amalgm 0.1.175 → 0.1.176

package/lib/shared-realtime-tunnel.js

@@ -282,26 +282,38 @@ function createSharedRealtimeTunnel({
     if (repoUploadInflight.size === 0) {
       const result = await localStateJson('POST', '/state/repo-objects/uploads/claim', {});
       const upload = result?.upload;
-      if (upload?.sha256 && upload?.dataBase64) {
+      if (upload?.resourceId && upload?.sha256 && upload?.dataBase64) {
         const requestId = `repo_put_${crypto.randomBytes(12).toString('hex')}`;
         if (sendLarge({
           type: 'repo.object.put',
           request_id: requestId,
+          resource_id: upload.resourceId,
           sha256: upload.sha256,
           bytes: upload.bytes,
           data_b64: upload.dataBase64,
         })) {
-          repoUploadInflight.set(requestId, upload.sha256);
+          repoUploadInflight.set(requestId, {
+            resourceId: upload.resourceId,
+            sha256: upload.sha256,
+          });
         }
       }
     }
     if (repoDownloadInflight.size === 0) {
       const result = await localStateJson('POST', '/state/repo-objects/downloads/claim', {});
       const download = result?.download;
-      if (download?.sha256) {
+      if (download?.resourceId && download?.sha256) {
         const requestId = `repo_get_${crypto.randomBytes(12).toString('hex')}`;
-        if (send({ type: 'repo.object.get', request_id: requestId, sha256: download.sha256 })) {
-          repoDownloadInflight.set(requestId, download.sha256);
+        if (send({
+          type: 'repo.object.get',
+          request_id: requestId,
+          resource_id: download.resourceId,
+          sha256: download.sha256,
+        })) {
+          repoDownloadInflight.set(requestId, {
+            resourceId: download.resourceId,
+            sha256: download.sha256,
+          });
         }
       }
     }
@@ -450,9 +462,12 @@ function createSharedRealtimeTunnel({
   }
 
   function handleRepoObjectStored(frame) {
-    const digest = repoUploadInflight.get(frame.request_id);
-    if (!digest || digest !== frame.sha256) return;
-    void localStateJson('POST', '/state/repo-objects/uploads/ack', { sha256: digest })
+    const object = repoUploadInflight.get(frame.request_id);
+    if (!object || object.sha256 !== frame.sha256) return;
+    void localStateJson('POST', '/state/repo-objects/uploads/ack', {
+      resourceId: object.resourceId,
+      sha256: object.sha256,
+    })
       .then(() => {
         repoUploadInflight.delete(frame.request_id);
         scheduleRepoObjects();
@@ -464,16 +479,17 @@ function createSharedRealtimeTunnel({
   }
 
   function handleRepoObjectData(frame) {
-    const digest = repoDownloadInflight.get(frame.request_id);
-    if (!digest || digest !== frame.sha256) return;
+    const object = repoDownloadInflight.get(frame.request_id);
+    if (!object || object.sha256 !== frame.sha256) return;
     void localStateJson('POST', '/state/repo-objects/downloads/receive', {
-      sha256: digest,
+      resourceId: object.resourceId,
+      sha256: object.sha256,
       dataBase64: frame.data_b64,
     }).then(() => {
       repoDownloadInflight.delete(frame.request_id);
       scheduleRepoObjects();
     }).catch((error) => {
-      warn(`repo object ${digest} was not stored locally: ${error?.message || error}`);
+      warn(`repo object ${object.sha256} was not stored locally: ${error?.message || error}`);
       repoDownloadInflight.delete(frame.request_id);
       scheduleRepoObjects(RETRY_MS);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.175",
+  "version": "0.1.176",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/index.js

@@ -132,7 +132,7 @@ async function boot() {
   require('./workspace/tree-store').startTreeEnrollmentService();
   require('./workspace/wall').startWallService();
   require('./workspace/checkpoint').startCheckpointService();
-  require('./workspace/reconcile').startWorkspaceReconciler();
+  require('./workspace/reducer').startWorkspaceReducer();
 
   await startRegisteredApps();
   startAppRouteSyncLoop();

package/runtime/scripts/amalgm-mcp/server/routes/state.js

@@ -53,7 +53,10 @@ async function handleStateRoutes(ctx) {
     }
     if (ctx.pathname === '/state/repo-objects/uploads/ack') {
       const body = await ctx.readJsonBody();
-      ctx.sendJson(200, require('../../workspace/objects').acknowledgeUpload(body?.sha256));
+      ctx.sendJson(200, require('../../workspace/objects').acknowledgeUpload(
+        body?.resourceId,
+        body?.sha256,
+      ));
       return true;
     }
     if (ctx.pathname === '/state/repo-objects/downloads/claim') {
@@ -63,6 +66,7 @@ async function handleStateRoutes(ctx) {
     if (ctx.pathname === '/state/repo-objects/downloads/receive') {
       const body = await ctx.readJsonBody();
       ctx.sendJson(200, require('../../workspace/objects').receiveDownload(
+        body?.resourceId,
         body?.sha256,
         body?.dataBase64,
       ));

package/runtime/scripts/amalgm-mcp/server/routes/workspace.js

@@ -63,6 +63,10 @@ async function handleWorkspaceRoutes(ctx) {
     workspaceRest.handleWorkspaceSyncStats(ctx.sendJson);
     return true;
   }
+  if (ctx.pathname === '/workspace/sync/project' && ctx.method === 'POST') {
+    workspaceRest.handleCodeProjectJoin(await ctx.readJsonBody(), ctx.sendJson);
+    return true;
+  }
   if (ctx.pathname === '/workspace/machines' && ctx.method === 'GET') {
     workspaceRest.handleWorkspaceMachines(ctx.sendJson);
     return true;

package/runtime/scripts/amalgm-mcp/state/docs.js

@@ -294,11 +294,11 @@ function isLowSurrogate(code) {
  * API caller got no acknowledgement and retries). Returns null when the text
  * is already current.
  */
-function spliceDocText(Y, entry, nextText, source) {
+function spliceDocText(Y, entry, nextText, source, mutationId = newMutationId()) {
   const origin = { amalgmMutation: true, source, patch: null };
   const changed = spliceTextInto(Y, entry.doc, entry.doc.getText(TEXT_KEY), nextText, origin);
   if (!changed) return null;
-  return { mutationId: newMutationId(), update: origin.patch.yjs, bytes: null };
+  return { mutationId, update: origin.patch.yjs, bytes: null };
 }
 
 function canCurrentUserEditDoc(entry) {
@@ -931,13 +931,19 @@ function writeDocText(pathInput, textInput, options = {}) {
   if (Buffer.byteLength(textInput, 'utf8') > MAX_DOC_BYTES) {
     throw invalid(`"text" exceeds the ${MAX_DOC_BYTES}-byte live document limit`, 413);
   }
-  const { baseHash, baseSeq } = options;
+  const { baseHash, baseSeq, mutationId } = options;
   if (baseHash !== undefined && !(typeof baseHash === 'string' && /^[0-9a-f]{64}$/.test(baseHash))) {
     throw invalid(`"baseHash" must be the lowercase sha256 hex (64 chars) of the exact text you read — the "sha256" field returned by open/write, e.g. ${WRITE_EXAMPLE} (got ${JSON.stringify(baseHash)})`);
   }
   if (baseSeq !== undefined && !(Number.isInteger(baseSeq) && baseSeq >= 0)) {
     throw invalid(`"baseSeq" must be the non-negative integer event seq at which you read the doc, e.g. {"path": "notes.md", "text": "...", "baseSeq": 42} (got ${JSON.stringify(baseSeq)})`);
   }
+  if (
+    mutationId !== undefined
+    && !(typeof mutationId === 'string' && /^[A-Za-z0-9_-]{16,160}$/.test(mutationId))
+  ) {
+    throw invalid('"mutationId" must be a stable opaque id using letters, numbers, _ or -');
+  }
 
   const entry = loadDocEntry(pathInput);
   entry.lastAccess = Date.now();
@@ -951,11 +957,12 @@ function writeDocText(pathInput, textInput, options = {}) {
   const ytext = entry.doc.getText(TEXT_KEY);
   const ours = ytext.toString();
 
-  const respond = (merge, finalText, conflict) => ({
+  const respond = (merge, finalText, conflict, committedMutationId = null) => ({
     merge,
     seq: currentSeq(),
     sha256: hashText(finalText),
     conflict: conflict || null,
+    mutationId: committedMutationId,
   });
 
   if (textInput === ours) return respond('noop', ours, null);
@@ -1011,10 +1018,10 @@ function writeDocText(pathInput, textInput, options = {}) {
   }
 
   entry.pendingConflict = conflict;
-  const edit = spliceDocText(Y, entry, nextText, 'doc:write');
+  const edit = spliceDocText(Y, entry, nextText, 'doc:write', mutationId);
   if (edit) commitDocMutation(Y, entry, edit, 'doc:write');
   else publishConflictOnly(entry, 'doc:write');
-  return respond(merge, nextText, conflict);
+  return respond(merge, nextText, conflict, edit?.mutationId || null);
 }
 
 function normalizeDocMutations(Y, mutationsInput) {

package/runtime/scripts/amalgm-mcp/state/migrations.js

@@ -135,10 +135,6 @@ function migrateWorkspaceIds(database) {
         SET id = ?, workspace_json = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
         WHERE id = ?
       `).run(workspaceId, JSON.stringify(workspaceJson), row.id);
-      database.prepare(`
-        INSERT OR IGNORE INTO workspace_id_aliases(alias_id, workspace_id)
-        VALUES (?, ?)
-      `).run(row.id, workspaceId);
       database.prepare('UPDATE project_context SET project_id = ? WHERE project_id = ?')
         .run(workspaceId, row.id);
     }

package/runtime/scripts/amalgm-mcp/state/mutations.js

@@ -700,8 +700,9 @@ function acknowledgeCloudMutation(sharedResourceIdInput, mutationIdInput, acknow
     64,
   );
   const database = options.database || openLocalDb();
+  let event = null;
 
-  return database.transaction(() => {
+  const result = database.transaction(() => {
     const row = findCloudMutationRow(database, sharedResourceId, mutationId);
     if (!row) throw invalid(`unknown shared mutation ${mutationId}`, 404);
     if (row.mutation_state === 'synced') {
@@ -726,6 +727,15 @@ function acknowledgeCloudMutation(sharedResourceIdInput, mutationIdInput, acknow
       WHERE journal_id = ?
     `).run(version, committedAt, now, row.journal_id);
     advanceReplicaCursor(database, sharedResourceId);
+    event = insertStateEvent(database, {
+      resource: 'shared-mutations',
+      op: 'ack',
+      id: mutationId,
+      mutationId,
+      sharedResourceId,
+      resourceVersion: version,
+      source: 'cloud-ack',
+    });
     trace('cloud-ack', { mutationId, shared: sharedResourceId, version });
     return {
       mutation: normalizeJournalRow(
@@ -735,6 +745,8 @@ function acknowledgeCloudMutation(sharedResourceIdInput, mutationIdInput, acknow
       duplicate: false,
     };
   })();
+  if (event) publishStateEvent(event);
+  return { ...result, event };
 }
 
 function failCloudMutation(sharedResourceIdInput, mutationIdInput, failure, options = {}) {

package/runtime/scripts/amalgm-mcp/state/shared-rest.js

@@ -118,10 +118,34 @@ async function handleWorkspaceContentDiscover(body, sendJson) {
 
 async function handlePromotionStart(body, sendJson) {
   try {
+    const requestedResourceId = typeof body?.resourceId === 'string' && body.resourceId.trim()
+      ? body.resourceId.trim()
+      : null;
+    const requestedNodeId = requestedResourceId
+      && require('../workspace/tree/identity').isUuid(requestedResourceId)
+      ? requestedResourceId.toLowerCase()
+      : null;
+    if (!requestedResourceId || requestedNodeId) {
+      require('../workspace/tree-store').ensureNodeForPath(body?.path);
+    }
     const opened = require('./docs').openDoc(body?.path);
+    if (!requestedResourceId && !opened.nodeId) {
+      const error = new Error('document must belong to an enrolled workspace before it can be shared');
+      error.code = 'workspace_identity_required';
+      error.statusCode = 409;
+      throw error;
+    }
+    if (requestedNodeId && opened.nodeId !== requestedNodeId) {
+      const error = new Error('resourceId must equal the document node UUID');
+      error.code = 'workspace_identity_mismatch';
+      error.statusCode = 409;
+      throw error;
+    }
     const result = require('./promotions').enqueuePromotion({
       promotionId: body?.promotionId || `prm_${crypto.randomBytes(16).toString('base64url')}`,
-      resourceId: body?.resourceId || opened.nodeId || `shr_${crypto.randomBytes(18).toString('base64url')}`,
+      // Workspace documents never acquire a second cloud identity. Explicit
+      // non-UUID ids remain available to internal protocol resources.
+      resourceId: requestedResourceId || opened.nodeId,
       localResource: opened.resource,
       localPath: opened.path,
       contract: body?.contract || 'text-yjs@1',

package/runtime/scripts/amalgm-mcp/tests/state-mutations.test.js

@@ -187,6 +187,10 @@ test('materialization failure stays durable but invisible until recovery complet
 
 test('shared rows alone form the leased cloud outbox and acknowledgements deduplicate', () => {
   const db = openLocalDb();
+  const acknowledgedEvents = [];
+  const unsubscribe = subscribeStateEvents((event) => {
+    if (event.resource === 'shared-mutations') acknowledgedEvents.push(event);
+  });
   const result = commitLocalMutation(sharedInput, {
     database: db,
     materialize() {},
@@ -248,6 +252,11 @@ test('shared rows alone form the leased cloud outbox and acknowledgements dedupl
     { database: db },
   );
   assert.equal(duplicate.duplicate, true);
+  unsubscribe();
+  assert.equal(acknowledgedEvents.length, 1);
+  assert.equal(acknowledgedEvents[0].mutationId, sharedInput.mutationId);
+  assert.equal(acknowledgedEvents[0].sharedResourceId, sharedResourceId);
+  assert.equal(acknowledgedEvents[0].version, 1);
   assert.equal(claimCloudMutations({ database: db }).length, 0);
 });
 

package/runtime/scripts/amalgm-mcp/tests/state-promotion-ownership.test.js

@@ -28,6 +28,9 @@ fs.writeFileSync(
 
 const { closeLocalDb } = require('../state/db');
 const { handlePromotionStart } = require('../state/shared-rest');
+const { upsertWorkspace } = require('../workspace/store');
+const { enrollWorkspace, nodeForPath } = require('../workspace/tree-store');
+const { isUuidV7, uuidV7 } = require('../workspace/tree/identity');
 
 test.after(() => {
   closeLocalDb();
@@ -43,9 +46,9 @@ async function run(cwd, ...args) {
 }
 
 /** Run the handler, capture what it would send over the wire. */
-async function promote(filePath) {
+async function promote(filePath, input = {}) {
   let sent;
-  await handlePromotionStart({ path: filePath }, (statusCode, payload) => {
+  await handlePromotionStart({ path: filePath, ...input }, (statusCode, payload) => {
     sent = { statusCode, payload };
   });
   return sent;
@@ -59,9 +62,13 @@ test('a git-tracked text file promotes through the document rail', async () => {
   fs.writeFileSync(tracked, '# tracked\n');
   await run(repo, 'add', '.');
   await run(repo, 'commit', '-m', 'initial');
+  const workspace = upsertWorkspace({ path: repo, name: 'Repo', source: 'computer' });
+  enrollWorkspace(workspace.id);
 
   const { statusCode, payload } = await promote(tracked);
   assert.equal(statusCode, 202, JSON.stringify(payload));
+  assert.equal(payload.promotion.resourceId, nodeForPath(tracked).node.id);
+  assert.equal(isUuidV7(payload.promotion.resourceId), true);
 });
 
 test('an untracked file inside a repo has no git owner and promotes', async () => {
@@ -71,12 +78,32 @@ test('an untracked file inside a repo has no git owner and promotes', async () =
 
   const { statusCode, payload } = await promote(untracked);
   assert.equal(statusCode, 202, JSON.stringify(payload));
+  assert.equal(payload.promotion.resourceId, nodeForPath(untracked).node.id);
+  assert.equal(isUuidV7(payload.promotion.resourceId), true);
 });
 
-test('a file outside any repository promotes', async () => {
+test('a user document outside an enrolled workspace never receives a fallback shared id', async () => {
   const loose = path.join(tempRoot, 'loose.md');
   fs.writeFileSync(loose, '# loose\n');
 
   const { statusCode, payload } = await promote(loose);
+  assert.equal(statusCode, 409, JSON.stringify(payload));
+  assert.equal(payload.code, 'workspace_identity_required');
+});
+
+test('an explicit workspace resource id must equal the local document UUID', async () => {
+  const tracked = path.join(tempRoot, 'repo', 'README.md');
+  const { statusCode, payload } = await promote(tracked, { resourceId: uuidV7() });
+  assert.equal(statusCode, 409, JSON.stringify(payload));
+  assert.equal(payload.code, 'workspace_identity_mismatch');
+});
+
+test('internal protocol documents may retain an explicit shared-resource namespace', async () => {
+  const protocolFile = path.join(tempRoot, 'machine-card.json');
+  fs.writeFileSync(protocolFile, '{}\n');
+
+  const resourceId = 'shr_machine_card_test_0001';
+  const { statusCode, payload } = await promote(protocolFile, { resourceId });
   assert.equal(statusCode, 202, JSON.stringify(payload));
+  assert.equal(payload.promotion.resourceId, resourceId);
 });

package/runtime/scripts/amalgm-mcp/tests/workspace-cards-store.test.js

@@ -85,21 +85,20 @@ test('refresh cards the tracked world once, and a no-change refresh writes nothi
   assert.equal(cardEvents().length, eventsAfterFirst.length);
 });
 
-test('working-tree changes preserve the committed-position clock', async () => {
+test('repo cards contain observations, not a machine-clock ordering field', async () => {
   const repo = path.join(tempRoot, 'projects/app');
   const before = findCard(listRepoCards(), repo);
-  assert.equal(before.positionAt, before.observedAt);
+  assert.equal(Object.hasOwn(before, 'positionAt'), false);
 
   fs.writeFileSync(path.join(repo, 'position.txt'), 'working tree\n');
   const dirty = findCard((await refreshRepoCards()).cards, repo);
-  assert.equal(dirty.positionAt, before.positionAt);
+  assert.equal(Object.hasOwn(dirty, 'positionAt'), false);
 
   await run(repo, 'add', 'position.txt');
   await run(repo, 'commit', '-m', 'move committed position');
   const committed = findCard((await refreshRepoCards()).cards, repo);
   assert.notEqual(committed.head.oid, before.head.oid);
-  assert.equal(committed.positionAt, committed.observedAt);
-  assert.notEqual(committed.positionAt, before.positionAt);
+  assert.equal(Object.hasOwn(committed, 'positionAt'), false);
 });
 
 test('a 4,000-file branch switch is exactly one generation bump and one event', async () => {

package/runtime/scripts/amalgm-mcp/tests/workspace-checkpoint-reducer.test.js

@@ -0,0 +1,91 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFile } = require('child_process');
+const { promisify } = require('util');
+
+const execFileAsync = promisify(execFile);
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-checkpoint-reducer-'));
+const merge = require('../workspace/merge');
+
+test.after(() => fs.rmSync(root, { recursive: true, force: true }));
+
+async function git(cwd, ...args) {
+  const { stdout } = await execFileAsync(
+    'git',
+    ['-c', 'user.email=test@amalgm.test', '-c', 'user.name=Amalgm Test', '-c', 'commit.gpgsign=false', ...args],
+    { cwd, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' } },
+  );
+  return stdout;
+}
+
+async function makeRepo(name) {
+  const repo = path.join(root, name);
+  fs.mkdirSync(repo, { recursive: true });
+  await git(repo, 'init', '-b', 'main');
+  fs.writeFileSync(path.join(repo, 'a.txt'), 'a0\n');
+  fs.writeFileSync(path.join(repo, 'b.txt'), 'b0\n');
+  fs.writeFileSync(path.join(repo, 'same.txt'), 'line 1\nline 2\n');
+  await git(repo, 'add', '.');
+  await git(repo, 'commit', '-m', 'base');
+  const oid = (await git(repo, 'rev-parse', 'HEAD')).trim();
+  const tree = await merge.treeOf(repo, oid);
+  return { repo, oid, tree };
+}
+
+async function patchFor(repo, edits) {
+  for (const [name, content] of Object.entries(edits)) {
+    fs.writeFileSync(path.join(repo, name), content);
+  }
+  const diff = await git(repo, 'diff', 'HEAD', '--binary', '--full-index');
+  await git(repo, 'reset', '--hard', 'HEAD');
+  return diff;
+}
+
+async function treeText(repo, tree, file) {
+  return git(repo, 'show', `${tree}:${file}`);
+}
+
+test('rail-ordered checkpoint transitions combine and a later revert removes only its change', async () => {
+  const { repo, oid, tree: clean } = await makeRepo('combine');
+  const patchA = await patchFor(repo, { 'a.txt': 'a1\n' });
+  const patchB = await patchFor(repo, { 'b.txt': 'b1\n' });
+  const treeA = await merge.treeOfPatch(repo, oid, patchA);
+  const treeB = await merge.treeOfPatch(repo, oid, patchB);
+
+  const afterA = await merge.reduceTree(repo, clean, clean, treeA, { label: '1' });
+  const afterB = await merge.reduceTree(repo, afterA.tree, clean, treeB, { label: '2' });
+  assert.equal(await treeText(repo, afterB.tree, 'a.txt'), 'a1\n');
+  assert.equal(await treeText(repo, afterB.tree, 'b.txt'), 'b1\n');
+  assert.deepEqual(afterB.conflicts, []);
+
+  // A's next operation says "from A+B to B": the reducer can remove A even
+  // though B's latest checkpoint already incorporated A.
+  const reverted = await merge.reduceTree(repo, afterB.tree, afterB.tree, treeB, { label: '3' });
+  assert.equal(await treeText(repo, reverted.tree, 'a.txt'), 'a0\n');
+  assert.equal(await treeText(repo, reverted.tree, 'b.txt'), 'b1\n');
+});
+
+test('an overlapping transition produces deterministic conflict bytes', async () => {
+  const { repo, oid, tree: clean } = await makeRepo('conflict');
+  const leftPatch = await patchFor(repo, { 'same.txt': 'left\nline 2\n' });
+  const rightPatch = await patchFor(repo, { 'same.txt': 'right\nline 2\n' });
+  const left = await merge.treeOfPatch(repo, oid, leftPatch);
+  const right = await merge.treeOfPatch(repo, oid, rightPatch);
+
+  const current = await merge.reduceTree(repo, clean, clean, left, { label: '10' });
+  const first = await merge.reduceTree(repo, current.tree, clean, right, { label: '11' });
+  const second = await merge.reduceTree(repo, current.tree, clean, right, { label: '11' });
+
+  assert.equal(first.tree, second.tree);
+  assert.deepEqual(first.conflicts, second.conflicts);
+  assert.equal(first.conflicts[0].kind, 'content-overlap');
+  const content = await treeText(repo, first.tree, 'same.txt');
+  assert.match(content, /<<<<<<< current/);
+  assert.match(content, /left/);
+  assert.match(content, /right/);
+});

package/runtime/scripts/amalgm-mcp/tests/workspace-checkpoint.test.js

@@ -23,9 +23,10 @@ fs.writeFileSync(
 );
 
 const { closeLocalDb } = require('../state/db');
-const { captureWorktreeDiff } = require('../workspace/git');
+const { captureCheckpoint, captureWorktreeDiff } = require('../workspace/git');
+const merge = require('../workspace/merge');
 const { applyPatch } = require('../workspace/transition');
-const { checkpointResourceId, revisionOf } = require('../workspace/checkpoint');
+const { checkpointFile, revisionOf } = require('../workspace/checkpoint');
 
 test.after(() => {
   closeLocalDb();
@@ -40,6 +41,15 @@ async function run(cwd, ...args) {
   );
 }
 
+async function runOutput(cwd, ...args) {
+  const { stdout } = await execFileAsync(
+    'git',
+    args,
+    { cwd, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' } },
+  );
+  return stdout;
+}
+
 async function makeRepoPair() {
   const stamp = Math.random().toString(36).slice(2, 8);
   const author = path.join(tempRoot, `author-${stamp}`);
@@ -114,6 +124,25 @@ test('capture is stable: two reads of an untouched tree produce the same revisio
   assert.equal(revisionOf(first.baseOid, first.diff), revisionOf(second.baseOid, second.diff));
 });
 
+test('one checkpoint preserves the staged and unstaged layers separately', async () => {
+  const { author } = await makeRepoPair();
+  fs.writeFileSync(path.join(author, 'src', 'index.js'), 'console.log(2);\n');
+  await run(author, 'add', 'src/index.js');
+  fs.writeFileSync(path.join(author, 'src', 'index.js'), 'console.log(3);\n');
+  fs.appendFileSync(path.join(author, 'README.md'), 'unstaged\n');
+
+  const captured = await captureCheckpoint(author);
+  assert.ok(captured.indexDiff.includes('console.log(2)'));
+  assert.ok(!captured.indexDiff.includes('console.log(3)'));
+  assert.ok(captured.worktreeDiff.includes('console.log(3)'));
+  assert.ok(captured.worktreeDiff.includes('unstaged'));
+
+  const indexTree = await merge.treeOfPatch(author, captured.baseOid, captured.indexDiff);
+  const worktreeTree = await merge.treeOfPatch(author, indexTree, captured.worktreeDiff);
+  assert.equal(await runOutput(author, 'show', `${indexTree}:src/index.js`), 'console.log(2);\n');
+  assert.equal(await runOutput(author, 'show', `${worktreeTree}:src/index.js`), 'console.log(3);\n');
+});
+
 test('a clean tree captures as an empty patch, and oversized state is a named refusal', async () => {
   const { author } = await makeRepoPair();
   const clean = await captureWorktreeDiff(author);
@@ -125,13 +154,10 @@ test('a clean tree captures as an empty patch, and oversized state is a named re
   assert.equal(bounded.reason, 'too-large');
 });
 
-test('checkpoint resource ids are stable per (user, machine, repo) and distinct across each', () => {
-  const user = '11111111-1111-4111-8111-111111111111';
-  const id = checkpointResourceId('m1', 'https://github.com/a/b', user);
-  assert.equal(id, checkpointResourceId('m1', 'https://github.com/a/b', user));
-  assert.match(id, /^shr_[A-Za-z0-9_-]{16,128}$/);
-  assert.notEqual(id, checkpointResourceId('m2', 'https://github.com/a/b', user));
-  assert.notEqual(id, checkpointResourceId('m1', 'https://github.com/a/c', user));
-  assert.notEqual(id, checkpointResourceId('m1', 'https://github.com/a/b', 'other-user'));
-  assert.equal(checkpointResourceId(null, 'x', user), null);
+test('checkpoint captures are local cache; their operations travel on the one wall stream', () => {
+  const first = checkpointFile('m1', 'https://github.com/a/b');
+  assert.equal(first, checkpointFile('m1', 'https://github.com/a/b'));
+  assert.notEqual(first, checkpointFile('m2', 'https://github.com/a/b'));
+  assert.notEqual(first, checkpointFile('m1', 'https://github.com/a/c'));
+  assert.match(first, /repo-checkpoints-v4/);
 });

package/runtime/scripts/amalgm-mcp/tests/workspace-object-tunnel.test.js

@@ -20,6 +20,7 @@ test('repo object chunks travel through the shared tunnel one at a time', async
   const uploadSha = crypto.createHash('sha256').update(uploadBytes).digest('hex');
   const downloadBytes = Buffer.from('peer checkpoint chunk');
   const downloadSha = crypto.createHash('sha256').update(downloadBytes).digest('hex');
+  const resourceId = 'shr_cp1abcdefghijklmnopqrstuvwx';
   let uploadClaimed = false;
   let downloadClaimed = false;
   const calls = [];
@@ -42,6 +43,7 @@ test('repo object chunks travel through the shared tunnel one at a time', async
       }
       if (req.url === '/state/repo-objects/uploads/claim') {
         const upload = uploadClaimed ? null : {
+          resourceId,
           sha256: uploadSha,
           bytes: uploadBytes.length,
           dataBase64: uploadBytes.toString('base64'),
@@ -51,7 +53,7 @@ test('repo object chunks travel through the shared tunnel one at a time', async
         return;
       }
       if (req.url === '/state/repo-objects/downloads/claim') {
-        const download = downloadClaimed ? null : { sha256: downloadSha };
+        const download = downloadClaimed ? null : { resourceId, sha256: downloadSha };
         downloadClaimed = true;
         res.end(JSON.stringify({ download }));
         return;
@@ -80,8 +82,10 @@ test('repo object chunks travel through the shared tunnel one at a time', async
     const put = frames.find((frame) => frame.type === 'repo.object.put');
     const get = frames.find((frame) => frame.type === 'repo.object.get');
     assert.equal(put.sha256, uploadSha);
+    assert.equal(put.resource_id, resourceId);
     assert.deepEqual(Buffer.from(put.data_b64, 'base64'), uploadBytes);
     assert.equal(get.sha256, downloadSha);
+    assert.equal(get.resource_id, resourceId);
 
     tunnel.handleFrame({
       type: 'repo.object.stored',
@@ -107,7 +111,11 @@ test('repo object chunks travel through the shared tunnel one at a time', async
     );
     assert.deepEqual(
       calls.find((call) => call.path === '/state/repo-objects/downloads/receive').body,
-      { sha256: downloadSha, dataBase64: downloadBytes.toString('base64') },
+      {
+        resourceId,
+        sha256: downloadSha,
+        dataBase64: downloadBytes.toString('base64'),
+      },
     );
   } finally {
     tunnel.stop();