@sekiban/dcb-runtime 0.2.0 → 0.2.1

package/dist/read/SerializedReadWorker.d.ts

@@ -8,6 +8,9 @@ interface ReadWorkerEnv {
     TAG_STATE?: DurableObjectNamespace;
     POSTGRES_URL?: string;
     HYPERDRIVE?: Hyperdrive;
+    COSMOS_ENDPOINT?: string;
+    COSMOS_DATABASE?: string;
+    COSMOS_KEY?: string;
     /** Optional explicit D1 provider binding; Postgres remains the default. */
     D1?: D1Database;
     /** Set only by an authenticated deployment-verification lane. */

package/dist/read/SerializedReadWorker.js

@@ -174,10 +174,10 @@ export class SerializedReadWorker {
         // Direct unit tests can exercise Tag DO determinacy with only TAG. The
         // default provider has no backing store in that fixture. An explicit
         // provider (including Cosmos) is always checked when it is configured.
-        if (this.storeProvider === undefined || this.storeProvider.isConfigured?.(this.env) === false) {
-            return;
-        }
         try {
+            if (this.storeProvider === undefined || this.storeProvider.isConfigured?.(this.env) === false) {
+                return;
+            }
             const store = this.storeProvider.create(this.env);
             await store.initialize();
             const nowMs = Date.now();

package/dist/shard/ShardRotation.d.ts

@@ -0,0 +1,48 @@
+export type SealedShard = Readonly<{
+    id: string;
+    lastSuid: string;
+}>;
+export type LateArrival = Readonly<{
+    shardId: string;
+    suid: string;
+    reason: "sealed-range";
+}>;
+export type ShardRotationState = Readonly<{
+    sealed: readonly SealedShard[];
+    active: string;
+    ledger: readonly LateArrival[];
+}>;
+export type ShardRotationDiagnostic = Readonly<{
+    code: "ORDER_INVARIANT" | "SEALED_WRITE" | "IDENTITY_SWAP" | "ACTIVE_COUNT" | "SEAL_MAX_MISSING" | "UNKNOWN_SHARD" | "SILENT_MERGE" | "SAFEWINDOW_SEAL";
+    path: string;
+    reason: string;
+}>;
+export declare class ShardRotationError extends Error {
+    readonly diagnostic: ShardRotationDiagnostic;
+    constructor(diagnostic: ShardRotationDiagnostic);
+}
+export declare function createRotationState(active: string): ShardRotationState;
+/** Fail closed unless last(D1-1) < first(D1-2). */
+export declare function assertStrictlyBefore(lastD1_1: string, firstD1_2: string): void;
+export declare function maxSortableUniqueId(values: readonly string[]): string;
+/**
+ * Normal rotation: derive last(D1-1) as the maximum SortableUniqueId present in
+ * the shard being sealed, append that sealed entry in order, then point active
+ * at exactly one new shard id that is not already sealed.
+ */
+export declare function rotateAppend(state: ShardRotationState, sealedId: string, shardSuids: readonly string[], nextActiveId: string): ShardRotationState;
+export declare function replaceSealedIdentity(state: ShardRotationState, index: number, nextId: string): never;
+export declare function refuseSealedWrite(state: ShardRotationState, shardId: string): void;
+/**
+ * First or later write into the active shard after a seal. Requires
+ * last(D1-1) < candidate. Does not write when the gate fails.
+ */
+export declare function admitActiveWrite(state: ShardRotationState, shardId: string, firstOrNextSuid: string): void;
+/**
+ * Late arrival under a sealed range. Appended only to the side ledger.
+ * Never writes back into the sealed shard.
+ */
+export declare function recordLateArrival(state: ShardRotationState, sealedShardId: string, suid: string): ShardRotationState;
+export declare function assertNoSilentLedgerMerge(source: string): void;
+export declare function refuseSilentLedgerMerge(): never;
+export declare function refuseSafeWindowSeal(): never;

package/dist/shard/ShardRotation.js

@@ -0,0 +1,120 @@
+import { assertSortableUniqueId, compareSortableUniqueId } from "../allocator/SortableUniqueId";
+export class ShardRotationError extends Error {
+    diagnostic;
+    constructor(diagnostic) {
+        super(diagnostic.code);
+        this.name = "ShardRotationError";
+        this.diagnostic = diagnostic;
+    }
+}
+function fail(code, path, reason) {
+    throw new ShardRotationError({ code, path, reason });
+}
+export function createRotationState(active) {
+    if (typeof active !== "string" || active.length === 0)
+        fail("ACTIVE_COUNT", "active", "active-missing");
+    return { sealed: [], active, ledger: [] };
+}
+/** Fail closed unless last(D1-1) < first(D1-2). */
+export function assertStrictlyBefore(lastD1_1, firstD1_2) {
+    assertSortableUniqueId(lastD1_1);
+    assertSortableUniqueId(firstD1_2);
+    if (compareSortableUniqueId(lastD1_1, firstD1_2) >= 0) {
+        fail("ORDER_INVARIANT", "last(D1-1)<first(D1-2)", "order-invariant");
+    }
+}
+export function maxSortableUniqueId(values) {
+    if (values.length === 0)
+        fail("SEAL_MAX_MISSING", "d1-1", "seal-max-missing");
+    let max = assertSortableUniqueId(values[0]).value;
+    for (let i = 1; i < values.length; i += 1) {
+        const next = assertSortableUniqueId(values[i]).value;
+        if (next > max)
+            max = next;
+    }
+    return max;
+}
+/**
+ * Normal rotation: derive last(D1-1) as the maximum SortableUniqueId present in
+ * the shard being sealed, append that sealed entry in order, then point active
+ * at exactly one new shard id that is not already sealed.
+ */
+export function rotateAppend(state, sealedId, shardSuids, nextActiveId) {
+    if (sealedId !== state.active)
+        fail("UNKNOWN_SHARD", sealedId, "unknown-shard");
+    if (typeof nextActiveId !== "string" || nextActiveId.length === 0 || nextActiveId === sealedId) {
+        fail("ACTIVE_COUNT", "active", "active-count");
+    }
+    if (state.sealed.some((entry) => entry.id === nextActiveId)) {
+        fail("ACTIVE_COUNT", nextActiveId, "active-already-sealed");
+    }
+    if (state.sealed.some((entry) => entry.id === sealedId))
+        fail("IDENTITY_SWAP", sealedId, "identity-swap");
+    const lastSuid = maxSortableUniqueId(shardSuids);
+    return {
+        sealed: [...state.sealed, { id: sealedId, lastSuid }],
+        active: nextActiveId,
+        ledger: state.ledger,
+    };
+}
+export function replaceSealedIdentity(state, index, nextId) {
+    if (index < 0 || index >= state.sealed.length)
+        fail("UNKNOWN_SHARD", "sealed", "unknown-shard");
+    fail("IDENTITY_SWAP", state.sealed[index].id, `identity-swap:${nextId}`);
+}
+export function refuseSealedWrite(state, shardId) {
+    if (state.sealed.some((entry) => entry.id === shardId))
+        fail("SEALED_WRITE", shardId, "sealed-write");
+}
+/**
+ * First or later write into the active shard after a seal. Requires
+ * last(D1-1) < candidate. Does not write when the gate fails.
+ */
+export function admitActiveWrite(state, shardId, firstOrNextSuid) {
+    assertSortableUniqueId(firstOrNextSuid);
+    refuseSealedWrite(state, shardId);
+    if (shardId !== state.active)
+        fail("UNKNOWN_SHARD", shardId, "unknown-shard");
+    if (state.sealed.length === 0)
+        return;
+    const previous = state.sealed[state.sealed.length - 1];
+    assertStrictlyBefore(previous.lastSuid, firstOrNextSuid);
+}
+/**
+ * Late arrival under a sealed range. Appended only to the side ledger.
+ * Never writes back into the sealed shard.
+ */
+export function recordLateArrival(state, sealedShardId, suid) {
+    assertSortableUniqueId(suid);
+    const sealed = state.sealed.find((entry) => entry.id === sealedShardId);
+    if (sealed === undefined)
+        fail("UNKNOWN_SHARD", sealedShardId, "unknown-shard");
+    if (compareSortableUniqueId(suid, sealed.lastSuid) > 0) {
+        fail("ORDER_INVARIANT", sealedShardId, "not-late-arrival");
+    }
+    return {
+        ...state,
+        ledger: [...state.ledger, { shardId: sealed.id, suid, reason: "sealed-range" }],
+    };
+}
+const SILENT_MERGE_TOKENS = [
+    ["merge", "Ledger", "Into", "Sealed"],
+    ["merge", "OnRead", "Sealed"],
+    ["silent", "Merge", "Ledger"],
+    ["ledger", ".concat(", "sealed"],
+    ["sealed", ".concat(", "ledger"],
+];
+export function assertNoSilentLedgerMerge(source) {
+    const lowered = source.toLowerCase();
+    for (const token of SILENT_MERGE_TOKENS) {
+        const needle = token.join("").toLowerCase();
+        if (lowered.includes(needle))
+            fail("SILENT_MERGE", "ledger", "silent-merge");
+    }
+}
+export function refuseSilentLedgerMerge() {
+    fail("SILENT_MERGE", "ledger", "silent-merge");
+}
+export function refuseSafeWindowSeal() {
+    fail("SAFEWINDOW_SEAL", "safe-window", "safewindow-seal");
+}

package/dist/store/CosmosEventStore.js

@@ -2,44 +2,43 @@ import { resolveDeliveryIdentity } from "../eventIdentity";
 import { assertSortableUniqueId } from "../allocator/SortableUniqueId";
 import { CANONICAL_UTC_TIMESTAMP_PATTERN, isRfc4122Uuid, isUuidV7, serializedEventMetadata } from "../eventRecord";
 import { decayedLagEstimateMs } from "../safeWindow";
+import { COSMOS_CONTAINER_LAYOUT, COSMOS_CONTAINER_NAMES, COSMOS_DOCUMENT_ID_RULES, } from "../generated/cosmos-layout";
 import { CanonicalEventIdentityConflictError, } from "./types";
 /** Sekiban.Dcb CosmosEvent's immutable logical-record partition. */
-export const COSMOS_EVENT_PARTITION_KEY_PATH = "/pk";
+export const COSMOS_EVENT_PARTITION_KEY_PATH = COSMOS_CONTAINER_LAYOUT.events.partitionKeyPath;
 /** TS-only auxiliary documents retain a service-local partition. */
-export const COSMOS_AUXILIARY_PARTITION_KEY_PATH = "/serviceId";
+export const COSMOS_AUXILIARY_PARTITION_KEY_PATH = COSMOS_CONTAINER_LAYOUT.lagEstimates.partitionKeyPath;
 /** @deprecated Kept as an alias for auxiliary-container callers. */
 export const COSMOS_PARTITION_KEY_PATH = COSMOS_AUXILIARY_PARTITION_KEY_PATH;
-export const DEFAULT_COSMOS_CONTAINERS = Object.freeze({
-    events: "dcb-events",
-    lagEstimates: "dcb-lag-estimates",
-    pendingArrivals: "dcb-pending-arrivals",
-    findings: "dcb-findings",
-    checkpoints: "dcb-projection-checkpoints",
-});
+export const DEFAULT_COSMOS_CONTAINERS = COSMOS_CONTAINER_NAMES;
 /**
  * The layout is data rather than a comment so every adapter initialization and
  * contract fixture can inspect the same five service-partitioned containers.
  */
 export function cosmosContainerDefinitions(containers = DEFAULT_COSMOS_CONTAINERS) {
-    return [
-        {
-            name: containers.events,
-            partitionKeyPath: COSMOS_EVENT_PARTITION_KEY_PATH,
-            // The C# CosmosEvent is partitioned by the exact serviceId|id pair.
-            // Refuse a missing id here so an introspection fixture cannot mistake
-            // an auxiliary service partition for the logical event partition.
-            partitionKeyValue: (serviceId, id) => {
-                if (typeof id !== "string" || id.length === 0)
-                    throw new Error("Cosmos event partition key requires an event id");
-                return eventPk(serviceId, id);
-            },
-        },
-        ...[containers.lagEstimates, containers.pendingArrivals, containers.findings, containers.checkpoints].map((name) => ({
+    return Object.keys(COSMOS_CONTAINER_LAYOUT).map((key) => {
+        const layout = COSMOS_CONTAINER_LAYOUT[key];
+        const name = containers[key];
+        if (key === "events") {
+            return {
+                name,
+                partitionKeyPath: layout.partitionKeyPath,
+                // The C# CosmosEvent is partitioned by the exact serviceId|id pair.
+                // Refuse a missing id here so an introspection fixture cannot mistake
+                // an auxiliary service partition for the logical event partition.
+                partitionKeyValue: (serviceId, id) => {
+                    if (typeof id !== "string" || id.length === 0)
+                        throw new Error("Cosmos event partition key requires an event id");
+                    return eventPk(serviceId, id);
+                },
+            };
+        }
+        return {
             name,
-            partitionKeyPath: COSMOS_AUXILIARY_PARTITION_KEY_PATH,
+            partitionKeyPath: layout.partitionKeyPath,
             partitionKeyValue: (serviceId) => serviceId,
-        })),
-    ];
+        };
+    });
 }
 export class CosmosClientError extends Error {
     status;
@@ -103,6 +102,13 @@ export function compareCosmosSuid(left, right) {
 function safeId(...parts) {
     return parts.map((part) => encodeURIComponent(part)).join("~");
 }
+function rulePrefix(rule, fallback) {
+    return rule.match(/^safeId\("([^"]+)"/)?.[1] ?? fallback;
+}
+const EVENT_OPS_ID_PREFIX = rulePrefix(COSMOS_DOCUMENT_ID_RULES.events.eventSidecar, "event-ops");
+const LINEAGE_ID_PREFIX = rulePrefix(COSMOS_DOCUMENT_ID_RULES.events.serviceGuards.allocatorLineageBinding, "allocator-lineage-binding");
+const SUID_ID_PREFIX = rulePrefix(COSMOS_DOCUMENT_ID_RULES.events.serviceGuards.suidBinding, "suid-binding");
+const INCIDENT_ID_PREFIX = rulePrefix(COSMOS_DOCUMENT_ID_RULES.events.serviceGuards.deliveryIncident, "incident");
 /** The exact CosmosEvent partition-key derivation from Sekiban.Dcb. */
 function eventPk(serviceId, id) {
     return `${serviceId}|${id}`;
@@ -362,19 +368,23 @@ export class CosmosRestClient {
             return buffer;
         })(), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
         const signature = encodeURIComponent(`type=master&ver=1.0&sig=${base64(await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(signaturePayload)))}`);
-        const response = await this.fetcher(new URL(path, this.endpoint), {
-            method,
-            headers: {
-                accept: "application/json",
-                "content-type": "application/json",
-                "x-ms-date": date,
-                "x-ms-version": "2018-12-31",
-                authorization: signature,
-                ...extraHeaders,
-            },
-            body: body === undefined ? undefined : JSON.stringify(body),
-        });
-        return response;
+        try {
+            return await this.fetcher(new URL(path, this.endpoint), {
+                method,
+                headers: {
+                    accept: "application/json",
+                    "content-type": "application/json",
+                    "x-ms-date": date,
+                    "x-ms-version": "2018-12-31",
+                    authorization: signature,
+                    ...extraHeaders,
+                },
+                body: body === undefined ? undefined : JSON.stringify(body),
+            });
+        }
+        catch {
+            throw new CosmosClientError(0, "Cosmos request failed before a response was received");
+        }
     }
     async errorFrom(response, prefix) {
         // Never include response bodies: Cosmos errors can echo account or query
@@ -655,7 +665,7 @@ export class CosmosEventStore {
     }
     async hasDeliveryIncident(serviceId, identityKey) {
         this.ready();
-        return (await this.client.read(this.containers.events, safeId("incident", identityKey), auxiliaryPk(serviceId))) !== undefined;
+        return (await this.client.read(this.containers.events, safeId(INCIDENT_ID_PREFIX, identityKey), auxiliaryPk(serviceId))) !== undefined;
     }
     async listDeliveryIncidents(serviceId) {
         this.ready();
@@ -680,7 +690,7 @@ export class CosmosEventStore {
     }
     async bindLineage(serviceId, allocatorLineageId, boundAt) {
         const document = {
-            id: safeId("allocator-lineage-binding"),
+            id: safeId(LINEAGE_ID_PREFIX),
             pk: auxiliaryPk(serviceId),
             serviceId,
             kind: "allocator-lineage-binding",
@@ -702,7 +712,7 @@ export class CosmosEventStore {
      * mutation. Historical rows are still checked by eventDocuments above.
      */
     async reserveSuid(serviceId, suid, eventId) {
-        const id = safeId("suid-binding", suid);
+        const id = safeId(SUID_ID_PREFIX, suid);
         const existing = await this.client.read(this.containers.events, id, auxiliaryPk(serviceId));
         if (existing !== undefined)
             return existing.document.eventId;
@@ -728,7 +738,7 @@ export class CosmosEventStore {
     }
     async persistIncident(incident) {
         const document = {
-            id: safeId("incident", incident.identityKey),
+            id: safeId(INCIDENT_ID_PREFIX, incident.identityKey),
             pk: auxiliaryPk(incident.serviceId),
             serviceId: incident.serviceId,
             kind: "delivery-incident",
@@ -753,7 +763,7 @@ export class CosmosEventStore {
     }
     async projectIncident(incident) {
         const document = {
-            id: safeId("incident", incident.identityKey),
+            id: safeId(INCIDENT_ID_PREFIX, incident.identityKey),
             serviceId: incident.serviceId,
             eventId: incident.eventId ?? incident.incomingEventId ?? incident.identityKey,
             path: incident.classification,
@@ -799,7 +809,7 @@ export class CosmosEventStore {
         return rows;
     }
     async eventOps(serviceId, eventId) {
-        const row = await this.client.read(this.containers.events, safeId("event-ops", eventId), eventPk(serviceId, eventId));
+        const row = await this.client.read(this.containers.events, safeId(EVENT_OPS_ID_PREFIX, eventId), eventPk(serviceId, eventId));
         return row?.document;
     }
     async mutateEvent(message, eventTags, eventType, timestamp, metadata) {
@@ -847,7 +857,7 @@ export class CosmosEventStore {
         throw new Error("Cosmos event CAS did not converge");
     }
     async mutateEventOps(message, arrivedAt, lagMs) {
-        const id = safeId("event-ops", message.eventId);
+        const id = safeId(EVENT_OPS_ID_PREFIX, message.eventId);
         const pk = eventPk(message.serviceId, message.eventId);
         const nextArrival = {
             serviceId: message.serviceId,

package/dist/store/PostgresEventStore.d.ts

@@ -1,5 +1,17 @@
 import type { DeliverySource, DownstreamOutboxMessage } from "../downstream/types";
 import { type DeliveryIncident, type DeliveryOutcome, type DetectorStore, type EventStore, type InconsistencyClassification, type InconsistencyFinding, type PendingArrivalRecord, type ProjectionCheckpoint, type ProjectionCheckpointAdvance, type ProjectionLag, type ProjectionStore, type StoredEvent } from "./types";
+export interface LogicalProviderEvent {
+    readonly serviceId: string;
+    readonly id: string;
+    readonly sortableUniqueId: string;
+    readonly eventType: string;
+    readonly payload: string;
+    readonly tags: readonly string[];
+    readonly timestamp: string;
+    readonly causationId: string | null;
+    readonly correlationId: string | null;
+    readonly executedUser: string | null;
+}
 /**
  * `postgres` exposes an ESM/workerd build. The deployed Worker passes a
  * Hyperdrive connection string; local Miniflare passes Docker PostgreSQL.
@@ -12,6 +24,14 @@ export declare class PostgresEventStore implements EventStore, DetectorStore, Pr
     /** Close an owned request/test client without touching durable records. */
     close(): Promise<void>;
     recordDelivery(message: DownstreamOutboxMessage, arrivedAt: number, deliverySource?: DeliverySource): Promise<DeliveryOutcome>;
+    /**
+     * DDL columns only. C# rows have no provenance and no allocator lineage;
+     * this read must not invent either, and it must not treat Tags as
+     * committed membership.
+     */
+    readLogicalEvents(serviceId: string): Promise<LogicalProviderEvent[]>;
+    /** Insert one DDL row. Does not write dcb_event_ops or a provenance stamp. */
+    appendLogicalEvent(event: LogicalProviderEvent): Promise<void>;
     readAllEvents(serviceId: string, since: string): Promise<StoredEvent[]>;
     currentLagBound(serviceId: string, nowMs?: number): Promise<number>;
     listProjectionTags(serviceId: string): Promise<string[]>;

package/dist/store/PostgresEventStore.js

@@ -480,6 +480,59 @@ export class PostgresEventStore {
             ? { outcome, kind: "stored", event: stored }
             : { outcome, kind: outcome, incident: incident };
     }
+    /**
+     * DDL columns only. C# rows have no provenance and no allocator lineage;
+     * this read must not invent either, and it must not treat Tags as
+     * committed membership.
+     */
+    async readLogicalEvents(serviceId) {
+        const rows = await this.query(`SELECT "ServiceId" AS service_id, "Id"::text AS event_id,
+              "SortableUniqueId" AS suid, "Payload"::text AS payload,
+              "EventType" AS event_type, "Tags" AS event_tags,
+              "Timestamp"::text AS timestamp, "CausationId" AS causation_id,
+              "CorrelationId" AS correlation_id, "ExecutedUser" AS executed_user
+         FROM dcb_events
+        WHERE "ServiceId" = $1
+        ORDER BY "SortableUniqueId" ASC, "Id" ASC`, [serviceId]);
+        return rows.map((row) => ({
+            serviceId: asString(row.service_id, "service_id"),
+            id: asString(row.event_id, "event_id"),
+            sortableUniqueId: asString(row.suid, "suid"),
+            eventType: asString(row.event_type, "event_type"),
+            payload: asString(row.payload, "payload"),
+            tags: asStringArray(row.event_tags, "event_tags"),
+            timestamp: canonicalUtcTimestamp(row.timestamp, "timestamp"),
+            causationId: nullableString(row.causation_id, "causation_id"),
+            correlationId: nullableString(row.correlation_id, "correlation_id"),
+            executedUser: nullableString(row.executed_user, "executed_user"),
+        }));
+    }
+    /** Insert one DDL row. Does not write dcb_event_ops or a provenance stamp. */
+    async appendLogicalEvent(event) {
+        JSON.parse(event.payload);
+        assertSortableUniqueId(event.sortableUniqueId);
+        if (!isRfc4122Uuid(event.id)) {
+            throw new CanonicalEventIdentityConflictError("postgres", event.id, "logical event id must be an RFC 4122 UUID");
+        }
+        assertUtcTimestamp(event.timestamp, event.id);
+        const sql = this.requireSql();
+        await sql.begin(async (transaction) => {
+            await transaction.unsafe(`INSERT INTO dcb_events
+           ("ServiceId", "Id", "SortableUniqueId", "EventType", "Payload", "Tags", "Timestamp", "CausationId", "CorrelationId", "ExecutedUser")
+         VALUES ($1, $2::uuid, $3, $4, $5::text::json, $6::text::jsonb, $7::timestamptz, $8, $9, $10)`, [
+                event.serviceId,
+                event.id,
+                event.sortableUniqueId,
+                event.eventType,
+                event.payload,
+                JSON.stringify(event.tags),
+                event.timestamp,
+                event.causationId,
+                event.correlationId,
+                event.executedUser,
+            ]);
+        });
+    }
     async readAllEvents(serviceId, since) {
         if (since.length !== 0)
             assertSortableUniqueId(since);

package/dist/store/provider.d.ts

@@ -6,6 +6,10 @@ export interface StoreProviderEnvironment {
     readonly HYPERDRIVE?: {
         readonly connectionString?: string;
     };
+    /** Experimental Cosmos deployment values; the key is a secret binding. */
+    readonly COSMOS_ENDPOINT?: string;
+    readonly COSMOS_DATABASE?: string;
+    readonly COSMOS_KEY?: string;
     /** Explicit opt-in D1 binding; the default provider never requires it. */
     readonly D1?: D1Database;
     /** Separate opt-in MV D1 binding; never used by the PipelineStore provider. */

package/dist/tag/TagDurableObject.js

@@ -7,7 +7,7 @@ import { CANONICAL_UTC_TIMESTAMP_PATTERN, isRfc4122Uuid, isUuidV7, serializedEve
 import { DurableObjectActivation, enterNativeActorHandleSpan, noOpNativeTracing, } from "../trace/CommitTrace";
 import { beginDurableObjectHandlerObservation, } from "../trace/ObservationStream";
 import { canonicalDeclaredTagSet, eventDigestBytes, eventDigestHex } from "./EventDigest";
-import { hasTagSqlStorage, initializeTagSqlSchema, TAG_READ_AFTER_SQL, TAG_READ_AFTER_THROUGH_SQL, } from "./TagSqlSchema";
+import { ensureTagCommitReceiptWrittenVersion, hasTagSqlStorage, initializeTagSqlSchema, TAG_READ_AFTER_SQL, TAG_READ_AFTER_THROUGH_SQL, } from "./TagSqlSchema";
 import { G43SqlMeasurement } from "./TagSqlMeasurement";
 import { recordDurableHop } from "../diagnostics/G60DurableHop";
 import { recordG65AdmissionAttempt } from "../diagnostics/G65Admission";
@@ -1723,6 +1723,7 @@ export class TagDurableObject {
         const sql = this.sqlStorage();
         if (sql === undefined)
             throw new Error("Tag SQL storage is unavailable");
+        ensureTagCommitReceiptWrittenVersion(sql);
         const existing = sql.exec("SELECT tag FROM tag_identity WHERE singleton = 1").toArray()[0];
         if (existing !== undefined) {
             if (sqlString(existing.tag, "tag_identity.tag") !== tag)
@@ -1807,17 +1808,18 @@ export class TagDurableObject {
         sql.exec("UPDATE tag_control SET head_suid = ?, version = ?, updated_at = ? WHERE singleton = 1", head, version, committedAt);
         sql.exec("UPDATE tag_head SET service_id = ?, head_suid = ? WHERE singleton = 1", serviceId, head);
     }
-    writeCommittedSqlReceipt(sql, input, committedAt, eventCount, head, confirmsReservation) {
+    writeCommittedSqlReceipt(sql, input, committedAt, eventCount, head, confirmsReservation, writtenVersion) {
         sql.exec(`
       INSERT INTO tag_commit_receipt
-        (attempt_id, epoch, committed_at, committed_event_count, head_suid, reservation_confirmed)
-      VALUES (?, ?, ?, ?, ?, ?)
+        (attempt_id, epoch, committed_at, committed_event_count, head_suid, reservation_confirmed, written_version)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(attempt_id, epoch) DO UPDATE SET
         committed_at = excluded.committed_at,
         committed_event_count = excluded.committed_event_count,
         head_suid = excluded.head_suid,
-        reservation_confirmed = excluded.reservation_confirmed
-    `, input.attemptId, input.epoch, committedAt, eventCount, head, confirmsReservation ? 1 : 0);
+        reservation_confirmed = excluded.reservation_confirmed,
+        written_version = excluded.written_version
+    `, input.attemptId, input.epoch, committedAt, eventCount, head, confirmsReservation ? 1 : 0, writtenVersion);
     }
     /**
      * The normal append path deliberately probes only the indexed rows it needs
@@ -1868,8 +1870,35 @@ export class TagDurableObject {
                 return { event, obligation, exact };
             });
             // Exact duplicate replay precedes all epoch/token checks by contract.
+            // SDT-G36: replay the stored write transaction's own pair. Never mint
+            // a timestamp and never substitute the current head version.
             if (existingCandidates.every(({ exact }) => exact)) {
-                return { status: 200, body: { status: "duplicate", version } };
+                // Exact duplicate is before the epoch check, so a replay may name a
+                // different epoch than the write that stored the receipt. Prefer the
+                // caller's epoch, then the receipt whose head is this batch, then the
+                // sole receipt for the attempt. A missing or NULL written_version
+                // still fails closed.
+                const receipts = sql.exec(`
+          SELECT epoch, committed_at, written_version, head_suid FROM tag_commit_receipt
+          WHERE attempt_id = ?
+        `, input.attemptId).toArray();
+                const sameEpoch = receipts.find((row) => sqlNumber(row.epoch, "tag_commit_receipt.epoch") === input.epoch);
+                const replayHead = input.candidates.at(-1)?.suid;
+                const byHead = replayHead === undefined
+                    ? []
+                    : receipts.filter((row) => sqlString(row.head_suid, "tag_commit_receipt.head_suid") === replayHead);
+                const receipt = sameEpoch ?? (byHead.length === 1 ? byHead[0] : undefined) ?? (receipts.length === 1 ? receipts[0] : undefined);
+                if (receipt === undefined) {
+                    await this.rearmScheduler(txn);
+                    return { ...rejected("duplicate_receipt_missing"), body: { ...rejected("duplicate_receipt_missing").body, version } };
+                }
+                const storedAt = sqlNullableString(receipt.committed_at, "tag_commit_receipt.committed_at");
+                const storedVersion = sqlNullableNumber(receipt.written_version, "tag_commit_receipt.written_version");
+                if (storedAt === null || storedVersion === null) {
+                    await this.rearmScheduler(txn);
+                    return { ...rejected("duplicate_receipt_unknown"), body: { ...rejected("duplicate_receipt_unknown").body, version } };
+                }
+                return { status: 200, body: { status: "duplicate", version: storedVersion, updatedAt: storedAt } };
             }
             const active = sql.exec("SELECT * FROM tag_reservation WHERE singleton = 1").toArray()[0];
             const now = sqlNullableNumber(control.clock_now_ms, "tag_control.clock_now_ms") ??
@@ -1976,7 +2005,7 @@ export class TagDurableObject {
             if (input.faultInjection === "after-append-before-confirm") {
                 throw new AppendTransactionFault("Simulated interruption before atomic commit receipt");
             }
-            this.writeCommittedSqlReceipt(sql, input, committedAt, events.length, head, confirmsReservation);
+            this.writeCommittedSqlReceipt(sql, input, committedAt, events.length, head, confirmsReservation, version + 1);
             if (confirmsReservation)
                 sql.exec("DELETE FROM tag_reservation WHERE singleton = 1");
             await this.rearmScheduler(txn);
@@ -1986,6 +2015,7 @@ export class TagDurableObject {
                     status: "appended",
                     fenceGate: { checked: true, activeFenceCount: 0 },
                     version: version + 1,
+                    updatedAt: committedAt,
                 },
                 hopFacts,
             };
@@ -2360,12 +2390,13 @@ export class TagDurableObject {
       `, eventServiceId, outbox.eventId, outbox.attemptId, outbox.suid, outbox.payload, outbox.allocatorLineageId, outbox.eventType, outbox.provenance, outbox.timestamp, artifact.canonicalBytes, artifact.eventDigest, artifact.declaredTagSet, artifact.localMembership, Date.now());
             this.upsertSourcePartitionRegistration(sql, eventServiceId, record.tag, outbox.eventId);
         }
+        ensureTagCommitReceiptWrittenVersion(sql);
         for (const confirmation of record.confirmations) {
             sql.exec(`
         INSERT OR IGNORE INTO tag_commit_receipt
-          (attempt_id, epoch, committed_at, committed_event_count, head_suid, reservation_confirmed)
-        VALUES (?, ?, ?, ?, ?, 1)
-      `, confirmation.attemptId, confirmation.epoch, record.updatedAt, record.events.filter((event) => event.attemptId === confirmation.attemptId).length, record.head);
+          (attempt_id, epoch, committed_at, committed_event_count, head_suid, reservation_confirmed, written_version)
+        VALUES (?, ?, ?, ?, ?, 1, ?)
+      `, confirmation.attemptId, confirmation.epoch, record.updatedAt, record.events.filter((event) => event.attemptId === confirmation.attemptId).length, record.head, record.version);
         }
     }
     nextSqlAlarmDue() {
@@ -2764,7 +2795,21 @@ export class TagDurableObject {
                 let record = loaded.record;
                 // Required order begins here: exact duplicate is before any epoch or token check.
                 if (batchIsExactDuplicate(record, input)) {
-                    return { status: 200, body: { status: "duplicate", version: record.version } };
+                    const receipts = record.writeReceipts ?? {};
+                    const sameEpoch = receipts[`${input.attemptId}:${input.epoch}`];
+                    const forAttempt = Object.entries(receipts).filter(([key]) => key.startsWith(`${input.attemptId}:`));
+                    const replayHead = input.candidates.at(-1)?.suid;
+                    const byHead = replayHead === undefined
+                        ? []
+                        : forAttempt.filter(([, value]) => value.headSuid === replayHead);
+                    const receipt = sameEpoch ?? (byHead.length === 1 ? byHead[0]?.[1] : undefined) ?? (forAttempt.length === 1 ? forAttempt[0]?.[1] : undefined);
+                    if (receipt === undefined) {
+                        return {
+                            ...rejected("duplicate_receipt_unknown"),
+                            body: { ...rejected("duplicate_receipt_unknown").body, version: record.version },
+                        };
+                    }
+                    return { status: 200, body: { status: "duplicate", version: receipt.version, updatedAt: receipt.updatedAt } };
                 }
                 const expiry = expireReservation(record);
                 record = expiry.record;
@@ -2852,10 +2897,17 @@ export class TagDurableObject {
                         ? withMaxEpoch(record.confirmations, input.attemptId, input.epoch)
                         : record.confirmations,
                 });
-                await this.write(txn, updated, serviceId ?? "");
+                const recorded = {
+                    ...updated,
+                    writeReceipts: {
+                        ...(record.writeReceipts ?? {}),
+                        [`${input.attemptId}:${input.epoch}`]: { version: updated.version, updatedAt: updated.updatedAt, headSuid: updated.head },
+                    },
+                };
+                await this.write(txn, recorded, serviceId ?? "");
                 return {
                     status: 201,
-                    body: { status: "appended", fenceGate, version: updated.version },
+                    body: { status: "appended", fenceGate, version: recorded.version, updatedAt: recorded.updatedAt },
                 };
             });
             const response = json(result.body, result.status);