amalgm 0.1.254 → 0.1.256

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.254",
+  "version": "0.1.256",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/registration/entity-cloud.js

@@ -424,14 +424,23 @@ function createEntityCloud({ db, userId, deviceId, content = null, repoStates =
     }
   }
 
-  function bootstrap(registry) {
+  /**
+   * Create the first private entity-resource snapshot from the *already
+   * verified* bootstrap graph. This deliberately accepts records rather than
+   * a registry: login owns the declared user-home graph, but an older device
+   * can also hold unrelated local registrations which have never had cloud
+   * authority. Publishing those as an implicit local-wins merge would make
+   * sign-in a hidden `register` command.
+   */
+  function bootstrap(records) {
     const currentIdentity = identity();
     if (!currentIdentity.enabled) return currentIdentity;
     const existing = replica();
     if (existing?.state === 'active') {
       throw new Error('entity cloud registry already exists locally; cloud lookup must not create it again');
     }
-    const snapshot = cloudSnapshot(registry.syncRecords());
+    if (!Array.isArray(records)) throw new Error('entity cloud bootstrap requires verified records');
+    const snapshot = cloudSnapshot(records);
     const cutoff = db.prepare('SELECT COALESCE(MAX(sequence), 0) AS sequence FROM entity_cloud_mutations').get().sequence;
     saveReplica({
       resourceId: currentIdentity.resourceId,
@@ -471,7 +480,6 @@ function createEntityCloud({ db, userId, deviceId, content = null, repoStates =
       || !Number.isInteger(Number(headVersion)) || Number(headVersion) < 0) {
       throw new Error('entity cloud registry authority is invalid');
     }
-    const local = cloudSnapshot(registry.syncRecords());
     const current = replica();
     const bootstrapping = current?.state === 'bootstrapping';
     const reconciling = current?.state === BOOTSTRAP_RECONCILIATION_STATE;
@@ -486,7 +494,12 @@ function createEntityCloud({ db, userId, deviceId, content = null, repoStates =
     // exactly the already-verified declared user home. This is not a general
     // local-wins merge: user-selected ground remains refused until an active
     // authoritative snapshot exists.
-    if (!current && emptyCloudGraph && trustedBootstrap && sameRecords(local.records, trustedBootstrap)) {
+    // The first entity resource contains only declared user-home truth. An
+    // old installation may also have local, pre-cloud user ground; that is
+    // deliberately excluded here and will join only through an explicit
+    // later `amalgm register`. The empty cloud resource is therefore repaired
+    // from the trusted bootstrap records, never from the whole local registry.
+    if (emptyCloudGraph && trustedBootstrap && (!current || bootstrapping)) {
       const next = {
         resourceId,
         deviceId: currentIdentity.deviceId,
@@ -515,8 +528,8 @@ function createEntityCloud({ db, userId, deviceId, content = null, repoStates =
     }
 
     if (reconciling) {
-      if (!trustedBootstrap || !sameRecords(local.records, trustedBootstrap)) {
-        throw new Error('entity bootstrap reconciliation no longer matches the verified user-home graph');
+      if (!trustedBootstrap) {
+        throw new Error('entity bootstrap reconciliation requires the verified user-home graph');
       }
       if (current.resourceId !== resourceId || Number(authorityEpoch) !== current.authorityEpoch
         || Number(headVersion) < current.headVersion || !recordsAreSubset(snapshot.records, trustedBootstrap)) {
@@ -547,13 +560,17 @@ function createEntityCloud({ db, userId, deviceId, content = null, repoStates =
         reconciling: !complete,
       };
     }
-    if (bootstrapping && !sameRecord(local, snapshot)) {
-      throw new Error('first cloud entity snapshot does not match the locally bootstrapped identity graph');
+    if (bootstrapping) {
+      const expected = trustedBootstrap ?? cloudSnapshot(registry.syncRecords()).records;
+      if (!sameRecords(expected, snapshot.records)) {
+        throw new Error('first cloud entity snapshot does not match the locally bootstrapped identity graph');
+      }
     }
     if (!bootstrapping) {
       const cloudByUuid = new Map(snapshot.records.map((record) => [record.uuid, record]));
-      for (const record of local.records) {
-        if (!sameRecord(record, cloudByUuid.get(record.uuid))) {
+      for (const local of registry.syncRecords()) {
+        const remote = cloudByUuid.get(local.uuid);
+        if (remote && !sameRecord(cloudRecord(local), remote)) {
           throw new Error('cloud entity graph conflicts with locally bound ground; resolve the local mutation before importing a new cloud head');
         }
       }

package/runtime/scripts/amalgm-mcp/registration/service.js

@@ -230,6 +230,24 @@ function createRegistrationService({
     };
   }
 
+  /** A bootstrap rekey is safe only before this installation has accepted
+   * ordinary entity-cloud state. After that point a UUID graph has an
+   * independent authority and an operator must resolve any disagreement
+   * explicitly; a login handshake never chooses a winner for it. */
+  function assertBootstrapRekeyAvailable() {
+    const state = identityDb.prepare(`
+      SELECT
+        (SELECT COUNT(*) FROM entity_cloud_replica) AS replicas,
+        (SELECT COUNT(*) FROM entity_cloud_mutations) AS mutations,
+        (SELECT COUNT(*) FROM entity_cloud_catalog_state) AS catalog_states,
+        (SELECT COUNT(*) FROM entity_cloud_catalog) AS catalog_records,
+        (SELECT COUNT(*) FROM entity_materializations) AS materializations
+    `).get();
+    if (Object.values(state).some((count) => Number(count) !== 0)) {
+      throw new Error('cannot adopt cloud user-home UUIDs after ordinary entity-cloud state exists');
+    }
+  }
+
   /**
    * Bootstrap a logged-in person's declared Amalgm home through the SAME
    * operation as `amalgm register`. `ensureUserHome` only creates the safe shape;
@@ -243,23 +261,18 @@ function createRegistrationService({
   async function bootstrapUserHome({ identitySnapshot = null } = {}) {
     const declaration = ensureUserHome(homeDir);
     const seeds = identitySeeds(identitySnapshot, declaration);
-    const roots = [];
     const addedRoots = boundary.current.addMany(declaration.roots.map((entry) => ({
       targetPath: entry.path,
       identityAt: seeds?.forRoot(entry.key) ?? null,
     })));
-    for (let index = 0; index < declaration.roots.length; index += 1) {
-      const entry = declaration.roots[index];
+    let roots = declaration.roots.map((entry, index) => {
       const added = addedRoots[index];
-      if (seeds && added.record.uuid !== seeds.root(entry.key).uuid) {
-        throw new Error(`local user-home root ${entry.key} does not match its cloud UUID`);
-      }
-      roots.push({
+      return {
         key: entry.key,
         path: added.rootPath,
         record: added.record,
-      });
-    }
+      };
+    });
 
     const system = roots.find((entry) => entry.key === 'system');
     if (!system) throw new Error('declared user home has no system root');
@@ -275,15 +288,12 @@ function createRegistrationService({
       return record;
     };
 
-    const exactManaged = declaration.exactManaged.map((entry) => {
+    let exactManaged = declaration.exactManaged.map((entry) => {
       const root = roots.find((candidate) => candidate.key === entry.rootKey);
       const isRoot = entry.relativePath === entry.rootKey;
       const relativePath = isRoot ? '' : entry.relativePath.slice(entry.rootKey.length + 1);
       const record = isRoot ? root?.record : recordAt(relativePath);
       if (!record) throw new Error(`declared user-home managed target was not registered: ${entry.relativePath}`);
-      if (seeds && record.uuid !== seeds.managed(entry.key).uuid) {
-        throw new Error(`local user-home managed target ${entry.key} does not match its cloud UUID`);
-      }
       return {
         key: entry.key,
         rootKey: entry.rootKey,
@@ -294,6 +304,65 @@ function createRegistrationService({
       };
     });
 
+    if (seeds) {
+      const bindings = [
+        ...roots.map((entry) => ({
+          key: entry.key,
+          local: entry.record,
+          authoritative: seeds.root(entry.key),
+        })),
+        ...exactManaged.map((entry) => ({
+          key: entry.key,
+          local: entry.record,
+          authoritative: seeds.managed(entry.key),
+        })),
+      ];
+      for (const binding of bindings) {
+        const remote = binding.authoritative;
+        const local = binding.local;
+        if (!remote || remote.type !== local.type || remote.name !== local.name || remote.status !== local.status) {
+          throw new Error(`cloud user-home node ${binding.key} does not match its declared local shape`);
+        }
+      }
+      if (bindings.some(({ local, authoritative }) => local.uuid !== authoritative.uuid)) {
+        assertBootstrapRekeyAvailable();
+        // The six roots appear once more in `exactManaged` to name their
+        // governance. They are the same nodes, not a second rekey.
+        const uniqueBindings = [...new Map(bindings.map((binding) => [binding.local.uuid, binding])).values()];
+        boundary.current.registry.rebindBootstrapIdentities(uniqueBindings.map(({ local, authoritative }) => ({
+          oldUUID: local.uuid,
+          newUUID: authoritative.uuid,
+          newParentUUID: authoritative.parentUUID,
+          type: authoritative.type,
+          name: authoritative.name,
+        })));
+        roots = roots.map((entry) => ({
+          ...entry,
+          record: boundary.current.registry.syncRecord(seeds.root(entry.key).uuid),
+        }));
+        const reboundSystem = roots.find((entry) => entry.key === 'system');
+        const reboundTree = boundary.current.tree(reboundSystem.path);
+        if (!reboundTree?.root()) throw new Error('cloud user-home rekey lost the declared system root');
+        exactManaged = exactManaged.map((entry) => {
+          const remote = seeds.managed(entry.key);
+          return {
+            ...entry,
+            record: boundary.current.registry.syncRecord(remote.uuid),
+          };
+        });
+      }
+      for (const entry of roots) {
+        if (entry.record.uuid !== seeds.root(entry.key).uuid) {
+          throw new Error(`local user-home root ${entry.key} does not match its cloud UUID`);
+        }
+      }
+      for (const entry of exactManaged) {
+        if (entry.record.uuid !== seeds.managed(entry.key).uuid) {
+          throw new Error(`local user-home managed target ${entry.key} does not match its cloud UUID`);
+        }
+      }
+    }
+
     const cloudSnapshot = {
       schemaVersion: USER_HOME_CLOUD_SCHEMA_VERSION,
       kind: 'amalgm-user-home',
@@ -312,10 +381,10 @@ function createRegistrationService({
     };
   }
 
-  /** The only local graph allowed to repair an old empty entity resource is
-   * the exact home that the user-home handshake has already verified. Any
-   * extra local entity would be user-selected ground and must wait for an
-   * active entity-cloud authority instead. */
+  /** The only local graph eligible to repair an old empty entity resource is
+   * the exact home that the user-home handshake has already verified. Extra
+   * local entities are deliberately excluded rather than treated as a login
+   * merge: they become cloud-backed only through a later explicit register. */
   async function exactUserHomeCloudRecords() {
     const home = await bootstrapUserHome();
     const expected = new Map();
@@ -326,12 +395,9 @@ function createRegistrationService({
       // containers, with the registry's sync representation.
       expected.set(entry.record.uuid, boundary.current.registry.syncRecord(entry.record.uuid));
     }
-    const records = boundary.current.registry.syncRecords();
-    if (records.length !== expected.size) {
-      throw new Error('local entity graph contains ground outside the declared user home');
-    }
+    const records = [...expected.values()];
     for (const record of records) {
-      const declared = expected.get(record.uuid);
+      const declared = boundary.current.registry.syncRecord(record.uuid);
       if (!declared || ![
         'uuid', 'type', 'parentUUID', 'name', 'status', 'version', 'payloadVersion',
       ].every((field) => record[field] === declared[field])) {

package/runtime/scripts/amalgm-mcp/registry/index.js

@@ -684,6 +684,67 @@ function createRegistry(options) {
       });
     },
 
+    /**
+     * First cloud bootstrap may meet a pre-cloud local safe home. Its six
+     * roots and three exact managed nodes are platform truth, so they may
+     * adopt the authenticated cloud UUIDs without changing any user-owned
+     * descendant identity. This is one atomic graph rekey, never a delete or
+     * local-wins merge, and callers must prove that no ordinary entity-cloud
+     * history has begun before asking for it.
+     */
+    rebindBootstrapIdentities(bindings) {
+      if (!Array.isArray(bindings) || bindings.length === 0) {
+        throw new Error('bootstrap identity rebind requires one or more bindings');
+      }
+      return transaction(() => {
+        const byOld = new Map();
+        const byNew = new Map();
+        const mappings = bindings.map((binding) => {
+          if (!binding || typeof binding.oldUUID !== 'string' || typeof binding.newUUID !== 'string'
+            || !UUID.test(binding.oldUUID) || !UUID.test(binding.newUUID)
+            || (binding.newParentUUID !== null && (!UUID.test(binding.newParentUUID)))) {
+            throw new Error('bootstrap identity rebind has an invalid UUID binding');
+          }
+          const oldUuid = binding.oldUUID.toLowerCase();
+          const newUuid = binding.newUUID.toLowerCase();
+          if (byOld.has(oldUuid) || byNew.has(newUuid)) {
+            throw new Error('bootstrap identity rebind repeats an identity');
+          }
+          const row = mustGet(oldUuid);
+          if (row.status !== 'active' || row.type !== binding.type || row.name !== binding.name) {
+            throw new Error(`bootstrap identity ${oldUuid} does not match its declared local node`);
+          }
+          if (newUuid !== oldUuid && store.byUuid(newUuid)) {
+            throw new Error(`bootstrap identity ${newUuid} is already registered locally`);
+          }
+          const mapping = {
+            oldUuid,
+            newUuid,
+            newParentUuid: binding.newParentUUID === null ? null : binding.newParentUUID.toLowerCase(),
+            type: row.type,
+            name: row.name,
+            status: row.status,
+            payloadVersion: row.payloadVersion,
+            oldParentUuid: row.parentUuid,
+          };
+          byOld.set(oldUuid, mapping);
+          byNew.set(newUuid, mapping);
+          return mapping;
+        });
+        for (const mapping of mappings) {
+          const translatedParent = mapping.oldParentUuid === null
+            ? null
+            : (byOld.get(mapping.oldParentUuid)?.newUuid ?? mapping.oldParentUuid);
+          if (translatedParent !== mapping.newParentUuid) {
+            throw new Error(`bootstrap identity ${mapping.oldUuid} has a different authoritative parent`);
+          }
+        }
+        store.rebindIdentities(mappings);
+        membershipHashes.clear();
+        return mappings.map((mapping) => syncRecord(mustGet(mapping.newUuid)));
+      });
+    },
+
     record: (uuid) => record(mustGet(uuid)),
     syncRecord: (uuid) => syncRecord(mustGet(uuid)),
     /** Full logical graph for cloud snapshots. Machine bindings and evidence

package/runtime/scripts/amalgm-mcp/registry/store.js

@@ -300,6 +300,63 @@ function createStore(db) {
         WHERE uuid = ?
       `).run(type, parentUuid, name, status, payloadVersion, uuid);
     },
+    /**
+     * Rekey a small, already-validated identity set in one invisible SQLite
+     * transition. This is deliberately a store primitive, not a generic
+     * public CRUD verb: trusted bootstrap migration is the only caller.
+     *
+     * The old row is retired just long enough to free its active slot, a new
+     * row is born with the authoritative UUID, every direct child follows the
+     * new parent, then the retired row is removed. Nothing outside the
+     * transaction can observe the temporary state. UUID references held by
+     * local evidence, Git state, and managed references follow as well.
+     */
+    rebindIdentities(mappings) {
+      const retired = mappings.filter((mapping) => mapping.oldUuid !== mapping.newUuid);
+      const retire = db.prepare("UPDATE entities SET status = 'trashed' WHERE uuid = ?");
+      const insert = db.prepare(`
+        INSERT INTO entities (uuid, type, parent_uuid, name, status, payload_version)
+        VALUES (?, ?, ?, ?, ?, ?)
+      `);
+      const reparent = db.prepare('UPDATE entities SET parent_uuid = ? WHERE parent_uuid = ?');
+      const rebindChannels = db.prepare('UPDATE channel_bindings SET entity_uuid = ? WHERE entity_uuid = ?');
+      const rebindClaims = db.prepare('UPDATE contested_ground SET claimant_uuid = ? WHERE claimant_uuid = ?');
+      const rebindRepoState = db.prepare('UPDATE repo_states SET entity_uuid = ? WHERE entity_uuid = ?');
+      const rebindReference = db.prepare("UPDATE entities SET payload_version = ? WHERE type = 'reference' AND payload_version = ?");
+      const remove = db.prepare('DELETE FROM entities WHERE uuid = ?');
+
+      db.transaction(() => {
+        for (const mapping of retired) retire.run(mapping.oldUuid);
+
+        const remaining = new Map(retired.map((mapping) => [mapping.newUuid, mapping]));
+        while (remaining.size > 0) {
+          let inserted = false;
+          for (const mapping of [...remaining.values()]) {
+            if (remaining.has(mapping.newParentUuid)) continue;
+            insert.run(
+              mapping.newUuid,
+              mapping.type,
+              mapping.newParentUuid,
+              mapping.name,
+              mapping.status,
+              mapping.payloadVersion,
+            );
+            remaining.delete(mapping.newUuid);
+            inserted = true;
+          }
+          if (!inserted) throw new Error('identity rebind has a cyclic authoritative parent map');
+        }
+
+        for (const mapping of retired) reparent.run(mapping.newUuid, mapping.oldUuid);
+        for (const mapping of retired) {
+          rebindChannels.run(mapping.newUuid, mapping.oldUuid);
+          rebindClaims.run(mapping.newUuid, mapping.oldUuid);
+          rebindRepoState.run(mapping.newUuid, mapping.oldUuid);
+          rebindReference.run(mapping.newUuid, mapping.oldUuid);
+        }
+        for (const mapping of retired) remove.run(mapping.oldUuid);
+      })();
+    },
     /**
      * One address permutation as one write. Movers may hold each other's
      * slots, and the live unique index cannot be threaded one row at a

package/runtime/scripts/amalgm-mcp/server/routes/entities.js

@@ -135,9 +135,11 @@ async function handleEntityRoutes(ctx) {
       return true;
     }
     // A missing entity resource is first created from the same declared
-    // user-home graph that login owns. This is not an alternate registrar.
-    await service.bootstrapUserHome();
-    ctx.sendJson(200, service.entityCloud.bootstrap(service.registration.registry));
+    // user-home graph that login owns. This is not an alternate registrar:
+    // pre-cloud user registrations are deliberately excluded until their
+    // caller explicitly registers them after the bootstrap head is active.
+    const bootstrapRecords = await service.exactUserHomeCloudRecords();
+    ctx.sendJson(200, service.entityCloud.bootstrap(bootstrapRecords));
     return true;
   }
 
@@ -147,7 +149,8 @@ async function handleEntityRoutes(ctx) {
     const service = registrationService();
     try {
       const existing = service.entityCloud.replica();
-      let requiresBootstrapProof = existing?.state === 'reconciling-bootstrap';
+      let requiresBootstrapProof = existing?.state === 'bootstrapping'
+        || existing?.state === 'reconciling-bootstrap';
       try {
         const snapshot = JSON.parse(Buffer.from(String(body?.snapshotBase64 || ''), 'base64').toString('utf8'));
         requiresBootstrapProof ||= Number(body?.headVersion) === 0

package/runtime/scripts/amalgm-mcp/tests/entity-cloud.test.js

@@ -25,7 +25,7 @@ test('the entity cloud snapshot establishes identity, then each later entity com
   assert.equal(db.prepare('SELECT COUNT(*) AS count FROM entity_cloud_mutations').get().count, 0,
     'initial bootstrap identity is carried by the first immutable snapshot, not an unscoped tail');
 
-  const bootstrap = cloud.bootstrap(registry);
+  const bootstrap = cloud.bootstrap(registry.syncRecords());
   const snapshot = parseSnapshot(Buffer.from(bootstrap.snapshotBase64, 'base64'));
   assert.deepEqual(snapshot.records.map((record) => record.uuid), [root.uuid]);
   cloud.install({
@@ -64,7 +64,7 @@ test('a signed-in registration is refused until the cloud entity resource is act
   const registry = createRegistry({ db, ephemeral: true, emit: () => {}, journal: cloud.journal });
   assert.throws(() => cloud.assertRegistrationReady(), /entity cloud registry is not ready/);
   registry.enrollRoot({ type: 'workspace', name: 'bootstrap-only' });
-  const bootstrap = cloud.bootstrap(registry);
+  const bootstrap = cloud.bootstrap(registry.syncRecords());
   cloud.install({
     registry,
     resourceId: bootstrap.resourceId,
@@ -81,7 +81,7 @@ test('a large registration replaces the complete graph in one cloud operation an
   const cloud = createEntityCloud({ db, userId: 'user-1', deviceId: 'device-1' });
   const registry = createRegistry({ db, ephemeral: true, emit: () => {}, journal: cloud.journal });
   const root = registry.enrollRoot({ type: 'workspace', name: 'large-ground' });
-  const bootstrap = cloud.bootstrap(registry);
+  const bootstrap = cloud.bootstrap(registry.syncRecords());
   cloud.install({
     registry,
     resourceId: bootstrap.resourceId,
@@ -126,7 +126,7 @@ test('a large registration replaces the complete graph in one cloud operation an
   recipientDb.close();
 });
 
-test('only an exact verified bootstrap graph can repair a legacy empty entity resource', () => {
+test('a legacy empty entity resource repairs only the verified home and excludes unrelated local ground', () => {
   const db = new Database(':memory:');
   const cloud = createEntityCloud({ db, userId: 'user-1', deviceId: 'device-1' });
   const registry = createRegistry({ db, ephemeral: true, emit: () => {}, journal: cloud.journal });
@@ -172,21 +172,28 @@ test('only an exact verified bootstrap graph can repair a legacy empty entity re
   assert.equal(cloud.replica().state, 'active');
   assert.doesNotThrow(() => cloud.assertRegistrationReady());
 
-  const unsafeDb = new Database(':memory:');
-  const unsafeCloud = createEntityCloud({ db: unsafeDb, userId: 'user-1', deviceId: 'unsafe-device' });
-  const unsafeRegistry = createRegistry({ db: unsafeDb, ephemeral: true, emit: () => {}, journal: unsafeCloud.journal });
-  const safeRoot = unsafeRegistry.enrollRoot({ type: 'workspace', name: 'agents' });
-  unsafeRegistry.create({ type: 'file.text', parentUUID: safeRoot.uuid, name: 'not-a-default.md', payloadVersion: 'a'.repeat(64) });
-  assert.throws(() => unsafeCloud.install({
-    registry: unsafeRegistry,
+  const legacyDb = new Database(':memory:');
+  const legacyCloud = createEntityCloud({ db: legacyDb, userId: 'user-1', deviceId: 'legacy-device' });
+  const legacyRegistry = createRegistry({ db: legacyDb, ephemeral: true, emit: () => {}, journal: legacyCloud.journal });
+  const safeRoot = legacyRegistry.enrollRoot({ type: 'workspace', name: 'agents' });
+  const legacyRepo = legacyRegistry.create({ type: 'repo.git', parentUUID: safeRoot.uuid, name: 'old-local-repo' });
+  const verifiedHome = legacyRegistry.syncRecords().filter((record) => record.uuid === safeRoot.uuid);
+  const repaired = legacyCloud.install({
+    registry: legacyRegistry,
     resourceId,
     authorityEpoch: 1,
     headVersion: 0,
     snapshotBase64: empty.toString('base64'),
     snapshotChecksum: require('crypto').createHash('sha256').update(empty).digest('hex'),
-    bootstrapRecords: unsafeRegistry.syncRecords().filter((record) => record.uuid === safeRoot.uuid),
-  }), /conflicts with locally bound ground/,
-    'an empty cloud resource never authorizes arbitrary local ground');
+    bootstrapRecords: verifiedHome,
+  });
+  assert.equal(repaired.reconciling, true);
+  const repair = legacyCloud.claim();
+  assert.equal(repair.length, 1);
+  assert.equal(repair[0].operation.record.uuid, safeRoot.uuid,
+    'only the verified home node is queued into the automatic cloud graph');
+  assert.equal(legacyRegistry.syncRecord(legacyRepo.uuid).uuid, legacyRepo.uuid,
+    'unrelated local ground remains local until its caller explicitly registers it');
 });
 
 test('a compacted remote snapshot enters the cloud catalog, not locally watched identity, and add claims its immutable content', () => {

package/runtime/scripts/amalgm-mcp/tests/entity-content.test.js

@@ -32,7 +32,7 @@ test('file bytes are captured as bounded immutable chunks, then acknowledged bef
   const cloud = createEntityCloud({ db, userId: 'user-1', deviceId: 'device-1', content });
   const registry = createRegistry({ db, ephemeral: true, emit: () => {}, journal: cloud.journal });
   const root = registry.enrollRoot({ type: 'workspace', name: 'ground' });
-  const bootstrap = cloud.bootstrap(registry);
+  const bootstrap = cloud.bootstrap(registry.syncRecords());
   cloud.install({
     registry,
     resourceId: bootstrap.resourceId,

package/runtime/scripts/amalgm-mcp/tests/entity-materialization.test.js

@@ -344,7 +344,7 @@ test('add recreates an actual Git repository from verified Repocard cargo, then
     cloudUserId: 'user-1', cloudDeviceId: 'target-device',
   });
   try {
-    const bootstrap = source.entityCloud.bootstrap(source.registration.registry);
+    const bootstrap = source.entityCloud.bootstrap(source.registration.registry.syncRecords());
     source.entityCloud.install({
       registry: source.registration.registry, resourceId: bootstrap.resourceId,
       authorityEpoch: 1, headVersion: 0, snapshotBase64: bootstrap.snapshotBase64,

package/runtime/scripts/amalgm-mcp/tests/registration.service.test.js

@@ -233,6 +233,40 @@ test('user-home bootstrap creates only declared roots and registers them through
   );
 });
 
+test('entity-cloud bootstrap publishes only the verified user home when an old local repo exists', async () => {
+  const service = createRegistrationService({
+    dir: path.join(tempRoot, 'state-user-home-cloud-boundary'),
+    homeDir: path.join(tempRoot, 'user-home-cloud-boundary'),
+    cloudUserId: 'user-home-cloud-boundary',
+    cloudDeviceId: 'computer-user-home-cloud-boundary',
+  });
+  services.push(service);
+  const home = await service.bootstrapUserHome();
+  const workspaces = home.roots.find((entry) => entry.key === 'workspaces').record;
+  const oldRepo = service.registration.registry.create({
+    type: 'repo.git', parentUUID: workspaces.uuid, name: 'old-local-repo', payloadVersion: null,
+  });
+
+  const records = await service.exactUserHomeCloudRecords();
+  assert.equal(records.length, 9);
+  assert.equal(records.some((record) => record.uuid === oldRepo.uuid), false,
+    'login never turns existing user-selected ground into an implicit cloud registration');
+
+  const bootstrap = service.entityCloud.bootstrap(records);
+  const snapshot = JSON.parse(Buffer.from(bootstrap.snapshotBase64, 'base64').toString('utf8'));
+  assert.equal(snapshot.records.length, 9);
+  service.entityCloud.install({
+    registry: service.registration.registry,
+    resourceId: bootstrap.resourceId,
+    authorityEpoch: 1,
+    headVersion: 1,
+    snapshotBase64: bootstrap.snapshotBase64,
+    snapshotChecksum: bootstrap.snapshotChecksum,
+    bootstrapRecords: records,
+  });
+  assert.doesNotThrow(() => service.entityCloud.assertRegistrationReady());
+});
+
 test('a fresh machine binds existing user-home UUIDs before it starts watching', async () => {
   const first = createRegistrationService({
     dir: path.join(tempRoot, 'state-user-home-origin'),
@@ -262,6 +296,62 @@ test('a fresh machine binds existing user-home UUIDs before it starts watching',
     'only the bound identities enter Watch');
 });
 
+test('an older pre-cloud home adopts authenticated platform UUIDs without changing user descendants', async () => {
+  const authority = createRegistrationService({
+    dir: path.join(tempRoot, 'state-user-home-authority'),
+    homeDir: path.join(tempRoot, 'user-home-authority'),
+  });
+  const local = createRegistrationService({
+    dir: path.join(tempRoot, 'state-user-home-pre-cloud'),
+    homeDir: path.join(tempRoot, 'user-home-pre-cloud'),
+  });
+  services.push(authority, local);
+  const authoritative = await authority.bootstrapUserHome();
+  const before = await local.bootstrapUserHome();
+  const oldWorkspaces = before.roots.find((entry) => entry.key === 'workspaces').record;
+  const userProject = local.registration.registry.create({
+    type: 'folder', parentUUID: oldWorkspaces.uuid, name: 'user-project',
+  });
+
+  const snapshot = JSON.parse(JSON.stringify(authoritative.cloudSnapshot));
+  const rootIds = new Map();
+  for (const root of snapshot.roots) {
+    root.record.uuid = crypto.randomUUID();
+    rootIds.set(root.key, root.record.uuid);
+  }
+  for (const managed of snapshot.exactManaged) {
+    if (managed.relativePath === managed.key.replace(/-root$/, '')) {
+      managed.record.uuid = rootIds.get(managed.key.replace(/-root$/, ''));
+      managed.record.parentUUID = null;
+    } else {
+      managed.record.uuid = crypto.randomUUID();
+      managed.record.parentUUID = rootIds.get(managed.relativePath.split('/')[0]);
+    }
+  }
+
+  const rebound = await local.bootstrapUserHome({ identitySnapshot: snapshot });
+  const reboundWorkspaces = rebound.roots.find((entry) => entry.key === 'workspaces').record;
+  assert.equal(reboundWorkspaces.uuid, rootIds.get('workspaces'));
+  assert.equal(local.registration.registry.syncRecord(userProject.uuid).uuid, userProject.uuid,
+    'the user project keeps its permanent identity');
+  assert.equal(local.registration.registry.syncRecord(userProject.uuid).parentUUID, reboundWorkspaces.uuid,
+    'only its parent now names the cloud-authoritative platform root');
+  assert.deepEqual(
+    rebound.exactManaged.map((entry) => entry.record.uuid),
+    snapshot.exactManaged.map((entry) => entry.record.uuid),
+    'the three exact system nodes and six roots now use the signed cloud identities',
+  );
+  const db = new Database(path.join(local.dir, 'identity.db'), { readonly: true });
+  try {
+    assert.equal(db.prepare('SELECT COUNT(*) AS count FROM entities WHERE uuid = ?').get(oldWorkspaces.uuid).count, 0,
+      'the superseded platform root is not retained as a second active identity');
+  } finally {
+    db.close();
+  }
+  assert.equal(local.observer.status().every((root) => root.watching && !root.degraded), true,
+    'rekeying identity preserves every existing watcher');
+});
+
 test('a signed-in register call writes every entity delivery intent in identity.db before Watch begins', async () => {
   const service = createRegistrationService({
     dir: path.join(tempRoot, 'state-cloud-register'),
@@ -270,7 +360,7 @@ test('a signed-in register call writes every entity delivery intent in identity.
     cloudDeviceId: 'computer-cloud-register',
   });
   const home = await service.bootstrapUserHome();
-  const bootstrap = service.entityCloud.bootstrap(service.registration.registry);
+  const bootstrap = service.entityCloud.bootstrap(service.registration.registry.syncRecords());
   service.entityCloud.install({
     registry: service.registration.registry,
     resourceId: bootstrap.resourceId,
@@ -310,7 +400,7 @@ test('a large signed-in register call publishes one complete cloud graph before
     cloudUserId: 'user-cloud-register-large',
     cloudDeviceId: 'computer-cloud-register-large',
   });
-  const bootstrap = service.entityCloud.bootstrap(service.registration.registry);
+  const bootstrap = service.entityCloud.bootstrap(service.registration.registry.syncRecords());
   service.entityCloud.install({
     registry: service.registration.registry,
     resourceId: bootstrap.resourceId,