@opendatalabs/personal-server-ts-server 1.34.1 → 1.35.0

package/dist/storage/pdpp-records-sqlite-store.js

@@ -1,32 +1,15 @@
+import { assertSupportedSchemaVersions } from "./schema-versions.js";
+import { binaryLength, readBinary, verifyBinary, } from "./pdpp-binary-chunks.js";
+import { parseTime, timeSortKey, } from "@opendatalabs/personal-server-ts-core/pdpp";
+import { selectSyncChange, decodeListCursor, decodeSyncPageCursor, listSnapshotPage, compareRecordIdentity, LIST_ORDER_COLUMNS, } from "@opendatalabs/personal-server-ts-core/storage/pdpp-records";
 import { createHash } from "node:crypto";
 import { randomUUID } from "node:crypto";
 import { encodeRecordKey, planIngest, RecordKeyError, summarizeIngest, decodeCursor, encodeCursor, InvalidCursorSyntaxError, CursorExpiredError, InvalidCursorError, BlobConflictError, } from "@opendatalabs/personal-server-ts-core/storage/pdpp-records";
 import { isCompletionTime, liveSnapshotDigest, parseCompletionRequest, StreamCompletionError, } from "./pdpp-stream-completion.js";
 export { StreamCompletionError, } from "./pdpp-stream-completion.js";
-const RFC3339_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?(?:[Zz]|[+-](\d{2}):(\d{2}))$/;
-/** RFC 3339 `date-time`, with calendar-valid fields. No clock check. */
+/** Compatibility export; the portable temporal policy owns RFC3339 validity. */
 export function isRfc3339DateTime(value) {
-    if (typeof value !== "string")
-        return false;
-    const match = RFC3339_DATE_TIME.exec(value);
-    if (!match)
-        return false;
-    const [year, month, day, hour, minute, second] = match
-        .slice(1, 7)
-        .map(Number);
-    const offsetHour = Number(match[8] ?? 0);
-    const offsetMinute = Number(match[9] ?? 0);
-    const daysInMonth = new Date(Date.UTC(year, month, 0)).getUTCDate();
-    return (month >= 1 &&
-        month <= 12 &&
-        day >= 1 &&
-        day <= daysInMonth &&
-        hour <= 23 &&
-        minute <= 59 &&
-        second <= 59 &&
-        offsetHour <= 23 &&
-        offsetMinute <= 59 &&
-        !Number.isNaN(Date.parse(value)));
+    return parseTime(value, "date-time") !== null;
 }
 export class PdppBindingError extends Error {
     reason;
@@ -221,8 +204,54 @@ CREATE TABLE IF NOT EXISTS pdpp_record_arrival_clock (
   value INTEGER NOT NULL
 );
 INSERT OR IGNORE INTO pdpp_record_arrival_clock (id, value) VALUES (1, 0);
+`,
+    // v12: ordered history traversal and one-key as-of lookup. The horizon
+    // index alone scans an instance's full history for every outer row.
+    `
+CREATE INDEX IF NOT EXISTS idx_pdpp_record_changes_snapshot_order
+  ON pdpp_record_changes (stream, emitted_at, record_key, instance, written_at);
+CREATE INDEX IF NOT EXISTS idx_pdpp_record_changes_snapshot_latest
+  ON pdpp_record_changes (instance, stream, record_key, written_at DESC, version DESC);
+`,
+    // v13: an `emitted_key` that orders emitted time by instant rather than by
+    // timestamp text, for list order, list seeks and the latest stream time.
+    // `migrateToV13` applies it.
+    "",
+    // v14: one recoverable export-to-live transition per Claude connection.
+    `CREATE TABLE IF NOT EXISTS pdpp_claude_transition (
+    instance TEXT PRIMARY KEY,
+    archive_instance TEXT NOT NULL UNIQUE,
+    generation INTEGER NOT NULL,
+    snapshots_json TEXT NOT NULL,
+    conversations_covered INTEGER NOT NULL DEFAULT 0
+  );`,
+    // v15: expression index for the retained-history blob reference check in
+    // `deleteUnclaimedBlobs`. Without it each candidate blob scanned every
+    // history row at every writable open. `json_valid` guards the extraction:
+    // `json_extract` raises on malformed JSON, which would make this index
+    // (and every later insert of such a row) fail. The outer CAST gives the
+    // expression TEXT affinity, which the TEXT `blob_id` comparison needs before
+    // the planner will search it; a CASE alone does not provide that. Additive
+    // only; the expression must stay identical to `noRetainedHistoryReferenceSql`.
+    `
+CREATE INDEX IF NOT EXISTS idx_pdpp_record_changes_blob_ref
+  ON pdpp_record_changes (CAST(CASE WHEN json_valid(data) THEN json_extract(data, '$.blob_ref.blob_id') END AS TEXT));
+`,
+    // v16: converge main v15 (history index) with Desktop v15 (Strava).
+    // Either v15 database may lack the other addition; preserve both by presence.
+    `CREATE TABLE IF NOT EXISTS pdpp_strava_transition (
+    instance TEXT PRIMARY KEY,
+    archive_instance TEXT NOT NULL UNIQUE,
+    generation INTEGER NOT NULL,
+    snapshots_json TEXT NOT NULL,
+    activities_covered INTEGER NOT NULL DEFAULT 0
+  );
+CREATE INDEX IF NOT EXISTS idx_pdpp_record_changes_blob_ref
+  ON pdpp_record_changes (CAST(CASE WHEN json_valid(data) THEN json_extract(data, '$.blob_ref.blob_id') END AS TEXT));
 `,
 ];
+/** The records namespace in the shared index.db; preflight before bootstrap effects. */
+export const PDPP_RECORD_SCHEMA_VERSION = MIGRATIONS.length;
 function addCompletionProofColumns(db) {
     // `table_xinfo`, unlike `table_info`, also lists generated columns.
     const existing = new Map(db.prepare("PRAGMA table_xinfo(pdpp_stream_completion)").all().map((column) => [column.name, column]));
@@ -240,6 +269,27 @@ function addCompletionProofColumns(db) {
         }
     }
 }
+/** `emitted_key` is `timeSortKey(emitted_at)`, written by SQL on every insert. */
+function registerTimeKey(db) {
+    db.function("pdpp_time_key", { deterministic: true }, (value) => timeSortKey(String(value)));
+}
+function migrateToV13(db) {
+    for (const table of ["pdpp_records", "pdpp_record_changes"]) {
+        const columns = db.prepare(`PRAGMA table_info(${table})`).all();
+        if (!columns.some((c) => c.name === "emitted_key")) {
+            db.exec(`ALTER TABLE ${table} ADD COLUMN emitted_key TEXT`);
+        }
+        db.exec(`UPDATE ${table} SET emitted_key = pdpp_time_key(emitted_at) WHERE emitted_key IS NULL`);
+    }
+    db.exec(`
+DROP INDEX IF EXISTS idx_pdpp_record_changes_snapshot_order;
+CREATE INDEX IF NOT EXISTS idx_pdpp_record_changes_snapshot_key_order
+  ON pdpp_record_changes (stream, emitted_key, record_key, instance, written_at);
+CREATE INDEX IF NOT EXISTS idx_pdpp_records_live_instance_stream_emitted_key
+  ON pdpp_records (instance, stream, emitted_key, emitted_at)
+  WHERE deleted = 0;
+`);
+}
 function migrate(db) {
     db.exec(`
     CREATE TABLE IF NOT EXISTS pdpp_schema_version (
@@ -259,6 +309,8 @@ function migrate(db) {
             if (v === 4) {
                 db.prepare("INSERT OR IGNORE INTO pdpp_store_metadata (id, epoch) VALUES (1, ?)").run(randomUUID());
             }
+            if (v === 12)
+                migrateToV13(db);
         }
         db.prepare("UPDATE pdpp_schema_version SET version = ? WHERE id = 1").run(MIGRATIONS.length);
     });
@@ -274,28 +326,71 @@ function migrate(db) {
 }
 function sweepStaleBlobClaims(db) {
     db.transaction(() => {
+        // A method-transition archive is retained history, not a registered
+        // instance: it has no binding row, so only the transition ledger vouches
+        // for its claims. Erasing the connection drops the ledger row and claims.
         db.exec(`
       DELETE FROM pdpp_blob_claims
       WHERE NOT EXISTS (
         SELECT 1 FROM pdpp_instance_binding b
         WHERE b.instance = pdpp_blob_claims.instance
           AND b.generation = pdpp_blob_claims.generation
+      )
+      AND NOT EXISTS (
+        SELECT 1 FROM pdpp_claude_transition t
+        WHERE t.archive_instance = pdpp_blob_claims.instance
+      )
+      AND NOT EXISTS (
+        SELECT 1 FROM pdpp_strava_transition t
+        WHERE t.archive_instance = pdpp_blob_claims.instance
       );
     `);
-        deleteUnclaimedBlobs(db);
+        collectStartupUnclaimedBlobs(db);
     })();
 }
+/**
+ * Automatic (startup) blob collection. A history row whose JSON cannot be
+ * parsed may reference any blob, so collection is skipped while one exists.
+ * Explicit owner erasure calls `deleteUnclaimedBlobs` directly and is not
+ * gated here.
+ */
+function collectStartupUnclaimedBlobs(db) {
+    const { found } = db
+        .prepare("SELECT EXISTS (SELECT 1 FROM pdpp_record_changes WHERE NOT json_valid(data)) AS found")
+        .get();
+    if (found === 1) {
+        const { count } = db
+            .prepare("SELECT COUNT(*) AS count FROM pdpp_record_changes WHERE NOT json_valid(data)")
+            .get();
+        console.warn(`[pdpp-records] skipped startup blob collection: ${count} history row(s) hold invalid JSON, so their blob references cannot be read`);
+        return;
+    }
+    deleteUnclaimedBlobs(db);
+}
+/**
+ * `NOT EXISTS` predicate: no retained history row references `blobId`.
+ * The expression must match the v15 index `idx_pdpp_record_changes_blob_ref`
+ * exactly, so the planner searches by blob id rather than scanning history.
+ */
+export function noRetainedHistoryReferenceSql(blobId) {
+    return `NOT EXISTS (SELECT 1 FROM pdpp_record_changes WHERE CAST(CASE WHEN json_valid(data) THEN json_extract(data, '$.blob_ref.blob_id') END AS TEXT) = ${blobId})`;
+}
 function deleteUnclaimedBlobs(db) {
+    // Claims reconstructed by v4 only cover current records. Retained history
+    // independently owns its bytes, even after overwrite or tombstone. Explicit
+    // owner erasure removes that history before calling this collector.
     db.exec(`
     DELETE FROM pdpp_blob_bytes
     WHERE blob_id IN (
       SELECT blob_id FROM pdpp_blobs b
       WHERE NOT EXISTS (SELECT 1 FROM pdpp_blob_claims c WHERE c.blob_id = b.blob_id)
         AND NOT EXISTS (SELECT 1 FROM pdpp_records r WHERE r.blob_id = b.blob_id AND r.deleted = 0)
+        AND ${noRetainedHistoryReferenceSql("b.blob_id")}
     );
     DELETE FROM pdpp_blobs
     WHERE NOT EXISTS (SELECT 1 FROM pdpp_blob_claims c WHERE c.blob_id = pdpp_blobs.blob_id)
-      AND NOT EXISTS (SELECT 1 FROM pdpp_records r WHERE r.blob_id = pdpp_blobs.blob_id AND r.deleted = 0);
+      AND NOT EXISTS (SELECT 1 FROM pdpp_records r WHERE r.blob_id = pdpp_blobs.blob_id AND r.deleted = 0)
+      AND ${noRetainedHistoryReferenceSql("pdpp_blobs.blob_id")};
   `);
 }
 function toBinding(row) {
@@ -370,23 +465,11 @@ function toRow(db) {
         deleted: false,
     };
 }
-function projectFields(data, fields) {
-    if (!fields)
-        return data;
-    const projected = {};
-    for (const field of fields) {
-        if (field in data)
-            projected[field] = data[field];
-    }
-    return projected;
-}
-/**
- * SQLite-backed PdppRecordStore for desktop persistence. Requires
- * `better-sqlite3` (already a `packages/server` dependency in this repo).
- * A readonly database must already have the current schema; no migration,
- * journal-mode change or stale-blob sweep runs. SQLite rejects write methods.
- */
-export function createSqliteRecordStore(db) {
+export function createSqliteRecordStore(db, options = {}) {
+    assertSupportedSchemaVersions(db, PDPP_RECORD_SCHEMA_VERSION);
+    // Insert statements call it, so even a readonly handle must register it
+    // before they are prepared.
+    registerTimeKey(db);
     if (db.readonly) {
         const current = db
             .prepare("SELECT version FROM pdpp_schema_version WHERE id = 1")
@@ -400,25 +483,56 @@ export function createSqliteRecordStore(db) {
         migrate(db);
         sweepStaleBlobClaims(db);
     }
+    const replica = options.replica?.(db);
+    /**
+     * Every connection-scoped write enters through this quarantine boundary.
+     * Without replication a top-level call begins the transaction main began:
+     * deferred, so a mutation that writes nothing takes no write lock.
+     * With replication the transaction is immediate and starts from derived
+     * state that matches canonical rows.
+     */
+    const connectionMutation = (instances, write, begin = "deferred") => {
+        const run = () => {
+            const ids = typeof instances === "function" ? instances() : instances;
+            for (const instance of new Set(typeof ids === "string" ? [ids] : ids))
+                replica?.assertConnectionWritable(instance);
+            return write();
+        };
+        // Inside an outer transaction better-sqlite3 runs this as a SAVEPOINT, so
+        // a mutator that throws undoes its own writes even if the caller catches
+        // the error and commits. That is what main's per-mutator
+        // `db.transaction` gave every one of these.
+        if (replica)
+            return replica.exclusive(run);
+        const atomic = db.transaction(run);
+        return begin === "immediate" ? atomic.immediate() : atomic();
+    };
+    /** The one mutation main opened with `BEGIN IMMEDIATE`: a stream completion. */
+    const immediateConnectionMutation = (instance, write) => connectionMutation(instance, write, "immediate");
+    /** Replica quarantine filter for read SQL; empty without replication. */
+    const unquarantined = (alias) => replica ? ` AND ${replica.unquarantinedRecordSql(alias)}` : "";
+    /** Without replication a read needs no snapshot beyond its write horizon. */
+    const inReadSnapshot = (read) => replica ? db.transaction(read).deferred() : read();
     const nextWriteSeq = db.prepare("UPDATE pdpp_write_clock SET value = value + 1 WHERE id = 1 RETURNING value");
     const readWriteClockStmt = db.prepare("SELECT value FROM pdpp_write_clock WHERE id = 1");
     const readWriteClock = () => readWriteClockStmt.get().value;
     const getCurrentStmt = db.prepare("SELECT * FROM pdpp_records WHERE instance = ? AND stream = ? AND record_key = ?");
     const upsertCurrentStmt = db.prepare(`
-    INSERT INTO pdpp_records (instance, stream, record_key, data, version, emitted_at, deleted, deleted_at, blob_id)
-    VALUES (@instance, @stream, @record_key, @data, @version, @emitted_at, @deleted, @deleted_at, @blob_id)
+    INSERT INTO pdpp_records (instance, stream, record_key, data, version, emitted_at, emitted_key, deleted, deleted_at, blob_id)
+    VALUES (@instance, @stream, @record_key, @data, @version, @emitted_at, pdpp_time_key(@emitted_at), @deleted, @deleted_at, @blob_id)
     ON CONFLICT (instance, stream, record_key) DO UPDATE SET
       data = excluded.data,
       version = excluded.version,
       emitted_at = excluded.emitted_at,
+      emitted_key = excluded.emitted_key,
       deleted = excluded.deleted,
       deleted_at = excluded.deleted_at,
       blob_id = excluded.blob_id
   `);
     const insertHistoryStmt = db.prepare(`
     INSERT INTO pdpp_record_changes
-      (instance, stream, record_key, version, data, emitted_at, deleted, deleted_at, written_at)
-    VALUES (@instance, @stream, @record_key, @version, @data, @emitted_at, @deleted, @deleted_at, @written_at)
+      (instance, stream, record_key, version, data, emitted_at, emitted_key, deleted, deleted_at, written_at)
+    VALUES (@instance, @stream, @record_key, @version, @data, @emitted_at, pdpp_time_key(@emitted_at), @deleted, @deleted_at, @written_at)
   `);
     const putBlobStmt = db.prepare(`
     INSERT INTO pdpp_blobs (blob_id, mime_type, size_bytes, sha256)
@@ -427,10 +541,14 @@ export function createSqliteRecordStore(db) {
       mime_type = excluded.mime_type, size_bytes = excluded.size_bytes, sha256 = excluded.sha256
   `);
     const getBlobStmt = db.prepare("SELECT * FROM pdpp_blobs WHERE blob_id = ?");
-    const findBlobRefsStmt = db.prepare("SELECT instance, stream, record_key FROM pdpp_records WHERE blob_id = ? AND deleted = 0");
+    const findBlobRefsStmt = db.prepare(`SELECT r.instance, r.stream, r.record_key FROM pdpp_records r WHERE r.blob_id = ? AND r.deleted = 0${unquarantined("r")}`);
     const insertBlobBytesStmt = db.prepare("INSERT INTO pdpp_blob_bytes (blob_id, bytes) VALUES (@blob_id, @bytes)");
     const getBlobBytesStmt = db.prepare("SELECT bytes FROM pdpp_blob_bytes WHERE blob_id = ?");
     const dropCompletionStmt = db.prepare("DELETE FROM pdpp_stream_completion WHERE instance = ? AND stream = ?");
+    function dropCompletion(instance, stream) {
+        if (dropCompletionStmt.run(instance, stream).changes > 0)
+            replica?.captureInvalidation(instance, stream);
+    }
     const noteArrivalStmt = db.prepare(`
     INSERT INTO pdpp_record_arrival (instance, stream, record_key, generation, arrival)
     VALUES (@instance, @stream, @record_key, @generation, (
@@ -456,7 +574,7 @@ export function createSqliteRecordStore(db) {
         const row = getCurrentStmt.get(instance, stream, recordKey);
         return row?.version ?? 0;
     }
-    function ingestBatch(envelopes, streamSemantics, primaryKeyFields, binding, validateData) {
+    function ingestBatch(envelopes, streamSemantics, primaryKeyFields, binding, validateData, declarationFor) {
         const results = [];
         // The whole batch is one SQLite transaction: a thrown error rolls back
         // every write from this call, never leaving partial version/
@@ -482,7 +600,9 @@ export function createSqliteRecordStore(db) {
                 checkBinding(binding.method, generation, envelopes);
             }
             envelopes.forEach((envelope, index) => {
-                const plan = planIngest(index, envelope, streamSemantics(envelope.stream, envelope.instance), primaryKeyFields(envelope.stream, envelope.instance), (recordKey) => {
+                const semantics = streamSemantics(envelope.stream, envelope.instance);
+                const primaryKey = primaryKeyFields(envelope.stream, envelope.instance);
+                const plan = planIngest(index, envelope, semantics, primaryKey, (recordKey) => {
                     const row = getCurrentStmt.get(envelope.instance, envelope.stream, recordKey);
                     return row
                         ? {
@@ -515,6 +635,7 @@ export function createSqliteRecordStore(db) {
                     return;
                 }
                 writeVersion(envelope.instance, envelope.stream, recordKey, data, envelope.emitted_at);
+                replica?.recordWritten(envelope.instance, envelope.stream, recordKey, semantics, primaryKey, declarationFor?.(envelope.stream, envelope.instance));
                 if (data === null) {
                     forgetArrivalStmt.run(envelope.instance, envelope.stream, recordKey);
                 }
@@ -522,8 +643,9 @@ export function createSqliteRecordStore(db) {
                     noteArrival(envelope.instance, envelope.stream, recordKey, generation);
                 }
             });
+            replica?.settleLocalWrites();
         });
-        runBatch();
+        connectionMutation(envelopes.map((envelope) => envelope.instance), () => runBatch());
         return summarizeIngest(results);
     }
     function blobClaimedByCurrentGeneration(blobId, instance) {
@@ -533,12 +655,13 @@ export function createSqliteRecordStore(db) {
     }
     /** Writes the next version of a key: `data === null` is a tombstone. */
     function writeVersion(instance, stream, recordKey, data, emittedAt) {
+        replica?.assertKeyWritable(instance, stream, recordKey);
         const deleted = data === null;
         const version = latestVersion(instance, stream, recordKey) + 1;
         const writtenAt = nextWriteSeq.get();
         // The stream no longer holds what a replace delivered. `replaceStream`
         // writes its own receipt after its writes.
-        dropCompletionStmt.run(instance, stream);
+        dropCompletion(instance, stream);
         const dataJson = deleted ? null : JSON.stringify(data);
         const deletedAt = deleted ? emittedAt : null;
         upsertCurrentStmt.run({
@@ -584,8 +707,9 @@ export function createSqliteRecordStore(db) {
                 input.sourceCollectedAt !== undefined)) {
             throw new TypeError("invalid_completion_policy");
         }
-        return db.transaction(() => {
+        return connectionMutation(input.instance, () => {
             checkInstanceBinding(input.instance, input.method, input.generation);
+            replica?.assertStreamWritable(input.instance, input.stream, input.generation);
             const seen = new Set();
             /** Live keys of the snapshot, in the order it delivered them. */
             const snapshotOrder = [];
@@ -641,12 +765,14 @@ export function createSqliteRecordStore(db) {
                 : false;
             for (const write of writes) {
                 writeVersion(input.instance, input.stream, write.recordKey, write.data, write.emittedAt);
+                replica?.recordWritten(input.instance, input.stream, write.recordKey, "mutable_state", input.primaryKey, input.declaration);
             }
             const missing = db
                 .prepare("SELECT record_key FROM pdpp_records WHERE instance = ? AND stream = ? AND deleted = 0")
                 .all(input.instance, input.stream).filter(({ record_key }) => !seen.has(record_key));
             for (const { record_key } of missing) {
                 writeVersion(input.instance, input.stream, record_key, null, input.emittedAt);
+                replica?.recordWritten(input.instance, input.stream, record_key, "mutable_state", input.primaryKey, input.declaration);
             }
             // Desktop rebuilt a fully refreshed stream in emit order, unchanged
             // keys included.
@@ -655,7 +781,7 @@ export function createSqliteRecordStore(db) {
                 noteArrival(input.instance, input.stream, recordKey, input.generation);
             }
             if (!preserved)
-                dropCompletionStmt.run(input.instance, input.stream);
+                dropCompletion(input.instance, input.stream);
             if (input.sourceCollectedAt !== undefined) {
                 db.prepare(`INSERT INTO pdpp_stream_completion
              (instance, stream, method, generation, source_collected_at, write_seq, live_count)
@@ -663,8 +789,11 @@ export function createSqliteRecordStore(db) {
                     .prepare("SELECT COUNT(*) AS n FROM pdpp_records WHERE instance = ? AND stream = ? AND deleted = 0")
                     .get(input.instance, input.stream).n);
             }
+            if (input.sourceCollectedAt !== undefined)
+                replica?.captureCompletion(input.instance, input.stream);
+            replica?.settleLocalWrites();
             return { ...summary, applied: true, deleted: missing.length };
-        })();
+        });
     }
     // Under `preserve_if_unchanged`: true when this replace writes nothing to
     // the stream's rows, no live key is missing from the snapshot, and the
@@ -756,7 +885,7 @@ export function createSqliteRecordStore(db) {
         };
     }
     function resetInstanceBinding(input) {
-        return db.transaction(() => {
+        return connectionMutation(input.instance, () => {
             const current = ensureBinding(db, input.instance);
             if (current.deleted_at !== null) {
                 throw new PdppBindingError("connection_deleted");
@@ -782,11 +911,213 @@ export function createSqliteRecordStore(db) {
             eraseInstanceData(input.instance);
             const resetClock = nextWriteSeq.get().value;
             db.prepare("UPDATE pdpp_instance_binding SET method = ?, generation = ?, reset_clock = ? WHERE instance = ?").run(input.nextMethod, input.expectedGeneration + 1, resetClock, input.instance);
+            replica?.captureLifecycle(input.instance, "connection-reset");
+            replica?.notifyVisibility();
             return {
                 binding: toBinding(ensureBinding(db, input.instance)),
                 alreadyReset: false,
             };
-        })();
+        });
+    }
+    function transitionWriteClock() {
+        return db.prepare("SELECT value FROM pdpp_write_clock WHERE id = 1").get().value;
+    }
+    function claudeTransition(instance) {
+        const row = db
+            .prepare("SELECT * FROM pdpp_claude_transition WHERE instance = ?")
+            .get(instance);
+        return row
+            ? {
+                instance: row.instance,
+                archiveInstance: row.archive_instance,
+                conversationsCovered: row.conversations_covered === 1,
+                generation: row.generation,
+                snapshots: JSON.parse(row.snapshots_json),
+            }
+            : null;
+    }
+    function listClaudeTransitions() {
+        return db
+            .prepare("SELECT instance FROM pdpp_claude_transition ORDER BY instance")
+            .all().map((row) => claudeTransition(row.instance));
+    }
+    function confirmClaudeTransition(instance, generation) {
+        connectionMutation(instance, () => db
+            .prepare("UPDATE pdpp_claude_transition SET conversations_covered = 1 WHERE instance = ? AND generation = ?")
+            .run(instance, generation));
+    }
+    function clearClaudeTransitionScope(scope) {
+        if (scope !== "claude.conversations" && scope !== "claude.projects")
+            return;
+        connectionMutation(() => listClaudeTransitions().map((transition) => transition.instance), () => {
+            for (const transition of listClaudeTransitions()) {
+                delete transition.snapshots[scope];
+                db.prepare("UPDATE pdpp_claude_transition SET snapshots_json = ? WHERE instance = ?").run(JSON.stringify(transition.snapshots), transition.instance);
+                const streams = scope === "claude.conversations"
+                    ? ["conversations", "messages"]
+                    : ["projects", "project_documents"];
+                if (Object.keys(transition.snapshots).length === 0)
+                    streams.push("account_profile");
+                for (const table of [
+                    "pdpp_records",
+                    "pdpp_record_changes",
+                    "pdpp_stream_completion",
+                    "pdpp_record_arrival",
+                ]) {
+                    for (const stream of streams)
+                        db.prepare(`DELETE FROM ${table} WHERE instance = ? AND stream = ?`).run(transition.archiveInstance, stream);
+                }
+                db.prepare(`DELETE FROM pdpp_blob_claims WHERE instance = ?
+          AND NOT EXISTS (SELECT 1 FROM pdpp_records r WHERE r.instance = pdpp_blob_claims.instance AND r.blob_id = pdpp_blob_claims.blob_id)
+          AND NOT EXISTS (SELECT 1 FROM pdpp_record_changes c WHERE c.instance = pdpp_blob_claims.instance AND json_extract(c.data, '$.blob_ref.blob_id') = pdpp_blob_claims.blob_id)`).run(transition.archiveInstance);
+            }
+            deleteUnclaimedBlobs(db);
+        });
+    }
+    const STRAVA_SOURCE = "https://registry.pdpp.dev/sources/strava";
+    const STRAVA_EXPORT_METHOD = "strava";
+    const STRAVA_BROWSER_METHOD = "strava-browser";
+    const STRAVA_SCOPE_STREAMS = {
+        "strava.activities": "activities",
+        "strava.coverage_diagnostics": "coverage_diagnostics",
+    };
+    /** Tables whose rows move to the archive instance on a method transition. */
+    const ARCHIVED_TABLES = [
+        "pdpp_records",
+        "pdpp_record_changes",
+        "pdpp_blob_claims",
+        "pdpp_stream_completion",
+        "pdpp_record_arrival",
+    ];
+    function stravaTransition(instance) {
+        const row = db
+            .prepare("SELECT * FROM pdpp_strava_transition WHERE instance = ?")
+            .get(instance);
+        if (!row)
+            return null;
+        return {
+            instance: row.instance,
+            archiveInstance: row.archive_instance,
+            activitiesCovered: row.activities_covered === 1,
+            generation: row.generation,
+            snapshots: JSON.parse(row.snapshots_json),
+        };
+    }
+    function listStravaTransitions() {
+        return db
+            .prepare("SELECT instance FROM pdpp_strava_transition ORDER BY instance")
+            .all().map((row) => stravaTransition(row.instance));
+    }
+    function confirmStravaTransition(instance, generation) {
+        connectionMutation(instance, () => db
+            .prepare("UPDATE pdpp_strava_transition SET activities_covered = 1 WHERE instance = ? AND generation = ?")
+            .run(instance, generation));
+    }
+    /** A takeover reset drops the saved body and its archived rows. */
+    function clearStravaTransitionScope(scope) {
+        if (!(scope in STRAVA_SCOPE_STREAMS))
+            return;
+        const stream = STRAVA_SCOPE_STREAMS[scope];
+        connectionMutation(() => listStravaTransitions().map((transition) => transition.instance), () => {
+            for (const transition of listStravaTransitions()) {
+                delete transition.snapshots[scope];
+                db.prepare("UPDATE pdpp_strava_transition SET snapshots_json = ? WHERE instance = ?").run(JSON.stringify(transition.snapshots), transition.instance);
+                for (const table of ARCHIVED_TABLES) {
+                    if (table === "pdpp_blob_claims")
+                        continue;
+                    db.prepare(`DELETE FROM ${table} WHERE instance = ? AND stream = ?`).run(transition.archiveInstance, stream);
+                }
+                // Unreadable retained history may still reference any archived blob.
+                db.prepare(`DELETE FROM pdpp_blob_claims WHERE instance = ?
+          AND NOT EXISTS (SELECT 1 FROM pdpp_records r WHERE r.instance = pdpp_blob_claims.instance AND r.blob_id = pdpp_blob_claims.blob_id)
+          AND NOT EXISTS (
+            SELECT 1 FROM pdpp_record_changes c
+            WHERE c.instance = pdpp_blob_claims.instance
+              AND CASE WHEN json_valid(c.data)
+                THEN json_extract(c.data, '$.blob_ref.blob_id') = pdpp_blob_claims.blob_id
+                ELSE c.data IS NOT NULL END
+          )`).run(transition.archiveInstance);
+            }
+            // A scope reset must retain blobs that unreadable history may reference.
+            collectStartupUnclaimedBlobs(db);
+        });
+    }
+    /**
+     * Owner-authorized, one-way: archive the export rows and bind the browser
+     * method at the next generation in one transaction. Replaying the same
+     * intent after success returns the current binding and erases nothing.
+     */
+    function transitionStravaToBrowser(input) {
+        return connectionMutation(input.instance, () => {
+            replica?.assertMethodTransitionAllowed();
+            const current = getInstanceBinding(input.instance);
+            if (current.deletedAt !== null)
+                throw new PdppBindingError("connection_deleted");
+            const previous = stravaTransition(input.instance);
+            if (previous &&
+                previous.generation === input.expectedGeneration + 1 &&
+                current.method === STRAVA_BROWSER_METHOD &&
+                current.generation === previous.generation)
+                return current;
+            if (current.method !== STRAVA_EXPORT_METHOD ||
+                current.sourceId !== STRAVA_SOURCE)
+                throw new PdppBindingError("connection_conflict");
+            if (current.generation !== input.expectedGeneration ||
+                transitionWriteClock() !== input.expectedWriteClock)
+                throw new PdppBindingError("binding_generation_mismatch");
+            if (previous || listConnections(current.sourceId).length !== 1)
+                throw new PdppBindingError("connection_conflict");
+            const archive = `retired-strava:${randomUUID()}`;
+            const generation = current.generation + 1;
+            db.prepare("INSERT INTO pdpp_strava_transition (instance, archive_instance, generation, snapshots_json) VALUES (?, ?, ?, ?)").run(input.instance, archive, generation, JSON.stringify(input.snapshots));
+            // The archive is not a registered connection: it cannot accept writes.
+            for (const table of ARCHIVED_TABLES) {
+                db.prepare(`UPDATE ${table} SET instance = ? WHERE instance = ?`).run(archive, input.instance);
+            }
+            const clock = nextWriteSeq.get().value;
+            db.prepare("UPDATE pdpp_instance_binding SET method = ?, generation = ?, reset_clock = ? WHERE instance = ?").run(STRAVA_BROWSER_METHOD, generation, clock, input.instance);
+            return getInstanceBinding(input.instance);
+        });
+    }
+    function transitionClaudeToLive(input) {
+        return connectionMutation(input.instance, () => {
+            replica?.assertMethodTransitionAllowed();
+            const current = getInstanceBinding(input.instance);
+            if (current.deletedAt !== null)
+                throw new PdppBindingError("connection_deleted");
+            const previous = claudeTransition(input.instance);
+            // Replaying the same intent must not erase a successful live import.
+            if (previous &&
+                previous.generation === input.expectedGeneration + 1 &&
+                current.method === "anthropic-live" &&
+                current.generation === previous.generation)
+                return current;
+            if (current.method !== "anthropic" ||
+                current.sourceId !== "https://registry.pdpp.dev/sources/claude")
+                throw new PdppBindingError("connection_conflict");
+            if (current.generation !== input.expectedGeneration ||
+                transitionWriteClock() !== input.expectedWriteClock)
+                throw new PdppBindingError("binding_generation_mismatch");
+            if (previous || listConnections(current.sourceId).length !== 1)
+                throw new PdppBindingError("connection_conflict");
+            const archive = `retired-claude:${randomUUID()}`;
+            const generation = current.generation + 1;
+            db.prepare("INSERT INTO pdpp_claude_transition (instance, archive_instance, generation, snapshots_json) VALUES (?, ?, ?, ?)").run(input.instance, archive, generation, JSON.stringify(input.snapshots));
+            // An archive is deliberately not a registered connection and cannot mint
+            // owner tokens or accept writes. Blob claims keep the old bytes alive.
+            for (const table of [
+                "pdpp_records",
+                "pdpp_record_changes",
+                "pdpp_blob_claims",
+                "pdpp_stream_completion",
+                "pdpp_record_arrival",
+            ]) {
+                db.prepare(`UPDATE ${table} SET instance = ? WHERE instance = ?`).run(archive, input.instance);
+            }
+            const clock = nextWriteSeq.get().value;
+            db.prepare("UPDATE pdpp_instance_binding SET method = 'anthropic-live', generation = ?, reset_clock = ? WHERE instance = ?").run(generation, clock, input.instance);
+            return getInstanceBinding(input.instance);
+        });
     }
     function listConnections(sourceId) {
         const rows = db
@@ -795,7 +1126,7 @@ export function createSqliteRecordStore(db) {
         return rows.map(toBinding);
     }
     function registerConnection(input) {
-        return db.transaction(() => {
+        return connectionMutation(input.instance, () => {
             const current = ensureBinding(db, input.instance);
             if (current.deleted_at !== null) {
                 throw new PdppBindingError("connection_deleted");
@@ -809,11 +1140,14 @@ export function createSqliteRecordStore(db) {
                 throw new PdppBindingError("connection_conflict");
             }
             db.prepare("UPDATE pdpp_instance_binding SET source_id = ?, method = ?, label = ? WHERE instance = ?").run(input.sourceId, input.method, input.label, input.instance);
+            if (current.source_id === null)
+                replica?.captureLifecycle(input.instance, "connection-register");
+            replica?.notifyVisibility();
             return getInstanceBinding(input.instance);
-        })();
+        });
     }
     function deleteConnection(instance) {
-        return db.transaction(() => {
+        return connectionMutation(instance, () => {
             const current = ensureBinding(db, instance);
             if (current.deleted_at !== null)
                 return toBinding(current);
@@ -821,10 +1155,22 @@ export function createSqliteRecordStore(db) {
             const resetClock = nextWriteSeq.get().value;
             const deletedAt = new Date().toISOString();
             db.prepare("UPDATE pdpp_instance_binding SET deleted_at = ?, generation = generation + 1, reset_clock = ? WHERE instance = ?").run(deletedAt, resetClock, instance);
+            replica?.captureLifecycle(instance, "connection-delete");
+            replica?.notifyVisibility();
             return getInstanceBinding(instance);
-        })();
+        });
     }
     function eraseInstanceData(instance) {
+        const transition = claudeTransition(instance);
+        if (transition) {
+            db.prepare("DELETE FROM pdpp_claude_transition WHERE instance = ?").run(instance);
+            eraseInstanceData(transition.archiveInstance);
+        }
+        const strava = stravaTransition(instance);
+        if (strava) {
+            db.prepare("DELETE FROM pdpp_strava_transition WHERE instance = ?").run(instance);
+            eraseInstanceData(strava.archiveInstance);
+        }
         db.prepare("DELETE FROM pdpp_records WHERE instance = ?").run(instance);
         db.prepare("DELETE FROM pdpp_record_changes WHERE instance = ?").run(instance);
         db.prepare("DELETE FROM pdpp_blob_claims WHERE instance = ?").run(instance);
@@ -875,8 +1221,7 @@ export function createSqliteRecordStore(db) {
     }
     function completeStreams(rawRequest, declarations) {
         const request = parseCompletionRequest(rawRequest);
-        return db
-            .transaction(() => {
+        return immediateConnectionMutation(request.instance, () => {
             const binding = db
                 .prepare("SELECT * FROM pdpp_instance_binding WHERE instance = ?")
                 .get(request.instance);
@@ -900,6 +1245,7 @@ export function createSqliteRecordStore(db) {
             // Validate every stream before the first receipt is written.
             const writes = [];
             for (const proof of request.streams) {
+                replica?.assertStreamWritable(request.instance, proof.stream, request.generation);
                 const primaryKey = declarations(request.sourceId, proof.stream);
                 if (primaryKey === undefined) {
                     throw new StreamCompletionError("unknown_stream");
@@ -969,6 +1315,10 @@ export function createSqliteRecordStore(db) {
               WHERE instance = ? AND stream = ?`).run(request.sourceCollectedAt, clock, proof.snapshotSha256, request.collectionTimeBasis, request.instance, proof.stream);
                 }
             }
+            for (const write of writes) {
+                if (write.kind !== "keep")
+                    replica?.captureCompletion(request.instance, write.stream);
+            }
             return {
                 receipts: request.streams.map((proof) => {
                     const row = db
@@ -987,8 +1337,7 @@ export function createSqliteRecordStore(db) {
                     };
                 }),
             };
-        })
-            .immediate();
+        });
     }
     function listArrivalOrder(instance, stream) {
         const rows = db
@@ -1001,7 +1350,11 @@ export function createSqliteRecordStore(db) {
         return rows.map((row) => row.record_key);
     }
     function getRecord(instance, stream, recordKey) {
-        const row = getCurrentStmt.get(instance, stream, recordKey);
+        const row = (replica
+            ? db
+                .prepare(`SELECT r.* FROM pdpp_records r WHERE r.instance=? AND r.stream=? AND r.record_key=?${unquarantined("r")}`)
+                .get(instance, stream, recordKey)
+            : getCurrentStmt.get(instance, stream, recordKey));
         if (!row || row.deleted)
             return undefined;
         return toRow(row);
@@ -1036,75 +1389,88 @@ export function createSqliteRecordStore(db) {
             throw new CursorExpiredError();
         }
     }
+    /** Latest version of each complete identity at one fixed write horizon. */
+    function* snapshotRows(stream, instanceIds, horizon, options = {}) {
+        const dir = options.order === "desc" ? "DESC" : "ASC";
+        const comparison = options.order === "desc" ? "<" : ">";
+        let sql = `SELECT c.* FROM pdpp_record_changes c INDEXED BY idx_pdpp_record_changes_snapshot_key_order
+      WHERE c.stream = ? AND c.instance IN (${instanceIds.map(() => "?").join(",")}) AND c.written_at <= ?
+      AND c.version = (
+        SELECT c2.version FROM pdpp_record_changes c2 INDEXED BY idx_pdpp_record_changes_snapshot_latest
+        WHERE c2.instance = c.instance AND c2.stream = c.stream AND c2.record_key = c.record_key AND c2.written_at <= ?
+        ORDER BY c2.written_at DESC, c2.version DESC LIMIT 1
+      )`;
+        const params = [stream, ...instanceIds, horizon, horizon];
+        if (options.liveOnly)
+            sql += " AND c.deleted = 0";
+        sql += unquarantined("c");
+        if (options.after) {
+            sql += ` AND (c.emitted_key, c.record_key, c.instance) ${comparison} (?, ?, ?)`;
+            params.push(timeSortKey(options.after.val), options.after.key, options.after.instance);
+        }
+        sql += ` ORDER BY ${LIST_ORDER_COLUMNS.map((column) => `c.${column} ${dir}`).join(", ")}`;
+        for (const row of db.prepare(sql).iterate(...params))
+            yield row;
+    }
     function listRecords(stream, options) {
+        // With replication, one read snapshot: a fence that commits meanwhile
+        // cannot mix into the page or label its cursor with the post-fence epoch.
+        return inReadSnapshot(() => listRecordsAtHorizon(stream, options));
+    }
+    function listRecordsAtHorizon(stream, options) {
         let startAfter = null;
         let horizon;
         if (options.cursor) {
-            const payload = decodeCursor(options.cursor);
-            if (payload.kind !== "list")
-                throw new InvalidCursorError();
+            const payload = decodeListCursor(options.cursor);
             assertCursorScope(payload, stream);
             if (payload.order !== options.order)
                 throw new InvalidCursorError();
-            const cursorHorizon = payload.horizon === undefined ? null : parseHorizon(payload.horizon);
-            assertNotResetSince(options.instanceIds, [cursorHorizon]);
-            // A legacy cursor that survives the fence read no reset instance; it
-            // is anchored at the current clock from here on.
-            horizon = cursorHorizon ?? readWriteClock();
-            startAfter = { val: payload.sortValue ?? "", key: payload.recordKey };
+            horizon = parseHorizon(payload.horizon);
+            replica?.assertCursorIntegrity(payload, options.instanceIds, options.fields);
+            assertNotResetSince(options.instanceIds, [horizon]);
+            startAfter = {
+                val: payload.sortValue ?? "",
+                key: payload.recordKey,
+                instance: payload.instance,
+            };
         }
         else {
             horizon = readWriteClock();
         }
-        const placeholders = options.instanceIds.map(() => "?").join(",");
-        const dir = options.order === "asc" ? "ASC" : "DESC";
-        const cmp = options.order === "asc" ? ">" : "<";
-        let sql = `
-      SELECT * FROM pdpp_records
-      WHERE stream = ? AND deleted = 0 AND instance IN (${placeholders})
-    `;
-        const params = [stream, ...options.instanceIds];
-        if (startAfter) {
-            sql += ` AND (emitted_at ${cmp} ? OR (emitted_at = ? AND record_key ${cmp} ?))`;
-            params.push(startAfter.val, startAfter.val, startAfter.key);
+        // The generator holds at most one raw row beyond the visible client page.
+        function* rows() {
+            for (const row of snapshotRows(stream, options.instanceIds, horizon, {
+                order: options.order,
+                after: startAfter,
+                liveOnly: true,
+            })) {
+                yield toRow(row);
+            }
         }
-        sql += ` ORDER BY emitted_at ${dir}, record_key ${dir} LIMIT ?`;
-        params.push(options.limit + 1);
-        const rows = db.prepare(sql).all(...params);
-        const hasMore = rows.length > options.limit;
-        const page = rows.slice(0, options.limit);
-        const last = page[page.length - 1];
-        return {
-            data: page.map((row) => {
-                const stored = toRow(row);
-                return { ...stored, data: projectFields(stored.data, options.fields) };
-            }),
-            hasMore,
-            nextCursor: hasMore && last
-                ? encodeCursor({
-                    kind: "list",
-                    stream,
-                    epoch: cursorEpoch(),
-                    order: options.order,
-                    sortValue: last.emitted_at,
-                    recordKey: last.record_key,
-                    horizon: String(horizon),
-                })
-                : undefined,
+        const hasLaterWrites = horizon < readWriteClock();
+        const erasure = db.prepare(`SELECT 1 FROM pdpp_record_changes INDEXED BY idx_pdpp_record_changes_snapshot_latest
+      WHERE instance = ? AND stream = ? AND record_key = ? AND written_at > ? AND deleted = 1 LIMIT 1`);
+        return listSnapshotPage(rows(), options, {
+            stream,
+            epoch: cursorEpoch(),
+            ...replica?.cursorBinding(options.instanceIds, options.fields),
             horizon: String(horizon),
-        };
+        }, (row) => hasLaterWrites &&
+            erasure.get(row.instance, row.stream, row.recordKey, horizon) !==
+                undefined);
     }
     function deleteRecord(instance, stream, recordKey, deletedAt, streamSemantics) {
         if (streamSemantics === "append_only")
             return false;
         let result = false;
-        const run = db.transaction(() => {
+        const run = () => connectionMutation(instance, () => {
+            replica?.assertKeyWritable(instance, stream, recordKey);
             const existing = getCurrentStmt.get(instance, stream, recordKey);
             if (!existing || existing.deleted)
                 return;
             const version = existing.version + 1;
             const writtenAt = nextWriteSeq.get();
-            dropCompletionStmt.run(instance, stream);
+            dropCompletion(instance, stream);
             upsertCurrentStmt.run({
                 instance,
                 stream,
@@ -1127,20 +1493,31 @@ export function createSqliteRecordStore(db) {
                 deleted_at: deletedAt,
                 written_at: writtenAt.value,
             });
+            replica?.recordWritten(instance, stream, recordKey, streamSemantics);
             forgetArrivalStmt.run(instance, stream, recordKey);
+            replica?.settleLocalWrites();
             result = true;
         });
         run();
         return result;
     }
-    function changesSince(stream, options) {
+    function changesSince(stream, options, visibleInstanceIds = options.instanceIds) {
+        if (!replica)
+            return changesSinceInSnapshot(stream, options, visibleInstanceIds, undefined);
+        // A new session allocates its horizon first, in its own write. The rest
+        // reads one snapshot, so a concurrent fence is wholly before or after it.
+        const fresh = options.cursor ? undefined : allocateHorizon();
+        return inReadSnapshot(() => changesSinceInSnapshot(stream, options, visibleInstanceIds, fresh));
+    }
+    function allocateHorizon() {
+        return nextWriteSeq.get().value;
+    }
+    function changesSinceInSnapshot(stream, options, visibleInstanceIds, freshHorizon) {
         let horizon;
         let sinceHorizon;
         let offset = 0;
         if (options.cursor) {
-            const payload = decodeCursor(options.cursor);
-            if (payload.kind !== "changes_since")
-                throw new InvalidCursorError();
+            const payload = decodeSyncPageCursor(options.cursor);
             assertCursorScope(payload, stream);
             horizon = parseHorizon(payload.horizon);
             sinceHorizon =
@@ -1148,6 +1525,7 @@ export function createSqliteRecordStore(db) {
                     ? parseHorizon(payload.sinceHorizon)
                     : null;
             offset = parseOffset(payload.offset);
+            replica?.assertCursorIntegrity(payload, options.instanceIds, options.fields);
         }
         else if (options.changesSince) {
             let payload;
@@ -1163,29 +1541,21 @@ export function createSqliteRecordStore(db) {
                 throw new InvalidCursorError();
             assertCursorScope(payload, stream);
             sinceHorizon = parseHorizon(payload.horizon);
-            horizon = nextWriteSeq.get().value;
+            replica?.assertCursorIntegrity(payload, options.instanceIds, undefined);
+            horizon = freshHorizon ?? allocateHorizon();
         }
         else {
             sinceHorizon = null;
-            horizon = nextWriteSeq.get().value;
+            horizon = freshHorizon ?? allocateHorizon();
         }
         assertNotResetSince(options.instanceIds, [
             horizon,
             sinceHorizon ?? horizon,
         ]);
-        const placeholders = options.instanceIds.map(() => "?").join(",");
-        // Latest history row per key, as of the horizon.
-        const latestRows = db
-            .prepare(`
-        SELECT c.* FROM pdpp_record_changes c
-        WHERE c.stream = ? AND c.instance IN (${placeholders}) AND c.written_at <= ?
-        AND c.version = (
-          SELECT MAX(c2.version) FROM pdpp_record_changes c2
-          WHERE c2.stream = c.stream AND c2.instance = c.instance
-            AND c2.record_key = c.record_key AND c2.written_at <= ?
-        )
-      `)
-            .all(stream, ...options.instanceIds, horizon, horizon);
+        const visibleIds = [...new Set(visibleInstanceIds)].filter((id) => options.instanceIds.includes(id));
+        const latestRows = visibleIds.length
+            ? snapshotRows(stream, visibleIds, horizon)
+            : [];
         const changed = [];
         for (const entry of latestRows) {
             if (sinceHorizon !== null) {
@@ -1197,55 +1567,30 @@ export function createSqliteRecordStore(db) {
                 if (!wroteSincePrior)
                     continue;
             }
-            if (entry.deleted) {
-                changed.push({
-                    instance: entry.instance,
-                    stream: entry.stream,
-                    recordKey: entry.record_key,
-                    version: entry.version,
-                    deletedAt: entry.deleted_at ?? entry.emitted_at,
-                    emittedAt: entry.emitted_at,
-                    deleted: true,
-                });
-                continue;
-            }
-            const currentData = entry.data ? JSON.parse(entry.data) : {};
-            const projectedNow = projectFields(currentData, options.fields);
-            if (sinceHorizon !== null && options.fields) {
-                const priorRow = db
-                    .prepare(`SELECT * FROM pdpp_record_changes
-             WHERE stream = ? AND instance = ? AND record_key = ? AND written_at <= ?
-             ORDER BY version DESC LIMIT 1`)
+            const previous = sinceHorizon === null
+                ? undefined
+                : db
+                    .prepare(`
+        SELECT * FROM pdpp_record_changes
+        WHERE stream = ? AND instance = ? AND record_key = ? AND written_at <= ?
+        ORDER BY version DESC LIMIT 1
+      `)
                     .get(entry.stream, entry.instance, entry.record_key, sinceHorizon);
-                if (priorRow && !priorRow.deleted) {
-                    const priorData = priorRow.data ? JSON.parse(priorRow.data) : {};
-                    const priorProjected = projectFields(priorData, options.fields);
-                    if (JSON.stringify(priorProjected) === JSON.stringify(projectedNow)) {
-                        continue;
-                    }
-                }
-            }
-            // Return the RAW (unprojected) data here, not `projectedNow`.
-            // `projectedNow`/`priorProjected` above exist only to decide
-            // eligibility (did the grant-authorized projection change) without
-            // leaking a hidden-field change. A caller enforcing time_constraint
-            // against `data` needs the real field value; projecting here would
-            // silently break that filter for any grant whose fields don't happen
-            // to include the time_constraint field. Response field projection is
-            // the caller's job, applied after any filtering on real values.
-            changed.push({
-                instance: entry.instance,
-                stream: entry.stream,
-                recordKey: entry.record_key,
-                data: currentData,
-                version: entry.version,
-                emittedAt: entry.emitted_at,
-                deleted: false,
-            });
+            const selected = selectSyncChange(toRow(entry), previous ? toRow(previous) : undefined, options);
+            if (selected)
+                changed.push(selected);
         }
-        changed.sort((a, b) => a.recordKey.localeCompare(b.recordKey));
+        changed.sort(compareRecordIdentity);
         const page = changed.slice(offset, offset + options.limit);
         const hasMore = offset + options.limit < changed.length;
+        if (options.expireOnErasure && horizon < readWriteClock()) {
+            const erasure = db.prepare(`SELECT 1 FROM pdpp_record_changes INDEXED BY idx_pdpp_record_changes_snapshot_latest
+        WHERE instance = ? AND stream = ? AND record_key = ? AND written_at > ? AND deleted = 1 LIMIT 1`);
+            if (page.some((row) => !row.deleted &&
+                erasure.get(row.instance, stream, row.recordKey, horizon) !==
+                    undefined))
+                throw new CursorExpiredError();
+        }
         return {
             data: page,
             hasMore,
@@ -1254,9 +1599,11 @@ export function createSqliteRecordStore(db) {
                     kind: "changes_since",
                     stream,
                     epoch: cursorEpoch(),
+                    ...replica?.cursorBinding(options.instanceIds, options.fields),
                     horizon: String(horizon),
                     sinceHorizon: sinceHorizon !== null ? String(sinceHorizon) : null,
                     offset: offset + options.limit,
+                    orderKey: "code-point",
                 })
                 : undefined,
             nextChangesSince: hasMore
@@ -1265,6 +1612,7 @@ export function createSqliteRecordStore(db) {
                     kind: "changes_since",
                     stream,
                     epoch: cursorEpoch(),
+                    ...replica?.cursorBinding(options.instanceIds, undefined),
                     horizon: String(horizon),
                     sinceHorizon: null,
                     offset: 0,
@@ -1274,8 +1622,10 @@ export function createSqliteRecordStore(db) {
     function listStreams(instanceIds) {
         const placeholders = instanceIds.map(() => "?").join(",");
         const rows = db
-            .prepare(`SELECT stream, COUNT(*) as count, MAX(emitted_at) as last_updated
-         FROM pdpp_records WHERE deleted = 0 AND instance IN (${placeholders})
+            .prepare(
+        // SQLite takes a bare column from the row that holds the single MAX.
+        `SELECT stream, COUNT(*) as count, emitted_at as last_updated, MAX(emitted_key)
+         FROM pdpp_records r WHERE deleted = 0 AND instance IN (${placeholders})${unquarantined("r")}
          GROUP BY stream`)
             .all(...instanceIds);
         return rows.map((r) => ({
@@ -1295,15 +1645,38 @@ export function createSqliteRecordStore(db) {
             sha256: row.sha256,
         };
     }
+    /**
+     * Without replication the store writes main's `pdpp_blob_bytes` format. It
+     * also reads a blob over 1 MiB that replication stored only as verified
+     * canonical chunks, so that blob stays readable before a flag-off boot
+     * writes main's row for it.
+     */
+    const chunkStore = () => db
+        .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'pdpp_binary_manifests'")
+        .get() !== undefined;
+    const blobBytes = replica?.blobBytes ?? {
+        has: (blobId) => getBlobBytesStmt.get(blobId) !== undefined ||
+            (chunkStore() && binaryLength(db, "canonical", blobId) !== undefined),
+        readVerified(meta) {
+            const row = getBlobBytesStmt.get(meta.blobId);
+            if (!row)
+                return chunkStore() &&
+                    verifyBinary(db, "canonical", meta.blobId, `sha256:${meta.sha256}`, meta.sizeBytes)
+                    ? readBinary(db, "canonical", meta.blobId)
+                    : undefined;
+            const stored = new Uint8Array(row.bytes);
+            if (stored.byteLength !== meta.sizeBytes)
+                return undefined;
+            return createHash("sha256").update(stored).digest("hex") === meta.sha256
+                ? stored
+                : undefined;
+        },
+        clearMalformed: () => { },
+        write: (blobId, bytes) => insertBlobBytesStmt.run({ blob_id: blobId, bytes: Buffer.from(bytes) }),
+    };
     /** True only when a stored bytes row actually hash/size-matches `meta`. */
     function storedBytesVerify(meta) {
-        const row = getBlobBytesStmt.get(meta.blobId);
-        if (!row)
-            return false;
-        const stored = new Uint8Array(row.bytes);
-        if (stored.byteLength !== meta.sizeBytes)
-            return false;
-        return createHash("sha256").update(stored).digest("hex") === meta.sha256;
+        return blobBytes.readVerified(meta) !== undefined;
     }
     function storeBlobBytes(bytes, mimeType) {
         const blobId = blobIdForBytes(bytes);
@@ -1320,6 +1693,7 @@ export function createSqliteRecordStore(db) {
         // row" and race to insert, or one could complete a metadata-only row
         // while another concurrently overwrites it.
         const run = db.transaction(() => {
+            blobBytes.clearMalformed(blobId);
             const existing = getBlobMeta(blobId);
             if (existing) {
                 if (existing.mimeType !== mimeType ||
@@ -1327,15 +1701,11 @@ export function createSqliteRecordStore(db) {
                     existing.sizeBytes !== bytes.byteLength) {
                     throw new BlobConflictError(blobId, existing);
                 }
-                const bytesRow = getBlobBytesStmt.get(blobId);
-                if (!bytesRow) {
+                if (!blobBytes.has(blobId)) {
                     // Metadata-only row (legacy/test fixture via putBlobMeta, or a
                     // prior write that never got this far): complete it with real
                     // bytes now instead of reporting a false "already stored" no-op.
-                    insertBlobBytesStmt.run({
-                        blob_id: existing.blobId,
-                        bytes: Buffer.from(bytes),
-                    });
+                    blobBytes.write(blobId, bytes);
                     return existing;
                 }
                 if (!storedBytesVerify(existing)) {
@@ -1354,16 +1724,13 @@ export function createSqliteRecordStore(db) {
                 size_bytes: candidate.sizeBytes,
                 sha256: candidate.sha256,
             });
-            insertBlobBytesStmt.run({
-                blob_id: candidate.blobId,
-                bytes: Buffer.from(bytes),
-            });
+            blobBytes.write(blobId, bytes);
             return candidate;
         });
         return run();
     }
     function storeBlobBytesForInstance(input) {
-        return db.transaction(() => {
+        return connectionMutation(input.instance, () => {
             const binding = ensureBinding(db, input.instance);
             if (binding.deleted_at !== null) {
                 throw new PdppBindingError("connection_deleted");
@@ -1381,41 +1748,79 @@ export function createSqliteRecordStore(db) {
             db.prepare(`INSERT INTO pdpp_blob_claims (blob_id, instance, generation)
          VALUES (?, ?, ?)
          ON CONFLICT (blob_id, instance) DO UPDATE SET generation = excluded.generation`).run(meta.blobId, input.instance, input.generation);
+            replica?.captureBlob(input.instance, meta.blobId);
+            replica?.notifyVisibility();
             return meta;
-        })();
+        });
     }
     function getBlobBytes(blobId) {
-        const meta = getBlobMeta(blobId);
-        if (!meta)
-            return undefined;
-        const row = getBlobBytesStmt.get(blobId);
-        if (!row)
-            return undefined;
-        const bytes = new Uint8Array(row.bytes);
-        if (bytes.byteLength !== meta.sizeBytes)
-            return undefined;
-        const actualHash = createHash("sha256").update(bytes).digest("hex");
-        if (actualHash !== meta.sha256)
-            return undefined;
-        return bytes;
+        // Verification and assembly share a snapshot.
+        return inReadSnapshot(() => {
+            const meta = getBlobMeta(blobId);
+            return meta ? blobBytes.readVerified(meta) : undefined;
+        });
     }
     return {
+        transitionClaudeToLive,
+        claudeTransition,
+        listClaudeTransitions,
+        clearClaudeTransitionScope,
+        confirmClaudeTransition,
+        transitionStravaToBrowser,
+        stravaTransition,
+        listStravaTransitions,
+        clearStravaTransitionScope,
+        confirmStravaTransition,
+        transitionWriteClock,
         listConnections,
         registerConnection,
         deleteConnection,
         ingestBatch,
         getInstanceBinding,
-        readSnapshot: (read) => db.transaction(read).deferred(),
+        listRetainedRecordData: (instance, stream) => {
+            const prior = db.prepare(`SELECT data FROM pdpp_record_changes
+        WHERE instance = ? AND stream = ? AND record_key = ? AND deleted = 0
+        ORDER BY version DESC LIMIT 1`);
+            const rows = db
+                .prepare(`SELECT record_key, data, emitted_at FROM pdpp_records
+        WHERE instance = ? AND stream = ? ORDER BY record_key`)
+                .all(instance, stream);
+            return rows.map((row) => {
+                const data = row.data ??
+                    prior.get(instance, stream, row.record_key)?.data;
+                if (!data)
+                    throw new Error("Retained record history unavailable");
+                return {
+                    data: JSON.parse(data),
+                    emittedAt: row.emitted_at,
+                };
+            });
+        },
+        readSnapshot: (read) => replica ? replica.snapshot(read) : db.transaction(read).deferred(),
+        writeTransaction: (write) => replica ? replica.exclusive(write) : db.transaction(write).immediate(),
         resetInstanceBinding,
         storeBlobBytesForInstance,
         replaceStream,
+        replaceStreams: (inputs) => {
+            const replaceAll = () => {
+                for (const input of inputs) {
+                    if (!replaceStream(input).applied)
+                        throw new Error("canonical_batch_rejected");
+                }
+            };
+            if (replica)
+                replica.exclusive(replaceAll);
+            else
+                db.transaction(replaceAll)();
+        },
         listStreamCompletions,
         completeStreams,
         listArrivalOrder,
         getRecord,
         listRecords,
         deleteRecord,
-        changesSince,
+        changesSince: (stream, options) => changesSince(stream, options),
+        changesSinceForInstances: changesSince,
         listStreams,
         putBlobMeta: (meta) => putBlobStmt.run({
             blob_id: meta.blobId,