narraeon 0.6.0 → 0.6.1

package/dist/node/runtime/play/PlayCallChain.js

@@ -8,7 +8,7 @@ import { PlayCallChainError } from "./PlayCallChainError.js";
 import { preparePlayerRevisionTrace, prepareForkTrace, restorePlayDocuments, independentContextCopy, } from "./PlayTraceRetention.js";
 import { currentPlayPrompt, recordedPlayPrompt, playPromptRunsThroughEvents, } from "./PlayPromptRun.js";
 import { comparePromptPrefixes } from "../prompt/WorldPromptDiagnostics.js";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { completedPlayerRounds, continuationNotice, playerInputAppend, toolStepNotice, } from "./PlayContinuity.js";
 import { renderFreshContextCoverage } from "../prompt/WorldMaterialCoverage.js";
 import { renderWriteSizeAdvice, readDeclaredWorldClock, } from "../prompt/WorldMaintenanceReport.js";
@@ -34,6 +34,24 @@ const callChainToolNames = new Set([
     "world_checkpoint",
 ]);
 const projectedEventTail = 40;
+function isPlayerRevisionIntent(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const record = value;
+    return (record.schemaVersion === 1 &&
+        record.kind === "player_revision_intent" &&
+        typeof record.operationId === "string" &&
+        typeof record.worldId === "string" &&
+        typeof record.chainId === "string" &&
+        Number.isSafeInteger(record.eventId) &&
+        typeof record.replacementExchangeId === "string" &&
+        typeof record.replacementText === "string" &&
+        (record.continuation === "continue_context" ||
+            record.continuation === "fresh_context") &&
+        typeof record.restoresHead === "string" &&
+        (record.continuation === "continue_context" ||
+            typeof record.freshContext === "object"));
+}
 export { PlayCallChainError } from "./PlayCallChainError.js";
 /**
  * The production play loop: one durable logical context, no Runtime-authored
@@ -50,8 +68,12 @@ export class PlayCallChain {
     #failureLog;
     #active = new Map();
     #worldChains = new Map();
+    /** One in-flight disk hydration per world; concurrent callers share it. */
+    #hydrating = new Map();
     #loadedCursors = new Map();
     #activeInvocations = new Map();
+    /** Resolves when the matching invocation has left the active table. */
+    #invocationSettled = new Map();
     constructor(worlds, compiler = new FileNativePromptCompiler(), artifacts, failureLog, changed = () => {
         /* No observers attached. */
     }) {
@@ -136,12 +158,6 @@ export class PlayCallChain {
             transcript: [],
             events: [],
             completedTools: [],
-            documentAuthorizationCheckpoints: [
-                {
-                    afterEventId: 0,
-                    authorization: documents.authorizationCheckpoint(),
-                },
-            ],
             changedDocuments: [],
             nextMaterials: structuredClone(binding.additionalMaterials),
             nextEventId: 1,
@@ -158,7 +174,6 @@ export class PlayCallChain {
                 eventCount: 0,
                 transcriptCount: 0,
                 completedToolCount: 0,
-                authorizationCheckpointCount: 0,
             },
         };
         if (activeId !== undefined)
@@ -258,12 +273,7 @@ export class PlayCallChain {
             playPresetScriptsEnabled: playPreset.scriptsEnabled,
             presetFiles: structuredClone(playPreset.files),
         });
-        session.documentAuthorizationCheckpoints.push({
-            afterEventId: session.nextEventId,
-            authorization: session.documents.authorizationCheckpoint(),
-        });
         await this.#persist(session);
-        crashAtPlayAdvanceEdge("after_prompt_run_prepared");
     }
     cancel(input) {
         validateIdentity(input.worldId, "world ID");
@@ -289,6 +299,10 @@ export class PlayCallChain {
             [...this.#activeInvocations.values()].some(({ worldId }) => worldId === input.worldId))
             throw new PlayCallChainError("A model request is already running for this world or call chain.");
         const startedAt = Date.now();
+        let markSettled;
+        const settled = new Promise((resolve) => {
+            markSettled = resolve;
+        });
         const invocation = {
             worldId: input.worldId,
             chainId: input.chainId,
@@ -307,6 +321,7 @@ export class PlayCallChain {
         const controlUseId = operationId(input.chainId, `control-use:${input.exchangeId}`);
         this.#worlds.freezeControl(input.worldId, controlUseId);
         this.#activeInvocations.set(input.chainId, invocation);
+        this.#invocationSettled.set(input.chainId, settled);
         this.changed(input.worldId);
         try {
             await this.#worlds.assertWorldRevisionUnlocked(input.worldId);
@@ -317,6 +332,8 @@ export class PlayCallChain {
                 this.#activeInvocations.delete(input.chainId);
             this.#worlds.releaseControl(input.worldId, controlUseId);
             this.changed(input.worldId);
+            this.#invocationSettled.delete(input.chainId);
+            markSettled();
         }
     }
     #observeInvocation(chainId, phase, increments = {}) {
@@ -378,6 +395,14 @@ export class PlayCallChain {
         return view;
     }
     async #worldSession(worldId) {
+        return this.#loadWorldSession(worldId);
+    }
+    /**
+     * Returns the live session for a world, hydrating it from disk at most once
+     * at a time. Concurrent callers share one hydration, so a session object is
+     * never replaced by a stale copy that finished hydrating later.
+     */
+    async #loadWorldSession(worldId) {
         const activeId = this.#worldChains.get(worldId);
         const active = activeId === undefined ? undefined : this.#active.get(activeId);
         if (active !== undefined) {
@@ -385,17 +410,38 @@ export class PlayCallChain {
                 await this.#reconcileSessionAdvance(active);
             return active;
         }
+        const pending = this.#hydrating.get(worldId);
+        if (pending !== undefined)
+            return pending.session;
+        const token = Symbol(worldId);
+        const session = this.#hydrateWorldSession(worldId, token);
+        this.#hydrating.set(worldId, { token, session });
+        try {
+            return await session;
+        }
+        finally {
+            if (this.#hydrating.get(worldId)?.token === token)
+                this.#hydrating.delete(worldId);
+        }
+    }
+    async #hydrateWorldSession(worldId, token) {
+        await this.#recoverPlayerRevision(worldId);
         const persisted = await this.#readPersisted(worldId);
         if (persisted === null)
             return null;
         const advance = await this.#worlds.playAdvances.readCurrent(worldId, persisted.chainId);
-        const session = await this.#hydrateSession(persisted, advance);
-        this.#active.set(session.chainId, session);
-        this.#worldChains.set(worldId, session.chainId);
-        await this.#reconcileSessionAdvance(session, advance);
-        if (session.status === "running")
-            await this.#interruptAbandonedDispatch(session);
-        return session;
+        const hydrated = await this.#hydrateSession(persisted, advance);
+        // A live session registered while this disk read was in flight wins.
+        const live = this.#active.get(hydrated.chainId);
+        if (live !== undefined)
+            return live;
+        // forgetWorld ran during hydration; do not resurrect the old session.
+        if (this.#hydrating.get(worldId)?.token !== token)
+            return null;
+        this.#active.set(hydrated.chainId, hydrated);
+        this.#worldChains.set(worldId, hydrated.chainId);
+        await this.#reconcileSessionAdvance(hydrated, advance);
+        return hydrated;
     }
     async inspectReading(worldId, worldHead) {
         const view = await this.inspectWorld(worldId);
@@ -567,9 +613,10 @@ export class PlayCallChain {
         });
     }
     /**
-     * Revise one committed player message in place. Authority remains
-     * append-only: one timeline-revision commit restores the player's logical
-     * parent snapshot and appends the replacement text atomically.
+     * Edit one committed player message as a rewind followed by an ordinary
+     * submission (ADR-0044, ADR-0045). The intent is written before the first
+     * world change; every later step is repeatable, so an exit at any point is
+     * completed by the same path on the next load.
      */
     async revisePlayer(input) {
         validateIdentity(input.operationId, "timeline-revision operation ID");
@@ -583,178 +630,229 @@ export class PlayCallChain {
         const active = activeId === undefined ? undefined : this.#active.get(activeId);
         if (active?.status === "running")
             throw new PlayCallChainError("A model request is still running; wait for it to return before revising committed history.");
+        await this.#recoverPlayerRevision(input.worldId);
         const source = await this.#readPersisted(input.worldId);
         if (source === null)
             throw new PlayCallChainError("The current world has no model call chain to revise.");
-        const sourceContexts = await this.#worlds.playTimeline.readAllContexts(input.worldId);
-        const appliedContext = sourceContexts.find(({ events }) => events.some((event) => event.kind === "player" &&
-            event.exchangeId === input.replacementExchangeId &&
-            event.committedHead !== undefined));
-        const appliedEvent = appliedContext?.events.find((event) => event.kind === "player" &&
+        const contexts = await this.#worlds.playTimeline.readAllContexts(input.worldId);
+        // A replacement exchange that already reached the timeline is a repeat of
+        // the same request: answer with the current view and do not redo it.
+        const applied = contexts
+            .flatMap(({ events }) => events)
+            .find((event) => event.kind === "player" &&
             event.exchangeId === input.replacementExchangeId &&
             event.committedHead !== undefined);
-        if (appliedEvent !== undefined) {
-            if (appliedEvent.text !== input.replacementText)
+        if (applied !== undefined) {
+            if (applied.kind === "player" && applied.text !== input.replacementText)
                 throw new PlayCallChainError("The same replacement exchange ID is already bound to different player text.");
-            const requestedSource = await this.#worlds.playTimeline.readContext(input.worldId, input.chainId);
-            const requestedEventIndex = requestedSource?.value.events.findIndex(({ id }) => id === input.eventId);
-            const requestedEvent = requestedEventIndex === undefined || requestedEventIndex < 0
-                ? undefined
-                : requestedSource?.value.events[requestedEventIndex];
-            if (requestedSource === null ||
-                requestedEventIndex === undefined ||
-                requestedEventIndex < 0 ||
-                requestedEvent?.kind !== "player" ||
-                requestedEvent.committedHead === undefined)
-                throw new PlayCallChainError("The replacement exchange ID is already used by another commit.");
-            const requestedRestoresHead = playerRevisionRestoresHead(requestedSource.value, requestedEventIndex);
-            const authority = await this.#worlds.readAuthorityHistory(input.worldId);
-            const commit = authority.commits.find(({ head }) => head === appliedEvent.committedHead);
-            const operation = await this.#worlds.getOperationOutcome(input.operationId);
-            if (commit?.mode !== "timeline_revision" ||
-                (operation.outcome !== "committed" &&
-                    operation.outcome !== "committed_materialization_pending") ||
-                operation.worldId !== input.worldId ||
-                operation.head !== appliedEvent.committedHead ||
-                commit.timelineRevision?.restoresHead !== requestedRestoresHead ||
-                commit.timelineRevision.replacesHead !== requestedEvent.committedHead ||
-                commit.timelineRevision.requestFingerprint !==
-                    playerRevisionRequestFingerprint(input, requestedEvent.committedHead, requestedRestoresHead))
-                throw new PlayCallChainError("The replacement exchange ID is already used by another commit.");
             return {
                 outcome: "revised",
                 worldId: input.worldId,
                 playCallChain: projectView(source),
             };
         }
-        const selectedContextIndex = sourceContexts.findIndex(({ chainId }) => chainId === input.chainId);
-        if (selectedContextIndex < 0)
+        const contextIndex = contexts.findIndex(({ chainId }) => chainId === input.chainId);
+        if (contextIndex < 0)
             throw new PlayCallChainError("The model context to revise does not exist.");
-        const sourceContext = sourceContexts[selectedContextIndex];
+        const sourceContext = contexts[contextIndex];
         if (input.continuation === "continue_context" &&
             sourceContext.importedFromArchive)
             throw new PlayCallChainError("This model context was imported from a backup; start a fresh context before continuing.");
-        const selectedEventIndex = sourceContext.events.findIndex((event) => event.id === input.eventId);
-        const selectedEvent = sourceContext.events[selectedEventIndex];
-        if (selectedEventIndex < 0 ||
+        const eventIndex = sourceContext.events.findIndex((event) => event.id === input.eventId);
+        const selectedEvent = sourceContext.events[eventIndex];
+        if (eventIndex < 0 ||
             selectedEvent?.kind !== "player" ||
             selectedEvent.committedHead === undefined)
             throw new PlayCallChainError("The selected event is not a committed player message.");
-        return this.#applyPlayerRevision({
-            request: input,
-            source,
-            sourceContexts,
-            selectedContextIndex,
-            selectedEventIndex,
-            selectedEvent: {
-                ...selectedEvent,
-                committedHead: selectedEvent.committedHead,
-            },
+        const intent = {
+            schemaVersion: 1,
+            kind: "player_revision_intent",
+            operationId: input.operationId,
+            worldId: input.worldId,
+            chainId: input.chainId,
+            eventId: input.eventId,
+            replacementExchangeId: input.replacementExchangeId,
+            replacementText: input.replacementText,
+            continuation: input.continuation,
+            restoresHead: playerRevisionRestoresHead(sourceContext, eventIndex),
+            discardChainIds: contexts
+                .slice(contextIndex)
+                .map(({ chainId }) => chainId),
+            ...(input.continuation === "fresh_context"
+                ? { freshContext: structuredClone(input.freshContext) }
+                : {}),
+        };
+        await this.#worlds.writePlayerRevisionIntent(input.worldId, intent);
+        const revised = await this.#completePlayerRevision(intent);
+        return {
+            outcome: "revised",
+            worldId: input.worldId,
+            playCallChain: projectView(revised),
+        };
+    }
+    /** Complete an interrupted revision recorded by a previous process. */
+    async #recoverPlayerRevision(worldId) {
+        await this.#worlds.operations.withExclusiveWorldStateMutation(worldId, async () => {
+            const intent = await this.#worlds.readPlayerRevisionIntent(worldId);
+            if (intent === null)
+                return;
+            if (!isPlayerRevisionIntent(intent) || intent.worldId !== worldId)
+                throw new PlayCallChainError("The interrupted player revision record is invalid.");
+            await this.#completePlayerRevision(intent);
         });
     }
-    async #applyPlayerRevision(input) {
-        const request = input.request;
-        const sourceContext = input.sourceContexts[input.selectedContextIndex];
-        const restoresHead = playerRevisionRestoresHead(sourceContext, input.selectedEventIndex);
-        const freshPreparation = request.continuation === "fresh_context"
-            ? await this.#prepareFreshPlayerRevision(request, restoresHead)
+    /**
+     * Run the revision steps in order. Each step either checks whether it is
+     * already done or repeats harmlessly: rewinding to the restored endpoint is a
+     * no-op at that endpoint, the commit uses the intent's operation ID, and the
+     * context is published last, so it is the only step that changes what the
+     * next load sees.
+     */
+    async #completePlayerRevision(intent) {
+        return this.#worlds.operations.withExclusiveWorldStateMutation(intent.worldId, () => this.#completePlayerRevisionQueued(intent));
+    }
+    async #completePlayerRevisionQueued(intent) {
+        const worldId = intent.worldId;
+        const resultChainId = revisionChainId(intent.chainId, intent.operationId, worldId, intent.continuation);
+        const current = await this.#readPersisted(worldId);
+        if (current?.chainId === resultChainId) {
+            await this.#discardRevisedContexts(intent, resultChainId);
+            await this.#worlds.clearPlayerRevisionIntent(worldId);
+            return current;
+        }
+        const contexts = await this.#worlds.playTimeline.readAllContexts(worldId);
+        const sourceIndex = contexts.findIndex(({ chainId }) => chainId === intent.chainId);
+        const sourceContext = contexts[sourceIndex];
+        if (sourceContext === undefined)
+            throw new PlayCallChainError("The model context to revise does not exist.");
+        const eventIndex = sourceContext.events.findIndex(({ id }) => id === intent.eventId);
+        if (eventIndex < 0)
+            throw new PlayCallChainError("The selected event is no longer in its model context.");
+        // Fresh-context bootstrap is compiled before any world change.
+        const fresh = intent.continuation === "fresh_context" && intent.freshContext
+            ? await this.#prepareFreshPlayerRevision(worldId, intent.freshContext, intent.restoresHead, intent.replacementText)
             : null;
-        const timelineGeneration = playerRevisionTimelineGeneration(input.source.timelineGeneration, request.operationId, request.worldId, request.continuation);
-        const requestFingerprint = playerRevisionRequestFingerprint(request, input.selectedEvent.committedHead, restoresHead);
-        const traceRetention = preparePlayerRevisionTrace(sourceContext, input.selectedEventIndex);
-        // A timeline revision appends on the current audit head and restores the
-        // selected message's logical parent, so a chain that lags the world (an
-        // out-of-story world revision, or an earlier revision whose chain was not
-        // published) must not block it. The commit still rechecks this head under
-        // the world lock.
-        const outcome = await this.#worlds.reviseTimeline({
-            operationId: request.operationId,
-            worldId: request.worldId,
-            expectedCurrentHead: await this.#worlds.currentHead(request.worldId),
-            restoresHead,
-            replacesHead: input.selectedEvent.committedHead,
-            replacementText: request.replacementText,
-            requestFingerprint,
-        });
+        const head = await this.#commitPlayerRevision(intent);
         const [baseline, selected, binding] = await Promise.all([
-            this.#worlds.recoverEndpoint(request.worldId, sourceContext.baselineHead),
-            this.#worlds.recoverEndpoint(request.worldId, restoresHead),
-            this.#worlds.bindPlayCallChain(request.worldId),
+            this.#worlds.recoverEndpoint(worldId, sourceContext.baselineHead),
+            this.#worlds.recoverEndpoint(worldId, intent.restoresHead),
+            this.#worlds.bindPlayCallChain(worldId),
         ]);
-        const continuedTrace = traceRetention.withReplacement({
-            head: outcome.head,
-            exchangeId: request.replacementExchangeId,
-            text: request.replacementText,
-        });
-        if (binding.parentHead !== outcome.head)
-            throw new PlayCallChainError("The timeline revision was committed, but current-world materialization has not reached the new endpoint.");
-        if (request.continuation === "fresh_context") {
-            if (freshPreparation === null)
-                throw new PlayCallChainError("The fresh model context was not prepared before committing the timeline revision.");
-            const revised = await this.#buildFreshPlayerRevision({
-                request,
+        if (binding.parentHead !== head)
+            throw new PlayCallChainError("The player revision was committed, but current-world materialization has not reached the new endpoint.");
+        const timelineGeneration = revisionTimelineGeneration(current?.timelineGeneration ?? "none", intent.operationId, worldId, intent.continuation);
+        const previousChainId = sourceIndex === 0 ? null : contexts[sourceIndex - 1].chainId;
+        const traceRetention = preparePlayerRevisionTrace(sourceContext, eventIndex);
+        let revised;
+        if (intent.continuation === "fresh_context") {
+            if (fresh === null || intent.freshContext === undefined)
+                throw new PlayCallChainError("The fresh model context was not prepared before committing the player revision.");
+            revised = await this.#buildFreshPlayerRevision({
+                intent,
+                freshContext: intent.freshContext,
                 sourceContext,
-                sourceContexts: input.sourceContexts,
-                selectedContextIndex: input.selectedContextIndex,
                 traceRetention,
                 baseline,
                 selected,
                 binding,
-                restoresHead,
-                outcomeHead: outcome.head,
+                head,
+                chainId: resultChainId,
+                previousChainId,
                 timelineGeneration,
-                freshPreparation,
+                fresh,
             });
-            await this.#worlds.playTimeline.persist(structuredClone(revised));
-            await this.#worlds.completeArchiveFreshContext(request.worldId);
-            const activeId = this.#worldChains.get(request.worldId);
-            if (activeId !== undefined)
-                this.#active.delete(activeId);
-            this.#active.delete(sourceContext.chainId);
-            this.#worldChains.delete(request.worldId);
-            return {
-                outcome: "revised",
-                worldId: request.worldId,
-                playCallChain: projectView(revised),
+        }
+        else {
+            revised = {
+                ...traceRetention
+                    .withReplacement({
+                    head,
+                    exchangeId: intent.replacementExchangeId,
+                    text: intent.replacementText,
+                })
+                    .atEndpoint({ baseline, selected, binding }),
+                schemaVersion: 3,
+                kind: "play_call_chain",
+                chainId: resultChainId,
+                worldId,
+                previousContexts: [],
+                previousChainId,
+                timelineGeneration,
+                parentHead: head,
+                updatedAt: Date.now(),
             };
         }
-        const revised = {
-            ...continuedTrace.atEndpoint({ baseline, selected, binding }),
-            schemaVersion: 3,
-            kind: "play_call_chain",
-            chainId: playerRevisionChainId(sourceContext.chainId, request.operationId, request.worldId, request.continuation),
-            worldId: request.worldId,
-            previousContexts: [],
-            previousChainId: input.selectedContextIndex === 0
-                ? null
-                : input.sourceContexts[input.selectedContextIndex - 1].chainId,
-            timelineGeneration,
-            parentHead: outcome.head,
-            updatedAt: Date.now(),
-        };
         await this.#worlds.playTimeline.persist(structuredClone(revised));
-        const activeId = this.#worldChains.get(request.worldId);
+        if (intent.continuation === "fresh_context")
+            await this.#worlds.completeArchiveFreshContext(worldId);
+        await this.#discardRevisedContexts(intent, resultChainId);
+        const activeId = this.#worldChains.get(worldId);
         if (activeId !== undefined)
             this.#active.delete(activeId);
         this.#active.delete(sourceContext.chainId);
-        this.#worldChains.delete(request.worldId);
-        return {
-            outcome: "revised",
-            worldId: request.worldId,
-            playCallChain: projectView(revised),
-        };
+        this.#worldChains.delete(worldId);
+        await this.#worlds.clearPlayerRevisionIntent(worldId);
+        return revised;
+    }
+    /**
+     * Delete the segments of the edited context and every later one. Their
+     * surviving content has been copied into the revised context, so only the
+     * discarded rounds and their in-progress markers are removed from disk.
+     */
+    async #discardRevisedContexts(intent, keepChainId) {
+        const discarded = intent.discardChainIds.filter((chainId) => chainId !== keepChainId);
+        await this.#worlds.playTimeline.discardContexts(intent.worldId, discarded);
+        for (const chainId of discarded)
+            await this.#worlds.playAdvances.discardChain(intent.worldId, chainId);
     }
-    async #prepareFreshPlayerRevision(request, restoresHead) {
-        const binding = await this.#worlds.bindPlayCallChainAt(request.worldId, restoresHead);
+    /**
+     * Rewind the world to the message's logical parent and commit the replacement
+     * as an ordinary player step. Returns the committed head. A commit already
+     * made in this process is reused rather than rewound and repeated.
+     */
+    async #commitPlayerRevision(intent) {
+        const done = await this.#worlds.getOperationOutcome(intent.operationId);
+        if (done.outcome === "committed")
+            return done.head;
+        await this.#worlds.rewindPlayerRevision(intent.worldId, intent.restoresHead);
+        await this.#artifacts?.discardAfterHead(intent.worldId, intent.restoresHead);
+        const binding = await this.#worlds.bindPlayCallChainAt(intent.worldId, intent.restoresHead);
+        const origin = captureNarrativeOrigin(WorldDocumentStore.open({
+            layout: "world_state",
+            files: Object.entries(binding.files).map(([path, contents]) => ({
+                path,
+                contents,
+            })),
+        }), intent.eventId);
+        const outcome = await this.#worlds.commitPlayStep({
+            operationId: intent.operationId,
+            worldId: intent.worldId,
+            parentHead: intent.restoresHead,
+            historyAppend: [
+                {
+                    role: "player",
+                    exactText: intent.replacementText,
+                    ...(origin.value == null
+                        ? {}
+                        : { background: snapshotBackground(origin.value) }),
+                },
+            ],
+            nextMaterials: structuredClone(binding.additionalMaterials),
+            stateChanges: [],
+        });
+        return outcome.head;
+    }
+    async #prepareFreshPlayerRevision(worldId, freshContext, restoresHead, replacementText) {
+        const binding = await this.#worlds.bindPlayCallChainAt(worldId, restoresHead);
         const documents = new FileNativePlayDocuments(binding.files);
-        const documentMaintenance = await this.#bindDocumentMaintenance(documents, request.worldId, binding.parentHead);
+        const documentMaintenance = await this.#bindDocumentMaintenance(documents, worldId, binding.parentHead);
         const compilation = this.#compiler.compilePlayCallChain({
-            extensionControls: await this.#worlds.extensionControls(request.worldId, request.freshContext.playPreset, this.#compiler.locale),
+            extensionControls: await this.#worlds.extensionControls(worldId, freshContext.playPreset, this.#compiler.locale),
             endpoint: {
-                id: `${request.worldId}:${binding.parentHead}`,
+                id: `${worldId}:${binding.parentHead}`,
                 commit: binding.parentHead,
             },
-            hostBinding: structuredClone(request.freshContext.hostBinding),
+            hostBinding: structuredClone(freshContext.hostBinding),
             world: {
                 controlFingerprint: fingerprintControl(binding.files),
                 documentSnapshot: documents.snapshot,
@@ -766,24 +864,20 @@ export class PlayCallChain {
                 documentMaintenanceUnavailableReason: documents.maintenanceWarning,
             },
             playerInputPlacement: "append",
-            playerInput: request.replacementText,
-            modelBinding: structuredClone(request.freshContext.modelBinding),
-        }, request.freshContext.playPreset);
-        const bootstrap = structuredClone(compilation.bootstrap);
-        documents.bindBootstrap(bootstrap);
+            playerInput: replacementText,
+            modelBinding: structuredClone(freshContext.modelBinding),
+        }, freshContext.playPreset);
+        documents.bindBootstrap(compilation.bootstrap);
         return {
             binding,
-            bootstrap,
+            bootstrap: structuredClone(compilation.bootstrap),
             tools: structuredClone(compilation.toolUniverse),
             followups: structuredClone(compilation.followups ?? []),
-            authorization: documents.authorizationCheckpoint(),
         };
     }
     async #buildFreshPlayerRevision(input) {
-        const { request, sourceContext } = input;
-        let previousChainId = input.selectedContextIndex === 0
-            ? null
-            : input.sourceContexts[input.selectedContextIndex - 1].chainId;
+        const { intent, sourceContext, fresh } = input;
+        let previousChainId = input.previousChainId;
         const retainedPrefix = input.traceRetention.pagePrefixAtEndpoint({
             baseline: input.baseline,
             selected: input.selected,
@@ -794,38 +888,37 @@ export class PlayCallChain {
                 ...retainedPrefix,
                 schemaVersion: 3,
                 kind: "play_call_chain",
-                chainId: derivedChainId(sourceContext.chainId, "timeline-revision-prefix:" + request.operationId, request.worldId),
-                worldId: request.worldId,
+                chainId: derivedChainId(sourceContext.chainId, "timeline-revision-prefix:" + intent.operationId, intent.worldId),
+                worldId: intent.worldId,
                 previousContexts: [],
                 previousChainId,
                 timelineGeneration: input.timelineGeneration,
-                parentHead: input.restoresHead,
+                parentHead: intent.restoresHead,
                 updatedAt: Date.now(),
             };
             await this.#worlds.playTimeline.persistDetached(structuredClone(prefix));
             previousChainId = prefix.chainId;
         }
-        const fresh = input.freshPreparation;
         return {
             schemaVersion: 3,
             kind: "play_call_chain",
-            chainId: playerRevisionChainId(sourceContext.chainId, request.operationId, request.worldId, request.continuation),
-            worldId: request.worldId,
+            chainId: input.chainId,
+            worldId: intent.worldId,
             previousContexts: [],
             previousChainId,
             timelineGeneration: input.timelineGeneration,
-            baselineHead: input.restoresHead,
+            baselineHead: intent.restoresHead,
             baselineHistoryLength: Object.keys(fresh.binding.history).length,
-            parentHead: input.outcomeHead,
+            parentHead: input.head,
             playPreset: {
-                id: request.freshContext.playPreset.id,
-                name: request.freshContext.playPreset.name,
-                revision: request.freshContext.playPreset.revision,
+                id: input.freshContext.playPreset.id,
+                name: input.freshContext.playPreset.name,
+                revision: input.freshContext.playPreset.revision,
             },
             followups: structuredClone(fresh.followups),
-            playPresetScriptsEnabled: request.freshContext.playPreset.scriptsEnabled,
-            presetFiles: structuredClone(request.freshContext.playPreset.files),
-            modelBinding: structuredClone(request.freshContext.modelBinding),
+            playPresetScriptsEnabled: input.freshContext.playPreset.scriptsEnabled,
+            presetFiles: structuredClone(input.freshContext.playPreset.files),
+            modelBinding: structuredClone(input.freshContext.modelBinding),
             status: "ready",
             canRetry: false,
             bootstrap: structuredClone(fresh.bootstrap),
@@ -834,24 +927,18 @@ export class PlayCallChain {
                 layout: "world_state",
                 files: Object.entries(input.binding.files).map(([path, contents]) => ({ path, contents })),
             }), 1),
-            transcript: playerInputAppend(request.replacementText),
+            transcript: playerInputAppend(intent.replacementText),
             events: [
                 {
                     id: 1,
                     kind: "player",
-                    exchangeId: request.replacementExchangeId,
-                    text: request.replacementText,
+                    exchangeId: intent.replacementExchangeId,
+                    text: intent.replacementText,
                     context: "fresh",
-                    committedHead: input.outcomeHead,
+                    committedHead: input.head,
                 },
             ],
             completedTools: [],
-            documentAuthorizationCheckpoints: [
-                {
-                    afterEventId: 0,
-                    authorization: structuredClone(fresh.authorization),
-                },
-            ],
             changedDocuments: [],
             nextMaterials: structuredClone(input.binding.additionalMaterials),
             nextEventId: 2,
@@ -955,28 +1042,24 @@ export class PlayCallChain {
                     ? { retainCompleteContext: true }
                     : {}),
             });
-        if (input.targetWorldRoot !== undefined) {
-            const retainedContexts = [
-                ...input.sourceContexts.slice(0, input.selectedContextIndex),
-                { ...sourceContext, events: input.sourceEvents },
-            ];
-            await this.#artifacts?.stageFork?.({
-                sourceWorldId: input.sourceWorldId,
-                targetWorldId: input.targetWorldId,
-                targetWorldRoot: input.targetWorldRoot,
-                timeline: retainedContexts.flatMap((context) => context.events.flatMap((event) => event.kind === "assistant" && event.committedHead !== undefined
-                    ? [
-                        {
-                            contextId: context.continuityContextId ?? context.chainId,
-                            eventId: event.id,
-                            head: event.committedHead,
-                        },
-                    ]
-                    : [])),
-            });
-        }
         return projectView(derived);
     }
+    /**
+     * Stops every in-flight model request for a world and waits until each has
+     * left the active table, so deletion never races a play write.
+     */
+    async abortWorld(worldId) {
+        validateIdentity(worldId, "world ID");
+        const invocations = [...this.#activeInvocations.values()].filter((invocation) => invocation.worldId === worldId);
+        for (const invocation of invocations) {
+            if (invocation.abortable && !invocation.controller.signal.aborted) {
+                invocation.phase = "cancelling";
+                invocation.lastActivityAt = Date.now();
+                invocation.controller.abort();
+            }
+        }
+        await Promise.all(invocations.map((invocation) => this.#invocationSettled.get(invocation.chainId) ?? Promise.resolve()));
+    }
     forgetWorld(worldId) {
         const activeId = this.#worldChains.get(worldId);
         const active = activeId === undefined ? undefined : this.#active.get(activeId);
@@ -985,6 +1068,7 @@ export class PlayCallChain {
         if (activeId !== undefined)
             this.#active.delete(activeId);
         this.#worldChains.delete(worldId);
+        this.#hydrating.delete(worldId);
     }
     async #captureOrigin(session) {
         const binding = await this.#worlds.bindPlayCallChain(session.worldId);
@@ -1036,14 +1120,6 @@ export class PlayCallChain {
             await this.#settlePlayerAdvance(session, advance);
         }
         catch (error) {
-            const accepted = await this.#worlds
-                .getOperationOutcome(advance.operationId)
-                .catch(() => ({ outcome: "not_started" }));
-            if (accepted.outcome === "committed" ||
-                accepted.outcome === "committed_materialization_pending") {
-                await this.#settlePlayerAdvance(session, advance);
-                return this.#dispatch(session, modelHost, structuredClone(nextRequest), 1, signal, observer);
-            }
             const message = error instanceof Error
                 ? error.message
                 : "Failed to write the original player text.";
@@ -1059,7 +1135,7 @@ export class PlayCallChain {
             session.lastFailure = message;
             session.lastFailureKind = failureKind;
             await this.#persist(session);
-            await this.#worlds.playAdvances.markSettled(advance, session.parentHead);
+            await this.#worlds.playAdvances.markSettled(advance);
             throw new PlayCallChainError(message);
         }
         return this.#dispatch(session, modelHost, structuredClone(nextRequest), 1, signal, observer);
@@ -1123,8 +1199,7 @@ export class PlayCallChain {
             "The player message is committed; the frozen model request is ready to continue.";
         session.lastFailureKind = "retryable";
         await this.#persist(session);
-        crashAtPlayAdvanceEdge("after_timeline_settled");
-        await this.#worlds.playAdvances.markSettled(advance, outcome.head);
+        await this.#worlds.playAdvances.markSettled(advance);
     }
     async #prepareResponseSettlement(session, advance, response) {
         const existing = session.events.find(({ id }) => id === advance.eventId);
@@ -1159,15 +1234,13 @@ export class PlayCallChain {
         const prepared = [];
         const trailingEvents = [];
         let nextEventId = advance.eventId + 1;
-        // One persisted seed per advance: every resolution call draws from it by
-        // call identity, so recovery reproduces the same receipts.
+        // Fresh in-memory seed per settlement. It is never persisted: a crashed
+        // exchange is retried by the player and re-rolls (ADR-0044).
         const resolutionSeed = calls.some(({ name }) => isResolutionTool(name))
-            ? await this.#worlds.playAdvances.resolutionSeed(advance)
+            ? randomBytes(32).toString("hex")
             : undefined;
         for (const call of calls) {
             const item = prepareTool(session, workingTools, advance.exchange, call, this.#compiler.locale, resolutionSeed);
-            if (item.result.resolution !== undefined)
-                crashAtPlayAdvanceEdge("after_resolution");
             prepared.push(item);
             trailingEvents.push({
                 id: nextEventId++,
@@ -1282,7 +1355,6 @@ export class PlayCallChain {
                     : []),
             ],
             completedTools: [...workingTools.values()].map((item) => structuredClone(item)),
-            authorizationCheckpoint: session.documents.authorizationCheckpoint(),
             stateChanges: structuredClone(stateChanges),
             visibleText,
             ...(narrativeCheckpoint === undefined ? {} : { narrativeCheckpoint }),
@@ -1343,7 +1415,6 @@ export class PlayCallChain {
                     historyMessageId: `message.${outcome.head.slice("commit:".length)}.1.narrator`,
                 };
             }
-            crashAtPlayAdvanceEdge("after_authority_accepted");
             appendCommittedHistory(session, outcome.head, outcome.historyAppend);
         }
         finalizePreparedReceipts(settlement);
@@ -1365,29 +1436,10 @@ export class PlayCallChain {
             item.key,
             structuredClone(item),
         ]));
-        const lastToolEventId = settlement.trailingEvents.findLast(({ kind }) => kind === "tool_result")?.id;
-        if (lastToolEventId !== undefined) {
-            session.documentAuthorizationCheckpoints =
-                session.documentAuthorizationCheckpoints.filter(({ afterEventId }) => afterEventId < advance.eventId);
-            session.documentAuthorizationCheckpoints.push({
-                afterEventId: lastToolEventId,
-                authorization: structuredClone(settlement.authorizationCheckpoint),
-            });
-        }
         if (committedHead !== undefined)
             session.parentHead = committedHead;
         if (settlement.stateChanges.length > 0) {
-            const currentAuthorization = session.documents.authorizationCheckpoint();
-            if (currentAuthorization.stateFingerprint ===
-                settlement.authorizationCheckpoint.stateFingerprint)
-                session.documents.acceptCommittedState();
-            else {
-                const binding = await this.#worlds.bindPlayCallChain(session.worldId);
-                session.documents = new FileNativePlayDocuments(binding.files);
-                session.documents.restoreAuthorizationCheckpoint(settlement.authorizationCheckpoint);
-                session.history = historyEntries(binding.history, binding.historyBackgrounds);
-                session.nextMaterials = structuredClone(binding.additionalMaterials);
-            }
+            session.documents.acceptCommittedState();
             mergeChangedDocuments(session, settlement.stateChanges);
         }
         if (settlement.stateChanges.length > 0)
@@ -1440,24 +1492,9 @@ export class PlayCallChain {
             result = { kind: "terminal", status: session.status };
         }
         await this.#persist(session);
-        crashAtPlayAdvanceEdge("after_timeline_settled");
-        await this.#worlds.playAdvances.markSettled(advance, committedHead ?? session.parentHead);
+        await this.#worlds.playAdvances.markSettled(advance);
         return result;
     }
-    async #recoverAcceptedResponseAdvance(session, advance) {
-        const outcome = await this.#worlds
-            .getOperationOutcome(advance.operationId)
-            .catch(() => ({ outcome: "not_started" }));
-        if (outcome.outcome !== "committed" &&
-            outcome.outcome !== "committed_materialization_pending")
-            return null;
-        const current = await this.#worlds.playAdvances.readCurrent(advance.worldId, advance.chainId);
-        if (current?.base.advanceKind !== "response" ||
-            current.base.advanceId !== advance.advanceId ||
-            current.settlementPrepared === null)
-            throw new PlayCallChainError("Authority accepted a response whose durable settlement is missing.");
-        return this.#settleResponseAdvance(session, advance, current.settlementPrepared.settlement);
-    }
     async #dispatch(session, modelHost, firstRequest, firstAttempt, signal, observer) {
         let request = modelHost.freezeRequest?.(firstRequest) ?? structuredClone(firstRequest);
         let attempt = firstAttempt;
@@ -1503,7 +1540,6 @@ export class PlayCallChain {
                 createdAt: Date.now(),
             };
             await this.#worlds.playAdvances.begin(advance);
-            crashAtPlayAdvanceEdge("after_response_advance_began");
             this.#notifySnapshot(observer, session);
             if (signal.aborted)
                 return this.#cancelBeforeProviderDispatch(session, request, attempt, observer, advance);
@@ -1587,17 +1623,13 @@ export class PlayCallChain {
                     });
                 }
                 await this.#persist(session);
-                await this.#worlds.playAdvances.markSettled(advance, session.parentHead);
+                await this.#worlds.playAdvances.markSettled(advance);
                 this.#notifySnapshot(observer, session);
                 return projectView(session);
             }
             const durableResponse = durableModelResponse(response);
             try {
-                await this.#worlds.playAdvances.recordProviderCompleted(advance, durableResponse);
-                crashAtPlayAdvanceEdge("after_provider_completed");
                 const settlement = await this.#prepareResponseSettlement(session, advance, durableResponse);
-                await this.#worlds.playAdvances.recordSettlementPrepared(advance, settlement);
-                crashAtPlayAdvanceEdge("after_settlement_prepared");
                 const failedTools = settlement.trailingEvents.filter((candidate) => candidate.kind === "tool_result" && !candidate.ok);
                 if (failedTools.length > 0 && response.diagnostics !== undefined)
                     await this.#failureLog?.recordFailure({
@@ -1679,17 +1711,6 @@ export class PlayCallChain {
                 attempt = 1;
             }
             catch (error) {
-                const recovered = await this.#recoverAcceptedResponseAdvance(session, advance);
-                if (recovered !== null) {
-                    if (recovered.kind === "continue") {
-                        request = recovered.nextRequest;
-                        attempt = 1;
-                        this.#notifySnapshot(observer, session);
-                        continue;
-                    }
-                    this.#notifySnapshot(observer, session);
-                    return projectView(session);
-                }
                 const message = error instanceof Error
                     ? error.message
                     : "Call-chain processing failed.";
@@ -1740,7 +1761,7 @@ export class PlayCallChain {
         delete session.lastFailureKind;
         await this.#persist(session);
         if (advance !== undefined)
-            await this.#worlds.playAdvances.markSettled(advance, session.parentHead);
+            await this.#worlds.playAdvances.markSettled(advance);
         this.#notifySnapshot(observer, session);
         return projectView(session);
     }
@@ -1859,16 +1880,9 @@ export class PlayCallChain {
             await this.#reconcileSessionAdvance(active);
             return active;
         }
-        const persisted = await this.#readPersisted(worldId);
-        if (persisted?.chainId !== chainId)
+        const session = await this.#loadWorldSession(worldId);
+        if (session?.chainId !== chainId)
             throw new PlayCallChainError("The call chain does not exist; start from the latest world state.");
-        const advance = await this.#worlds.playAdvances.readCurrent(worldId, chainId);
-        const session = await this.#hydrateSession(persisted, advance);
-        this.#active.set(chainId, session);
-        this.#worldChains.set(worldId, chainId);
-        await this.#reconcileSessionAdvance(session, advance);
-        if (session.status === "running")
-            await this.#interruptAbandonedDispatch(session);
         const currentHead = await this.#worlds.currentHead(worldId);
         if (currentHead !== session.parentHead)
             throw new PlayCallChainError("The call-chain record differs from the current world endpoint; use a fresh context.");
@@ -1886,27 +1900,15 @@ export class PlayCallChain {
         const currentBinding = await this.#worlds.bindPlayCallChain(persisted.worldId);
         // A completed chain still describes its own immutable endpoint after a
         // world revision. Restore its reads against that state, not the revised
-        // current tree. An unsettled advance keeps the existing crash-recovery
-        // path because Authority may already contain its prepared result.
-        const binding = currentBinding.parentHead !== persisted.parentHead &&
-            advance?.settled !== null
+        // current tree. An in-progress advance reads the current tree; it is
+        // interrupted on load and retried against that tree.
+        const binding = currentBinding.parentHead !== persisted.parentHead && advance === null
             ? await this.#worlds.bindPlayCallChainAt(persisted.worldId, persisted.parentHead)
             : currentBinding;
-        let documents;
-        try {
-            documents = restorePlayDocuments(binding.files, persisted, persisted.events);
-        }
-        catch (error) {
-            const prepared = advance?.settlementPrepared?.settlement;
-            if (prepared === undefined)
-                throw error;
-            documents = new FileNativePlayDocuments(binding.files);
-            documents.restoreAuthorizationCheckpoint(prepared.authorizationCheckpoint);
-        }
+        const documents = restorePlayDocuments(binding.files, persisted, persisted.events);
         await this.#bindDocumentMaintenance(documents, persisted.worldId, binding.parentHead);
         return {
             ...structuredClone(persisted),
-            documentAuthorizationCheckpoints: persisted.documentAuthorizationCheckpoints?.map((checkpoint) => structuredClone(checkpoint)) ?? [],
             nextMaterials: structuredClone(binding.additionalMaterials),
             documents,
             history: historyEntries(binding.history, binding.historyBackgrounds),
@@ -1919,49 +1921,45 @@ export class PlayCallChain {
                 eventCount: 0,
                 transcriptCount: 0,
                 completedToolCount: 0,
-                authorizationCheckpointCount: 0,
             },
         };
     }
+    /**
+     * An in-progress advance, or a session still marked running, means a model
+     * dispatch or settlement was cut off by a process exit. Nothing is replayed:
+     * the exchange is interrupted and the player retries (ADR-0044).
+     */
     async #reconcileSessionAdvance(session, loaded) {
-        const current = loaded ??
-            (await this.#worlds.playAdvances.readCurrent(session.worldId, session.chainId));
-        if (current?.settled !== null)
+        const advance = loaded === undefined
+            ? await this.#worlds.playAdvances.readCurrent(session.worldId, session.chainId)
+            : loaded;
+        if (advance === null && session.status !== "running")
             return;
-        if (current.base.advanceKind === "player") {
-            await this.#settlePlayerAdvance(session, current.base);
-            return;
-        }
-        if (current.providerCompleted === null) {
-            await this.#interruptAbandonedDispatch(session, current.base);
-            await this.#worlds.playAdvances.markSettled(current.base, session.parentHead);
-            return;
-        }
-        let settlement = current.settlementPrepared?.settlement;
-        if (settlement === undefined) {
-            settlement = await this.#prepareResponseSettlement(session, current.base, current.providerCompleted.response);
-            await this.#worlds.playAdvances.recordSettlementPrepared(current.base, settlement);
-        }
-        await this.#settleResponseAdvance(session, current.base, settlement);
+        await this.#interruptAbandonedDispatch(session, advance);
+        if (advance !== null)
+            await this.#worlds.playAdvances.markSettled(advance);
     }
     async #interruptAbandonedDispatch(session, advance) {
-        const streaming = session.events.findLast((event) => event.kind === "assistant" &&
-            event.status === "streaming" &&
-            (advance === undefined || event.id === advance.eventId));
+        const headMoved = (await this.#worlds.currentHead(session.worldId)) !== session.parentHead;
+        const playerPhase = advance?.advanceKind === "player";
+        const streaming = playerPhase
+            ? undefined
+            : session.events.findLast((event) => event.kind === "assistant" &&
+                event.status === "streaming" &&
+                (advance === null || event.id === advance.eventId));
         if (streaming !== undefined)
             streaming.status = "interrupted";
-        const dispatchMayHaveStarted = advance !== undefined;
-        const canRetry = !dispatchMayHaveStarted && session.lastRequest !== null;
-        const message = dispatchMayHaveStarted
-            ? "The service stopped after model dispatch may have started; the outcome is unknown and the request cannot be replayed. Use a fresh context."
-            : canRetry
-                ? "The service stopped before model dispatch; the frozen request can be retried."
-                : "The service stopped before preparing a model request; use a fresh context.";
-        const failureKind = dispatchMayHaveStarted
-            ? "outcome_unknown"
-            : canRetry
-                ? "retryable"
-                : "other";
+        // Authority already moved past the persisted parent head: the world
+        // cannot be replayed onto that head, so a fresh context is required.
+        const canRetry = !headMoved && !playerPhase && session.lastRequest !== null;
+        const message = headMoved
+            ? "The service stopped after the world was updated; use a fresh context."
+            : playerPhase
+                ? "The service stopped while saving the player message; use a fresh context."
+                : canRetry
+                    ? "The service stopped while the model request was in progress; retry to call the model again."
+                    : "The service stopped before preparing a model request; use a fresh context.";
+        const failureKind = canRetry ? "retryable" : "other";
         session.events.push({
             id: session.nextEventId++,
             kind: "failure",
@@ -2348,31 +2346,10 @@ function playerRevisionRestoresHead(source, selectedEventIndex) {
             restoresHead = event.committedHead;
     return restoresHead;
 }
-function playerRevisionRequestFingerprint(request, selectedHead, restoresHead) {
-    const base = {
-        schema: "narraeon.timeline-revision-request/v1",
-        chainId: request.chainId,
-        eventId: request.eventId,
-        selectedHead,
-        restoresHead,
-        replacementExchangeId: request.replacementExchangeId,
-        replacementText: request.replacementText,
-    };
-    // Keep the released continuation fingerprint byte-for-byte recoverable;
-    // the fresh strategy owns a new request shape with an explicit mode.
-    const value = request.continuation === "continue_context"
-        ? base
-        : {
-            ...base,
-            schema: "narraeon.timeline-revision-request/v2",
-            continuation: request.continuation,
-        };
-    return ("sha256:" + createHash("sha256").update(JSON.stringify(value)).digest("hex"));
-}
-function playerRevisionChainId(sourceChainId, operationId, worldId, continuation) {
+function revisionChainId(sourceChainId, operationId, worldId, continuation) {
     return derivedChainId(sourceChainId, `${continuation === "fresh_context" ? "timeline-revision-fresh" : "timeline-revision"}:${operationId}`, worldId);
 }
-function playerRevisionTimelineGeneration(sourceGeneration, operationId, worldId, continuation) {
+function revisionTimelineGeneration(sourceGeneration, operationId, worldId, continuation) {
     return `timeline:${createHash("sha256")
         .update(JSON.stringify({
         schema: "narraeon.player-revision-timeline-generation/v1",
@@ -2437,11 +2414,6 @@ function resolutionToolResult(name, args, seed, identity, locale) {
         resolution,
     };
 }
-function crashAtPlayAdvanceEdge(edge) {
-    if (process.env.NODE_ENV === "test" &&
-        process.env.NARRAEON_INTERNAL_TEST_CRASH_AT_PLAY_ADVANCE_EDGE === edge)
-        throw new Error(`Simulated process exit at play advance edge: ${edge}`);
-}
 function frozenFollowupPresentations(session) {
     const files = session.promptRuns?.at(-1)?.presetFiles ?? session.presetFiles;
     if (files === undefined)