amalgm 0.1.245 → 0.1.246

package/lib/shared-realtime-tunnel.js

@@ -17,6 +17,10 @@ const CLAIM_LIMIT = 16;
 const CLAIM_LEASE_MS = 30_000;
 const RETRY_MS = 1_000;
 const REAUTHORIZE_MS = 30_000;
+const REPO_OBJECT_REQUEST_TIMEOUT_MS = 15_000;
+const COOKIE_PRIVATE_CONTRACT = 'browser-cookie-jar@1';
+const USER_HOME_PRIVATE_CONTRACT = 'amalgm-user-home@1';
+const ENTITY_REGISTRY_PRIVATE_CONTRACT = 'amalgm-entity-registry@1';
 
 function createSharedRealtimeTunnel({
   send,
@@ -24,8 +28,11 @@ function createSharedRealtimeTunnel({
   localPort,
   localHeaders,
   warn,
+  repoObjectRequestTimeoutMs = REPO_OBJECT_REQUEST_TIMEOUT_MS,
 }) {
   const mutationInflight = new Map();
+  const entityMutationInflight = new Map();
+  const entityContentInflight = new Map();
   const promotionInflight = new Map();
   const attachmentInflight = new Map();
   const privateEnsureInflight = new Map();
@@ -37,19 +44,28 @@ function createSharedRealtimeTunnel({
   let enabled = false;
   let presenceEnabled = false;
   let mutationDrain = null;
+  let entityMutationDrain = null;
+  let entityContentDrain = null;
   let promotionDrain = null;
   let attachmentDrain = null;
   let wakeRequest = null;
   let wakeRetryTimer = null;
   let mutationRetryTimer = null;
+  let entityMutationRetryTimer = null;
+  let entityContentRetryTimer = null;
   let promotionRetryTimer = null;
   let attachmentRetryTimer = null;
   let reauthorizeTimer = null;
   let repoObjectTimer = null;
   let localFailures = 0;
+  let userHomeReady = false;
+
+  function privateInflightFor(contract) {
+    return [...privateEnsureInflight.values()].some((entry) => entry.contract === contract);
+  }
 
   async function ensurePrivateCookieResource() {
-    if (!enabled || privateEnsureInflight.size > 0) return;
+    if (!enabled || privateInflightFor(COOKIE_PRIVATE_CONTRACT)) return;
     try {
       const bootstrap = await localStateJson('GET', '/browser/cookie-jar/cloud/bootstrap');
       if (!bootstrap?.enabled || !bootstrap.resourceId) return;
@@ -67,12 +83,131 @@ function createSharedRealtimeTunnel({
         scheduleMutationDrain(RETRY_MS);
         return;
       }
-      privateEnsureInflight.set(requestId, bootstrap.resourceId);
+      privateEnsureInflight.set(requestId, {
+        resourceId: bootstrap.resourceId,
+        contract: COOKIE_PRIVATE_CONTRACT,
+        phase: 'ensure',
+      });
     } catch (error) {
       warn(`private cookie bootstrap unavailable: ${error?.message || error}`);
     }
   }
 
+  async function ensurePrivateUserHome() {
+    if (!enabled || privateInflightFor(USER_HOME_PRIVATE_CONTRACT)) return;
+    try {
+      const identity = await localStateJson('GET', '/entities/user-home/cloud/identity');
+      if (!identity?.enabled || !identity.resourceId) return;
+      const requestId = `private_home_lookup_${crypto.randomBytes(12).toString('hex')}`;
+      if (!sendLarge({
+        type: 'private.resource.lookup',
+        request_id: requestId,
+        resource_id: identity.resourceId,
+        contract: identity.contract,
+      })) {
+        scheduleMutationDrain(RETRY_MS);
+        return;
+      }
+      privateEnsureInflight.set(requestId, {
+        resourceId: identity.resourceId,
+        contract: USER_HOME_PRIVATE_CONTRACT,
+        phase: 'lookup',
+      });
+    } catch (error) {
+      warn(`private user-home lookup unavailable: ${error?.message || error}`);
+    }
+  }
+
+  async function createPrivateUserHome(resourceId) {
+    try {
+      const bootstrap = await localStateJson('GET', '/entities/user-home/cloud/bootstrap');
+      if (!bootstrap?.enabled || bootstrap.resourceId !== resourceId) {
+        throw new Error('local user-home bootstrap identity changed');
+      }
+      const requestId = `private_home_ensure_${crypto.randomBytes(12).toString('hex')}`;
+      if (!sendLarge({
+        type: 'private.resource.ensure',
+        request_id: requestId,
+        resource_id: bootstrap.resourceId,
+        contract: bootstrap.contract,
+        schema_version: bootstrap.schemaVersion,
+        snapshot_b64: bootstrap.snapshotBase64,
+        snapshot_checksum: bootstrap.snapshotChecksum,
+        snapshot_bytes: bootstrap.snapshotBytes,
+      })) {
+        scheduleMutationDrain(RETRY_MS);
+        return;
+      }
+      privateEnsureInflight.set(requestId, {
+        resourceId: bootstrap.resourceId,
+        contract: USER_HOME_PRIVATE_CONTRACT,
+        phase: 'ensure',
+      });
+    } catch (error) {
+      warn(`private user-home bootstrap unavailable: ${error?.message || error}`);
+      setTimeout(() => enabled && void ensurePrivateUserHome(), RETRY_MS).unref?.();
+    }
+  }
+
+  async function ensurePrivateEntityRegistry() {
+    // The user-home snapshot is the root UUID handshake. Creating the
+    // universal graph before it lands risks minting a competing bootstrap
+    // graph on a newly reinstalled machine.
+    if (!enabled || !userHomeReady || privateInflightFor(ENTITY_REGISTRY_PRIVATE_CONTRACT)) return;
+    try {
+      const identity = await localStateJson('GET', '/entities/cloud/identity');
+      if (!identity?.enabled || !identity.resourceId) return;
+      const requestId = `private_entities_lookup_${crypto.randomBytes(12).toString('hex')}`;
+      if (!sendLarge({
+        type: 'private.resource.lookup',
+        request_id: requestId,
+        resource_id: identity.resourceId,
+        contract: identity.contract,
+      })) {
+        scheduleEntityMutationDrain(RETRY_MS);
+        return;
+      }
+      privateEnsureInflight.set(requestId, {
+        resourceId: identity.resourceId,
+        contract: ENTITY_REGISTRY_PRIVATE_CONTRACT,
+        phase: 'lookup',
+      });
+    } catch (error) {
+      warn(`private entity registry lookup unavailable: ${error?.message || error}`);
+    }
+  }
+
+  async function createPrivateEntityRegistry(resourceId) {
+    try {
+      const bootstrap = await localStateJson('GET', '/entities/cloud/bootstrap');
+      if (!bootstrap?.enabled || bootstrap.resourceId !== resourceId) {
+        throw new Error('local entity registry bootstrap identity changed');
+      }
+      const requestId = `private_entities_ensure_${crypto.randomBytes(12).toString('hex')}`;
+      if (!sendLarge({
+        type: 'private.resource.ensure',
+        request_id: requestId,
+        resource_id: bootstrap.resourceId,
+        contract: bootstrap.contract,
+        schema_version: bootstrap.schemaVersion,
+        snapshot_b64: bootstrap.snapshotBase64,
+        snapshot_checksum: bootstrap.snapshotChecksum,
+        snapshot_bytes: bootstrap.snapshotBytes,
+      })) {
+        scheduleEntityMutationDrain(RETRY_MS);
+        return;
+      }
+      privateEnsureInflight.set(requestId, {
+        resourceId: bootstrap.resourceId,
+        contract: ENTITY_REGISTRY_PRIVATE_CONTRACT,
+        phase: 'ensure',
+      });
+    } catch (error) {
+      warn(`private entity registry bootstrap unavailable: ${error?.message || error}`);
+      setTimeout(() => enabled && void ensurePrivateEntityRegistry(), RETRY_MS).unref?.();
+    }
+  }
+
   function localStateJson(method, requestPath, body) {
     const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
     return new Promise((resolve, reject) => {
@@ -124,6 +259,24 @@ function createSharedRealtimeTunnel({
     mutationRetryTimer.unref?.();
   }
 
+  function scheduleEntityMutationDrain(delay = 0) {
+    if (!enabled || entityMutationRetryTimer) return;
+    entityMutationRetryTimer = setTimeout(() => {
+      entityMutationRetryTimer = null;
+      void drainEntityCloudMutations();
+    }, delay);
+    entityMutationRetryTimer.unref?.();
+  }
+
+  function scheduleEntityContentDrain(delay = 0) {
+    if (!enabled || entityContentRetryTimer) return;
+    entityContentRetryTimer = setTimeout(() => {
+      entityContentRetryTimer = null;
+      void drainEntityContent();
+    }, delay);
+    entityContentRetryTimer.unref?.();
+  }
+
   function schedulePromotionDrain(delay = 0) {
     if (!enabled || promotionRetryTimer) return;
     promotionRetryTimer = setTimeout(() => {
@@ -142,10 +295,6 @@ function createSharedRealtimeTunnel({
     attachmentRetryTimer.unref?.();
   }
 
-  function alreadyInflight(inflight, matches) {
-    return [...inflight.values()].some(matches);
-  }
-
   async function drainMutations() {
     if (!enabled || mutationDrain) return;
     mutationDrain = (async () => {
@@ -156,10 +305,6 @@ function createSharedRealtimeTunnel({
       for (const claim of Array.isArray(result?.mutations) ? result.mutations : []) {
         const envelope = claim?.envelope;
         if (!envelope?.resourceId || !envelope?.mutationId) continue;
-        if (alreadyInflight(mutationInflight, (entry) => (
-          entry.resourceId === envelope.resourceId
-          && entry.mutationId === envelope.mutationId
-        ))) continue;
         const requestId = `shared_${crypto.randomBytes(12).toString('hex')}`;
         if (!sendLarge({ type: 'shared.mutation.submit', request_id: requestId, envelope })) {
           await failMutationClaim(claim, 'shared tunnel backpressure: mutation was not queued');
@@ -184,6 +329,103 @@ function createSharedRealtimeTunnel({
     await mutationDrain;
   }
 
+  async function drainEntityCloudMutations() {
+    if (!enabled || entityMutationDrain) return;
+    entityMutationDrain = (async () => {
+      const result = await localStateJson('POST', '/entities/cloud/mutations/claim', {
+        limit: CLAIM_LIMIT,
+        leaseMs: CLAIM_LEASE_MS,
+      });
+      for (const envelope of Array.isArray(result?.mutations) ? result.mutations : []) {
+        if (!envelope?.resourceId || !envelope?.mutationId) continue;
+        const requestId = `entities_${crypto.randomBytes(12).toString('hex')}`;
+        if (!sendLarge({ type: 'shared.mutation.submit', request_id: requestId, envelope })) {
+          await failEntityMutation(envelope, 'shared tunnel backpressure: entity mutation was not queued');
+          scheduleEntityMutationDrain(RETRY_MS);
+          continue;
+        }
+        entityMutationInflight.set(requestId, {
+          resourceId: envelope.resourceId,
+          mutationId: envelope.mutationId,
+        });
+      }
+      localFailures = 0;
+    })().catch((error) => {
+      localFailures += 1;
+      if (localFailures === 1 || localFailures % 20 === 0) {
+        warn(`entity outbox unavailable (attempt ${localFailures}): ${error?.message || error}`);
+      }
+      scheduleEntityMutationDrain(RETRY_MS);
+    }).finally(() => {
+      entityMutationDrain = null;
+    });
+    await entityMutationDrain;
+  }
+
+  async function drainEntityContent() {
+    if (!enabled || entityContentDrain) return;
+    entityContentDrain = (async () => {
+      const result = await localStateJson('POST', '/entities/cloud/content/claim', {
+        leaseMs: CLAIM_LEASE_MS,
+      });
+      const upload = result?.upload;
+      if (!upload?.resourceId || !upload?.contentHash || !upload?.kind) return;
+      const requestId = `entity_content_${crypto.randomBytes(12).toString('hex')}`;
+      if (!sendLarge({
+        type: 'private.entity-content.put',
+        request_id: requestId,
+        resource_id: upload.resourceId,
+        content_hash: upload.contentHash,
+        kind: upload.kind,
+        part_index: upload.partIndex,
+        part_count: upload.partCount,
+        sha256: upload.sha256,
+        bytes: upload.bytes,
+        data_b64: upload.dataBase64,
+      })) {
+        await failEntityContent(upload, 'shared tunnel backpressure: entity content was not queued');
+        scheduleEntityContentDrain(RETRY_MS);
+        return;
+      }
+      entityContentInflight.set(requestId, upload);
+    })().catch((error) => {
+      localFailures += 1;
+      if (localFailures === 1 || localFailures % 20 === 0) {
+        warn(`entity content outbox unavailable (attempt ${localFailures}): ${error?.message || error}`);
+      }
+      scheduleEntityContentDrain(RETRY_MS);
+    }).finally(() => {
+      entityContentDrain = null;
+    });
+    await entityContentDrain;
+  }
+
+  async function failEntityContent(upload, message) {
+    try {
+      await localStateJson('POST', '/entities/cloud/content/fail', {
+        resourceId: upload.resourceId,
+        contentHash: upload.contentHash,
+        message,
+      });
+    } catch {
+      // The durable local content ledger leaves the upload claimable after
+      // its lease, even if this failure response cannot reach the runtime.
+    }
+  }
+
+  async function failEntityMutation(envelope, message) {
+    try {
+      await localStateJson('POST', '/entities/cloud/mutations/fail', {
+        resourceId: envelope.resourceId,
+        mutationId: envelope.mutationId,
+        message,
+        retryable: true,
+      });
+    } catch {
+      // The durable identity-db lease makes the row claimable after expiry.
+    }
+  }
+
   async function failMutationClaim(claim, message) {
     try {
       await localStateJson('POST', '/state/mutations/fail', {
@@ -207,9 +449,6 @@ function createSharedRealtimeTunnel({
       for (const claim of Array.isArray(result?.promotions) ? result.promotions : []) {
         const promotion = claim?.frame;
         if (!promotion?.promotionId || !promotion?.resourceId) continue;
-        if (alreadyInflight(promotionInflight, (entry) => (
-          entry.promotionId === promotion.promotionId
-        ))) continue;
         const requestId = `promote_${crypto.randomBytes(12).toString('hex')}`;
         const queued = sendLarge({
           type: 'shared.resource.promote',
@@ -256,9 +495,6 @@ function createSharedRealtimeTunnel({
       });
       for (const attachment of Array.isArray(result?.attachments) ? result.attachments : []) {
         if (!attachment?.attachmentId || !attachment?.resourceId) continue;
-        if (alreadyInflight(attachmentInflight, (entry) => (
-          entry.attachmentId === attachment.attachmentId
-        ))) continue;
         const requestId = `attach_${crypto.randomBytes(12).toString('hex')}`;
         if (!send({
           type: 'shared.resource.attach',
@@ -291,10 +527,17 @@ function createSharedRealtimeTunnel({
     repoObjectTimer.unref?.();
   }
 
+  function expireRepoObjectRequests(now = Date.now()) {
+    for (const inflight of [repoUploadInflight, repoDownloadInflight]) {
+      for (const [requestId, object] of inflight) {
+        if (now - object.sentAt >= repoObjectRequestTimeoutMs) inflight.delete(requestId);
+      }
+    }
+  }
+
   async function drainRepoObjects() {
     if (!enabled) return;
-    // One ordered WebSocket carries one request until its reply. A disconnect
-    // clears this map and the durable local queue resends after reconnect.
+    expireRepoObjectRequests();
     if (repoUploadInflight.size === 0) {
       const result = await localStateJson('POST', '/state/repo-objects/uploads/claim', {});
       const upload = result?.upload;
@@ -311,6 +554,7 @@ function createSharedRealtimeTunnel({
           repoUploadInflight.set(requestId, {
             resourceId: upload.resourceId,
             sha256: upload.sha256,
+            sentAt: Date.now(),
           });
         }
       }
@@ -329,6 +573,7 @@ function createSharedRealtimeTunnel({
           repoDownloadInflight.set(requestId, {
             resourceId: download.resourceId,
             sha256: download.sha256,
+            sentAt: Date.now(),
           });
         }
       }
@@ -470,10 +715,14 @@ function createSharedRealtimeTunnel({
     if (!enabled) return;
     startWakeStream();
     void ensurePrivateCookieResource();
+    void ensurePrivateUserHome();
+    if (userHomeReady) void ensurePrivateEntityRegistry();
     void joinReplicas();
     scheduleAttachmentDrain();
     schedulePromotionDrain();
     scheduleMutationDrain();
+    scheduleEntityContentDrain();
+    scheduleEntityMutationDrain();
     scheduleRepoObjects();
   }
 
@@ -521,6 +770,26 @@ function createSharedRealtimeTunnel({
     });
   }
 
+  function handlePrivateEntityContentStored(frame) {
+    const upload = entityContentInflight.get(frame.request_id);
+    if (!upload || upload.contentHash !== frame.content_hash || upload.kind !== frame.kind
+      || upload.partIndex !== frame.part_index) return;
+    void localStateJson('POST', '/entities/cloud/content/ack', {
+      resourceId: upload.resourceId,
+      contentHash: upload.contentHash,
+      kind: upload.kind,
+      partIndex: upload.partIndex,
+    }).then(() => {
+      entityContentInflight.delete(frame.request_id);
+      // A completed manifest may unblock the first entity mutation that
+      // names this exact head, so advance both rails immediately.
+      scheduleEntityContentDrain();
+      scheduleEntityMutationDrain();
+    }).catch(() => {
+      setTimeout(() => enabled && handlePrivateEntityContentStored(frame), RETRY_MS).unref?.();
+    });
+  }
+
   function handleAttached(frame) {
     const identity = attachmentInflight.get(frame.request_id);
     if (!identity) return;
@@ -545,13 +814,9 @@ function createSharedRealtimeTunnel({
       void localStateJson('POST', '/state/shared/attachments/fail', {
         attachmentId: identity.attachmentId,
         message: error?.message || 'local snapshot materialization failed',
-        // The gateway already authorized and completed this attachment.
-        // A local materialization failure is weather (busy disk, concurrent
-        // save, restart), never proof that the binding is permanently bad.
-        retryable: true,
+        retryable: false,
       }).catch(() => {});
       attachmentInflight.delete(frame.request_id);
-      scheduleAttachmentDrain(RETRY_MS);
     });
   }
 
@@ -576,9 +841,17 @@ function createSharedRealtimeTunnel({
   }
 
   function handlePrivateReady(frame) {
-    const resourceId = privateEnsureInflight.get(frame.request_id);
-    if (!resourceId || resourceId !== frame.resource_id) return;
-    void localStateJson('POST', '/browser/cookie-jar/cloud/install', {
+    const inflight = privateEnsureInflight.get(frame.request_id);
+    if (!inflight || inflight.resourceId !== frame.resource_id) return;
+    const installPath = inflight.contract === COOKIE_PRIVATE_CONTRACT
+      ? '/browser/cookie-jar/cloud/install'
+      : inflight.contract === USER_HOME_PRIVATE_CONTRACT
+        ? '/entities/user-home/cloud/install'
+        : inflight.contract === ENTITY_REGISTRY_PRIVATE_CONTRACT
+          ? '/entities/cloud/install'
+        : null;
+    if (!installPath) return;
+    void localStateJson('POST', installPath, {
       resourceId: frame.resource_id,
       authorityEpoch: frame.authority_epoch,
       headVersion: frame.head_version,
@@ -589,15 +862,47 @@ function createSharedRealtimeTunnel({
       schemaVersion: frame.schema_version,
     }).then(() => {
       privateEnsureInflight.delete(frame.request_id);
+      if (inflight.contract === USER_HOME_PRIVATE_CONTRACT) {
+        userHomeReady = true;
+        void ensurePrivateEntityRegistry();
+      }
       void joinReplicas();
       scheduleMutationDrain();
+      scheduleEntityContentDrain();
+      scheduleEntityMutationDrain();
     }).catch((error) => {
-      warn(`private cookie snapshot was not installed: ${error?.message || error}`);
+      warn(`private ${inflight.contract} snapshot was not installed: ${error?.message || error}`);
       setTimeout(() => enabled && handlePrivateReady(frame), RETRY_MS).unref?.();
     });
   }
 
+  function handlePrivateMissing(frame) {
+    const inflight = privateEnsureInflight.get(frame.request_id);
+    if (!inflight || inflight.resourceId !== frame.resource_id || inflight.phase !== 'lookup') return;
+    privateEnsureInflight.delete(frame.request_id);
+    if (inflight.contract === USER_HOME_PRIVATE_CONTRACT) {
+      void createPrivateUserHome(inflight.resourceId);
+    } else if (inflight.contract === ENTITY_REGISTRY_PRIVATE_CONTRACT) {
+      void createPrivateEntityRegistry(inflight.resourceId);
+    }
+  }
+
   function handleAck(frame) {
+    const entityIdentity = entityMutationInflight.get(frame.request_id);
+    if (entityIdentity) {
+      void localStateJson('POST', '/entities/cloud/mutations/ack', {
+        resourceId: entityIdentity.resourceId,
+        mutationId: entityIdentity.mutationId,
+        version: frame.version,
+        committedAt: frame.committed_at,
+      }).then(() => {
+        entityMutationInflight.delete(frame.request_id);
+        scheduleEntityMutationDrain();
+      }).catch(() => {
+        setTimeout(() => enabled && handleAck(frame), RETRY_MS).unref?.();
+      });
+      return;
+    }
     const identity = mutationInflight.get(frame.request_id) || {
       resourceId: frame.resource_id,
       mutationId: frame.mutation_id,
@@ -618,18 +923,9 @@ function createSharedRealtimeTunnel({
   }
 
   function handleError(frame) {
-    const failedUpload = repoUploadInflight.get(frame.request_id);
-    if (failedUpload) {
-      void localStateJson('POST', '/state/repo-objects/uploads/fail', {
-        resourceId: failedUpload.resourceId,
-        sha256: failedUpload.sha256,
-        retryable: frame.retryable !== false,
-        code: frame.code,
-        message: frame.message,
-      }).finally(() => {
-        repoUploadInflight.delete(frame.request_id);
-        scheduleRepoObjects();
-      });
+    if (repoUploadInflight.has(frame.request_id)) {
+      repoUploadInflight.delete(frame.request_id);
+      scheduleRepoObjects(RETRY_MS);
       return;
     }
     if (repoDownloadInflight.has(frame.request_id)) {
@@ -637,12 +933,26 @@ function createSharedRealtimeTunnel({
       scheduleRepoObjects(RETRY_MS);
       return;
     }
+    const content = entityContentInflight.get(frame.request_id);
+    if (content) {
+      void failEntityContent(content, `${frame.code || 'shared_error'}: ${frame.message || 'entity content failed'}`)
+        .finally(() => {
+          entityContentInflight.delete(frame.request_id);
+          if (frame.retryable !== false) scheduleEntityContentDrain(RETRY_MS);
+        });
+      return;
+    }
     const privateResource = privateEnsureInflight.get(frame.request_id);
     if (privateResource) {
       privateEnsureInflight.delete(frame.request_id);
-      warn(`private cookie bootstrap failed for ${privateResource}: ${frame.code || 'shared_error'}: ${frame.message || ''}`);
+      warn(`private ${privateResource.contract} bootstrap failed for ${privateResource.resourceId}: ${frame.code || 'shared_error'}: ${frame.message || ''}`);
       if (frame.retryable !== false) {
-        setTimeout(() => enabled && void ensurePrivateCookieResource(), RETRY_MS).unref?.();
+        const retry = privateResource.contract === USER_HOME_PRIVATE_CONTRACT
+          ? ensurePrivateUserHome
+          : privateResource.contract === ENTITY_REGISTRY_PRIVATE_CONTRACT
+            ? ensurePrivateEntityRegistry
+            : ensurePrivateCookieResource;
+        setTimeout(() => enabled && void retry(), RETRY_MS).unref?.();
       }
       return;
     }
@@ -702,6 +1012,20 @@ function createSharedRealtimeTunnel({
       return;
     }
 
+    const entityIdentity = entityMutationInflight.get(frame.request_id);
+    if (entityIdentity) {
+      void localStateJson('POST', '/entities/cloud/mutations/fail', {
+        resourceId: entityIdentity.resourceId,
+        mutationId: entityIdentity.mutationId,
+        message: `${frame.code || 'shared_error'}: ${frame.message || 'entity cloud mutation failed'}`,
+        retryable: frame.retryable !== false,
+      }).finally(() => {
+        entityMutationInflight.delete(frame.request_id);
+        if (frame.retryable !== false) scheduleEntityMutationDrain(RETRY_MS);
+      });
+      return;
+    }
+
     const identity = mutationInflight.get(frame.request_id) || {
       resourceId: frame.resource_id,
       mutationId: frame.mutation_id,
@@ -710,7 +1034,6 @@ function createSharedRealtimeTunnel({
     void localStateJson('POST', '/state/mutations/fail', {
       resourceId: identity.resourceId,
       mutationId: identity.mutationId,
-      code: frame.code,
       message: `${frame.code || 'shared_error'}: ${frame.message || 'shared mutation failed'}`,
       retryable: frame.retryable !== false,
     }).finally(() => {
@@ -722,8 +1045,11 @@ function createSharedRealtimeTunnel({
   function handleCommitted(frame) {
     const resourceId = frame.resource_id || frame.envelope?.resourceId;
     if (!resourceId) return;
+    const endpoint = frame.envelope?.contract === ENTITY_REGISTRY_PRIVATE_CONTRACT
+      ? '/entities/cloud/mutations/ingest'
+      : '/state/mutations/ingest';
     const prior = inboundChains.get(resourceId) || Promise.resolve();
-    const next = prior.then(() => localStateJson('POST', '/state/mutations/ingest', {
+    const next = prior.then(() => localStateJson('POST', endpoint, {
       envelope: frame.envelope,
       version: frame.version,
       committedAt: frame.committed_at,
@@ -803,6 +1129,12 @@ function createSharedRealtimeTunnel({
       case 'private.resource.ready':
         handlePrivateReady(frame);
         return true;
+      case 'private.resource.missing':
+        handlePrivateMissing(frame);
+        return true;
+      case 'private.entity-content.stored':
+        handlePrivateEntityContentStored(frame);
+        return true;
       case 'repo.object.stored':
         handleRepoObjectStored(frame);
         return true;
@@ -828,6 +1160,8 @@ function createSharedRealtimeTunnel({
     enabled = false;
     presenceEnabled = false;
     mutationInflight.clear();
+    entityMutationInflight.clear();
+    entityContentInflight.clear();
     promotionInflight.clear();
     attachmentInflight.clear();
     privateEnsureInflight.clear();
@@ -839,12 +1173,19 @@ function createSharedRealtimeTunnel({
     wakeRequest = null;
     clearTimeout(wakeRetryTimer);
     clearTimeout(mutationRetryTimer);
+    clearTimeout(entityMutationRetryTimer);
+    clearTimeout(entityContentRetryTimer);
     clearTimeout(promotionRetryTimer);
     clearTimeout(attachmentRetryTimer);
     clearTimeout(reauthorizeTimer);
     clearTimeout(repoObjectTimer);
     wakeRetryTimer = null;
     mutationRetryTimer = null;
+    entityMutationRetryTimer = null;
+    entityMutationDrain = null;
+    entityContentRetryTimer = null;
+    entityContentDrain = null;
+    userHomeReady = false;
     promotionRetryTimer = null;
     attachmentRetryTimer = null;
     reauthorizeTimer = null;

package/lib/supervisor.js

@@ -174,8 +174,6 @@ const SAFE_PROCESS_ENV_KEYS = [
   'LANG',
   'LC_ALL',
   'LOGNAME',
-  'AMALGM_AUTO_UPDATE',
-  'AMALGM_DISABLE_AUTO_UPDATE',
   'AMALGM_NATIVE_NODE_MODULES',
   'AMALGM_SKIP_NATIVE_INSTALL',
   'ELECTRON_RUN_AS_NODE',
@@ -1345,6 +1343,5 @@ module.exports = {
     liveDeclaredRuntimePorts,
     runtimeStateFilesUnder,
     runtimeStateSearchRoots,
-    safeBaseProcessEnv,
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.245",
+  "version": "0.1.246",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,
@@ -17,7 +17,7 @@
     "sync-runtime": "node ../../scripts/sync-npm-package-runtime.mjs",
     "prepack": "node ../../scripts/sync-npm-package-runtime.mjs",
     "pack:dry": "npm pack --dry-run",
-    "check": "node --check bin/amalgm.js && node --check lib/app-chat.js && node --check lib/react.js && node --check lib/auth-store.js && node --check lib/cli.js && node --check lib/identity-adopt.js && node --check lib/layout.js && node --check lib/migrate-layout.js && node --check lib/paths.js && node --check lib/process-cleanup.js && node --check lib/runtime-identity.js && node --check lib/runtime-manifest.js && node --check lib/service.js && node --check lib/state-migration.js && node --check lib/supervisor.js && node --check lib/tunnel-chat.js && node --check lib/tunnel-events.js && node --check lib/updater.js && node --check runtime/lib/runtime-manifest.js && node --check runtime/scripts/runtime-auth.js && node --check runtime/scripts/proxy-token-store.js && node --check runtime/scripts/local-gateway.js && node --check runtime/scripts/port-monitor.js && node --check runtime/scripts/chat-server.js && node --check runtime/scripts/chat-server/index.js && node --check runtime/scripts/chat-server/config.js && node --check runtime/scripts/chat-core/tooling/native-binaries.js && node --check runtime/scripts/chat-core/tooling/package-import.js && node --check runtime/scripts/chat-core/tooling/runtime-home.js && node --check runtime/scripts/amalgm-mcp/index.js && node --check runtime/scripts/amalgm-mcp/config.js && node --check runtime/scripts/amalgm-mcp/events/pr-check-runner.js && node --check runtime/scripts/lib/project-paths.js && node --check runtime/scripts/lib/runtime-paths.js"
+    "check": "node --check bin/amalgm.js && node --check lib/app-chat.js && node --check lib/react.js && node --check lib/auth-store.js && node --check lib/cli.js && node --check lib/identity-adopt.js && node --check lib/layout.js && node --check lib/migrate-layout.js && node --check lib/paths.js && node --check lib/process-cleanup.js && node --check lib/runtime-identity.js && node --check lib/runtime-manifest.js && node --check lib/service.js && node --check lib/state-migration.js && node --check lib/supervisor.js && node --check lib/tunnel-chat.js && node --check lib/tunnel-events.js && node --check lib/updater.js && node --check runtime/lib/runtime-manifest.js && node --check runtime/scripts/runtime-auth.js && node --check runtime/scripts/proxy-token-store.js && node --check runtime/scripts/local-gateway.js && node --check runtime/scripts/port-monitor.js && node --check runtime/scripts/chat-server.js && node --check runtime/scripts/chat-server/index.js && node --check runtime/scripts/chat-server/config.js && node --check runtime/scripts/chat-core/tooling/native-binaries.js && node --check runtime/scripts/chat-core/tooling/package-import.js && node --check runtime/scripts/chat-core/tooling/runtime-home.js && node --check runtime/scripts/amalgm-mcp/index.js && node --check runtime/scripts/amalgm-mcp/config.js && node --check runtime/scripts/amalgm-mcp/events/pr-check-runner.js && node --check runtime/scripts/amalgm-mcp/registration/entity-cloud.js && node --check runtime/scripts/amalgm-mcp/registration/entity-content.js && node --check runtime/scripts/amalgm-mcp/registration/service.js && node --check runtime/scripts/amalgm-mcp/server/routes/entities.js && node --check runtime/scripts/lib/project-paths.js && node --check runtime/scripts/lib/runtime-paths.js"
   },
   "engines": {
     "node": ">=20"