narraeon 0.1.1 → 0.3.0

package/dist/node/runtime/world/FileNativeWorldStore.js

@@ -1,12 +1,17 @@
 import { createHash, randomUUID } from "node:crypto";
-import { link, mkdir, open, readFile, readdir, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { inspectContentPackageCurrentTree, isContentPackageWorldDocumentPath, } from "../content/FileNativeContentTree.js";
 import { FileNativePromptCompiler, } from "../prompt/FileNativePromptCompiler.js";
 import { PlayerViewRenderer } from "./PlayerViewRenderer.js";
 import { WorldDocumentStore } from "./WorldDocumentStore.js";
+import { FileNativePlayTimelineStore } from "../play/FileNativePlayTimelineStore.js";
+import { FileNativePlayAdvanceStore } from "../play/FileNativePlayAdvanceStore.js";
+import { FileNativeWorldStorageMigrator } from "./FileNativeWorldStorageMigrator.js";
+import { FileNativeAuthorityV3, FileNativeAuthorityV3Error, } from "./FileNativeAuthorityV3.js";
 import { FileNativeWorldOperationCoordinator, WorldOperationBusyError, } from "./WorldOperationCoordinator.js";
+import { fileNativeHistoryMessageIdFromProjectionPath, projectFileNativeHistorySurface, } from "./FileNativeHistoryProjection.js";
 const publicationFile = "publication.json";
 const localMetadataFile = "local.json";
 export class FileNativeWorldCreationError extends Error {
@@ -29,6 +34,11 @@ export class FileNativeWorldStore {
     #promptCompiler;
     #activeControlUsers = new Map();
     operations;
+    playTimeline;
+    playAdvances;
+    #storageMigrator;
+    #storageMigrations = new Map();
+    #currentStorage = new Set();
     constructor(dataRoot, options = {}) {
         const root = resolve(dataRoot);
         this.#worldsRoot = join(root, "worlds-file-native");
@@ -36,6 +46,62 @@ export class FileNativeWorldStore {
         this.#promptCompiler =
             options.promptCompiler ?? new FileNativePromptCompiler();
         this.operations = new FileNativeWorldOperationCoordinator(root);
+        this.playTimeline = new FileNativePlayTimelineStore(root);
+        this.playAdvances = new FileNativePlayAdvanceStore(root);
+        this.#storageMigrator = new FileNativeWorldStorageMigrator(root, this.playTimeline);
+    }
+    /**
+     * Upgrade a formally released cumulative layout before current Authority or
+     * play-timeline behavior crosses its seam. Concurrent callers share one
+     * in-process promise; the durable world lock serializes processes.
+     */
+    async ensureCurrentStorage(worldId) {
+        assertIdentity(worldId, "World ID");
+        if (this.#currentStorage.has(worldId))
+            return;
+        const existing = this.#storageMigrations.get(worldId);
+        if (existing !== undefined)
+            return existing;
+        const migration = this.#ensureCurrentStorageSerialized(worldId);
+        this.#storageMigrations.set(worldId, migration);
+        try {
+            await migration;
+        }
+        finally {
+            if (this.#storageMigrations.get(worldId) === migration)
+                this.#storageMigrations.delete(worldId);
+        }
+    }
+    async #ensureCurrentStorageSerialized(worldId) {
+        try {
+            const root = join(this.#worldsRoot, worldId);
+            const authority = new FileNativeAuthorityV3(root);
+            if (await authority.exists()) {
+                await authority.readHead();
+                this.#currentStorage.add(worldId);
+                return;
+            }
+            await this.operations.withWorldAuthorityLock(worldId, async () => {
+                await this.#storageMigrator.migrate(worldId);
+            });
+            this.#currentStorage.add(worldId);
+        }
+        catch (error) {
+            if (error instanceof FileNativeWorldCreationError)
+                throw error;
+            if (isNodeError(error) && error.code === "ENOENT") {
+                const root = await stat(join(this.#worldsRoot, worldId)).catch((statError) => {
+                    if (isNodeError(statError) && statError.code === "ENOENT")
+                        return null;
+                    throw statError;
+                });
+                if (root === null)
+                    throw new FileNativeWorldNotFoundError({ cause: error });
+            }
+            if (error instanceof WorldOperationBusyError)
+                throw new FileNativeWorldCreationError("operation_conflict", "World storage is being upgraded by another durable operation", { cause: error });
+            throw new FileNativeWorldCreationError("world_corrupt", "Released world storage could not be migrated to the current format", error instanceof Error ? { cause: error } : undefined);
+        }
     }
     async listWorlds() {
         await mkdir(this.#worldsRoot, { recursive: true, mode: 0o700 });
@@ -90,6 +156,7 @@ export class FileNativeWorldStore {
         }
         return this.operations.withExclusiveWorldStateMutation(worldId, async () => {
             await rm(root, { recursive: true, force: true });
+            this.#currentStorage.delete(worldId);
             return { deleted: true };
         });
     }
@@ -148,7 +215,7 @@ export class FileNativeWorldStore {
         await mkdir(this.#operationsRoot, { recursive: true, mode: 0o700 });
         await rm(stagingRoot, { recursive: true, force: true });
         try {
-            const openingMessage = genesisOpeningMessage(worldId, openingText(packageFiles));
+            const openingMessage = genesisOpeningMessage(openingText(packageFiles));
             const initialMaterials = [
                 { kind: "history_message", message: openingMessage.messageId },
             ];
@@ -156,7 +223,7 @@ export class FileNativeWorldStore {
             await writeSurface(stagingRoot, "control", control);
             await mkdir(join(stagingRoot, "history"), { recursive: true });
             await mkdir(join(stagingRoot, "runtime"), { recursive: true });
-            await writeIdempotentText(join(stagingRoot, "history", `00000000-${historyFileName(1, openingMessage)}`), openingMessage.exactText);
+            await writeIdempotentText(join(stagingRoot, "history", historySurfaceFiles([openingMessage])[0].path), openingMessage.exactText);
             const genesis = {
                 schemaVersion: 1,
                 type: "file_native_genesis",
@@ -169,8 +236,22 @@ export class FileNativeWorldStore {
                 additionalMaterials: initialMaterials,
             };
             await writeJson(join(stagingRoot, "runtime", "genesis.json"), genesis);
+            await writeJson(join(stagingRoot, "runtime", "play-genesis-timeline.json"), {
+                schemaVersion: 1,
+                worldId,
+                history: genesis.history,
+            });
+            await new FileNativeAuthorityV3(stagingRoot).initialize({
+                operationId: input.operationId,
+                state,
+                history: [openingMessage],
+                additionalMaterials: initialMaterials,
+            });
             await writeJson(join(stagingRoot, "runtime", "materialized-head.json"), {
+                schemaVersion: 3,
                 head: "genesis",
+                sequence: 0,
+                commitDigest: null,
             });
             await writeJson(join(stagingRoot, "runtime", "additional-materials.json"), { head: "genesis", items: initialMaterials });
             const publication = {
@@ -215,6 +296,7 @@ export class FileNativeWorldStore {
     }
     async readSurface(worldId, surface) {
         assertIdentity(worldId, "World ID");
+        await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
         if (surface === "runtime") {
@@ -236,28 +318,37 @@ export class FileNativeWorldStore {
      * must never pair a mutable state tree with a different response head.
      */
     async renderPlayerViewsAtHead(worldId, head) {
-        const endpoint = await this.recoverEndpoint(worldId, head);
-        const control = await this.readSurface(worldId, "control");
+        const root = join(this.#worldsRoot, worldId);
+        const materialized = await readOptionalJson(join(root, "runtime", "materialized-head.json"));
+        const [state, control] = await Promise.all([
+            materialized?.head === head
+                ? readTree(join(root, "state"))
+                : this.recoverEndpoint(worldId, head).then(({ state }) => state),
+            this.readSurface(worldId, "control"),
+        ]);
         const source = control.find(({ path }) => path === "player-views.yaml");
         return new PlayerViewRenderer().render({
-            snapshot: openWorldDocumentSnapshot(endpoint.state),
+            snapshot: openWorldDocumentSnapshot(state),
             control: source?.contents ?? "",
         });
     }
     async currentHead(worldId) {
         assertIdentity(worldId, "World ID");
+        await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
-        return (await readAcceptedAuthority(root))?.head ?? "genesis";
+        return (await new FileNativeAuthorityV3(root).readHead()).head;
     }
     async currentHeadOperationId(worldId) {
         assertIdentity(worldId, "World ID");
+        await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
-        return ((await readAcceptedAuthority(root))?.commits.at(-1)?.operationId ?? null);
+        return new FileNativeAuthorityV3(root).currentOperationId();
     }
     async saveControlDraft(worldId, files) {
         assertIdentity(worldId, "World ID");
+        await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
         for (const file of files)
@@ -350,6 +441,7 @@ export class FileNativeWorldStore {
     }
     async #readControlDraft(worldId) {
         assertIdentity(worldId, "World ID");
+        await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
         const [state, draft] = await Promise.all([
@@ -363,6 +455,7 @@ export class FileNativeWorldStore {
     /** Bind the current Authority endpoint for a model-directed play call chain. */
     async bindPlayCallChain(worldId) {
         assertIdentity(worldId, "World ID");
+        await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         try {
             await readPublicationAt(root);
@@ -384,61 +477,47 @@ export class FileNativeWorldStore {
         }
         try {
             return await this.operations.withWorldAuthorityLock(worldId, async () => {
-                const publishedAuthority = await readAcceptedAuthority(root);
-                if (publishedAuthority !== null) {
-                    const materialized = await readOptionalJson(join(root, "runtime", "materialized-head.json"));
-                    let materializedIndex = 0;
-                    if (materialized !== null && materialized.head !== "genesis") {
-                        const found = publishedAuthority.commits.findIndex(({ head }) => head === materialized.head);
-                        if (found < 0)
-                            throw new FileNativeWorldCreationError("world_corrupt", "World materialized head does not belong to the authority commit chain");
-                        materializedIndex = found + 1;
-                    }
-                    for (let index = materializedIndex; index < publishedAuthority.commits.length; index += 1) {
-                        const commit = publishedAuthority.commits[index];
-                        await materializePlayCommit(root, index + 1, {
-                            mode: commit.mode,
-                            historyAppend: commit.historyAppend,
-                            nextMaterials: commit.nextAdditionalMaterials,
-                            stateChanges: commit.stateChanges ?? [],
-                            ...(commit.timelineRevision === undefined
-                                ? {}
-                                : { timelineRevision: commit.timelineRevision }),
-                        });
-                        await publishJson(this.#operationOutcomePath(commit.operationId), {
-                            outcome: "committed",
-                            worldId,
-                            parentHead: commit.parentHead,
-                            head: commit.head,
-                            historyAppend: commit.historyAppend.map(({ role, exactText }) => ({ role, exactText })),
-                            nextAdditionalMaterials: commit.nextAdditionalMaterials,
-                            mode: commit.mode,
-                        });
+                const authorityStore = new FileNativeAuthorityV3(root);
+                const authority = await authorityStore.readHead();
+                const checkpoint = await readMaterializedCheckpoint(root);
+                if (!sameMaterializedEndpoint(checkpoint, authority)) {
+                    const recovered = await authorityStore.recover();
+                    let operation = null;
+                    if (authority.operationId !== null && authority.sequence > 0) {
+                        const candidate = await this.getOperationOutcome(authority.operationId);
+                        if (isCommittedOutcome(candidate)) {
+                            if (candidate.worldId !== worldId ||
+                                candidate.head !== authority.head ||
+                                candidate.commitDigest !== authority.commitDigest)
+                                throw new FileNativeWorldCreationError("world_corrupt", "Current Authority head is bound to a different operation receipt");
+                            operation = candidate;
+                        }
+                        else if (candidate.outcome !== "not_started") {
+                            throw new FileNativeWorldCreationError("world_corrupt", "Current Authority head has no recoverable acceptance receipt");
+                        }
                     }
-                    await publishJson(join(root, "runtime", "materialized-head.json"), {
-                        head: publishedAuthority.head,
-                    });
+                    await materializeRecoveredEndpoint(root, authority, recovered);
+                    if (operation !== null)
+                        await publishJson(this.#operationOutcomePath(authority.operationId), { ...operation, outcome: "committed" });
                 }
-                const [state, control, authority, materials, recovered] = await Promise.all([
+                const [state, control, history, materials] = await Promise.all([
                     readTree(join(root, "state")),
                     readTree(join(root, "control")),
-                    readAcceptedAuthority(root),
+                    readTree(join(root, "history")),
                     readOptionalJson(join(root, "runtime", "additional-materials.json")),
-                    this.recoverEndpoint(worldId),
                 ]);
+                if ((materials?.head ?? "genesis") !== authority.head)
+                    throw new FileNativeWorldCreationError("inconsistent_materialization", "Materialized additional materials do not match the current Authority endpoint");
                 return {
                     worldId,
-                    parentHead: authority?.head ?? "genesis",
+                    parentHead: authority.head,
                     files: [...state, ...control].reduce((files, { path, contents }, index) => {
                         files[`${index < state.length ? "state" : "control"}/${path}`] =
                             contents;
                         return files;
                     }, {}),
                     additionalMaterials: materials?.items ?? [],
-                    history: Object.fromEntries(recovered.history.map(({ messageId, exactText }) => [
-                        messageId,
-                        exactText,
-                    ])),
+                    history: materializedHistoryRecord(history),
                 };
             });
         }
@@ -479,73 +558,33 @@ export class FileNativeWorldStore {
     }
     async recoverEndpoint(worldId, head) {
         assertIdentity(worldId, "World ID");
+        await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
-        const genesis = await readJson(join(root, "runtime", "genesis.json"));
-        for (const file of [...genesis.state, ...genesis.control])
-            if (sha256(file.canonicalBytes) !== file.sha256)
-                throw new FileNativeWorldCreationError("world_corrupt", `Genesis file hash does not match: ${file.path}`);
-        const authority = await readAcceptedAuthority(root);
-        const target = head ?? authority?.head ?? "genesis";
-        const commits = authority?.commits ?? [];
-        const end = target === "genesis"
-            ? 0
-            : commits.findIndex((commit) => commit.head === target) + 1;
-        if (target !== "genesis" && end === 0)
-            throw new FileNativeWorldCreationError("world_corrupt", `Cannot rebuild endpoint from immutable authority chain: ${target}`);
-        const state = new Map(genesis.state.map((file) => [file.path, file.canonicalBytes]));
-        const history = structuredClone(genesis.history);
-        let additionalMaterials = genesis.additionalMaterials;
-        for (const commit of commits.slice(0, end)) {
-            if (commit.mode === "timeline_revision") {
-                const revision = commit.timelineRevision;
-                if (revision === undefined)
-                    throw new FileNativeWorldCreationError("world_corrupt", "Timeline-revision commit is missing its recovery snapshot");
-                const restored = await this.recoverEndpoint(worldId, revision.restoresHead);
-                if (!isDeepStrictEqual(revision.replacementState, immutableFiles(restored.state)) ||
-                    !isDeepStrictEqual(revision.replacementHistory, restored.history) ||
-                    !isDeepStrictEqual(commit.nextAdditionalMaterials, restored.additionalMaterials))
-                    throw new FileNativeWorldCreationError("world_corrupt", "Timeline-revision recovery snapshot does not match its logical parent endpoint");
-                state.clear();
-                for (const file of revision.replacementState) {
-                    if (sha256(file.canonicalBytes) !== file.sha256)
-                        throw new FileNativeWorldCreationError("world_corrupt", `Timeline-revision state hash does not match: ${file.path}`);
-                    state.set(file.path, file.canonicalBytes);
-                }
-                history.splice(0, history.length, ...structuredClone(revision.replacementHistory));
-            }
-            else {
-                for (const change of commit.stateChanges) {
-                    const existing = state.get(change.relativePath);
-                    const existingHash = existing === undefined ? null : sha256(existing);
-                    if (existingHash !== change.expectedPreviousHash)
-                        throw new FileNativeWorldCreationError("world_corrupt", `Immutable commit-chain previous hash does not match: ${change.relativePath}`);
-                    if (sha256(change.canonicalNextBytes) !== change.nextHash)
-                        throw new FileNativeWorldCreationError("world_corrupt", `Immutable commit-chain next hash does not match: ${change.relativePath}`);
-                    state.set(change.relativePath, change.canonicalNextBytes);
-                }
-            }
-            history.push(...structuredClone(commit.historyAppend));
-            additionalMaterials = structuredClone(commit.nextAdditionalMaterials);
+        try {
+            const recovered = await new FileNativeAuthorityV3(root).recover(head);
+            return {
+                worldId,
+                head: recovered.head,
+                state: recovered.state,
+                history: recovered.history,
+                additionalMaterials: recovered.additionalMaterials,
+            };
+        }
+        catch (error) {
+            if (error instanceof FileNativeWorldCreationError)
+                throw error;
+            throw new FileNativeWorldCreationError("world_corrupt", `Cannot recover immutable Authority endpoint${head === undefined ? "" : `: ${head}`}`, error instanceof Error ? { cause: error } : undefined);
         }
-        return {
-            worldId,
-            head: target,
-            state: [...state]
-                .map(([path, contents]) => ({ path, contents }))
-                .sort((a, b) => a.path.localeCompare(b.path)),
-            history,
-            additionalMaterials,
-        };
     }
     async repairMaterialization(worldId) {
         assertIdentity(worldId, "World ID");
+        await this.ensureCurrentStorage(worldId);
         try {
             const operationId = await this.operations.withExclusiveWorldStateMutation(worldId, async () => {
                 await this.bindPlayCallChain(worldId);
                 const root = join(this.#worldsRoot, worldId);
-                const authority = await readAcceptedAuthority(root);
-                return authority?.commits.at(-1)?.operationId ?? null;
+                return (await new FileNativeAuthorityV3(root).readHead()).operationId;
             });
             return operationId === null
                 ? { outcome: "not_started" }
@@ -572,6 +611,7 @@ export class FileNativeWorldStore {
         const finalRoot = join(this.#worldsRoot, worldId);
         const previous = await readOptionalJson(operationPath);
         if (previous !== null) {
+            await this.ensureCurrentStorage(previous.worldId);
             if (!(await derivationPublicationMatches(join(this.#worldsRoot, previous.worldId), previous, input, requestFingerprint)))
                 throw new FileNativeWorldCreationError("operation_conflict", "The same fork operation ID is bound to a different fork payload");
             return {
@@ -581,6 +621,7 @@ export class FileNativeWorldStore {
         }
         const alreadyPublished = await readOptionalJson(join(finalRoot, publicationFile));
         if (alreadyPublished !== null) {
+            await this.ensureCurrentStorage(alreadyPublished.worldId);
             if (!(await derivationPublicationMatches(finalRoot, alreadyPublished, input, requestFingerprint)))
                 throw new FileNativeWorldCreationError("operation_conflict", "Published fork world does not match the operation payload");
             await mkdir(this.#operationsRoot, { recursive: true, mode: 0o700 });
@@ -590,98 +631,112 @@ export class FileNativeWorldStore {
                 world: await this.#currentSummary(alreadyPublished),
             };
         }
-        const sourceRoot = join(this.#worldsRoot, input.sourceWorldId);
-        const sourcePublication = await readPublicationAt(sourceRoot);
-        const sourceSummary = await readWorldSummaryAt(sourceRoot, sourcePublication);
-        const [sourceGenesis, selected, sourceAuthority, control] = await Promise.all([
-            this.recoverEndpoint(input.sourceWorldId, "genesis"),
-            this.recoverEndpoint(input.sourceWorldId, input.sourceHead),
-            readAcceptedAuthority(sourceRoot),
-            readTree(join(sourceRoot, "control")),
-        ]);
-        const cloned = cloneAuthorityPrefix({
-            sourceWorldId: input.sourceWorldId,
-            sourceHead: input.sourceHead,
-            targetWorldId: worldId,
-            sourceGenesis,
-            sourceAuthority,
-        });
-        const staging = join(this.#worldsRoot, `.staging-${worldId}-${randomUUID()}`);
-        await mkdir(this.#worldsRoot, { recursive: true, mode: 0o700 });
-        await mkdir(this.#operationsRoot, { recursive: true, mode: 0o700 });
-        try {
-            await writeSurface(staging, "state", sourceGenesis.state);
-            await writeSurface(staging, "control", control);
-            await mkdir(join(staging, "history"), { recursive: true });
-            await mkdir(join(staging, "runtime"), { recursive: true });
-            for (const [index, message] of cloned.genesisHistory.entries())
-                await writeIdempotentText(join(staging, "history", `00000000-${historyFileName(index + 1, message)}`), message.exactText);
-            const genesis = {
-                schemaVersion: 1,
-                type: "file_native_genesis",
-                worldId,
-                operationId: input.operationId,
-                parentEndpoint: "genesis",
-                state: immutableFiles(sourceGenesis.state),
-                control: immutableFiles(control),
-                history: cloned.genesisHistory,
-                additionalMaterials: cloned.genesisMaterials,
-            };
-            await writeJson(join(staging, "runtime", "genesis.json"), genesis);
-            await writeJson(join(staging, "runtime", "additional-materials.json"), {
-                head: "genesis",
-                items: cloned.genesisMaterials,
-            });
-            for (const [index, commit] of cloned.commits.entries()) {
-                await publishImmutableJson(join(staging, "runtime", "play-commits", `${createHash("sha256").update(JSON.stringify(commit)).digest("hex")}.json`), commit);
-                await materializePlayCommit(staging, index + 1, {
-                    mode: commit.mode,
-                    historyAppend: commit.historyAppend,
-                    nextMaterials: commit.nextAdditionalMaterials,
-                    stateChanges: commit.stateChanges,
-                    ...(commit.timelineRevision === undefined
-                        ? {}
-                        : { timelineRevision: commit.timelineRevision }),
+        await this.ensureCurrentStorage(input.sourceWorldId);
+        const retainSourceSnapshot = async () => {
+            const sourceRoot = join(this.#worldsRoot, input.sourceWorldId);
+            const sourcePublication = await readPublicationAt(sourceRoot);
+            const sourceSummary = await readWorldSummaryAt(sourceRoot, sourcePublication);
+            const sourceAuthority = new FileNativeAuthorityV3(sourceRoot);
+            const [sourceGenesis, control] = await Promise.all([
+                readGenesisForFork(sourceRoot, input.sourceWorldId),
+                readTree(join(sourceRoot, "control")),
+            ]);
+            const staging = join(this.#worldsRoot, `.staging-${worldId}-${randomUUID()}`);
+            await mkdir(this.#worldsRoot, { recursive: true, mode: 0o700 });
+            await mkdir(this.#operationsRoot, { recursive: true, mode: 0o700 });
+            try {
+                await mkdir(join(staging, "runtime"), { recursive: true });
+                const clonedHead = await sourceAuthority.clonePrefixTo({
+                    targetWorldRoot: staging,
+                    selectedHead: input.sourceHead,
+                    operationId: input.operationId,
                 });
-            }
-            if (cloned.commits.length > 0)
-                await writeJson(join(staging, "runtime", "play-authority.json"), {
+                const selected = await new FileNativeAuthorityV3(staging).recoverHeadResult();
+                await writeSurface(staging, "state", selected.state);
+                await writeSurface(staging, "control", control);
+                await mkdir(join(staging, "history"), { recursive: true });
+                for (const file of historySurfaceFiles(selected.history))
+                    await writeIdempotentText(join(staging, "history", file.path), file.contents);
+                const genesis = {
                     schemaVersion: 1,
+                    type: "file_native_genesis",
+                    worldId,
+                    operationId: input.operationId,
+                    parentEndpoint: "genesis",
+                    state: structuredClone(sourceGenesis.state),
+                    control: immutableFiles(control),
+                    history: structuredClone(sourceGenesis.history),
+                    additionalMaterials: structuredClone(sourceGenesis.additionalMaterials),
+                };
+                await writeJson(join(staging, "runtime", "genesis.json"), genesis);
+                await writeJson(join(staging, "runtime", "play-genesis-timeline.json"), {
+                    schemaVersion: 1,
+                    worldId,
+                    history: genesis.history,
+                });
+                await writeJson(join(staging, "runtime", "additional-materials.json"), {
                     head: input.sourceHead,
-                    commits: cloned.commits,
+                    items: selected.additionalMaterials,
                 });
-            await writeJson(join(staging, "runtime", "materialized-head.json"), {
-                head: input.sourceHead,
-            });
-            const materializedState = await readTree(join(staging, "state"));
-            if (!isDeepStrictEqual(materializedState, selected.state))
-                throw new FileNativeWorldCreationError("world_corrupt", "Fork Authority prefix cannot rebuild the source endpoint state");
-            const publication = {
-                schemaVersion: 1,
-                worldId,
-                title: derivedWorldName(sourceSummary.title),
-                parentEndpoint: "genesis",
-                operationId: input.operationId,
-                sourceFingerprint: requestFingerprint,
-            };
-            await writeJson(join(staging, publicationFile), publication);
-            await durableTree(staging);
-            crashAtFileNativeAuthorityEdge("derivation_before_publish");
-            await rename(staging, finalRoot);
-            await syncDirectory(this.#worldsRoot);
-            crashAtFileNativeAuthorityEdge("derivation_after_publish");
-            await publishJson(operationPath, publication);
-            return { outcome: "derived", world: toSummary(publication) };
+                await writeJson(join(staging, "runtime", "materialized-head.json"), {
+                    schemaVersion: 3,
+                    head: input.sourceHead,
+                    sequence: clonedHead.sequence,
+                    commitDigest: clonedHead.commitDigest,
+                });
+                await input.stageTarget?.({
+                    targetWorldRoot: staging,
+                    targetWorldId: worldId,
+                    binding: {
+                        worldId,
+                        parentHead: input.sourceHead,
+                        files: [...selected.state, ...control].reduce((files, { path, contents }, index) => {
+                            files[`${index < selected.state.length ? "state" : "control"}/${path}`] = contents;
+                            return files;
+                        }, {}),
+                        additionalMaterials: structuredClone(selected.additionalMaterials),
+                        history: Object.fromEntries(selected.history.map(({ messageId, exactText }) => [
+                            messageId,
+                            exactText,
+                        ])),
+                    },
+                });
+                crashAtFileNativeAuthorityEdge("derivation_after_target_staging");
+                const publication = {
+                    schemaVersion: 1,
+                    worldId,
+                    title: derivedWorldName(sourceSummary.title),
+                    parentEndpoint: "genesis",
+                    operationId: input.operationId,
+                    sourceFingerprint: requestFingerprint,
+                };
+                await writeJson(join(staging, publicationFile), publication);
+                await durableTree(staging);
+                crashAtFileNativeAuthorityEdge("derivation_before_publish");
+                await rename(staging, finalRoot);
+                await syncDirectory(this.#worldsRoot);
+                crashAtFileNativeAuthorityEdge("derivation_after_publish");
+                await publishJson(operationPath, publication);
+                return { outcome: "derived", world: toSummary(publication) };
+            }
+            catch (error) {
+                await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+                const published = await readOptionalJson(join(finalRoot, publicationFile));
+                if (published !== null) {
+                    if (!(await derivationPublicationMatches(finalRoot, published, input, requestFingerprint)))
+                        throw new FileNativeWorldCreationError("operation_conflict", "Published fork world does not match the operation payload");
+                    await publishJson(operationPath, published);
+                    return { outcome: "derived", world: toSummary(published) };
+                }
+                throw error;
+            }
+        };
+        try {
+            return await this.operations.withExclusiveWorldStateMutation(input.sourceWorldId, async () => this.operations.withWorldAuthorityLock(input.sourceWorldId, retainSourceSnapshot));
         }
         catch (error) {
-            await rm(staging, { recursive: true, force: true }).catch(() => undefined);
-            const published = await readOptionalJson(join(finalRoot, publicationFile));
-            if (published !== null) {
-                if (!(await derivationPublicationMatches(finalRoot, published, input, requestFingerprint)))
-                    throw new FileNativeWorldCreationError("operation_conflict", "Published fork world does not match the operation payload");
-                await publishJson(operationPath, published);
-                return { outcome: "derived", world: toSummary(published) };
-            }
+            if (error instanceof WorldOperationBusyError)
+                throw new FileNativeWorldCreationError("operation_conflict", "The source world is changing and cannot provide one stable fork snapshot", { cause: error });
             throw error;
         }
     }
@@ -698,7 +753,15 @@ export class FileNativeWorldStore {
         assertIdentity(operationId, "operation ID");
         let directRecord;
         try {
-            const value = await readOptionalJson(this.#operationOutcomePath(operationId));
+            let value = await readOptionalJson(this.#operationOutcomePath(operationId));
+            if (isRecord(value) &&
+                (value.outcome === "acceptance_prepared" ||
+                    value.outcome === "committed" ||
+                    value.outcome === "committed_materialization_pending") &&
+                typeof value.worldId === "string") {
+                await this.ensureCurrentStorage(value.worldId);
+                value = await readOptionalJson(this.#operationOutcomePath(operationId));
+            }
             if (value === null)
                 directRecord = null;
             else {
@@ -711,46 +774,18 @@ export class FileNativeWorldStore {
                 throw error;
             throw new FileNativeWorldCreationError("world_corrupt", "Authority operation outcome has an invalid structure", error instanceof Error ? { cause: error } : undefined);
         }
+        if (directRecord?.outcome === "acceptance_prepared")
+            return resolvePreparedOperationOutcome(this.#worldsRoot, operationId, directRecord);
         const direct = directRecord === null ? null : projectOperationOutcome(directRecord);
         if (direct?.outcome === "committed" ||
             direct?.outcome === "committed_materialization_pending") {
-            if (direct.outcome === "committed") {
-                await assertCommittedAuthorityOutcomeMatches(join(this.#worldsRoot, direct.worldId), operationId, direct);
-                const materialized = await readOptionalJson(join(this.#worldsRoot, direct.worldId, "runtime", "materialized-head.json"));
-                if (materialized?.head !== direct.head)
-                    return { ...direct, outcome: "committed_materialization_pending" };
-            }
-            else {
-                await assertCommittedAuthorityOutcomeMatches(join(this.#worldsRoot, direct.worldId), operationId, direct);
-                await assertPendingMaterializationCompatible(join(this.#worldsRoot, direct.worldId), operationId);
-            }
-            return direct;
-        }
-        const worlds = await readDirectoryNames(this.#worldsRoot);
-        for (const worldId of worlds) {
-            const authority = await readAcceptedAuthority(join(this.#worldsRoot, worldId));
-            const commitIndex = authority?.commits.findIndex((candidate) => candidate.operationId === operationId) ?? -1;
-            const commit = authority?.commits[commitIndex];
-            if (commit !== undefined) {
-                const materialized = await readOptionalJson(join(this.#worldsRoot, worldId, "runtime", "materialized-head.json"));
-                const materializedIndex = materialized?.head === "genesis"
-                    ? -1
-                    : (authority?.commits.findIndex(({ head }) => head === materialized?.head) ?? -1);
-                return {
-                    outcome: materializedIndex >= commitIndex
-                        ? "committed"
-                        : "committed_materialization_pending",
-                    worldId,
-                    parentHead: commit.parentHead,
-                    head: commit.head,
-                    historyAppend: commit.historyAppend.map(({ role, exactText }) => ({
-                        role,
-                        exactText,
-                    })),
-                    nextAdditionalMaterials: commit.nextAdditionalMaterials,
-                    mode: commit.mode,
-                };
-            }
+            const worldRoot = join(this.#worldsRoot, direct.worldId);
+            const commit = await assertCommittedAuthorityOutcomeMatches(worldRoot, direct);
+            const materialized = await readMaterializedCheckpoint(worldRoot);
+            if (materialized !== null && materialized.sequence >= commit.sequence)
+                return { ...direct, outcome: "committed" };
+            await assertPendingMaterializationCompatible(worldRoot, direct);
+            return { ...direct, outcome: "committed_materialization_pending" };
         }
         return direct?.outcome === "in_progress"
             ? { outcome: "in_progress" }
@@ -773,11 +808,13 @@ export class FileNativeWorldStore {
             throw new TypeError("Edited player message cannot be empty");
         if (!/^sha256:[a-f0-9]{64}$/u.test(input.requestFingerprint))
             throw new TypeError("Timeline-revision request fingerprint is invalid");
+        await this.ensureCurrentStorage(input.worldId);
         const existing = await this.getOperationOutcome(input.operationId);
         if (isCommittedOutcome(existing)) {
-            const authority = await readAcceptedAuthority(join(this.#worldsRoot, existing.worldId));
-            const commit = authority?.commits.find(({ operationId }) => operationId === input.operationId);
+            const fact = await new FileNativeAuthorityV3(join(this.#worldsRoot, existing.worldId)).authorityFactAt(existing.head);
+            const commit = fact.commit;
             if (existing.worldId !== input.worldId ||
+                fact.digest !== existing.commitDigest ||
                 commit?.mode !== "timeline_revision" ||
                 commit.timelineRevision?.restoresHead !== input.restoresHead ||
                 commit.timelineRevision.replacesHead !== input.replacesHead ||
@@ -791,15 +828,13 @@ export class FileNativeWorldStore {
             return existing;
         }
         const root = join(this.#worldsRoot, input.worldId);
-        const [authority, replacement] = await Promise.all([
-            readAcceptedAuthority(root),
-            this.recoverEndpoint(input.worldId, input.restoresHead),
+        const authorityStore = new FileNativeAuthorityV3(root);
+        const [replaced, replacementMaterials] = await Promise.all([
+            authorityStore.commitAt(input.replacesHead),
+            authorityStore.recoverMaterials(input.restoresHead),
         ]);
-        const replaced = authority?.commits.find(({ head }) => head === input.replacesHead);
-        const logicalParent = replaced?.mode === "timeline_revision"
-            ? replaced.timelineRevision?.restoresHead
-            : replaced?.parentHead;
-        if (replaced === undefined ||
+        const logicalParent = replaced?.timelineParent.head;
+        if (replaced === null ||
             !replaced.historyAppend.some(({ role }) => role === "player") ||
             logicalParent !== input.restoresHead)
             throw new FileNativeWorldCreationError("operation_conflict", "Selected player message does not match the logical parent endpoint to restore");
@@ -808,19 +843,18 @@ export class FileNativeWorldStore {
             worldId: input.worldId,
             parentHead: input.expectedCurrentHead,
             historyAppend: [{ role: "player", exactText: input.replacementText }],
-            nextMaterials: structuredClone(replacement.additionalMaterials),
+            nextMaterials: worldNeutralMaterials(input.worldId, replacementMaterials),
             stateChanges: [],
             mode: "timeline_revision",
             timelineRevision: {
                 restoresHead: input.restoresHead,
                 replacesHead: input.replacesHead,
                 requestFingerprint: input.requestFingerprint,
-                replacementState: immutableFiles(replacement.state),
-                replacementHistory: structuredClone(replacement.history),
             },
         });
     }
     async commitCorrection(input) {
+        await this.ensureCurrentStorage(input.worldId);
         try {
             const commit = async () => {
                 let operationReserved = input.stateOperationClaim !== undefined;
@@ -833,7 +867,7 @@ export class FileNativeWorldStore {
                     operationId: input.operationId,
                     worldId: input.worldId,
                     parentHead: input.parentHead,
-                    nextMaterials: input.nextMaterials,
+                    nextMaterials: worldNeutralMaterials(input.worldId, input.nextMaterials),
                     stateChanges: input.stateChanges,
                     mode: "correction",
                     historyAppend: [],
@@ -856,40 +890,39 @@ export class FileNativeWorldStore {
      * separate commits; there is no synthetic call-chain-wide settlement boundary.
      */
     async commitPlayStep(input) {
+        await this.ensureCurrentStorage(input.worldId);
         if (input.historyAppend.length === 0 && input.stateChanges.length === 0)
             throw new TypeError("A call-chain commit cannot omit both narrative and state changes");
         return this.#commitHistoryChange({
             ...input,
+            nextMaterials: worldNeutralMaterials(input.worldId, input.nextMaterials),
             mode: "play",
         });
     }
-    async readPlayCallChain(worldId) {
-        assertIdentity(worldId, "World ID");
-        return readOptionalJson(join(this.#worldsRoot, worldId, "runtime", "play-call-chain.json"));
-    }
-    async writePlayCallChain(worldId, value) {
-        assertIdentity(worldId, "World ID");
-        await publishJson(join(this.#worldsRoot, worldId, "runtime", "play-call-chain.json"), value);
-    }
-    async removePlayCallChain(worldId) {
-        assertIdentity(worldId, "World ID");
-        await rm(join(this.#worldsRoot, worldId, "runtime", "play-call-chain.json"), { force: true });
-    }
     async #commitHistoryChange(input) {
         const existing = await this.getOperationOutcome(input.operationId);
         if (isCommittedOutcome(existing)) {
             assertSameOperationOutcome(existing, input);
-            const accepted = await readAcceptedAuthority(join(this.#worldsRoot, existing.worldId));
-            const commit = accepted?.commits.find(({ operationId }) => operationId === input.operationId);
-            if (commit?.mode !== input.mode ||
-                JSON.stringify(commit?.stateChanges) !==
-                    JSON.stringify(input.stateChanges) ||
-                !isDeepStrictEqual(commit?.timelineRevision, input.timelineRevision))
+            const authority = new FileNativeAuthorityV3(join(this.#worldsRoot, existing.worldId));
+            const fact = await authority.authorityFactAt(existing.head);
+            if (fact.digest !== existing.commitDigest ||
+                !authorityCommitMatchesInput(fact.commit, input))
                 throw new FileNativeWorldCreationError("operation_conflict", "The same play operation ID is bound to a different complete commit payload");
             return existing;
         }
+        const prepared = existing.outcome === "in_progress"
+            ? await readAcceptancePreparedOutcome(this.#operationOutcomePath(input.operationId))
+            : null;
+        if (prepared !== null) {
+            const comparable = {
+                ...structuredClone(prepared),
+                outcome: "committed_materialization_pending",
+            };
+            assertSameOperationOutcome(comparable, input);
+        }
         if (existing.outcome !== "not_started" &&
-            !(input.operationReserved === true && existing.outcome === "in_progress"))
+            !(existing.outcome === "in_progress" &&
+                (input.operationReserved === true || prepared !== null)))
             throw new FileNativeWorldCreationError("operation_conflict", "The same play operation ID is occupied by another durable operation");
         const root = join(this.#worldsRoot, input.worldId);
         try {
@@ -897,42 +930,40 @@ export class FileNativeWorldStore {
                 const concurrent = await this.#readOperationOutcome(input.operationId);
                 if (isCommittedOutcome(concurrent)) {
                     assertSameOperationOutcome(concurrent, input);
-                    const accepted = await readAcceptedAuthority(join(this.#worldsRoot, concurrent.worldId));
-                    const knownCommit = accepted?.commits.find(({ operationId }) => operationId === input.operationId);
-                    if (knownCommit?.mode !== input.mode ||
-                        !isDeepStrictEqual(knownCommit.stateChanges, input.stateChanges) ||
-                        !isDeepStrictEqual(knownCommit.timelineRevision, input.timelineRevision))
+                    const known = await new FileNativeAuthorityV3(join(this.#worldsRoot, concurrent.worldId)).authorityFactAt(concurrent.head);
+                    if (known.digest !== concurrent.commitDigest ||
+                        !authorityCommitMatchesInput(known.commit, input))
                         throw new FileNativeWorldCreationError("operation_conflict", "The same play operation ID is bound to a different complete commit payload");
                     return concurrent;
                 }
-                const authorityPath = join(root, "runtime", "play-authority.json");
-                const authority = (await readAcceptedAuthority(root)) ?? {
-                    schemaVersion: 1,
-                    head: "genesis",
-                    commits: [],
-                };
+                const concurrentPrepared = concurrent.outcome === "in_progress"
+                    ? await readAcceptancePreparedOutcome(this.#operationOutcomePath(input.operationId))
+                    : null;
+                if (concurrentPrepared !== null)
+                    assertSameOperationOutcome({
+                        ...structuredClone(concurrentPrepared),
+                        outcome: "committed_materialization_pending",
+                    }, input);
+                else if (concurrent.outcome === "in_progress" &&
+                    input.operationReserved !== true)
+                    throw new FileNativeWorldCreationError("operation_conflict", "The same play operation ID is occupied by another durable operation");
+                const authorityStore = new FileNativeAuthorityV3(root);
+                const authority = await authorityStore.readHead();
                 if (authority.head !== input.parentHead) {
                     throw new FileNativeWorldCreationError("operation_conflict", "The parent endpoint of the play operation has changed");
                 }
                 const materialized = await readOptionalJson(join(root, "runtime", "materialized-head.json"));
                 if ((materialized?.head ?? "genesis") !== authority.head)
                     throw new FileNativeWorldCreationError("operation_conflict", "The world has accepted but unrepaired materialization; new competing writes are forbidden");
-                const [currentState, currentControl] = await Promise.all([
-                    readTree(join(root, "state")),
+                const [basisState, currentControl] = await Promise.all([
+                    authorityStore.recoverState(input.timelineRevision?.restoresHead ?? authority.head),
                     readTree(join(root, "control")),
                 ]);
-                const candidateState = new Map(currentState.map((file) => [file.path, file.contents]));
+                const candidateState = new Map(basisState.map((file) => [file.path, file.contents]));
                 if (input.mode === "timeline_revision") {
                     if (input.timelineRevision === undefined ||
                         input.stateChanges.length !== 0)
                         throw new FileNativeWorldCreationError("operation_conflict", "Timeline-revision commit payload is invalid");
-                    candidateState.clear();
-                    for (const file of input.timelineRevision.replacementState) {
-                        assertRelativePath(file.path);
-                        if (sha256(file.canonicalBytes) !== file.sha256)
-                            throw new FileNativeWorldCreationError("operation_conflict", `Timeline-revision state hash conflicts: ${file.path}`);
-                        candidateState.set(file.path, file.canonicalBytes);
-                    }
                 }
                 else {
                     if (input.timelineRevision !== undefined)
@@ -959,64 +990,58 @@ export class FileNativeWorldStore {
                 ], { requireOpening: false });
                 if (inspection.status !== "usable")
                     throw new FileNativeWorldCreationError("candidate_validation_failed", `Candidate world failed mechanical validation: ${inspection.issues.map(({ message }) => message).join("; ")}`);
-                const sequence = authority.commits.length + 1;
-                const head = `commit:${sequence}`;
-                const commit = {
-                    schemaVersion: 1,
+                if (concurrentPrepared === null)
+                    await authorityStore.discardUnacceptedNextEpoch();
+                crashAtFileNativeAuthorityEdge("before_commit_acceptance");
+                const preparedAppend = await authorityStore.prepareAppend({
                     operationId: input.operationId,
                     parentHead: input.parentHead,
-                    head,
+                    ...(input.timelineRevision === undefined
+                        ? {}
+                        : { timelineParentHead: input.timelineRevision.restoresHead }),
                     mode: input.mode,
-                    historyAppend: input.historyAppend.map((message, index) => ({
-                        messageId: `${input.worldId}.message.${sequence}.${index + 1}.${message.role}`,
-                        ...structuredClone(message),
-                    })),
+                    historyAppend: input.historyAppend,
                     stateChanges: structuredClone(input.stateChanges),
-                    nextAdditionalMaterials: input.nextMaterials,
+                    nextMaterials: input.nextMaterials,
                     ...(input.mode === "correction"
                         ? {
                             correctionTargets: input.stateChanges.map(({ documentId }) => documentId),
                             corrects: input.parentHead,
                         }
                         : {}),
-                    ...(input.mode === "timeline_revision"
-                        ? {
-                            timelineRevision: structuredClone(input.timelineRevision),
-                        }
-                        : {}),
-                };
-                crashAtFileNativeAuthorityEdge("before_commit_acceptance");
-                await publishImmutableJson(join(root, "runtime", "play-commits", `${createHash("sha256").update(JSON.stringify(commit)).digest("hex")}.json`), commit);
-                await publishJson(authorityPath, {
-                    schemaVersion: 1,
-                    head,
-                    commits: [...authority.commits, commit],
+                    ...(input.timelineRevision === undefined
+                        ? {}
+                        : { timelineRevision: input.timelineRevision }),
                 });
-                crashAtFileNativeAuthorityEdge("after_commit_acceptance");
+                crashAtFileNativeAuthorityEdge("after_authority_objects");
+                const acceptedPreparation = concurrentPrepared ?? prepared;
+                if (acceptedPreparation !== null &&
+                    acceptedPreparation.commitDigest !== preparedAppend.commitDigest)
+                    throw new FileNativeWorldCreationError("operation_conflict", "The prepared Authority fact does not match the reserved operation");
+                const { commit } = preparedAppend;
                 const pending = {
                     outcome: "committed_materialization_pending",
                     worldId: input.worldId,
                     parentHead: input.parentHead,
-                    head,
+                    head: commit.head,
+                    commitDigest: preparedAppend.commitDigest,
                     historyAppend: structuredClone(input.historyAppend),
                     nextAdditionalMaterials: structuredClone(input.nextMaterials),
                     mode: input.mode,
                 };
+                await publishJson(this.#operationOutcomePath(input.operationId), {
+                    ...pending,
+                    outcome: "acceptance_prepared",
+                });
+                crashAtFileNativeAuthorityEdge("after_acceptance_prepared");
+                await authorityStore.publishPrepared(preparedAppend);
+                crashAtFileNativeAuthorityEdge("after_commit_acceptance");
                 await publishJson(this.#operationOutcomePath(input.operationId), pending);
                 try {
-                    await materializePlayCommit(root, sequence, {
-                        mode: commit.mode,
-                        historyAppend: commit.historyAppend,
-                        nextMaterials: input.nextMaterials,
-                        stateChanges: input.stateChanges,
-                        ...(commit.timelineRevision === undefined
-                            ? {}
-                            : { timelineRevision: commit.timelineRevision }),
-                    });
+                    const recovered = await authorityStore.recover(commit.head);
+                    await assertPendingMaterializationCompatible(root, pending);
+                    await materializeRecoveredEndpoint(root, preparedAppend.nextHead, recovered);
                     crashAtFileNativeAuthorityEdge("after_materialization");
-                    await publishJson(join(root, "runtime", "materialized-head.json"), {
-                        head,
-                    });
                     const outcome = { ...pending, outcome: "committed" };
                     await publishJson(this.#operationOutcomePath(input.operationId), outcome);
                     return outcome;
@@ -1033,17 +1058,18 @@ export class FileNativeWorldStore {
         catch (error) {
             if (error instanceof WorldOperationBusyError)
                 throw new FileNativeWorldCreationError("operation_conflict", "World Authority commit is being serialized by another process");
+            if (error instanceof FileNativeAuthorityV3Error)
+                throw new FileNativeWorldCreationError(error.code === "corrupt" ? "world_corrupt" : "operation_conflict", error.message, { cause: error });
             throw error;
         }
     }
     async readAuthorityHistory(worldId) {
         assertIdentity(worldId, "World ID");
+        await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
-        const authority = await readAcceptedAuthority(root);
-        return authority === null
-            ? { head: "genesis", commits: [] }
-            : { head: authority.head, commits: structuredClone(authority.commits) };
+        const authority = await new FileNativeAuthorityV3(root).readHistory();
+        return structuredClone(authority);
     }
     async readAuthorityEndpoint(worldId, endpoint) {
         const recovered = await this.recoverEndpoint(worldId, endpoint);
@@ -1115,7 +1141,7 @@ export class FileNativeWorldStore {
         return join(this.#operationsRoot, `derive-${operationDigest(operationId)}.json`);
     }
     #preview(input, worldId) {
-        const openingMessage = genesisOpeningMessage(worldId, openingText(input.packageFiles));
+        const openingMessage = genesisOpeningMessage(openingText(input.packageFiles));
         return this.#promptCompiler.preview({
             endpoint: { id: `${worldId}:genesis`, commit: "genesis" },
             hostBinding: input.prompt.hostBinding,
@@ -1148,9 +1174,9 @@ function openingText(files) {
         throw new FileNativeWorldCreationError("content_package_needs_repair", "Content package is missing a usable opening.md");
     return opening.contents;
 }
-function genesisOpeningMessage(worldId, exactText) {
+function genesisOpeningMessage(exactText) {
     return {
-        messageId: `${worldId}.message.genesis.narrator`,
+        messageId: "message.genesis.narrator",
         role: "narrator",
         exactText,
     };
@@ -1222,19 +1248,6 @@ async function readTree(root, prefix = "") {
     }
     return files;
 }
-async function readDirectoryNames(root) {
-    try {
-        return (await readdir(root, { withFileTypes: true }))
-            .filter((entry) => entry.isDirectory() && !entry.name.startsWith("."))
-            .map((entry) => entry.name)
-            .sort();
-    }
-    catch (error) {
-        if (isNodeError(error) && error.code === "ENOENT")
-            return [];
-        throw error;
-    }
-}
 function immutableFiles(files) {
     return files.map(({ path, contents }) => ({
         path,
@@ -1286,13 +1299,15 @@ function assertOperationOutcomeIntegrity(value) {
             throw corruptOperationOutcome();
         return;
     }
-    if (value.outcome === "committed" ||
+    if (value.outcome === "acceptance_prepared" ||
+        value.outcome === "committed" ||
         value.outcome === "committed_materialization_pending") {
         if (!hasExactKeys(value, [
             "outcome",
             "worldId",
             "parentHead",
             "head",
+            "commitDigest",
             "historyAppend",
             "nextAdditionalMaterials",
             "mode",
@@ -1303,6 +1318,8 @@ function assertOperationOutcomeIntegrity(value) {
             !/^(?:genesis|commit:[1-9][0-9]*)$/u.test(value.parentHead) ||
             typeof value.head !== "string" ||
             !/^commit:[1-9][0-9]*$/u.test(value.head) ||
+            typeof value.commitDigest !== "string" ||
+            !/^[a-f0-9]{64}$/u.test(value.commitDigest) ||
             !Array.isArray(value.historyAppend) ||
             !value.historyAppend.every(isPlayHistoryAppendInput) ||
             !Array.isArray(value.nextAdditionalMaterials) ||
@@ -1318,53 +1335,95 @@ function assertOperationOutcomeIntegrity(value) {
 function projectOperationOutcome(value) {
     return structuredClone(value);
 }
-function corruptOperationOutcome() {
-    return new FileNativeWorldCreationError("world_corrupt", "Authority operation outcome structure or operation identity is invalid");
+async function readAcceptancePreparedOutcome(path) {
+    const value = await readOptionalJson(path);
+    if (value === null)
+        return null;
+    assertOperationOutcomeIntegrity(value);
+    if (value.outcome !== "acceptance_prepared")
+        return null;
+    return structuredClone(value);
 }
-async function assertCommittedAuthorityOutcomeMatches(worldRoot, operationId, outcome) {
-    const authority = await readAcceptedAuthority(worldRoot);
-    const commit = authority?.commits.find((candidate) => candidate.operationId === operationId);
-    if (commit?.parentHead !== outcome.parentHead ||
-        commit?.head !== outcome.head ||
-        commit?.mode !== outcome.mode ||
-        !isDeepStrictEqual(commit?.historyAppend.map(({ role, exactText }) => ({ role, exactText })), outcome.historyAppend) ||
-        !isDeepStrictEqual(commit?.nextAdditionalMaterials, outcome.nextAdditionalMaterials))
+async function resolvePreparedOperationOutcome(worldsRoot, operationId, value) {
+    const prepared = value;
+    const worldRoot = join(worldsRoot, prepared.worldId);
+    const authorityStore = new FileNativeAuthorityV3(worldRoot);
+    const authority = await authorityStore.readHead();
+    if (authority.head === prepared.parentHead)
+        return { outcome: "in_progress" };
+    if (authority.operationId !== operationId)
+        throw corruptOperationOutcome();
+    const commit = await assertCommittedAuthorityOutcomeMatches(worldRoot, prepared);
+    if (authority.sequence < commit.sequence)
         throw corruptOperationOutcome();
+    const materialized = await readMaterializedCheckpoint(worldRoot);
+    const outcome = materialized !== null && materialized.sequence >= commit.sequence
+        ? "committed"
+        : "committed_materialization_pending";
+    const resolved = { ...structuredClone(prepared), outcome };
+    if (outcome === "committed_materialization_pending")
+        await assertPendingMaterializationCompatible(worldRoot, resolved);
+    return resolved;
 }
-async function assertPendingMaterializationCompatible(worldRoot, operationId) {
-    const authority = await readAcceptedAuthority(worldRoot);
-    const sequence = authority?.commits.findIndex((candidate) => candidate.operationId === operationId) ?? -1;
-    const commit = sequence < 0 ? undefined : authority?.commits[sequence];
-    if (commit === undefined)
+function corruptOperationOutcome() {
+    return new FileNativeWorldCreationError("world_corrupt", "Authority operation outcome structure or operation identity is invalid");
+}
+async function assertCommittedAuthorityOutcomeMatches(worldRoot, outcome) {
+    const fact = await new FileNativeAuthorityV3(worldRoot).authorityFactAt(outcome.head);
+    const { commit } = fact;
+    if (fact.digest !== outcome.commitDigest ||
+        commit.auditParent.head !== outcome.parentHead ||
+        commit.head !== outcome.head ||
+        commit.mode !== outcome.mode ||
+        !isDeepStrictEqual(commit.historyAppend.map(({ role, exactText }) => ({ role, exactText })), outcome.historyAppend) ||
+        !isDeepStrictEqual(commit.nextAdditionalMaterials, outcome.nextAdditionalMaterials))
         throw corruptOperationOutcome();
-    for (const change of commit.stateChanges) {
-        const path = join(worldRoot, "state", change.relativePath);
-        const existing = await readOptionalText(path);
-        const existingHash = existing === null
-            ? null
-            : `sha256:${createHash("sha256").update(existing).digest("hex")}`;
-        if (existingHash !== change.expectedPreviousHash &&
-            existingHash !== change.nextHash)
-            throw new FileNativeWorldCreationError("inconsistent_materialization", `World-state materialization conflict: ${change.relativePath}`);
-    }
-    for (const [index, message] of commit.historyAppend.entries()) {
-        const existing = await readOptionalText(join(worldRoot, "history", `${String(sequence + 1).padStart(8, "0")}-${historyFileName(index + 1, message)}`));
-        if (existing !== null && existing !== message.exactText)
-            throw new FileNativeWorldCreationError("inconsistent_materialization", "History-message materialization content conflict");
-    }
+    return commit;
+}
+async function assertPendingMaterializationCompatible(worldRoot, outcome) {
+    const authority = new FileNativeAuthorityV3(worldRoot);
+    await assertCommittedAuthorityOutcomeMatches(worldRoot, outcome);
+    const [parent, target, state, history] = await Promise.all([
+        authority.recover(outcome.parentHead),
+        authority.recover(outcome.head),
+        readTree(join(worldRoot, "state")),
+        readTree(join(worldRoot, "history")),
+    ]);
+    assertProjectionBetweenEndpoints("state", state, parent.state, target.state);
+    assertHistoryProjectionBetweenEndpoints(history, historySurfaceFiles(parent.history), historySurfaceFiles(target.history));
     const existingMaterials = await readOptionalJson(join(worldRoot, "runtime", "additional-materials.json"));
-    if (existingMaterials?.head === commit.head &&
-        !isDeepStrictEqual(existingMaterials.items, commit.nextAdditionalMaterials))
+    if (existingMaterials !== null &&
+        !((existingMaterials.head === parent.head &&
+            isDeepStrictEqual(existingMaterials.items, parent.additionalMaterials)) ||
+            (existingMaterials.head === target.head &&
+                isDeepStrictEqual(existingMaterials.items, target.additionalMaterials))))
         throw new FileNativeWorldCreationError("inconsistent_materialization", "Additional-material list content conflicts at the same endpoint");
 }
-async function readOptionalText(path) {
-    try {
-        return await readFile(path, "utf8");
-    }
-    catch (error) {
-        if (isNodeError(error) && error.code === "ENOENT")
-            return null;
-        throw error;
+function assertProjectionBetweenEndpoints(surface, current, parent, target) {
+    const parentFiles = new Map(parent.map((file) => [file.path, file.contents]));
+    const targetFiles = new Map(target.map((file) => [file.path, file.contents]));
+    for (const file of current) {
+        if (file.contents !== parentFiles.get(file.path) &&
+            file.contents !== targetFiles.get(file.path))
+            throw new FileNativeWorldCreationError("inconsistent_materialization", `World ${surface} projection conflicts with both accepted endpoints: ${file.path}`);
+    }
+}
+function assertHistoryProjectionBetweenEndpoints(current, parent, target) {
+    const byMessageId = (files) => new Map(files.map((file) => [
+        fileNativeHistoryMessageIdFromProjectionPath(file.path),
+        file.contents,
+    ]));
+    const parentFiles = byMessageId(parent);
+    const targetFiles = byMessageId(target);
+    const seen = new Set();
+    for (const file of current) {
+        const messageId = fileNativeHistoryMessageIdFromProjectionPath(file.path);
+        if (messageId === null ||
+            seen.has(messageId) ||
+            (file.contents !== parentFiles.get(messageId) &&
+                file.contents !== targetFiles.get(messageId)))
+            throw new FileNativeWorldCreationError("inconsistent_materialization", `World history projection conflicts with both accepted endpoints: ${file.path}`);
+        seen.add(messageId);
     }
 }
 function isAuthorityMaterialSelection(value) {
@@ -1400,228 +1459,36 @@ async function publishJson(path, value) {
     await rename(temporary, path);
     await syncDirectory(dirname(path));
 }
-async function publishImmutableJson(path, value) {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    const contents = `${JSON.stringify(value, null, 2)}\n`;
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    try {
-        await writeFile(temporary, contents, {
-            encoding: "utf8",
-            flag: "wx",
-            mode: 0o600,
-        });
-        await syncFile(temporary);
-        try {
-            await link(temporary, path);
-            await syncDirectory(dirname(path));
-            return true;
-        }
-        catch (error) {
-            if (!isNodeError(error) || error.code !== "EEXIST")
-                throw error;
-            if ((await readFile(path, "utf8")) !== contents)
-                throw new FileNativeWorldCreationError("operation_conflict", "Immutable play-commit file conflicts");
-            return false;
-        }
-    }
-    finally {
-        await rm(temporary, { force: true });
-    }
-}
-async function readAcceptedAuthority(root) {
-    try {
-        const published = await readOptionalJson(join(root, "runtime", "play-authority.json"));
-        if (published === null) {
-            const commitRoot = join(root, "runtime", "play-commits");
-            const names = await readDirectoryFileNames(commitRoot);
-            if (names.length === 0)
-                return null;
-            const remaining = await Promise.all(names.map(async (name) => {
-                const commit = await readJson(join(commitRoot, name));
-                assertFileNativePlayCommit(commit);
-                const canonicalName = `${createHash("sha256")
-                    .update(JSON.stringify(commit))
-                    .digest("hex")}.json`;
-                if (name !== canonicalName)
-                    throw new FileNativeWorldCreationError("world_corrupt", "Immutable commit does not match the durable path identity");
-                return commit;
-            }));
-            const commits = [];
-            let parent = "genesis";
-            while (remaining.length > 0) {
-                const matches = remaining.filter((commit) => commit.parentHead === parent);
-                if (matches.length !== 1)
-                    throw new FileNativeWorldCreationError("world_corrupt", "Immutable commits cannot rebuild one unique authority chain");
-                const next = matches[0];
-                commits.push(next);
-                remaining.splice(remaining.indexOf(next), 1);
-                parent = next.head;
-            }
-            assertFileNativePlayAuthority({
-                schemaVersion: 1,
-                head: parent,
-                commits,
-            });
-            return { schemaVersion: 1, head: parent, commits };
-        }
-        assertFileNativePlayAuthority(published);
-        const commits = [];
-        for (const recorded of published.commits) {
-            const digest = createHash("sha256")
-                .update(JSON.stringify(recorded))
-                .digest("hex");
-            const immutable = await readJson(join(root, "runtime", "play-commits", `${digest}.json`)).catch((error) => {
-                throw new FileNativeWorldCreationError("world_corrupt", `Accepted endpoint is missing an immutable commit: ${recorded.head}`, { cause: error });
-            });
-            assertFileNativePlayCommit(immutable);
-            if (JSON.stringify(immutable) !== JSON.stringify(recorded))
-                throw new FileNativeWorldCreationError("world_corrupt", `Accepted endpoint does not match its immutable commit: ${recorded.head}`);
-            commits.push(immutable);
-        }
-        return { ...published, commits };
-    }
-    catch (error) {
-        if (error instanceof FileNativeWorldCreationError)
-            throw error;
-        throw new FileNativeWorldCreationError("world_corrupt", "Play Authority durable data is corrupt", { cause: error });
-    }
-}
-function assertFileNativePlayAuthority(value) {
-    if (!isRecord(value) ||
-        !hasExactKeys(value, ["schemaVersion", "head", "commits"]) ||
-        value.schemaVersion !== 1 ||
-        typeof value.head !== "string" ||
-        !Array.isArray(value.commits))
-        throw new Error("Play Authority has an invalid shape");
-    const operationIds = new Set();
-    const heads = new Set();
-    const commitsByHead = new Map();
-    let parent = "genesis";
-    for (const [index, commit] of value.commits.entries()) {
-        assertFileNativePlayCommit(commit);
-        const revision = commit.timelineRevision;
-        const replaced = revision === undefined
-            ? undefined
-            : commitsByHead.get(revision.replacesHead);
-        const replacedLogicalParent = replaced?.mode === "timeline_revision"
-            ? replaced.timelineRevision.restoresHead
-            : replaced?.parentHead;
-        if (commit.parentHead !== parent ||
-            commit.head !== `commit:${index + 1}` ||
-            operationIds.has(commit.operationId) ||
-            heads.has(commit.head) ||
-            (commit.mode === "timeline_revision" &&
-                ((revision.restoresHead !== "genesis" &&
-                    !heads.has(revision.restoresHead)) ||
-                    replaced === undefined ||
-                    !replaced.historyAppend.some(({ role }) => role === "player") ||
-                    replacedLogicalParent !== revision.restoresHead)))
-            throw new Error("Play Authority commit chain is invalid");
-        operationIds.add(commit.operationId);
-        heads.add(commit.head);
-        commitsByHead.set(commit.head, commit);
-        parent = commit.head;
-    }
-    if (value.head !== parent)
-        throw new Error("Play Authority head is invalid");
-}
-function assertFileNativePlayCommit(value) {
-    if (!isRecord(value))
-        throw new Error("Play commit has an invalid shape");
-    const correction = value.mode === "correction";
-    const timelineRevision = value.mode === "timeline_revision";
-    if (!hasExactKeys(value, [
-        "schemaVersion",
-        "operationId",
-        "parentHead",
-        "head",
-        "mode",
-        "historyAppend",
-        "stateChanges",
-        "nextAdditionalMaterials",
-        ...(correction ? ["correctionTargets", "corrects"] : []),
-        ...(timelineRevision ? ["timelineRevision"] : []),
-    ]) ||
-        value.schemaVersion !== 1 ||
-        typeof value.operationId !== "string" ||
-        value.operationId.trim() === "" ||
-        typeof value.parentHead !== "string" ||
-        !/^(?:genesis|commit:[1-9][0-9]*)$/u.test(value.parentHead) ||
-        typeof value.head !== "string" ||
-        !/^commit:[1-9][0-9]*$/u.test(value.head) ||
-        (value.mode !== "play" &&
-            value.mode !== "correction" &&
-            value.mode !== "timeline_revision") ||
-        !Array.isArray(value.historyAppend) ||
-        (correction
-            ? value.historyAppend.length !== 0
-            : timelineRevision
-                ? value.historyAppend.length !== 1 ||
-                    !isRecord(value.historyAppend[0]) ||
-                    value.historyAppend[0].role !== "player"
-                : value.historyAppend.length === 0 &&
-                    (!Array.isArray(value.stateChanges) ||
-                        value.stateChanges.length === 0)) ||
-        !value.historyAppend.every(isFileNativeHistoryMessage) ||
-        !Array.isArray(value.stateChanges) ||
-        !value.stateChanges.every(isFileNativeStateChange) ||
-        !Array.isArray(value.nextAdditionalMaterials) ||
-        !value.nextAdditionalMaterials.every(isAuthorityMaterialSelection))
-        throw new Error("Play commit has an invalid shape");
-    if (correction &&
-        (!Array.isArray(value.correctionTargets) ||
-            !value.correctionTargets.every((target) => typeof target === "string" && target.trim() !== "") ||
-            typeof value.corrects !== "string" ||
-            value.corrects !== value.parentHead))
-        throw new Error("Correction commit has an invalid shape");
-    if (timelineRevision &&
-        (value.stateChanges.length !== 0 ||
-            !isFileNativeTimelineRevision(value.timelineRevision)))
-        throw new Error("Timeline-revision commit has an invalid shape");
-}
-function isFileNativeTimelineRevision(value) {
+async function readMaterializedCheckpoint(root) {
+    const value = await readOptionalJson(join(root, "runtime", "materialized-head.json"));
+    if (value === null)
+        return null;
     if (!isRecord(value) ||
         !hasExactKeys(value, [
-            "restoresHead",
-            "replacesHead",
-            "requestFingerprint",
-            "replacementState",
-            "replacementHistory",
+            "schemaVersion",
+            "head",
+            "sequence",
+            "commitDigest",
         ]) ||
-        typeof value.restoresHead !== "string" ||
-        !/^(?:genesis|commit:[1-9][0-9]*)$/u.test(value.restoresHead) ||
-        typeof value.replacesHead !== "string" ||
-        !/^commit:[1-9][0-9]*$/u.test(value.replacesHead) ||
-        typeof value.requestFingerprint !== "string" ||
-        !/^sha256:[a-f0-9]{64}$/u.test(value.requestFingerprint) ||
-        !Array.isArray(value.replacementState) ||
-        !Array.isArray(value.replacementHistory) ||
-        !value.replacementHistory.every(isFileNativeHistoryMessage))
-        return false;
-    for (const file of value.replacementState) {
-        if (!isRecord(file) ||
-            !hasExactKeys(file, ["path", "sha256", "canonicalBytes"]) ||
-            typeof file.path !== "string" ||
-            typeof file.sha256 !== "string" ||
-            typeof file.canonicalBytes !== "string" ||
-            sha256(file.canonicalBytes) !== file.sha256)
-            return false;
-        try {
-            assertRelativePath(file.path);
-        }
-        catch {
-            return false;
-        }
-    }
-    return true;
-}
-function isFileNativeHistoryMessage(value) {
-    return (isRecord(value) &&
-        hasExactKeys(value, ["messageId", "role", "exactText"]) &&
-        typeof value.messageId === "string" &&
-        value.messageId.trim() !== "" &&
-        (value.role === "player" || value.role === "narrator") &&
-        typeof value.exactText === "string");
+        value.schemaVersion !== 3 ||
+        typeof value.head !== "string" ||
+        !Number.isSafeInteger(value.sequence) ||
+        Number(value.sequence) < 0 ||
+        (value.commitDigest !== null &&
+            (typeof value.commitDigest !== "string" ||
+                !/^[a-f0-9]{64}$/u.test(value.commitDigest))) ||
+        (Number(value.sequence) === 0
+            ? value.head !== "genesis" || value.commitDigest !== null
+            : value.head !== `commit:${String(value.sequence)}` ||
+                value.commitDigest === null))
+        throw new FileNativeWorldCreationError("world_corrupt", "Materialized world checkpoint has an invalid shape");
+    return value;
+}
+function sameMaterializedEndpoint(checkpoint, authority) {
+    return (checkpoint !== null &&
+        checkpoint.head === authority.head &&
+        checkpoint.sequence === authority.sequence &&
+        checkpoint.commitDigest === authority.commitDigest);
 }
 function isPlayHistoryAppendInput(value) {
     return (isRecord(value) &&
@@ -1629,107 +1496,22 @@ function isPlayHistoryAppendInput(value) {
         (value.role === "player" || value.role === "narrator") &&
         typeof value.exactText === "string");
 }
-function isFileNativeStateChange(value) {
-    if (!isRecord(value) ||
-        !hasExactKeys(value, [
-            "kind",
-            "documentId",
-            "stableShortRef",
-            "relativePath",
-            "codec",
-            "expectedPreviousHash",
-            "nextHash",
-            "canonicalNextBytes",
-        ]) ||
-        (value.kind !== "create" && value.kind !== "replace") ||
-        typeof value.documentId !== "string" ||
-        value.documentId.trim() === "" ||
-        typeof value.stableShortRef !== "string" ||
-        value.stableShortRef.trim() === "" ||
-        typeof value.relativePath !== "string" ||
-        (value.codec !== "yaml" && value.codec !== "markdown") ||
-        (value.expectedPreviousHash !== null &&
-            (typeof value.expectedPreviousHash !== "string" ||
-                !/^sha256:[a-f0-9]{64}$/u.test(value.expectedPreviousHash))) ||
-        typeof value.nextHash !== "string" ||
-        !/^sha256:[a-f0-9]{64}$/u.test(value.nextHash) ||
-        typeof value.canonicalNextBytes !== "string" ||
-        `sha256:${createHash("sha256")
-            .update(value.canonicalNextBytes)
-            .digest("hex")}` !== value.nextHash)
-        return false;
-    try {
-        assertRelativePath(value.relativePath);
-    }
-    catch {
-        return false;
-    }
-    return true;
-}
-async function readDirectoryFileNames(root) {
-    try {
-        return (await readdir(root, { withFileTypes: true }))
-            .filter((entry) => entry.isFile() && entry.name.endsWith(".json"))
-            .map((entry) => entry.name)
-            .sort();
-    }
-    catch (error) {
-        if (isNodeError(error) && error.code === "ENOENT")
-            return [];
-        throw error;
-    }
-}
-async function materializePlayCommit(root, sequence, input) {
-    if (input.mode === "timeline_revision") {
-        if (input.timelineRevision === undefined)
-            throw new FileNativeWorldCreationError("world_corrupt", "Timeline-revision commit is missing its materialization snapshot");
-        await replaceMaterializedTree(join(root, "state"), input.timelineRevision.replacementState.map(({ path, canonicalBytes }) => ({ path, contents: canonicalBytes })));
-    }
-    else {
-        for (const change of input.stateChanges) {
-            assertRelativePath(change.relativePath);
-            const path = join(root, "state", change.relativePath);
-            let existing = null;
-            try {
-                existing = await readFile(path, "utf8");
-            }
-            catch (error) {
-                if (!isNodeError(error) || error.code !== "ENOENT")
-                    throw error;
-            }
-            const existingHash = existing === null ? null : sha256(existing);
-            if (existingHash === change.nextHash)
-                continue;
-            if (existingHash !== change.expectedPreviousHash)
-                throw new FileNativeWorldCreationError("inconsistent_materialization", `World-state materialization conflict: ${change.relativePath}`);
-            await publishText(path, change.canonicalNextBytes);
-        }
-    }
+async function materializeRecoveredEndpoint(root, authority, endpoint) {
+    if (authority.head !== endpoint.head)
+        throw new FileNativeWorldCreationError("world_corrupt", "Recovered endpoint does not match the Authority head to materialize");
+    await replaceMaterializedTree(join(root, "state"), endpoint.state);
     crashAtFileNativeAuthorityEdge("after_state_materialization");
-    const historyRoot = join(root, "history");
-    await mkdir(historyRoot, { recursive: true });
-    if (input.mode === "timeline_revision") {
-        await replaceMaterializedTree(historyRoot, historySurfaceFiles([
-            ...input.timelineRevision.replacementHistory,
-            ...input.historyAppend,
-        ]));
-    }
-    else {
-        for (const [index, message] of input.historyAppend.entries())
-            await writeIdempotentText(join(historyRoot, `${String(sequence).padStart(8, "0")}-${historyFileName(index + 1, message)}`), message.exactText);
-    }
-    const materialsPath = join(root, "runtime", "additional-materials.json");
-    const nextMaterials = {
-        head: `commit:${sequence}`,
-        items: input.nextMaterials,
-    };
-    const existingMaterials = await readOptionalJson(materialsPath);
-    if (existingMaterials?.head === nextMaterials.head &&
-        JSON.stringify(existingMaterials.items) !==
-            JSON.stringify(nextMaterials.items))
-        throw new FileNativeWorldCreationError("inconsistent_materialization", "Additional-material list content conflicts at the same endpoint");
-    if (JSON.stringify(existingMaterials) !== JSON.stringify(nextMaterials))
-        await publishJson(materialsPath, nextMaterials);
+    await replaceMaterializedTree(join(root, "history"), historySurfaceFiles(endpoint.history));
+    await publishJson(join(root, "runtime", "additional-materials.json"), {
+        head: authority.head,
+        items: endpoint.additionalMaterials,
+    });
+    await publishJson(join(root, "runtime", "materialized-head.json"), {
+        schemaVersion: 3,
+        head: authority.head,
+        sequence: authority.sequence,
+        commitDigest: authority.commitDigest,
+    });
 }
 async function replaceMaterializedTree(root, files) {
     const next = new Map();
@@ -1762,26 +1544,22 @@ async function publishText(path, contents) {
     await syncDirectory(dirname(path));
 }
 function historySurfaceFiles(messages) {
-    return messages.map((message) => {
-        const genesis = /\.message\.genesis(?:\.([1-9][0-9]*))?\.(player|narrator)$/u.exec(message.messageId);
-        const committed = /\.message\.([1-9][0-9]*)\.([1-9][0-9]*)\.(player|narrator)$/u.exec(message.messageId);
-        const sequence = genesis !== null ? 0 : Number.parseInt(committed?.[1] ?? "", 10);
-        const index = genesis !== null
-            ? Number.parseInt(genesis[1] ?? "1", 10)
-            : Number.parseInt(committed?.[2] ?? "", 10);
-        const role = genesis?.[2] ?? committed?.[3];
-        if (!Number.isSafeInteger(sequence) ||
-            sequence < 0 ||
-            !Number.isSafeInteger(index) ||
-            index < 1 ||
-            role !== message.role)
-            throw new FileNativeWorldCreationError("world_corrupt", `History-message identity cannot form a materialization path: ${message.messageId}`);
-        return {
-            path: `${String(sequence).padStart(8, "0")}-${historyFileName(index, message)}`,
-            contents: message.exactText,
-        };
+    return projectFileNativeHistorySurface(messages, (messageId) => {
+        throw new FileNativeWorldCreationError("world_corrupt", `History-message identity cannot form a materialization path: ${messageId}`);
     });
 }
+function materializedHistoryRecord(files) {
+    const result = {};
+    for (const file of files) {
+        const messageId = fileNativeHistoryMessageIdFromProjectionPath(file.path);
+        if (messageId === null)
+            throw new FileNativeWorldCreationError("world_corrupt", `Materialized history path is invalid: ${file.path}`);
+        if (messageId in result)
+            throw new FileNativeWorldCreationError("world_corrupt", `Materialized history contains a duplicate message: ${messageId}`);
+        result[messageId] = file.contents;
+    }
+    return result;
+}
 async function writeIdempotentText(path, contents) {
     try {
         const existing = await readFile(path, "utf8");
@@ -1798,72 +1576,6 @@ async function writeIdempotentText(path, contents) {
         await syncDirectory(dirname(path));
     }
 }
-function historyFileName(index, message) {
-    return `${String(index).padStart(2, "0")}-${message.role}-${operationDigest(message.messageId).slice(0, 12)}.md`;
-}
-function cloneAuthorityPrefix(input) {
-    const end = input.sourceHead === "genesis"
-        ? 0
-        : (input.sourceAuthority?.commits.findIndex(({ head }) => head === input.sourceHead) ?? -1) + 1;
-    if (input.sourceHead !== "genesis" && end === 0)
-        throw new FileNativeWorldCreationError("world_corrupt", `Cannot copy a nonexistent source Authority endpoint: ${input.sourceHead}`);
-    const sourceCommits = input.sourceAuthority?.commits.slice(0, end) ?? [];
-    const messageIds = new Map();
-    const bindMessageId = (source, target) => {
-        if (messageIds.has(source))
-            throw new FileNativeWorldCreationError("world_corrupt", `Source Authority contains a duplicate history-message identity: ${source}`);
-        messageIds.set(source, target);
-    };
-    for (const [index, message] of input.sourceGenesis.history.entries())
-        bindMessageId(message.messageId, index === 0 && message.role === "narrator"
-            ? `${input.targetWorldId}.message.genesis.narrator`
-            : `${input.targetWorldId}.message.genesis.${index + 1}.${message.role}`);
-    for (const [commitIndex, commit] of sourceCommits.entries())
-        for (const [messageIndex, message] of commit.historyAppend.entries())
-            bindMessageId(message.messageId, `${input.targetWorldId}.message.${commitIndex + 1}.${messageIndex + 1}.${message.role}`);
-    const rewriteHistory = (history) => history.map((message) => ({
-        ...structuredClone(message),
-        messageId: messageIds.get(message.messageId),
-    }));
-    return {
-        genesisHistory: rewriteHistory(input.sourceGenesis.history),
-        genesisMaterials: rewriteMaterials(input.sourceGenesis.additionalMaterials, messageIds, input.sourceWorldId, input.targetWorldId),
-        commits: sourceCommits.map((commit) => ({
-            ...structuredClone(commit),
-            operationId: `clone-${operationDigest(`${input.targetWorldId}\0${commit.head}`).slice(0, 56)}`,
-            historyAppend: rewriteHistory(commit.historyAppend),
-            nextAdditionalMaterials: rewriteMaterials(commit.nextAdditionalMaterials, messageIds, input.sourceWorldId, input.targetWorldId),
-            ...(commit.timelineRevision === undefined
-                ? {}
-                : {
-                    timelineRevision: {
-                        ...structuredClone(commit.timelineRevision),
-                        replacementHistory: rewriteHistory(commit.timelineRevision.replacementHistory),
-                    },
-                }),
-        })),
-    };
-}
-function rewriteMaterials(materials, messageIds, sourceWorldId, targetWorldId) {
-    return materials.map((material) => {
-        if (material.kind === "history_message") {
-            const message = messageIds.get(material.message);
-            if (message === undefined)
-                throw new FileNativeWorldCreationError("world_corrupt", `Fork material references a history message that cannot be remapped: ${material.message}`);
-            return { ...material, message };
-        }
-        if (material.kind === "history_commit") {
-            const sourcePrefix = `${sourceWorldId}.`;
-            return {
-                ...material,
-                commit: material.commit.startsWith(sourcePrefix)
-                    ? `${targetWorldId}.${material.commit.slice(sourcePrefix.length)}`
-                    : material.commit,
-            };
-        }
-        return structuredClone(material);
-    });
-}
 function isCommittedOutcome(outcome) {
     return (outcome.outcome === "committed" ||
         outcome.outcome === "committed_materialization_pending");
@@ -1876,6 +1588,63 @@ function assertSameOperationOutcome(outcome, input) {
         throw new FileNativeWorldCreationError("operation_conflict", "The same play operation ID is bound to a different commit payload");
     }
 }
+function worldNeutralMaterials(worldId, materials) {
+    const prefix = `${worldId}.`;
+    return materials.map((material) => {
+        if (material.kind === "history_message") {
+            const message = material.message.startsWith(prefix)
+                ? material.message.slice(prefix.length)
+                : material.message;
+            if (!/^message\.(?:genesis(?:\.[1-9][0-9]*)?\.(?:player|narrator)|[1-9][0-9]*\.[1-9][0-9]*\.(?:player|narrator))$/u.test(message))
+                throw new FileNativeWorldCreationError("operation_conflict", "History material does not name a local immutable message");
+            return { ...material, message };
+        }
+        if (material.kind === "history_commit") {
+            const commit = material.commit.startsWith(prefix)
+                ? material.commit.slice(prefix.length)
+                : material.commit;
+            if (!/^(?:genesis|commit:[1-9][0-9]*)$/u.test(commit))
+                throw new FileNativeWorldCreationError("operation_conflict", "History material does not name a local immutable Authority endpoint");
+            return { ...material, commit };
+        }
+        return structuredClone(material);
+    });
+}
+function authorityCommitMatchesInput(commit, input) {
+    const stateChangesMatch = commit.stateChanges.length === input.stateChanges.length &&
+        commit.stateChanges.every((stored, index) => {
+            const candidate = input.stateChanges[index];
+            if (candidate === undefined)
+                return false;
+            const { nextBlob, ...metadata } = stored;
+            const expected = {
+                kind: candidate.kind,
+                documentId: candidate.documentId,
+                stableShortRef: candidate.stableShortRef,
+                relativePath: candidate.relativePath,
+                codec: candidate.codec,
+                expectedPreviousHash: candidate.expectedPreviousHash,
+                nextHash: candidate.nextHash,
+            };
+            return (nextBlob.epoch === commit.sequence &&
+                `sha256:${nextBlob.digest}` === candidate.nextHash &&
+                isDeepStrictEqual(metadata, expected));
+        });
+    const expectedCorrection = input.mode === "correction"
+        ? input.stateChanges.map(({ documentId }) => documentId)
+        : undefined;
+    return (commit.mode === input.mode &&
+        commit.auditParent.head === input.parentHead &&
+        commit.timelineParent.head ===
+            (input.timelineRevision?.restoresHead ?? input.parentHead) &&
+        isDeepStrictEqual(commit.historyAppend.map(({ role, exactText }) => ({ role, exactText })), input.historyAppend) &&
+        stateChangesMatch &&
+        isDeepStrictEqual(commit.nextAdditionalMaterials, input.nextMaterials) &&
+        isDeepStrictEqual(commit.timelineRevision, input.timelineRevision) &&
+        isDeepStrictEqual(commit.correctionTargets, expectedCorrection) &&
+        commit.corrects ===
+            (input.mode === "correction" ? input.parentHead : undefined));
+}
 function openWorldDocumentSnapshot(files) {
     return WorldDocumentStore.open({
         layout: "world_state",
@@ -1923,6 +1692,68 @@ async function durableTree(root) {
     }
     await syncDirectory(root);
 }
+async function readGenesisForFork(worldRoot, worldId) {
+    const value = await readJson(join(worldRoot, "runtime", "genesis.json"));
+    if (!isRecord(value) ||
+        value.schemaVersion !== 1 ||
+        value.type !== "file_native_genesis" ||
+        value.worldId !== worldId ||
+        !Array.isArray(value.state) ||
+        !Array.isArray(value.history) ||
+        !Array.isArray(value.additionalMaterials))
+        throw new FileNativeWorldCreationError("world_corrupt", "World genesis projection has an invalid shape");
+    const state = value.state.map((file) => {
+        if (!isRecord(file) ||
+            !hasExactKeys(file, ["path", "sha256", "canonicalBytes"]) ||
+            typeof file.path !== "string" ||
+            typeof file.sha256 !== "string" ||
+            typeof file.canonicalBytes !== "string" ||
+            sha256(file.canonicalBytes) !== file.sha256)
+            throw new FileNativeWorldCreationError("world_corrupt", "World genesis state projection is corrupt");
+        try {
+            assertRelativePath(file.path);
+        }
+        catch (error) {
+            throw new FileNativeWorldCreationError("world_corrupt", "World genesis state path is invalid", error instanceof Error ? { cause: error } : undefined);
+        }
+        return {
+            path: file.path,
+            sha256: file.sha256,
+            canonicalBytes: file.canonicalBytes,
+        };
+    });
+    const prefix = `${worldId}.`;
+    const history = value.history.map((message, index) => {
+        if (!isRecord(message) ||
+            !hasExactKeys(message, ["messageId", "role", "exactText"]) ||
+            typeof message.messageId !== "string" ||
+            (message.role !== "player" && message.role !== "narrator") ||
+            typeof message.exactText !== "string")
+            throw new FileNativeWorldCreationError("world_corrupt", "World genesis history projection is corrupt");
+        const messageId = message.messageId.startsWith(prefix)
+            ? message.messageId.slice(prefix.length)
+            : message.messageId;
+        const role = message.role === "player" ? "player" : "narrator";
+        const expected = index === 0 && role === "narrator"
+            ? "message.genesis.narrator"
+            : `message.genesis.${index + 1}.${role}`;
+        if (messageId !== expected)
+            throw new FileNativeWorldCreationError("world_corrupt", "World genesis history identity is invalid");
+        return {
+            messageId,
+            role,
+            exactText: message.exactText,
+        };
+    });
+    let additionalMaterials;
+    try {
+        additionalMaterials = worldNeutralMaterials(worldId, value.additionalMaterials);
+    }
+    catch (error) {
+        throw new FileNativeWorldCreationError("world_corrupt", "World genesis material projection is invalid", error instanceof Error ? { cause: error } : undefined);
+    }
+    return { state, history, additionalMaterials };
+}
 async function readPublicationAt(root) {
     return readJson(join(root, publicationFile));
 }