyCommitted(_appended) {
+        // StateStore has reduced the just-appended durable frame already. Repoint
+        // this cache at that immutable aggregate rather than replaying the frame
+        // into a second mutable overlay beside it.
+        this.replaceFromJournal(this.store.getState().journal);
     }
     /**
      * Packing copies every source row into typed arrays, so this projection never
@@ -1040,21 +1142,30 @@ export class JournalStore {
      * pass-local), which is what put the outposts over Node's heap ceiling.
      */
     replaceFromJournal(journal) {
-        const decoded = decodedJournalRows(journal);
+        const proxied = journalRecordRows(journal.files);
+        const decoded = proxied instanceof JournalRowStore || proxied instanceof JournalRowOverlay
+            ? proxied
+            : decodedJournalRows(journal);
         if (decoded) {
-            if (!this.usesSharedRows && this.files !== decoded)
+            if (!this.usesSharedRows && this.files instanceof JournalRowStore && this.files !== decoded) {
                 this.files.clear();
+            }
             this.files = decoded;
             this.usesSharedRows = true;
+            this.committedOverlay.clear();
+            this.committedMoved.clear();
             this.version = journal.version;
             this.lastSync = journal.lastSync;
             this.pulls = structuredClone(journal.pulls ?? []);
             return;
         }
-        if (this.usesSharedRows)
+        if (this.usesSharedRows || !(this.files instanceof JournalRowStore)) {
             this.files = new JournalRowStore({ trackChanges: false });
+        }
         this.files.replaceFromRecord(journal.files);
         this.usesSharedRows = false;
+        this.committedOverlay.clear();
+        this.committedMoved.clear();
         this.version = journal.version;
         this.lastSync = journal.lastSync;
         this.pulls = structuredClone(journal.pulls ?? []);
@@ -1068,9 +1179,15 @@ export class JournalStore {
             throw new Error("journal: keyed session received an invalid WAL record");
         }
         for (const key of payload.deletes)
-            this.files.delete(key);
-        for (const [key, entry] of Object.entries(payload.upserts))
-            this.files.set(key, entry);
+            this.committedOverlay.set(key, undefined);
+        for (const [key, entry] of Object.entries(payload.upserts)) {
+            if (this.committedOverlay.get(key) === undefined && this.committedOverlay.has(key)) {
+                this.committedOverlay.delete(key);
+                if (this.files.has(key))
+                    this.committedMoved.add(key);
+            }
+            this.committedOverlay.set(key, immutableCopy(entry));
+        }
         this.version = payload.version;
         this.lastSync = payload.lastSync ?? this.lastSync;
         this.pulls = structuredClone(payload.pulls ?? this.pulls);
@@ -1081,7 +1198,9 @@ export class JournalStore {
             return;
         this.disposed = true;
         this.overlay.clear();
-        if (!this.usesSharedRows)
+        this.committedOverlay.clear();
+        this.committedMoved.clear();
+        if (!this.usesSharedRows && this.files instanceof JournalRowStore)
             this.files.clear();
         this.store = undefined;
         this.areaMigration = undefined;
@@ -1108,6 +1227,69 @@ function immutableCopy(value) {
     freeze(copy);
     return copy;
 }
+// A scoped watcher pass must not recover a 700k-row snapshot just to inspect
+// one path. A runner can alternate the personal vault and its companies in the
+// same realtime batch, so one cache entry turns that alternation into a fresh
+// whole-snapshot recovery on every dispatch. Keep a deliberately small LRU:
+// enough for the runner's active journal set, bounded so an unusually broad
+// company fanout cannot retain every journal for the lifetime of the process.
+const MAX_RETAINED_SCOPED_JOURNALS = 4;
+const cachedScopedJournalStores = new Map();
+function scopedJournalStoreCacheKey(slug) {
+    return `${getStateDir()}\u0000${slug}`;
+}
+function cachedScopedJournalStoreFor(slug) {
+    const cacheKey = scopedJournalStoreCacheKey(slug);
+    const cached = cachedScopedJournalStores.get(cacheKey);
+    if (cached === undefined)
+        return undefined;
+    // Map insertion order is our LRU order. A hot scope must not be evicted by
+    // a brief company fanout while the runner is still using it.
+    cachedScopedJournalStores.delete(cacheKey);
+    cachedScopedJournalStores.set(cacheKey, cached);
+    return cached;
+}
+function retainScopedJournalStore(slug, store) {
+    const cacheKey = scopedJournalStoreCacheKey(slug);
+    const previous = cachedScopedJournalStores.get(cacheKey);
+    if (previous !== undefined && previous !== store)
+        previous.dispose();
+    cachedScopedJournalStores.delete(cacheKey);
+    cachedScopedJournalStores.set(cacheKey, store);
+    while (cachedScopedJournalStores.size > MAX_RETAINED_SCOPED_JOURNALS) {
+        const oldest = cachedScopedJournalStores.entries().next().value;
+        if (oldest === undefined)
+            break;
+        const [oldestKey, oldestStore] = oldest;
+        cachedScopedJournalStores.delete(oldestKey);
+        oldestStore.dispose();
+    }
+    return store;
+}
+function scopedJournalStore(slug) {
+    const cached = cachedScopedJournalStoreFor(slug);
+    if (cached)
+        return cached;
+    return retainScopedJournalStore(slug, openJournalStoreSession(slug));
+}
+/** Drop one legacy keyed projection after an authoritative area cutover. */
+export function releaseScopedJournalStore(slug) {
+    const cacheKey = scopedJournalStoreCacheKey(slug);
+    const cached = cachedScopedJournalStores.get(cacheKey);
+    if (cached === undefined)
+        return;
+    cachedScopedJournalStores.delete(cacheKey);
+    cached.dispose();
+}
+/**
+ * Release retained scoped projections when a watch runner stops. Durable state
+ * remains in the StateStore; this only drops process-local decoded snapshots.
+ */
+export function disposeScopedJournalStores() {
+    for (const store of cachedScopedJournalStores.values())
+        store.dispose();
+    cachedScopedJournalStores.clear();
+}
 /** Open one keyed session, seeding a missing v3 store from legacy JSON once. */
 export function openJournalStoreSession(slug) {
     const areaMigration = openAreaMigrationIfAuthoritative(slug);
@@ -1620,6 +1802,47 @@ export function writeJournal(slug, journal) {
         ensureJournalLocator(slug);
         return;
     }
+    const baseline = journalBaselines.get(journal);
+    const cached = cachedScopedJournalStoreFor(slug);
+    if (cached && (storeBacking || baseline)) {
+        // The scoped reader captured only its named rows, so its baseline is the
+        // authoritative delta boundary. The retained session refreshes and appends
+        // under the normal StateStore lock; it never exposes partial durable rows
+        // to another writer.
+        const delta = storeBacking
+            ? journalDeltaFromStoreDirtyLog(storeBacking, journal)
+            : baseline
+                ? journalDeltaFromBaseline(baseline, journal)
+                : undefined;
+        if (delta && hasJournalDelta(delta)) {
+            // Carry ONLY the metadata fields this delta actually changed. The
+            // retained session's `metadata()` is a snapshot that goes stale the
+            // moment another writer advances `lastSync` or appends a pull record,
+            // and filling the untouched field from it republished that stale value
+            // over the concurrent writer's durable one — dropping pull history or
+            // reverting `lastSync`. The store's reducer already preserves a field
+            // the delta omits, so omission is the whole fix.
+            const metadata = {};
+            if (delta.lastSync !== undefined)
+                metadata.lastSync = delta.lastSync;
+            if (delta.pulls !== undefined)
+                metadata.pulls = delta.pulls;
+            const hasMetadata = delta.lastSync !== undefined || delta.pulls !== undefined;
+            cached.applyDelta({
+                upserts: delta.upserts,
+                deletes: delta.deletes,
+                ...(hasMetadata ? { metadata } : {}),
+            });
+        }
+        if (storeBacking) {
+            rebaseStoreBackedJournal(storeBacking, journal, cached.durableJournalForRebase());
+            checkpointStoreBackedJournal(storeBacking, journal);
+        }
+        else
+            rememberJournalBaseline(journal);
+        ensureJournalLocator(slug);
+        return;
+    }
     const store = openJournalStore(slug, journal);
     if (store.wasCreated) {
         // The store was just seeded from this journal, so its state already matches
@@ -1643,7 +1866,6 @@ export function writeJournal(slug, journal) {
     // The WAL still compacts on its own schedule (record count or byte ceiling),
     // so a full snapshot is written periodically rather than never — recovery
     // stays bounded, it just no longer happens on every single update.
-    const baseline = journalBaselines.get(journal);
     const delta = storeBacking
         ? journalDeltaFromStoreDirtyLog(storeBacking, journal)
         : baseline
@@ -1652,8 +1874,10 @@ export function writeJournal(slug, journal) {
     store.append(JOURNAL_DELTA_RECORD_TYPE, delta);
     // A caller can checkpoint more than once during one pass. Advancing only its
     // own tracking state means the next checkpoint again publishes only new mutations.
-    if (storeBacking)
+    if (storeBacking) {
+        rebaseStoreBackedJournal(storeBacking, journal, store.getState().journal);
         checkpointStoreBackedJournal(storeBacking, journal);
+    }
     else
         rememberJournalBaseline(journal);
     // The locator is immutable content, so it only needs writing if it is absent