@peerbit/trusted-network 6.0.109 → 6.0.110

package/dist/src/v2-policy-anchor.js

@@ -32,7 +32,8 @@ var __runInitializers = (this && this.__runInitializers) || function (thisArg, i
     }
     return useValue ? value : void 0;
 };
-import { deserialize, field, fixedArray, serialize, variant, } from "@dao-xyz/borsh";
+import { deserialize, field, fixedArray, serialize, variant, vec, } from "@dao-xyz/borsh";
+import { CrashSafeTwoSlotCheckpoint } from "@peerbit/any-store/checkpoint";
 import { PublicSignKey, sha256Sync } from "@peerbit/crypto";
 import { compare, concat, equals } from "uint8arrays";
 import { TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES, TrustedNetworkV2PolicyReducer, authenticatePolicySnapshotEntryV2, } from "./v2-policy-engine.js";
@@ -41,40 +42,39 @@ import { NetworkDescriptorV2, PolicySubjectBindingV2, TRUSTED_NETWORK_V2_KNOWN_R
  * Internal crash-safe policy-anchor storage format.
  *
  * This module is intentionally absent from the package entry point. Its store
- * must already be open and scoped to this namespace and descriptor. Exactly
- * one wrapper may write that scope: this append-only format deliberately does
- * not pretend that get-then-put is a multi-process compare-and-swap.
+ * must already be open and dedicated to this anchor and descriptor. Exactly
+ * one wrapper may write that scope: the two-slot checkpoint deliberately does
+ * not pretend that atomic replacement is a multi-process compare-and-swap.
  */
+/** The namespace owned by the superseded append-only anchor format. */
 export const TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER = "peerbit/trusted-network/v2/policy-anchor/v1";
-export const TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 4;
-const GENERATION_KEY_PREFIX = `${TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER}/generation/`;
-const ANCHOR_FORMAT_VERSION = 2;
 const REDUCER_DURABLE_FORMAT_VERSION = 1;
-const MAX_U64 = 0xffffffffffffffffn;
 const MAX_UNAVAILABLE_REASON_LENGTH = 512;
 // The core admits at most 64 pending policies. A fork transition can surface
 // that complete set plus its accepted and triggering children. Once the
 // transition is durable the wrapper stops policy admission entirely.
 const MAX_FORK_OBSERVATIONS_V2 = TRUSTED_NETWORK_V2_MAX_PENDING_POLICIES + 2;
+// Variant/state and length framing for the parent, empty candidate, digest,
+// empty reason, u8 vector count, and every u32-framed observation.
+const MAX_CHECKPOINT_PAYLOAD_FRAMING_BYTES_V2 = 313;
+/** Exact maximum encoded application payload accepted by the checkpoint. */
+export const TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES = (MAX_FORK_OBSERVATIONS_V2 + 1) * TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES +
+    MAX_CHECKPOINT_PAYLOAD_FRAMING_BYTES_V2;
 const MAX_QUEUED_POLICY_ENTRY_BYTES_V2 = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 2;
 const ZERO_DIGEST = new Uint8Array(32);
 const textEncoder = new TextEncoder();
-const DESCRIPTOR_DIGEST_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/descriptor/v1");
-const GENERATION_CHECKSUM_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/generation/v1");
-const FORK_OBSERVATION_COMMITMENT_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/fork-observations/v1");
+const CHECKPOINT_SCOPE_DOMAIN = textEncoder.encode("peerbit/trusted-network/v2/policy-anchor/checkpoint/v1\0");
 const ANCHOR_STATE = Object.freeze({
     ACTIVE: 1,
     UNAVAILABLE: 2,
     FORKED: 3,
 });
-const GENERATION_KIND = Object.freeze({
-    STATE: 1,
-    FORK_OBSERVATION: 2,
-});
-const MAX_STATE_GENERATION_PAYLOAD_BYTES = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES * 4;
-const MAX_OBSERVATION_GENERATION_PAYLOAD_BYTES = TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES + 1024;
-let PolicyAnchorCoreStateRecordV2 = (() => {
-    let _classDecorators = [variant([2, 16, 0])];
+/**
+ * One self-contained application snapshot. The enclosing generic checkpoint
+ * supplies generation, scope, predecessor, and checksum authentication.
+ */
+let PolicyAnchorCheckpointPayloadV2 = (() => {
+    let _classDecorators = [variant([2, 16, 5])];
     let _classDescriptor;
     let _classExtraInitializers = [];
     let _classThis;
@@ -93,13 +93,10 @@ let PolicyAnchorCoreStateRecordV2 = (() => {
     let _unavailableReason_decorators;
     let _unavailableReason_initializers = [];
     let _unavailableReason_extraInitializers = [];
-    let _forkChildEntryBytes0_decorators;
-    let _forkChildEntryBytes0_initializers = [];
-    let _forkChildEntryBytes0_extraInitializers = [];
-    let _forkChildEntryBytes1_decorators;
-    let _forkChildEntryBytes1_initializers = [];
-    let _forkChildEntryBytes1_extraInitializers = [];
-    var PolicyAnchorCoreStateRecordV2 = class {
+    let _forkObservationEntryBytes_decorators;
+    let _forkObservationEntryBytes_initializers = [];
+    let _forkObservationEntryBytes_extraInitializers = [];
+    var PolicyAnchorCheckpointPayloadV2 = class {
         static { _classThis = this; }
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
@@ -108,17 +105,15 @@ let PolicyAnchorCoreStateRecordV2 = (() => {
             _comparisonCandidateEntryBytes_decorators = [field({ type: Uint8Array })];
             _acceptedAncestorDigest_decorators = [field({ type: fixedArray("u8", 32) })];
             _unavailableReason_decorators = [field({ type: "string" })];
-            _forkChildEntryBytes0_decorators = [field({ type: Uint8Array })];
-            _forkChildEntryBytes1_decorators = [field({ type: Uint8Array })];
+            _forkObservationEntryBytes_decorators = [field({ type: vec(Uint8Array, "u8") })];
             __esDecorate(null, null, _state_decorators, { kind: "field", name: "state", static: false, private: false, access: { has: obj => "state" in obj, get: obj => obj.state, set: (obj, value) => { obj.state = value; } }, metadata: _metadata }, _state_initializers, _state_extraInitializers);
             __esDecorate(null, null, _acceptedHeadEntryBytes_decorators, { kind: "field", name: "acceptedHeadEntryBytes", static: false, private: false, access: { has: obj => "acceptedHeadEntryBytes" in obj, get: obj => obj.acceptedHeadEntryBytes, set: (obj, value) => { obj.acceptedHeadEntryBytes = value; } }, metadata: _metadata }, _acceptedHeadEntryBytes_initializers, _acceptedHeadEntryBytes_extraInitializers);
             __esDecorate(null, null, _comparisonCandidateEntryBytes_decorators, { kind: "field", name: "comparisonCandidateEntryBytes", static: false, private: false, access: { has: obj => "comparisonCandidateEntryBytes" in obj, get: obj => obj.comparisonCandidateEntryBytes, set: (obj, value) => { obj.comparisonCandidateEntryBytes = value; } }, metadata: _metadata }, _comparisonCandidateEntryBytes_initializers, _comparisonCandidateEntryBytes_extraInitializers);
             __esDecorate(null, null, _acceptedAncestorDigest_decorators, { kind: "field", name: "acceptedAncestorDigest", static: false, private: false, access: { has: obj => "acceptedAncestorDigest" in obj, get: obj => obj.acceptedAncestorDigest, set: (obj, value) => { obj.acceptedAncestorDigest = value; } }, metadata: _metadata }, _acceptedAncestorDigest_initializers, _acceptedAncestorDigest_extraInitializers);
             __esDecorate(null, null, _unavailableReason_decorators, { kind: "field", name: "unavailableReason", static: false, private: false, access: { has: obj => "unavailableReason" in obj, get: obj => obj.unavailableReason, set: (obj, value) => { obj.unavailableReason = value; } }, metadata: _metadata }, _unavailableReason_initializers, _unavailableReason_extraInitializers);
-            __esDecorate(null, null, _forkChildEntryBytes0_decorators, { kind: "field", name: "forkChildEntryBytes0", static: false, private: false, access: { has: obj => "forkChildEntryBytes0" in obj, get: obj => obj.forkChildEntryBytes0, set: (obj, value) => { obj.forkChildEntryBytes0 = value; } }, metadata: _metadata }, _forkChildEntryBytes0_initializers, _forkChildEntryBytes0_extraInitializers);
-            __esDecorate(null, null, _forkChildEntryBytes1_decorators, { kind: "field", name: "forkChildEntryBytes1", static: false, private: false, access: { has: obj => "forkChildEntryBytes1" in obj, get: obj => obj.forkChildEntryBytes1, set: (obj, value) => { obj.forkChildEntryBytes1 = value; } }, metadata: _metadata }, _forkChildEntryBytes1_initializers, _forkChildEntryBytes1_extraInitializers);
+            __esDecorate(null, null, _forkObservationEntryBytes_decorators, { kind: "field", name: "forkObservationEntryBytes", static: false, private: false, access: { has: obj => "forkObservationEntryBytes" in obj, get: obj => obj.forkObservationEntryBytes, set: (obj, value) => { obj.forkObservationEntryBytes = value; } }, metadata: _metadata }, _forkObservationEntryBytes_initializers, _forkObservationEntryBytes_extraInitializers);
             __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
-            PolicyAnchorCoreStateRecordV2 = _classThis = _classDescriptor.value;
+            PolicyAnchorCheckpointPayloadV2 = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
             __runInitializers(_classThis, _classExtraInitializers);
         }
@@ -127,175 +122,14 @@ let PolicyAnchorCoreStateRecordV2 = (() => {
         comparisonCandidateEntryBytes = (__runInitializers(this, _acceptedHeadEntryBytes_extraInitializers), __runInitializers(this, _comparisonCandidateEntryBytes_initializers, void 0));
         acceptedAncestorDigest = (__runInitializers(this, _comparisonCandidateEntryBytes_extraInitializers), __runInitializers(this, _acceptedAncestorDigest_initializers, void 0));
         unavailableReason = (__runInitializers(this, _acceptedAncestorDigest_extraInitializers), __runInitializers(this, _unavailableReason_initializers, void 0));
-        forkChildEntryBytes0 = (__runInitializers(this, _unavailableReason_extraInitializers), __runInitializers(this, _forkChildEntryBytes0_initializers, void 0));
-        forkChildEntryBytes1 = (__runInitializers(this, _forkChildEntryBytes0_extraInitializers), __runInitializers(this, _forkChildEntryBytes1_initializers, void 0));
-        constructor(properties) {
-            __runInitializers(this, _forkChildEntryBytes1_extraInitializers);
-            if (properties)
-                Object.assign(this, properties);
-        }
-    };
-    return PolicyAnchorCoreStateRecordV2 = _classThis;
-})();
-let PolicyAnchorStateGenerationPayloadV2 = (() => {
-    let _classDecorators = [variant([2, 16, 3])];
-    let _classDescriptor;
-    let _classExtraInitializers = [];
-    let _classThis;
-    let _coreState_decorators;
-    let _coreState_initializers = [];
-    let _coreState_extraInitializers = [];
-    let _forkObservationCount_decorators;
-    let _forkObservationCount_initializers = [];
-    let _forkObservationCount_extraInitializers = [];
-    let _forkObservationCommitment_decorators;
-    let _forkObservationCommitment_initializers = [];
-    let _forkObservationCommitment_extraInitializers = [];
-    var PolicyAnchorStateGenerationPayloadV2 = class {
-        static { _classThis = this; }
-        static {
-            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
-            _coreState_decorators = [field({ type: PolicyAnchorCoreStateRecordV2 })];
-            _forkObservationCount_decorators = [field({ type: "u8" })];
-            _forkObservationCommitment_decorators = [field({ type: fixedArray("u8", 32) })];
-            __esDecorate(null, null, _coreState_decorators, { kind: "field", name: "coreState", static: false, private: false, access: { has: obj => "coreState" in obj, get: obj => obj.coreState, set: (obj, value) => { obj.coreState = value; } }, metadata: _metadata }, _coreState_initializers, _coreState_extraInitializers);
-            __esDecorate(null, null, _forkObservationCount_decorators, { kind: "field", name: "forkObservationCount", static: false, private: false, access: { has: obj => "forkObservationCount" in obj, get: obj => obj.forkObservationCount, set: (obj, value) => { obj.forkObservationCount = value; } }, metadata: _metadata }, _forkObservationCount_initializers, _forkObservationCount_extraInitializers);
-            __esDecorate(null, null, _forkObservationCommitment_decorators, { kind: "field", name: "forkObservationCommitment", static: false, private: false, access: { has: obj => "forkObservationCommitment" in obj, get: obj => obj.forkObservationCommitment, set: (obj, value) => { obj.forkObservationCommitment = value; } }, metadata: _metadata }, _forkObservationCommitment_initializers, _forkObservationCommitment_extraInitializers);
-            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
-            PolicyAnchorStateGenerationPayloadV2 = _classThis = _classDescriptor.value;
-            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
-            __runInitializers(_classThis, _classExtraInitializers);
-        }
-        coreState = __runInitializers(this, _coreState_initializers, void 0);
-        forkObservationCount = (__runInitializers(this, _coreState_extraInitializers), __runInitializers(this, _forkObservationCount_initializers, void 0));
-        forkObservationCommitment = (__runInitializers(this, _forkObservationCount_extraInitializers), __runInitializers(this, _forkObservationCommitment_initializers, void 0));
+        forkObservationEntryBytes = (__runInitializers(this, _unavailableReason_extraInitializers), __runInitializers(this, _forkObservationEntryBytes_initializers, void 0));
         constructor(properties) {
-            __runInitializers(this, _forkObservationCommitment_extraInitializers);
+            __runInitializers(this, _forkObservationEntryBytes_extraInitializers);
             if (properties)
                 Object.assign(this, properties);
         }
     };
-    return PolicyAnchorStateGenerationPayloadV2 = _classThis;
-})();
-let PolicyAnchorObservationGenerationPayloadV2 = (() => {
-    let _classDecorators = [variant([2, 16, 4])];
-    let _classDescriptor;
-    let _classExtraInitializers = [];
-    let _classThis;
-    let _entryBytes_decorators;
-    let _entryBytes_initializers = [];
-    let _entryBytes_extraInitializers = [];
-    var PolicyAnchorObservationGenerationPayloadV2 = class {
-        static { _classThis = this; }
-        static {
-            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
-            _entryBytes_decorators = [field({ type: Uint8Array })];
-            __esDecorate(null, null, _entryBytes_decorators, { kind: "field", name: "entryBytes", static: false, private: false, access: { has: obj => "entryBytes" in obj, get: obj => obj.entryBytes, set: (obj, value) => { obj.entryBytes = value; } }, metadata: _metadata }, _entryBytes_initializers, _entryBytes_extraInitializers);
-            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
-            PolicyAnchorObservationGenerationPayloadV2 = _classThis = _classDescriptor.value;
-            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
-            __runInitializers(_classThis, _classExtraInitializers);
-        }
-        entryBytes = __runInitializers(this, _entryBytes_initializers, void 0);
-        constructor(properties) {
-            __runInitializers(this, _entryBytes_extraInitializers);
-            if (properties)
-                Object.assign(this, properties);
-        }
-    };
-    return PolicyAnchorObservationGenerationPayloadV2 = _classThis;
-})();
-let PolicyAnchorGenerationBodyV2 = (() => {
-    let _classDecorators = [variant([2, 16, 1])];
-    let _classDescriptor;
-    let _classExtraInitializers = [];
-    let _classThis;
-    let _formatVersion_decorators;
-    let _formatVersion_initializers = [];
-    let _formatVersion_extraInitializers = [];
-    let _generation_decorators;
-    let _generation_initializers = [];
-    let _generation_extraInitializers = [];
-    let _descriptorDigest_decorators;
-    let _descriptorDigest_initializers = [];
-    let _descriptorDigest_extraInitializers = [];
-    let _previousGenerationChecksum_decorators;
-    let _previousGenerationChecksum_initializers = [];
-    let _previousGenerationChecksum_extraInitializers = [];
-    let _kind_decorators;
-    let _kind_initializers = [];
-    let _kind_extraInitializers = [];
-    let _payloadBytes_decorators;
-    let _payloadBytes_initializers = [];
-    let _payloadBytes_extraInitializers = [];
-    var PolicyAnchorGenerationBodyV2 = class {
-        static { _classThis = this; }
-        static {
-            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
-            _formatVersion_decorators = [field({ type: "u8" })];
-            _generation_decorators = [field({ type: "u64" })];
-            _descriptorDigest_decorators = [field({ type: fixedArray("u8", 32) })];
-            _previousGenerationChecksum_decorators = [field({ type: fixedArray("u8", 32) })];
-            _kind_decorators = [field({ type: "u8" })];
-            _payloadBytes_decorators = [field({ type: Uint8Array })];
-            __esDecorate(null, null, _formatVersion_decorators, { kind: "field", name: "formatVersion", static: false, private: false, access: { has: obj => "formatVersion" in obj, get: obj => obj.formatVersion, set: (obj, value) => { obj.formatVersion = value; } }, metadata: _metadata }, _formatVersion_initializers, _formatVersion_extraInitializers);
-            __esDecorate(null, null, _generation_decorators, { kind: "field", name: "generation", static: false, private: false, access: { has: obj => "generation" in obj, get: obj => obj.generation, set: (obj, value) => { obj.generation = value; } }, metadata: _metadata }, _generation_initializers, _generation_extraInitializers);
-            __esDecorate(null, null, _descriptorDigest_decorators, { kind: "field", name: "descriptorDigest", static: false, private: false, access: { has: obj => "descriptorDigest" in obj, get: obj => obj.descriptorDigest, set: (obj, value) => { obj.descriptorDigest = value; } }, metadata: _metadata }, _descriptorDigest_initializers, _descriptorDigest_extraInitializers);
-            __esDecorate(null, null, _previousGenerationChecksum_decorators, { kind: "field", name: "previousGenerationChecksum", static: false, private: false, access: { has: obj => "previousGenerationChecksum" in obj, get: obj => obj.previousGenerationChecksum, set: (obj, value) => { obj.previousGenerationChecksum = value; } }, metadata: _metadata }, _previousGenerationChecksum_initializers, _previousGenerationChecksum_extraInitializers);
-            __esDecorate(null, null, _kind_decorators, { kind: "field", name: "kind", static: false, private: false, access: { has: obj => "kind" in obj, get: obj => obj.kind, set: (obj, value) => { obj.kind = value; } }, metadata: _metadata }, _kind_initializers, _kind_extraInitializers);
-            __esDecorate(null, null, _payloadBytes_decorators, { kind: "field", name: "payloadBytes", static: false, private: false, access: { has: obj => "payloadBytes" in obj, get: obj => obj.payloadBytes, set: (obj, value) => { obj.payloadBytes = value; } }, metadata: _metadata }, _payloadBytes_initializers, _payloadBytes_extraInitializers);
-            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
-            PolicyAnchorGenerationBodyV2 = _classThis = _classDescriptor.value;
-            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
-            __runInitializers(_classThis, _classExtraInitializers);
-        }
-        formatVersion = __runInitializers(this, _formatVersion_initializers, void 0);
-        generation = (__runInitializers(this, _formatVersion_extraInitializers), __runInitializers(this, _generation_initializers, void 0));
-        descriptorDigest = (__runInitializers(this, _generation_extraInitializers), __runInitializers(this, _descriptorDigest_initializers, void 0));
-        previousGenerationChecksum = (__runInitializers(this, _descriptorDigest_extraInitializers), __runInitializers(this, _previousGenerationChecksum_initializers, void 0));
-        kind = (__runInitializers(this, _previousGenerationChecksum_extraInitializers), __runInitializers(this, _kind_initializers, void 0));
-        payloadBytes = (__runInitializers(this, _kind_extraInitializers), __runInitializers(this, _payloadBytes_initializers, void 0));
-        constructor(properties) {
-            __runInitializers(this, _payloadBytes_extraInitializers);
-            if (properties)
-                Object.assign(this, properties);
-        }
-    };
-    return PolicyAnchorGenerationBodyV2 = _classThis;
-})();
-let PolicyAnchorGenerationRecordV2 = (() => {
-    let _classDecorators = [variant([2, 16, 2])];
-    let _classDescriptor;
-    let _classExtraInitializers = [];
-    let _classThis;
-    let _body_decorators;
-    let _body_initializers = [];
-    let _body_extraInitializers = [];
-    let _checksum_decorators;
-    let _checksum_initializers = [];
-    let _checksum_extraInitializers = [];
-    var PolicyAnchorGenerationRecordV2 = class {
-        static { _classThis = this; }
-        static {
-            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
-            _body_decorators = [field({ type: PolicyAnchorGenerationBodyV2 })];
-            _checksum_decorators = [field({ type: fixedArray("u8", 32) })];
-            __esDecorate(null, null, _body_decorators, { kind: "field", name: "body", static: false, private: false, access: { has: obj => "body" in obj, get: obj => obj.body, set: (obj, value) => { obj.body = value; } }, metadata: _metadata }, _body_initializers, _body_extraInitializers);
-            __esDecorate(null, null, _checksum_decorators, { kind: "field", name: "checksum", static: false, private: false, access: { has: obj => "checksum" in obj, get: obj => obj.checksum, set: (obj, value) => { obj.checksum = value; } }, metadata: _metadata }, _checksum_initializers, _checksum_extraInitializers);
-            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
-            PolicyAnchorGenerationRecordV2 = _classThis = _classDescriptor.value;
-            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
-            __runInitializers(_classThis, _classExtraInitializers);
-        }
-        body = __runInitializers(this, _body_initializers, void 0);
-        checksum = (__runInitializers(this, _body_extraInitializers), __runInitializers(this, _checksum_initializers, void 0));
-        constructor(properties) {
-            __runInitializers(this, _checksum_extraInitializers);
-            if (properties)
-                Object.assign(this, properties);
-        }
-    };
-    return PolicyAnchorGenerationRecordV2 = _classThis;
+    return PolicyAnchorCheckpointPayloadV2 = _classThis;
 })();
 const TYPED_ARRAY_PROTOTYPE = Object.getPrototypeOf(Uint8Array.prototype);
 const TYPED_ARRAY_BYTE_LENGTH = Object.getOwnPropertyDescriptor(TYPED_ARRAY_PROTOTYPE, "byteLength").get;
@@ -309,6 +143,8 @@ const exactUint8ArrayByteLength = (input) => {
     }
     const byteLength = TYPED_ARRAY_BYTE_LENGTH.call(input);
     if (byteLength === 0) {
+        // The intrinsic getter reports zero for both empty and detached views. The
+        // intrinsic set distinguishes them without consulting caller properties.
         UINT8_ARRAY_SET.call(new Uint8Array(0), input);
     }
     return byteLength;
@@ -362,36 +198,20 @@ const copyForkEvidence = (evidence) => evidence === undefined
         ],
     };
 const keyId = (key) => bytesKey(serialize(key));
-const descriptorDigest = (descriptor) => sha256Sync(concat([DESCRIPTOR_DIGEST_DOMAIN, serialize(descriptor)]));
-const generationChecksum = (body) => sha256Sync(concat([GENERATION_CHECKSUM_DOMAIN, serialize(body)]));
 const observationContentHash = (entryBytes) => sha256Sync(entryBytes);
 const u32Bytes = (value) => {
     const bytes = new Uint8Array(4);
     new DataView(bytes.buffer).setUint32(0, value, false);
     return bytes;
 };
-const canonicalForkObservationEntries = (entries) => [...entries]
-    .map((entryBytes) => ({
-    entryBytes: copyBytes(entryBytes),
-    hash: observationContentHash(entryBytes),
-}))
-    .sort((left, right) => {
-    const hashOrder = compare(left.hash, right.hash);
-    return hashOrder === 0
-        ? compare(left.entryBytes, right.entryBytes)
-        : hashOrder;
-})
-    .map(({ entryBytes }) => entryBytes);
-const forkObservationCommitment = (descriptorHash, canonicalEntries) => sha256Sync(concat([
-    FORK_OBSERVATION_COMMITMENT_DOMAIN,
-    descriptorHash,
-    Uint8Array.of(canonicalEntries.length),
-    ...canonicalEntries.flatMap((entryBytes) => [
-        u32Bytes(entryBytes.byteLength),
-        entryBytes,
-    ]),
-]));
-const generationKey = (generation) => `${GENERATION_KEY_PREFIX}${generation.toString().padStart(20, "0")}`;
+const checkpointScope = (descriptor) => {
+    const descriptorBytes = serialize(descriptor);
+    return concat([
+        CHECKPOINT_SCOPE_DOMAIN,
+        u32Bytes(descriptorBytes.byteLength),
+        descriptorBytes,
+    ]);
+};
 const assertOpenNotAborted = (signal) => {
     if (signal?.aborted) {
         throw new Error("TrustedNetwork v2 durable policy open was aborted");
@@ -410,6 +230,37 @@ const assertEntryBytes = (bytes, label) => {
         throw new Error(`${label} must contain 1-${TRUSTED_NETWORK_V2_MAX_POLICY_ENTRY_BYTES} bytes`);
     }
 };
+const canonicalForkObservationEntries = (entries) => {
+    const observed = new Map();
+    const hashed = [];
+    for (const entryBytes of entries) {
+        assertEntryBytes(entryBytes, "fork observation entry");
+        const hash = observationContentHash(entryBytes);
+        const hashKey = bytesKey(hash);
+        const existing = observed.get(hashKey);
+        if (existing !== undefined) {
+            if (equals(existing, entryBytes)) {
+                throw new Error("Duplicate policy fork observation");
+            }
+            throw new Error("Policy fork-observation content hash collision");
+        }
+        observed.set(hashKey, entryBytes);
+        hashed.push({ entryBytes, hash });
+    }
+    return hashed
+        .sort((left, right) => {
+        const hashOrder = compare(left.hash, right.hash);
+        return hashOrder === 0
+            ? compare(left.entryBytes, right.entryBytes)
+            : hashOrder;
+    })
+        .map(({ entryBytes }) => entryBytes);
+};
+const assertEmptyBytes = (bytes, label) => {
+    if (!hasExactUint8ArrayByteLength(bytes, 0)) {
+        throw new Error(`${label} must be empty`);
+    }
+};
 const retainCanonicalForkChild = (children, candidate) => {
     const existingIndex = children.findIndex(({ digest }) => equals(digest, candidate.digest));
     if (existingIndex >= 0) {
@@ -431,173 +282,161 @@ const retainCanonicalForkChild = (children, candidate) => {
     if (children.length > 2)
         children.length = 2;
 };
-const assertEmptyBytes = (bytes, label) => {
-    if (!hasExactUint8ArrayByteLength(bytes, 0)) {
-        throw new Error(`${label} must be empty`);
+const assertCanonicalObservationOrder = (entries) => {
+    const canonical = canonicalForkObservationEntries(entries);
+    if (canonical.length !== entries.length ||
+        canonical.some((entryBytes, index) => !equals(entryBytes, entries[index]))) {
+        throw new Error("Policy fork observations are not in canonical order");
     }
 };
-const coreRecordFromState = (state) => {
+const checkpointPayloadFromState = (state, forkObservationEntryBytes = []) => {
     if (state.state === "ACTIVE") {
-        return new PolicyAnchorCoreStateRecordV2({
+        return new PolicyAnchorCheckpointPayloadV2({
             state: ANCHOR_STATE.ACTIVE,
             acceptedHeadEntryBytes: copyBytes(state.acceptedHeadEntryBytes),
             comparisonCandidateEntryBytes: new Uint8Array(0),
             acceptedAncestorDigest: copyBytes(ZERO_DIGEST),
             unavailableReason: "",
-            forkChildEntryBytes0: new Uint8Array(0),
-            forkChildEntryBytes1: new Uint8Array(0),
+            forkObservationEntryBytes: [],
         });
     }
     if (state.state === "UNAVAILABLE") {
-        return new PolicyAnchorCoreStateRecordV2({
+        return new PolicyAnchorCheckpointPayloadV2({
             state: ANCHOR_STATE.UNAVAILABLE,
             acceptedHeadEntryBytes: copyBytes(state.acceptedHeadEntryBytes),
             comparisonCandidateEntryBytes: copyBytes(state.comparisonCandidateEntryBytes),
             acceptedAncestorDigest: copyBytes(state.acceptedAncestorDigest),
             unavailableReason: state.reason,
-            forkChildEntryBytes0: new Uint8Array(0),
-            forkChildEntryBytes1: new Uint8Array(0),
+            forkObservationEntryBytes: [],
         });
     }
-    return new PolicyAnchorCoreStateRecordV2({
+    return new PolicyAnchorCheckpointPayloadV2({
         state: ANCHOR_STATE.FORKED,
         acceptedHeadEntryBytes: copyBytes(state.commonParentEntryBytes),
         comparisonCandidateEntryBytes: new Uint8Array(0),
         acceptedAncestorDigest: copyBytes(ZERO_DIGEST),
         unavailableReason: "",
-        forkChildEntryBytes0: copyBytes(state.childEntryBytes[0]),
-        forkChildEntryBytes1: copyBytes(state.childEntryBytes[1]),
+        forkObservationEntryBytes: forkObservationEntryBytes.map(copyBytes),
     });
 };
-const durableStateFromCoreRecord = (record) => {
-    assertEntryBytes(record.acceptedHeadEntryBytes, "accepted head entry");
-    if (record.state === ANCHOR_STATE.ACTIVE) {
-        assertEmptyBytes(record.comparisonCandidateEntryBytes, "active comparison candidate");
-        if (!equals(record.acceptedAncestorDigest, ZERO_DIGEST)) {
+const coreIdentityBytesFromState = (state) => 
+// Fork observations are deliberately excluded from this transient identity.
+// A FORKED identity is only compared with the preceding non-forked snapshot;
+// after publication, the wrapper admits no more work and retains no copy.
+serialize(checkpointPayloadFromState(state));
+const decodeCanonicalCheckpointPayload = (input) => {
+    let byteLength;
+    try {
+        byteLength = exactUint8ArrayByteLength(input);
+    }
+    catch {
+        byteLength = -1;
+    }
+    if (byteLength < 1 ||
+        byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES) {
+        throw new Error("Policy-anchor checkpoint payload exceeds its byte ceiling");
+    }
+    // CrashSafeTwoSlotCheckpoint.current already returns a fresh genuine exact
+    // copy, so retaining that input while deserializing avoids another full-size
+    // restore copy without exposing caller-owned bytes.
+    const payload = deserialize(input, PolicyAnchorCheckpointPayloadV2);
+    if (!equals(input, serialize(payload))) {
+        throw new Error("Policy-anchor checkpoint payload is not canonical");
+    }
+    return payload;
+};
+const durableStateFromCheckpointPayload = async (payload, descriptor, signal) => {
+    assertEntryBytes(payload.acceptedHeadEntryBytes, "accepted head entry");
+    if (payload.state === ANCHOR_STATE.ACTIVE) {
+        assertEmptyBytes(payload.comparisonCandidateEntryBytes, "active comparison candidate");
+        if (!equals(payload.acceptedAncestorDigest, ZERO_DIGEST)) {
             throw new Error("Active accepted-ancestor digest must be zero");
         }
-        if (record.unavailableReason !== "") {
+        if (payload.unavailableReason !== "") {
             throw new Error("Active unavailable reason must be empty");
         }
-        assertEmptyBytes(record.forkChildEntryBytes0, "active fork child 0");
-        assertEmptyBytes(record.forkChildEntryBytes1, "active fork child 1");
-        return {
+        if (payload.forkObservationEntryBytes.length !== 0) {
+            throw new Error("Active policy-anchor state must not contain fork evidence");
+        }
+        const durableState = {
             formatVersion: REDUCER_DURABLE_FORMAT_VERSION,
             state: "ACTIVE",
-            acceptedHeadEntryBytes: copyBytes(record.acceptedHeadEntryBytes),
+            acceptedHeadEntryBytes: copyBytes(payload.acceptedHeadEntryBytes),
+        };
+        return {
+            durableState,
+            coreIdentityBytes: coreIdentityBytesFromState(durableState),
         };
     }
-    if (record.state === ANCHOR_STATE.UNAVAILABLE) {
-        assertEntryBytes(record.comparisonCandidateEntryBytes, "unavailable comparison candidate");
-        if (!hasExactUint8ArrayByteLength(record.acceptedAncestorDigest, 32)) {
+    if (payload.state === ANCHOR_STATE.UNAVAILABLE) {
+        assertEntryBytes(payload.comparisonCandidateEntryBytes, "unavailable comparison candidate");
+        if (!hasExactUint8ArrayByteLength(payload.acceptedAncestorDigest, 32)) {
             throw new Error("Unavailable accepted-ancestor digest must be 32 bytes");
         }
-        if (record.unavailableReason.length === 0 ||
-            record.unavailableReason.length > MAX_UNAVAILABLE_REASON_LENGTH) {
+        if (payload.unavailableReason.length === 0 ||
+            payload.unavailableReason.length > MAX_UNAVAILABLE_REASON_LENGTH) {
             throw new Error("Unavailable reason is empty or exceeds its character ceiling");
         }
-        assertEmptyBytes(record.forkChildEntryBytes0, "unavailable fork child 0");
-        assertEmptyBytes(record.forkChildEntryBytes1, "unavailable fork child 1");
-        return {
+        if (payload.forkObservationEntryBytes.length !== 0) {
+            throw new Error("Unavailable policy-anchor state must not contain fork evidence");
+        }
+        const durableState = {
             formatVersion: REDUCER_DURABLE_FORMAT_VERSION,
             state: "UNAVAILABLE",
-            acceptedHeadEntryBytes: copyBytes(record.acceptedHeadEntryBytes),
-            comparisonCandidateEntryBytes: copyBytes(record.comparisonCandidateEntryBytes),
-            acceptedAncestorDigest: copyBytes(record.acceptedAncestorDigest),
-            reason: record.unavailableReason,
+            acceptedHeadEntryBytes: copyBytes(payload.acceptedHeadEntryBytes),
+            comparisonCandidateEntryBytes: copyBytes(payload.comparisonCandidateEntryBytes),
+            acceptedAncestorDigest: copyBytes(payload.acceptedAncestorDigest),
+            reason: payload.unavailableReason,
         };
-    }
-    if (record.state === ANCHOR_STATE.FORKED) {
-        assertEmptyBytes(record.comparisonCandidateEntryBytes, "forked comparison candidate");
-        if (!equals(record.acceptedAncestorDigest, ZERO_DIGEST)) {
-            throw new Error("Forked accepted-ancestor digest must be zero");
-        }
-        if (record.unavailableReason !== "") {
-            throw new Error("Forked unavailable reason must be empty");
-        }
-        assertEntryBytes(record.forkChildEntryBytes0, "fork child 0");
-        assertEntryBytes(record.forkChildEntryBytes1, "fork child 1");
         return {
-            formatVersion: REDUCER_DURABLE_FORMAT_VERSION,
-            state: "FORKED",
-            commonParentEntryBytes: copyBytes(record.acceptedHeadEntryBytes),
-            childEntryBytes: [
-                copyBytes(record.forkChildEntryBytes0),
-                copyBytes(record.forkChildEntryBytes1),
-            ],
-        };
-    }
-    throw new Error("Unknown durable policy-anchor state");
-};
-const decodeCanonicalPayload = (input, type, maxBytes, label) => {
-    let byteLength;
-    try {
-        byteLength = exactUint8ArrayByteLength(input);
-    }
-    catch {
-        byteLength = -1;
-    }
-    if (byteLength < 1 || byteLength > maxBytes) {
-        throw new Error(`${label} exceeds its byte ceiling`);
-    }
-    const bytes = copyBytesWithLength(input, byteLength);
-    const payload = deserialize(bytes, type);
-    if (!equals(bytes, serialize(payload))) {
-        throw new Error(`${label} is not canonical`);
-    }
-    return payload;
-};
-const decodeGenerationPayload = (body) => {
-    if (body.kind === GENERATION_KIND.STATE) {
-        const payload = decodeCanonicalPayload(body.payloadBytes, PolicyAnchorStateGenerationPayloadV2, MAX_STATE_GENERATION_PAYLOAD_BYTES, "Policy-anchor state payload");
-        const durableState = durableStateFromCoreRecord(payload.coreState);
-        if (durableState.state === "FORKED") {
-            if (payload.forkObservationCount < 2 ||
-                payload.forkObservationCount > MAX_FORK_OBSERVATIONS_V2) {
-                throw new Error(`Forked policy-anchor state must commit to 2-${MAX_FORK_OBSERVATIONS_V2} observations`);
-            }
-        }
-        else if (payload.forkObservationCount !== 0 ||
-            !equals(payload.forkObservationCommitment, ZERO_DIGEST)) {
-            throw new Error("Non-forked policy-anchor state must not contain a fork commitment");
-        }
-        return {
-            kind: "state",
-            payload,
             durableState,
+            coreIdentityBytes: coreIdentityBytesFromState(durableState),
         };
     }
-    if (body.kind === GENERATION_KIND.FORK_OBSERVATION) {
-        const payload = decodeCanonicalPayload(body.payloadBytes, PolicyAnchorObservationGenerationPayloadV2, MAX_OBSERVATION_GENERATION_PAYLOAD_BYTES, "Policy fork-observation payload");
-        assertEntryBytes(payload.entryBytes, "fork observation entry");
-        return { kind: "fork-observation", payload };
+    if (payload.state !== ANCHOR_STATE.FORKED) {
+        throw new Error("Unknown durable policy-anchor state");
     }
-    throw new Error("Unknown policy-anchor generation kind");
-};
-const decodeGenerationRecord = (input) => {
-    let byteLength;
-    try {
-        byteLength = exactUint8ArrayByteLength(input);
-    }
-    catch {
-        byteLength = -1;
+    assertEmptyBytes(payload.comparisonCandidateEntryBytes, "forked comparison candidate");
+    if (!equals(payload.acceptedAncestorDigest, ZERO_DIGEST)) {
+        throw new Error("Forked accepted-ancestor digest must be zero");
     }
-    if (byteLength < 1 ||
-        byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
-        throw new Error("Policy-anchor generation record exceeds its byte ceiling");
+    if (payload.unavailableReason !== "") {
+        throw new Error("Forked unavailable reason must be empty");
     }
-    const bytes = copyBytesWithLength(input, byteLength);
-    const record = deserialize(bytes, PolicyAnchorGenerationRecordV2);
-    if (!equals(bytes, serialize(record))) {
-        throw new Error("Policy-anchor generation record is not canonical");
+    if (payload.forkObservationEntryBytes.length < 2 ||
+        payload.forkObservationEntryBytes.length > MAX_FORK_OBSERVATIONS_V2) {
+        throw new Error(`Forked policy-anchor state must contain 2-${MAX_FORK_OBSERVATIONS_V2} observations`);
     }
-    if (record.body.formatVersion !== ANCHOR_FORMAT_VERSION) {
-        throw new Error("Unsupported policy-anchor generation format");
+    assertCanonicalObservationOrder(payload.forkObservationEntryBytes);
+    const commonParent = await authenticatePolicySnapshotEntryV2(payload.acceptedHeadEntryBytes, descriptor);
+    assertOpenNotAborted(signal);
+    const canonicalChildren = [];
+    for (const entryBytes of payload.forkObservationEntryBytes) {
+        const authenticated = await authenticatePolicySnapshotEntryV2(entryBytes, descriptor);
+        assertOpenNotAborted(signal);
+        if (authenticated.body.sequence !== commonParent.body.sequence + 1n ||
+            !equals(authenticated.body.previousPolicyDigest, commonParent.digest)) {
+            throw new Error("Stored policy fork observation is not a direct child of the common parent");
+        }
+        retainCanonicalForkChild(canonicalChildren, {
+            digest: authenticated.digest,
+            entryBytes,
+        });
     }
-    if (!equals(record.checksum, generationChecksum(record.body))) {
-        throw new Error("Policy-anchor generation checksum mismatch");
+    if (canonicalChildren.length !== 2) {
+        throw new Error("Stored policy fork evidence has fewer than two distinct children");
     }
-    return { record, payload: decodeGenerationPayload(record.body) };
+    return {
+        durableState: {
+            formatVersion: REDUCER_DURABLE_FORMAT_VERSION,
+            state: "FORKED",
+            commonParentEntryBytes: copyBytes(payload.acceptedHeadEntryBytes),
+            childEntryBytes: [
+                copyBytes(canonicalChildren[0].entryBytes),
+                copyBytes(canonicalChildren[1].entryBytes),
+            ],
+        },
+    };
 };
 const publishedFromReducer = (reducer) => {
     if (reducer.state === "HALTED") {
@@ -615,51 +454,95 @@ const publishedFromReducer = (reducer) => {
         roles,
     };
 };
-const assertCanonicalCoreRestore = (reducer, storedCoreBytes) => {
+const assertCanonicalCoreRestore = (reducer, expectedState) => {
     const restoredState = reducer.exportDurableState();
-    if (restoredState.state === "EMPTY") {
+    if (restoredState.state === "EMPTY" ||
+        restoredState.state !== expectedState.state) {
         throw new Error("Restored policy-anchor state is unexpectedly empty");
     }
-    const restoredCoreBytes = serialize(coreRecordFromState(restoredState));
-    if (!equals(restoredCoreBytes, storedCoreBytes)) {
+    let exact = false;
+    if (restoredState.state === "ACTIVE" && expectedState.state === "ACTIVE") {
+        exact = equals(restoredState.acceptedHeadEntryBytes, expectedState.acceptedHeadEntryBytes);
+    }
+    else if (restoredState.state === "UNAVAILABLE" &&
+        expectedState.state === "UNAVAILABLE") {
+        exact =
+            equals(restoredState.acceptedHeadEntryBytes, expectedState.acceptedHeadEntryBytes) &&
+                equals(restoredState.comparisonCandidateEntryBytes, expectedState.comparisonCandidateEntryBytes) &&
+                equals(restoredState.acceptedAncestorDigest, expectedState.acceptedAncestorDigest) &&
+                restoredState.reason === expectedState.reason;
+    }
+    else if (restoredState.state === "FORKED" &&
+        expectedState.state === "FORKED") {
+        exact =
+            equals(restoredState.commonParentEntryBytes, expectedState.commonParentEntryBytes) &&
+                equals(restoredState.childEntryBytes[0], expectedState.childEntryBytes[0]) &&
+                equals(restoredState.childEntryBytes[1], expectedState.childEntryBytes[1]);
+    }
+    if (!exact) {
         throw new Error("Restored policy-anchor state is not canonical");
     }
 };
+const canonicalForkEntriesForCommit = (result, durableState, forkEvidence) => {
+    if (forkEvidence === undefined) {
+        throw new Error("Forked policy reducer has no fork evidence");
+    }
+    const observations = result.forkObservations ?? [];
+    if (observations.length < 2 ||
+        observations.length > MAX_FORK_OBSERVATIONS_V2) {
+        throw new Error(`A durable fork transition must contain 2-${MAX_FORK_OBSERVATIONS_V2} observations`);
+    }
+    const observationEntries = [];
+    const canonicalChildren = [];
+    for (const proof of observations) {
+        assertEntryBytes(proof.entryBytes, "fork observation entry");
+        if (!hasExactUint8ArrayByteLength(proof.digest, 32)) {
+            throw new Error("Policy fork-observation digest must be 32 bytes");
+        }
+        if (proof.sequence !== forkEvidence.commonParent.sequence + 1n) {
+            throw new Error("Policy fork observation is not a direct child of the common parent");
+        }
+        // The reducer result owns this genuine exact copy and is not exposed until
+        // publication settles, so retaining it through this synchronous validation
+        // avoids another full fork-evidence copy.
+        observationEntries.push(proof.entryBytes);
+        retainCanonicalForkChild(canonicalChildren, proof);
+    }
+    if (canonicalChildren.length !== 2) {
+        throw new Error("A durable fork transition requires two distinct policy children");
+    }
+    for (let index = 0; index < canonicalChildren.length; index++) {
+        if (!equals(canonicalChildren[index].entryBytes, durableState.childEntryBytes[index])) {
+            throw new Error("Published fork state does not contain the lowest canonical children");
+        }
+    }
+    return canonicalForkObservationEntries(observationEntries);
+};
 /**
  * Crash-safe publication wrapper for the internal v2 reducer.
  *
  * The mutable reducer is never exposed. Authorization reads use only the last
- * projection published after the store barrier. An admission places a
- * fail-closed fence around both reducer mutation and durable publication.
+ * projection published after one atomic checkpoint replacement. An admission
+ * places a fail-closed fence around both reducer mutation and publication.
  */
 export class TrustedNetworkV2DurablePolicyReducer {
-    store;
-    durability;
-    descriptor;
-    descriptorHash;
+    checkpoint;
     core;
     published;
-    generation = 0n;
-    previousGenerationChecksum = copyBytes(ZERO_DIGEST);
-    durableCoreBytes;
+    durableCoreIdentityBytes;
     operationTail = Promise.resolve();
     authorizationFences = 0;
     bufferedAdmissions = 0;
     bufferedAdmissionEntryBytes = 0;
     terminalError;
     constructor(properties) {
-        this.store = properties.store;
-        this.durability = properties.durability;
-        this.descriptor = deserialize(serialize(properties.descriptor), NetworkDescriptorV2);
-        this.descriptorHash = descriptorDigest(this.descriptor);
+        this.checkpoint = properties.checkpoint;
         this.core = properties.core;
         this.published = publishedFromReducer(this.core);
-        this.generation = properties.generation ?? 0n;
-        this.previousGenerationChecksum = copyBytes(properties.previousGenerationChecksum ?? ZERO_DIGEST);
-        this.durableCoreBytes =
-            properties.durableCoreBytes === undefined
+        this.durableCoreIdentityBytes =
+            properties.durableCoreIdentityBytes === undefined
                 ? undefined
-                : copyBytes(properties.durableCoreBytes);
+                : copyBytes(properties.durableCoreIdentityBytes);
     }
     static async open(options) {
         assertNetworkDescriptorV2(options.descriptor);
@@ -675,214 +558,49 @@ export class TrustedNetworkV2DurablePolicyReducer {
             maxPendingPolicyBytes: options.maxPendingPolicyBytes,
         };
         assertOpenNotAborted(signal);
-        const durability = store?.crashSafeDurability;
-        if (durability?.crashSafe !== true ||
-            typeof durability.barrier !== "function") {
-            throw new Error("TrustedNetwork v2 durable policy requires a crash-safe store barrier");
-        }
-        // A successful fresh barrier is required on every open, including an empty
-        // store; a generic flush acknowledgement is not this physical fence.
-        await durability.barrier();
+        const checkpoint = await CrashSafeTwoSlotCheckpoint.open({
+            store,
+            scope: checkpointScope(descriptor),
+            maxPayloadBytes: TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES,
+        });
         assertOpenNotAborted(signal);
-        const expectedDescriptorHash = descriptorDigest(descriptor);
-        // Keep only immutable keys while discovering the history, then use get()
-        // to decode one record at a time. This avoids retaining the raw log and its
-        // decoded payloads together during restore.
-        const generationKeys = [];
-        for await (const [key, input] of store.iterator()) {
+        // Never let the old append-only format look like an empty or newer
+        // checkpoint. It was internal and never activated, so migration or fallback
+        // would add rollback surface without preserving a public compatibility need.
+        for await (const [key] of store.iterator()) {
             assertOpenNotAborted(signal);
-            if (key.startsWith(GENERATION_KEY_PREFIX)) {
-                const suffix = key.slice(GENERATION_KEY_PREFIX.length);
-                if (!/^\d{20}$/.test(suffix)) {
-                    throw new Error("Malformed policy-anchor generation key");
-                }
-                let byteLength;
-                try {
-                    byteLength = exactUint8ArrayByteLength(input);
-                }
-                catch {
-                    byteLength = -1;
-                }
-                if (byteLength < 1 ||
-                    byteLength > TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
-                    throw new Error("Policy-anchor generation record exceeds its byte ceiling");
-                }
-                const generation = BigInt(suffix);
-                if (generation === 0n || generation > MAX_U64) {
-                    throw new Error("Policy-anchor generation key is outside u64");
-                }
-                generationKeys.push(key);
-                continue;
-            }
             if (key === TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER ||
                 key.startsWith(`${TRUSTED_NETWORK_V2_POLICY_ANCHOR_STORE_OWNER}/`)) {
-                throw new Error("Unknown policy-anchor record in the owned namespace");
+                throw new Error("Legacy append-only policy-anchor records are not supported; reset the dedicated store");
             }
         }
         assertOpenNotAborted(signal);
-        generationKeys.sort();
-        let previousChecksum = copyBytes(ZERO_DIGEST);
-        let latestCoreBytes;
-        let latestDurableState;
+        const current = checkpoint.current;
         let core;
-        let durableCoreBytes;
-        let forkEvidence;
-        let expectedForkObservationCount;
-        let expectedForkObservationCommitment;
-        const observedEntries = new Map();
-        const canonicalChildren = [];
         try {
-            for (let index = 0; index < generationKeys.length; index++) {
-                assertOpenNotAborted(signal);
-                const key = generationKeys[index];
-                const expectedGeneration = BigInt(index + 1);
-                const keyedGeneration = BigInt(key.slice(GENERATION_KEY_PREFIX.length));
-                if (keyedGeneration !== expectedGeneration) {
-                    throw new Error("Policy-anchor generation history is gapped");
-                }
-                const input = await store.get(key);
-                assertOpenNotAborted(signal);
-                if (input === undefined) {
-                    throw new Error("Policy-anchor generation disappeared during restore");
-                }
-                const { record, payload } = decodeGenerationRecord(input);
-                if (record.body.generation !== keyedGeneration ||
-                    generationKey(record.body.generation) !== key) {
-                    throw new Error("Policy-anchor generation key does not match record");
-                }
-                if (!equals(record.body.descriptorDigest, expectedDescriptorHash)) {
-                    throw new Error("Policy-anchor generation belongs to another descriptor");
-                }
-                if (!equals(record.body.previousGenerationChecksum, previousChecksum)) {
-                    throw new Error("Policy-anchor generation checksum chain is broken");
-                }
-                if (payload.kind === "state") {
-                    if (latestDurableState?.state === "FORKED") {
-                        throw new Error("A FORKED policy anchor may only append observation deltas");
-                    }
-                    latestCoreBytes = serialize(payload.payload.coreState);
-                    latestDurableState = payload.durableState;
-                    if (latestDurableState.state === "FORKED") {
-                        expectedForkObservationCount = payload.payload.forkObservationCount;
-                        expectedForkObservationCommitment = copyBytes(payload.payload.forkObservationCommitment);
-                        core = await TrustedNetworkV2PolicyReducer.restore({
-                            ...coreProperties,
-                            durableState: latestDurableState,
-                        });
-                        assertOpenNotAborted(signal);
-                        assertCanonicalCoreRestore(core, latestCoreBytes);
-                        durableCoreBytes = copyBytes(latestCoreBytes);
-                        forkEvidence = core.forkEvidence;
-                        if (forkEvidence === undefined) {
-                            throw new Error("Restored forked policy anchor has no fork evidence");
-                        }
-                        for (const child of forkEvidence.children) {
-                            const hashKey = bytesKey(observationContentHash(child.entryBytes));
-                            if (observedEntries.has(hashKey)) {
-                                throw new Error("Duplicate policy fork observation in durable state");
-                            }
-                            observedEntries.set(hashKey, copyBytes(child.entryBytes));
-                            retainCanonicalForkChild(canonicalChildren, child);
-                        }
-                    }
-                }
-                else {
-                    if (latestDurableState?.state !== "FORKED" ||
-                        core === undefined ||
-                        forkEvidence === undefined) {
-                        throw new Error("Policy fork-observation delta requires a preceding FORKED state");
-                    }
-                    const entryBytes = payload.payload.entryBytes;
-                    const hashKey = bytesKey(observationContentHash(entryBytes));
-                    if (observedEntries.has(hashKey)) {
-                        throw new Error("Duplicate policy fork-observation generation");
-                    }
-                    if (observedEntries.size >= MAX_FORK_OBSERVATIONS_V2) {
-                        throw new Error(`Policy fork evidence exceeds ${MAX_FORK_OBSERVATIONS_V2} children`);
-                    }
-                    const authenticated = await authenticatePolicySnapshotEntryV2(entryBytes, descriptor);
-                    assertOpenNotAborted(signal);
-                    if (authenticated.body.sequence !==
-                        forkEvidence.commonParent.sequence + 1n ||
-                        !equals(authenticated.body.previousPolicyDigest, forkEvidence.commonParent.digest)) {
-                        throw new Error("Stored policy fork observation is not a direct child of the common parent");
-                    }
-                    observedEntries.set(hashKey, copyBytes(entryBytes));
-                    retainCanonicalForkChild(canonicalChildren, {
-                        digest: authenticated.digest,
-                        entryBytes,
-                    });
-                }
-                previousChecksum = copyBytes(record.checksum);
-            }
-            const highestGeneration = generationKeys.length === 0 ? undefined : BigInt(generationKeys.length);
-            if (highestGeneration !== undefined && latestCoreBytes === undefined) {
-                throw new Error("Policy-anchor history has no durable state generation");
-            }
-            if (core === undefined) {
-                if (highestGeneration === undefined) {
-                    core = new TrustedNetworkV2PolicyReducer(coreProperties);
-                }
-                else {
-                    core = await TrustedNetworkV2PolicyReducer.restore({
-                        ...coreProperties,
-                        durableState: latestDurableState,
-                    });
-                    assertOpenNotAborted(signal);
-                    assertCanonicalCoreRestore(core, latestCoreBytes);
-                    durableCoreBytes = copyBytes(latestCoreBytes);
-                }
-            }
-            if (latestDurableState?.state === "FORKED") {
-                if (forkEvidence === undefined ||
-                    expectedForkObservationCount === undefined ||
-                    expectedForkObservationCommitment === undefined) {
-                    throw new Error("Restored forked policy anchor has no fork evidence");
-                }
-                if (observedEntries.size !== expectedForkObservationCount) {
-                    throw new Error(`Policy fork evidence is incomplete: expected ${expectedForkObservationCount}, restored ${observedEntries.size}`);
-                }
-                const restoredCommitment = forkObservationCommitment(expectedDescriptorHash, canonicalForkObservationEntries(observedEntries.values()));
-                if (!equals(restoredCommitment, expectedForkObservationCommitment)) {
-                    throw new Error("Policy fork evidence commitment mismatch");
-                }
-                if (canonicalChildren.length !== 2) {
-                    throw new Error("Stored policy fork evidence has fewer than two distinct children");
-                }
-                const normalizedForkState = {
-                    formatVersion: REDUCER_DURABLE_FORMAT_VERSION,
-                    state: "FORKED",
-                    commonParentEntryBytes: copyBytes(latestDurableState.commonParentEntryBytes),
-                    childEntryBytes: [
-                        copyBytes(canonicalChildren[0].entryBytes),
-                        copyBytes(canonicalChildren[1].entryBytes),
-                    ],
-                };
-                const pairChanged = canonicalChildren.some((child, index) => !equals(child.digest, forkEvidence.children[index].digest) ||
-                    !equals(child.entryBytes, forkEvidence.children[index].entryBytes));
-                if (pairChanged) {
-                    core.abort();
-                    core = await TrustedNetworkV2PolicyReducer.restore({
-                        ...coreProperties,
-                        durableState: normalizedForkState,
-                    });
-                    assertOpenNotAborted(signal);
-                    assertCanonicalCoreRestore(core, serialize(coreRecordFromState(normalizedForkState)));
-                }
-                latestDurableState = normalizedForkState;
-                durableCoreBytes = serialize(coreRecordFromState(normalizedForkState));
-            }
-            else if (observedEntries.size !== 0) {
-                throw new Error("Non-forked policy anchor has fork observations");
+            if (current === undefined) {
+                core = new TrustedNetworkV2PolicyReducer(coreProperties);
+                return new TrustedNetworkV2DurablePolicyReducer({
+                    checkpoint,
+                    core,
+                });
             }
+            const payload = decodeCanonicalCheckpointPayload(current.payload);
+            const decoded = await durableStateFromCheckpointPayload(payload, descriptor, signal);
+            assertOpenNotAborted(signal);
+            core = await TrustedNetworkV2PolicyReducer.restore({
+                ...coreProperties,
+                durableState: decoded.durableState,
+            });
+            assertOpenNotAborted(signal);
+            assertCanonicalCoreRestore(core, decoded.durableState);
+            const forked = decoded.durableState.state === "FORKED";
             return new TrustedNetworkV2DurablePolicyReducer({
-                store,
-                durability,
-                descriptor,
+                // The helper retains its latest payload. A terminal fork no longer needs
+                // storage, so release that potentially 8.78 MiB snapshot immediately.
+                checkpoint: forked ? undefined : checkpoint,
                 core,
-                generation: highestGeneration,
-                previousGenerationChecksum: previousChecksum,
-                durableCoreBytes,
+                durableCoreIdentityBytes: decoded.coreIdentityBytes,
             });
         }
         catch (error) {
@@ -907,13 +625,15 @@ export class TrustedNetworkV2DurablePolicyReducer {
         return copyForkEvidence(this.published.forkEvidence);
     }
     get pendingCount() {
-        return this.core.pendingCount;
+        return this.published.state === "FORKED" ? 0 : this.core.pendingCount;
     }
     get pendingBytes() {
-        return this.core.pendingBytes;
+        return this.published.state === "FORKED" ? 0 : this.core.pendingBytes;
     }
     get pendingDigests() {
-        return this.core.pendingDigests.map(copyBytes);
+        return this.published.state === "FORKED"
+            ? []
+            : this.core.pendingDigests.map(copyBytes);
     }
     /** Internal diagnostics for the fixed pre-publication admission bound. */
     get bufferedAdmissionCount() {
@@ -1074,120 +794,52 @@ export class TrustedNetworkV2DurablePolicyReducer {
     async persistCorePublication(result) {
         const durableState = this.core.exportDurableState();
         if (durableState.state === "EMPTY") {
-            if (this.durableCoreBytes !== undefined) {
-                throw this.halt("Durable policy state cannot return to EMPTY");
-            }
-            return;
-        }
-        const coreRecord = coreRecordFromState(durableState);
-        const coreBytes = serialize(coreRecord);
-        const stateChanged = this.durableCoreBytes === undefined ||
-            !equals(this.durableCoreBytes, coreBytes);
-        const suppliedObservations = new Map();
-        for (const proof of result.forkObservations ?? []) {
-            const contentHash = observationContentHash(proof.entryBytes);
-            const hashKey = bytesKey(contentHash);
-            const retained = suppliedObservations.get(hashKey);
-            if (retained !== undefined && !equals(retained, proof.entryBytes)) {
-                throw this.halt("Policy fork-observation content hash collision");
-            }
-            suppliedObservations.set(hashKey, copyBytes(proof.entryBytes));
-        }
-        let committedForkObservationCount = 0;
-        let committedForkObservationDigest = copyBytes(ZERO_DIGEST);
-        if (durableState.state !== "FORKED") {
-            if (suppliedObservations.size !== 0) {
-                throw this.halt("Only a forked policy anchor may contain observations");
-            }
-        }
-        else {
-            if (this.published.state === "FORKED" || !stateChanged) {
-                throw this.halt("A durable fork transition may be published only once");
-            }
-            if (suppliedObservations.size < 2 ||
-                suppliedObservations.size > MAX_FORK_OBSERVATIONS_V2) {
-                throw this.halt(`A durable fork transition must contain 2-${MAX_FORK_OBSERVATIONS_V2} distinct observations`);
+            if (this.durableCoreIdentityBytes !== undefined) {
+                throw new Error("Durable policy state cannot return to EMPTY");
             }
-            const completeObservationEntries = canonicalForkObservationEntries(suppliedObservations.values());
-            committedForkObservationCount = completeObservationEntries.length;
-            committedForkObservationDigest = forkObservationCommitment(this.descriptorHash, completeObservationEntries);
-            for (const entryBytes of durableState.childEntryBytes) {
-                const hashKey = bytesKey(observationContentHash(entryBytes));
-                if (!suppliedObservations.delete(hashKey)) {
-                    throw this.halt("Published fork state is missing a canonical observation");
-                }
+            if ((result.forkObservations?.length ?? 0) !== 0) {
+                throw new Error("An empty policy anchor cannot contain fork evidence");
             }
-        }
-        const observationEntries = canonicalForkObservationEntries(suppliedObservations.values());
-        const recordCount = (stateChanged ? 1 : 0) + observationEntries.length;
-        if (recordCount === 0)
             return;
-        if (BigInt(recordCount) > MAX_U64 - this.generation) {
-            throw this.halt("Policy-anchor generation exhausted u64");
         }
-        let nextGeneration = this.generation;
-        let previousChecksum = copyBytes(this.previousGenerationChecksum);
-        const drafts = [];
-        if (stateChanged) {
-            const payloadBytes = serialize(new PolicyAnchorStateGenerationPayloadV2({
-                coreState: coreRecord,
-                forkObservationCount: committedForkObservationCount,
-                forkObservationCommitment: committedForkObservationDigest,
-            }));
-            if (payloadBytes.byteLength > MAX_STATE_GENERATION_PAYLOAD_BYTES) {
-                throw this.halt("Policy-anchor state payload exceeds its byte ceiling");
-            }
-            drafts.push({ kind: GENERATION_KIND.STATE, payloadBytes });
-        }
-        for (const entryBytes of observationEntries) {
-            const payloadBytes = serialize(new PolicyAnchorObservationGenerationPayloadV2({
-                entryBytes: copyBytes(entryBytes),
-            }));
-            if (payloadBytes.byteLength > MAX_OBSERVATION_GENERATION_PAYLOAD_BYTES) {
-                throw this.halt("Policy fork-observation payload exceeds its byte ceiling");
-            }
-            drafts.push({
-                kind: GENERATION_KIND.FORK_OBSERVATION,
-                payloadBytes,
-            });
-        }
-        for (const draft of drafts) {
-            nextGeneration += 1n;
-            const body = new PolicyAnchorGenerationBodyV2({
-                formatVersion: ANCHOR_FORMAT_VERSION,
-                generation: nextGeneration,
-                descriptorDigest: copyBytes(this.descriptorHash),
-                previousGenerationChecksum: copyBytes(previousChecksum),
-                kind: draft.kind,
-                payloadBytes: copyBytes(draft.payloadBytes),
-            });
-            const record = new PolicyAnchorGenerationRecordV2({
-                body,
-                checksum: generationChecksum(body),
-            });
-            const recordBytes = serialize(record);
-            if (recordBytes.byteLength >
-                TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_GENERATION_BYTES) {
-                throw this.halt("Policy-anchor generation record exceeds its byte ceiling");
-            }
-            const key = generationKey(nextGeneration);
-            if ((await this.store.get(key)) !== undefined) {
-                throw this.halt("Policy-anchor generation must never be overwritten");
+        const coreIdentityBytes = coreIdentityBytesFromState(durableState);
+        const stateChanged = this.durableCoreIdentityBytes === undefined ||
+            !equals(this.durableCoreIdentityBytes, coreIdentityBytes);
+        if (durableState.state !== "FORKED") {
+            if ((result.forkObservations?.length ?? 0) !== 0) {
+                throw new Error("Only a forked policy anchor may contain observations");
             }
-            await this.store.put(key, copyBytes(recordBytes));
-            // Each immutable generation gets one physical fence. The projection is
-            // published only after every state/observation delta is fenced.
-            await this.durability.barrier();
-            previousChecksum = copyBytes(record.checksum);
-        }
-        this.generation = nextGeneration;
-        this.previousGenerationChecksum = previousChecksum;
-        this.durableCoreBytes = copyBytes(coreBytes);
-        try {
-            this.published = publishedFromReducer(this.core);
-        }
-        catch (error) {
-            throw this.halt(error);
+            if (!stateChanged)
+                return;
+        }
+        else if (this.published.state === "FORKED" || !stateChanged) {
+            throw new Error("A durable fork transition may be published only once");
+        }
+        const nextPublished = publishedFromReducer(this.core);
+        const observationEntries = durableState.state === "FORKED"
+            ? canonicalForkEntriesForCommit(result, durableState, nextPublished.forkEvidence)
+            : [];
+        const payloadBytes = serialize(checkpointPayloadFromState(durableState, observationEntries));
+        if (payloadBytes.byteLength >
+            TRUSTED_NETWORK_V2_MAX_POLICY_ANCHOR_CHECKPOINT_PAYLOAD_BYTES) {
+            throw new Error("Policy-anchor checkpoint payload exceeds its byte ceiling");
+        }
+        // Allocate every post-commit publication value before durable replacement.
+        // Once commit resolves, the remaining operations are non-throwing assignments.
+        const nextDurableCoreIdentityBytes = durableState.state === "FORKED"
+            ? undefined
+            : copyBytes(coreIdentityBytes);
+        const checkpoint = this.checkpoint;
+        if (checkpoint === undefined) {
+            throw new Error("Policy-anchor checkpoint is unavailable");
+        }
+        await checkpoint.commit(payloadBytes);
+        this.durableCoreIdentityBytes = nextDurableCoreIdentityBytes;
+        this.published = nextPublished;
+        if (durableState.state === "FORKED") {
+            // The terminal projection is self-contained; drop the helper's retained
+            // copy of the potentially maximum-sized checkpoint payload.
+            this.checkpoint = undefined;
         }
     }
 }