narraeon 0.6.0 → 0.6.2

package/dist/node/runtime/world/FileNativeWorldStore.js

@@ -1,5 +1,6 @@
 import { captureNarrativeOrigin, snapshotBackground, isHistoryBackground, } from "../history/HistoryBackground.js";
-import { FileNativeArtifactStore } from "../artifact/FileNativeArtifactStore.js";
+import { FileNativeArtifactStore, forkArtifactClosure, } from "../artifact/FileNativeArtifactStore.js";
+import { migrateLegacyArtifactStore } from "../artifact/LegacyArtifactStoreMigration.js";
 import { WorldExtensionRequests } from "../extension/WorldExtensionRequests.js";
 import { WorldExtensionControls, extensionDefinitions, } from "../extension/WorldExtensionControls.js";
 import { assertSameGameplay, readGameplay, } from "../../protocol/gameplay.js";
@@ -7,7 +8,7 @@ import { HistoryQuery } from "../history/HistoryQuery.js";
 import { exportStory } from "../history/StoryExport.js";
 import { PackageScriptPermissions } from "../extension/PackageScriptPermissions.js";
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, open, readFile, readdir, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { cp, mkdir, readFile, readdir, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { inspectContentPackageCurrentTree, isContentPackageWorldDocumentPath, } from "../content/FileNativeContentTree.js";
@@ -17,10 +18,11 @@ import { WorldDocumentStore } from "./WorldDocumentStore.js";
 import { readWorldActivity, updateWorldActivity, } from "./WorldActivity.js";
 import { FileNativePlayTimelineStore } from "../play/FileNativePlayTimelineStore.js";
 import { FileNativePlayAdvanceStore } from "../play/FileNativePlayAdvanceStore.js";
-import { FileNativeWorldStorageMigrator } from "./FileNativeWorldStorageMigrator.js";
-import { FileNativeAuthorityV3, FileNativeAuthorityV3Error, } from "./FileNativeAuthorityV3.js";
+import { FileNativeWorldStorageMigrator, UnsupportedLegacyStorageError, } from "./FileNativeWorldStorageMigrator.js";
+import { WorldAuthorityError, WorldLedgerAuthority, } from "./WorldLedgerAuthority.js";
+import { forgetLedger, rewindTo } from "./WorldTurnLedger.js";
 import { FileNativeWorldOperationCoordinator, WorldOperationBusyError, } from "./WorldOperationCoordinator.js";
-import { fileNativeHistoryMessageIdFromProjectionPath, projectFileNativeHistorySurface, projectHistoryBackgrounds, historyBackgroundRecord, } from "./FileNativeHistoryProjection.js";
+import { projectFileNativeHistorySurface, projectHistoryBackgrounds, historyBackgroundRecord, } from "./FileNativeHistoryProjection.js";
 const publicationFile = "publication.json";
 const localMetadataFile = "local.json";
 export class FileNativeWorldCreationError extends Error {
@@ -37,11 +39,21 @@ export class FileNativeWorldNotFoundError extends Error {
         this.name = "FileNativeWorldNotFoundError";
     }
 }
+/**
+ * Completed operations kept per world for same-process duplicate guards. A
+ * pending player-revision intent resumes against its own world's entry, so
+ * retention is per world: another world's traffic cannot evict it.
+ */
+const RETAINED_OPERATION_OUTCOMES_PER_WORLD = 256;
 export class FileNativeWorldStore {
     extensionRequests;
     #documentMaintenanceCache = new Map();
     #worldsRoot;
-    #operationsRoot;
+    // Process-local duplicate guard keyed by operation ID (ADR-0044): entries are
+    // not persisted, so a restart forgets them and a repeated operation redoes.
+    // Completed entries are bounded per world; in-progress entries are not.
+    #operationOutcomes = new Map();
+    #retainedOperationIds = new Map();
     #promptCompiler;
     #activeControlUsers = new Map();
     #openingWorldRevisions = new Set();
@@ -56,23 +68,26 @@ export class FileNativeWorldStore {
         const root = resolve(dataRoot);
         this.#worldsRoot = join(root, "worlds-file-native");
         this.extensionRequests = new WorldExtensionRequests(this.#worldsRoot);
-        this.#operationsRoot = join(root, "operations");
         this.#promptCompiler =
             options.promptCompiler ?? new FileNativePromptCompiler();
         this.operations = new FileNativeWorldOperationCoordinator(root);
         this.playTimeline = new FileNativePlayTimelineStore(root);
         this.playAdvances = new FileNativePlayAdvanceStore(root);
-        this.#storageMigrator = new FileNativeWorldStorageMigrator(root, this.playTimeline);
+        this.#storageMigrator = new FileNativeWorldStorageMigrator(root);
     }
     /**
-     * Upgrade a formally released cumulative layout before current Authority or
-     * play-timeline behavior crosses its seam. Concurrent callers share one
+     * Upgrade an Authority V3 world to the current ledger layout before current
+     * Authority or play-timeline behavior crosses its seam. Concurrent callers share one
      * in-process promise; the durable world lock serializes processes.
      */
     async ensureCurrentStorage(worldId) {
         assertIdentity(worldId, "World ID");
         if (this.#currentStorage.has(worldId))
             return;
+        // A shared migration may be queued behind this caller; when the caller
+        // already holds the world, run the migration inline instead of awaiting it.
+        if (this.operations.isWorldHeld(worldId))
+            return this.#ensureCurrentStorageSerialized(worldId);
         const existing = this.#storageMigrations.get(worldId);
         if (existing !== undefined)
             return existing;
@@ -89,7 +104,7 @@ export class FileNativeWorldStore {
     async #ensureCurrentStorageSerialized(worldId) {
         try {
             const root = join(this.#worldsRoot, worldId);
-            const authority = new FileNativeAuthorityV3(root);
+            const authority = new WorldLedgerAuthority(root);
             if (await authority.exists()) {
                 await authority.readHead();
                 this.#currentStorage.add(worldId);
@@ -97,6 +112,7 @@ export class FileNativeWorldStore {
             }
             await this.operations.withWorldAuthorityLock(worldId, async () => {
                 await this.#storageMigrator.migrate(worldId);
+                await migrateLegacyArtifactStore(dirname(this.#worldsRoot), worldId);
             });
             this.#currentStorage.add(worldId);
         }
@@ -114,7 +130,9 @@ export class FileNativeWorldStore {
             }
             if (error instanceof WorldOperationBusyError)
                 throw new FileNativeWorldCreationError("operation_conflict", "World storage is being upgraded by another durable operation", { cause: error });
-            throw new FileNativeWorldCreationError("world_corrupt", "Released world storage could not be migrated to the current format", error instanceof Error ? { cause: error } : undefined);
+            if (error instanceof UnsupportedLegacyStorageError)
+                throw new FileNativeWorldCreationError("world_corrupt", "This world was created by v0.2.0 or earlier; open it once with v0.3.0–v0.6.0 before upgrading", { cause: error });
+            throw new FileNativeWorldCreationError("world_corrupt", "World storage could not be migrated to the current format", error instanceof Error ? { cause: error } : undefined);
         }
     }
     async gameplay(worldId) {
@@ -150,7 +168,7 @@ export class FileNativeWorldStore {
             const root = join(this.#worldsRoot, worldId);
             const publication = await readPublicationAt(root);
             const title = await readWorldTitleAt(root, publication);
-            const endpoint = await new FileNativeAuthorityV3(root).recoverHeadResult();
+            const endpoint = await new WorldLedgerAuthority(root).recoverHeadResult();
             const history = new HistoryQuery(worldId, endpoint.history.map(({ messageId, role, exactText }) => ({
                 id: messageId,
                 role,
@@ -200,8 +218,14 @@ export class FileNativeWorldStore {
             throw error;
         }
         return this.operations.withExclusiveWorldStateMutation(worldId, () => this.operations.withWorldAuthorityLock(worldId, async () => {
+            forgetLedger(root);
             await rm(root, { recursive: true, force: true });
+            // 删除期间的并发读取可能重新填充缓存，删除后再失效一次。
+            forgetLedger(root);
             this.#currentStorage.delete(worldId);
+            for (const operationId of this.#retainedOperationIds.get(worldId) ?? [])
+                this.#operationOutcomes.delete(operationId);
+            this.#retainedOperationIds.delete(worldId);
             return { deleted: true };
         }));
     }
@@ -298,9 +322,7 @@ export class FileNativeWorldStore {
         const preview = this.#preview(boundInput, worldId);
         const finalRoot = join(this.#worldsRoot, worldId);
         const stagingRoot = join(this.#worldsRoot, `.staging-${worldId}-${randomUUID()}`);
-        const operationPath = this.#operationPath(input.operationId);
         await mkdir(this.#worldsRoot, { recursive: true, mode: 0o700 });
-        await mkdir(this.#operationsRoot, { recursive: true, mode: 0o700 });
         await rm(stagingRoot, { recursive: true, force: true });
         try {
             const openingMessage = {
@@ -334,19 +356,7 @@ export class FileNativeWorldStore {
                 worldId,
                 history: genesis.history,
             });
-            await new FileNativeAuthorityV3(stagingRoot).initialize({
-                operationId: input.operationId,
-                state,
-                history: [openingMessage],
-                additionalMaterials: initialMaterials,
-            });
-            await writeJson(join(stagingRoot, "runtime", "materialized-head.json"), {
-                schemaVersion: 3,
-                head: "genesis",
-                sequence: 0,
-                commitDigest: null,
-                ...backgroundCount([openingMessage]),
-            });
+            await new WorldLedgerAuthority(stagingRoot).initialize();
             await writeJson(join(stagingRoot, "runtime", "additional-materials.json"), { head: "genesis", items: initialMaterials });
             const publication = {
                 schemaVersion: 1,
@@ -358,12 +368,7 @@ export class FileNativeWorldStore {
             };
             await writeJson(join(stagingRoot, publicationFile), publication);
             await updateWorldActivity(stagingRoot, "genesis", [openingMessage], Date.now());
-            await durableTree(stagingRoot);
-            crashAtFileNativeWorldCreationEdge("after_staging");
             await rename(stagingRoot, finalRoot);
-            await syncDirectory(this.#worldsRoot);
-            crashAtFileNativeWorldCreationEdge("after_atomic_publish");
-            await publishOperation(operationPath, publication);
             return {
                 outcome: "created",
                 world: await this.#currentSummary(publication),
@@ -418,12 +423,8 @@ export class FileNativeWorldStore {
      * must never pair a mutable state tree with a different response head.
      */
     async renderPlayerViewsAtHead(worldId, head) {
-        const root = join(this.#worldsRoot, worldId);
-        const materialized = await readOptionalJson(join(root, "runtime", "materialized-head.json"));
         const [state, control] = await Promise.all([
-            materialized?.head === head
-                ? readTree(join(root, "state"))
-                : this.recoverEndpoint(worldId, head).then(({ state }) => state),
+            this.recoverEndpoint(worldId, head).then(({ state }) => state),
             this.readSurface(worldId, "control"),
         ]);
         const source = control.find(({ path }) => path === "player-views.yaml");
@@ -437,7 +438,7 @@ export class FileNativeWorldStore {
         await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
-        return (await new FileNativeAuthorityV3(root).readHead()).head;
+        return (await new WorldLedgerAuthority(root).readHead()).head;
     }
     async withArchiveExport(worldId, action) {
         assertIdentity(worldId, "World ID");
@@ -469,7 +470,7 @@ export class FileNativeWorldStore {
         await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
-        return new FileNativeAuthorityV3(root).currentOperationId();
+        return new WorldLedgerAuthority(root).currentOperationId();
     }
     async saveControlDraft(worldId, files) {
         assertIdentity(worldId, "World ID");
@@ -547,7 +548,6 @@ export class FileNativeWorldStore {
             if (currentFingerprint === nextFingerprint) {
                 await rm(stagingRoot, { recursive: true, force: true });
                 await rm(previousPath, { recursive: true, force: true });
-                await syncDirectory(runtimeRoot);
                 return { fingerprint: nextFingerprint };
             }
             const previous = await readTree(previousPath);
@@ -556,16 +556,11 @@ export class FileNativeWorldStore {
                 fingerprint(previous) === input.expectedFingerprint) {
                 if (fingerprint(staged) === nextFingerprint) {
                     await rename(stagedPath, currentPath);
-                    await syncDirectory(root);
-                    await syncDirectory(stagingRoot);
                     await rm(previousPath, { recursive: true, force: true });
                     await rm(stagingRoot, { recursive: true, force: true });
-                    await syncDirectory(runtimeRoot);
                     return { fingerprint: nextFingerprint };
                 }
                 await rename(previousPath, currentPath);
-                await syncDirectory(root);
-                await syncDirectory(runtimeRoot);
                 current = await readTree(currentPath);
                 currentFingerprint = fingerprint(current);
             }
@@ -575,16 +570,10 @@ export class FileNativeWorldStore {
             await rm(stagingRoot, { recursive: true, force: true });
             await rm(previousPath, { recursive: true, force: true });
             await writeSurface(stagingRoot, "control", input.files);
-            await durableTree(stagingRoot);
             await rename(currentPath, previousPath);
-            await syncDirectory(root);
-            await syncDirectory(runtimeRoot);
             await rename(stagedPath, currentPath);
-            await syncDirectory(root);
-            await syncDirectory(stagingRoot);
             await rm(previousPath, { recursive: true, force: true });
             await rm(stagingRoot, { recursive: true, force: true });
-            await syncDirectory(runtimeRoot);
             return { fingerprint: nextFingerprint };
         });
     }
@@ -709,52 +698,22 @@ export class FileNativeWorldStore {
         }
         try {
             return await this.operations.withWorldAuthorityLock(worldId, async () => {
-                const authorityStore = new FileNativeAuthorityV3(root);
-                const authority = await authorityStore.readHead();
-                const checkpoint = await readMaterializedCheckpoint(root);
-                const cachedBackgrounds = await readTree(join(root, "runtime", "history-backgrounds"));
-                if (!sameMaterializedEndpoint(checkpoint, authority) ||
-                    (checkpoint?.historyBackgroundCount ?? 0) !== cachedBackgrounds.length) {
-                    const recovered = await authorityStore.recover();
-                    let operation = null;
-                    if (authority.operationId !== null && authority.sequence > 0) {
-                        const candidate = await this.getOperationOutcome(authority.operationId);
-                        if (isCommittedOutcome(candidate)) {
-                            if (candidate.worldId !== worldId ||
-                                candidate.head !== authority.head ||
-                                candidate.commitDigest !== authority.commitDigest)
-                                throw new FileNativeWorldCreationError("world_corrupt", "Current Authority head is bound to a different operation receipt");
-                            operation = candidate;
-                        }
-                        else if (candidate.outcome !== "not_started") {
-                            throw new FileNativeWorldCreationError("world_corrupt", "Current Authority head has no recoverable acceptance receipt");
-                        }
-                    }
-                    await materializeRecoveredEndpoint(root, authority, recovered);
-                    if (operation !== null)
-                        await publishJson(this.#operationOutcomePath(authority.operationId), { ...operation, outcome: "committed" });
-                }
-                const [state, control, history, materials, backgrounds] = await Promise.all([
-                    readTree(join(root, "state")),
-                    readTree(join(root, "control")),
-                    readTree(join(root, "history")),
-                    readOptionalJson(join(root, "runtime", "additional-materials.json")),
-                    readTree(join(root, "runtime", "history-backgrounds")),
-                ]);
-                if ((materials?.head ?? "genesis") !== authority.head)
-                    throw new FileNativeWorldCreationError("inconsistent_materialization", "Materialized additional materials do not match the current Authority endpoint");
+                const recovered = await new WorldLedgerAuthority(root).recover();
+                const control = await readTree(join(root, "control"));
                 return {
                     worldId,
-                    parentHead: authority.head,
-                    files: [...state, ...control].reduce((files, { path, contents }, index) => {
-                        files[`${index < state.length ? "state" : "control"}/${path}`] =
-                            contents;
+                    parentHead: recovered.head,
+                    files: [...recovered.state, ...control].reduce((files, { path, contents }, index) => {
+                        files[`${index < recovered.state.length ? "state" : "control"}/${path}`] = contents;
                         return files;
                     }, {}),
-                    additionalMaterials: materials?.items ?? [],
-                    history: materializedHistoryRecord(history),
-                    historyBackgrounds: materializedBackgroundRecord(backgrounds, materializedHistoryRecord(history)),
-                    narrativeCheckpoint: await authorityStore.readNarrativeCheckpoint(),
+                    additionalMaterials: recovered.additionalMaterials,
+                    history: Object.fromEntries(recovered.history.map(({ messageId, exactText }) => [
+                        messageId,
+                        exactText,
+                    ])),
+                    historyBackgrounds: historyBackgroundRecord(recovered.history),
+                    narrativeCheckpoint: recovered.narrativeCheckpoint,
                 };
             });
         }
@@ -767,7 +726,7 @@ export class FileNativeWorldStore {
     /**
      * Bind an immutable historical endpoint with the world's current control
      * surface. This is the same semantic input as a fresh context started while
-     * that endpoint was current, without rematerializing it over today's head.
+     * that endpoint was current, without rewinding today's head.
      */
     async bindPlayCallChainAt(worldId, head) {
         assertIdentity(worldId, "World ID");
@@ -791,34 +750,29 @@ export class FileNativeWorldStore {
             ])),
         };
     }
-    async reserveOperation(operationId) {
+    reserveOperation(operationId) {
         assertIdentity(operationId, "operation ID");
-        await mkdir(this.#operationsRoot, { recursive: true, mode: 0o700 });
-        const path = this.#operationOutcomePath(operationId);
-        try {
-            await writeFile(path, `${JSON.stringify({ outcome: "in_progress" }, null, 2)}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
-            await syncFile(path);
-            await syncDirectory(this.#operationsRoot);
-            return true;
-        }
-        catch (error) {
-            if (isNodeError(error) && error.code === "EEXIST")
-                return false;
-            throw error;
+        if (this.#operationOutcomes.has(operationId))
+            return Promise.resolve(false);
+        this.#operationOutcomes.set(operationId, { phase: "in_progress" });
+        return Promise.resolve(true);
+    }
+    #rememberOperationOutcome(worldId, operationId, outcome) {
+        this.#operationOutcomes.set(operationId, { phase: "done", outcome });
+        const retained = this.#retainedOperationIds.get(worldId) ?? [];
+        retained.push(operationId);
+        while (retained.length > RETAINED_OPERATION_OUTCOMES_PER_WORLD) {
+            const evicted = retained.shift();
+            if (evicted !== undefined)
+                this.#operationOutcomes.delete(evicted);
         }
+        this.#retainedOperationIds.set(worldId, retained);
     }
-    async releaseOperationReservation(operationId) {
+    releaseOperationReservation(operationId) {
         assertIdentity(operationId, "operation ID");
-        const path = this.#operationOutcomePath(operationId);
-        const current = await readOptionalJson(path);
-        if (current === null)
-            return;
-        if (!isRecord(current) ||
-            !hasExactKeys(current, ["outcome"]) ||
-            current.outcome !== "in_progress")
-            throw new FileNativeWorldCreationError("world_corrupt", "Operation reservation to release has an invalid shape");
-        await rm(path, { force: true });
-        await syncDirectory(this.#operationsRoot);
+        if (this.#operationOutcomes.get(operationId)?.phase === "in_progress")
+            this.#operationOutcomes.delete(operationId);
+        return Promise.resolve();
     }
     async recoverEndpoint(worldId, head) {
         assertIdentity(worldId, "World ID");
@@ -826,7 +780,7 @@ export class FileNativeWorldStore {
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
         try {
-            const recovered = await new FileNativeAuthorityV3(root).recover(head);
+            const recovered = await new WorldLedgerAuthority(root).recover(head);
             return {
                 worldId,
                 head: recovered.head,
@@ -842,25 +796,6 @@ export class FileNativeWorldStore {
             throw new FileNativeWorldCreationError("world_corrupt", `Cannot recover immutable Authority endpoint${head === undefined ? "" : `: ${head}`}`, error instanceof Error ? { cause: error } : undefined);
         }
     }
-    async repairMaterialization(worldId) {
-        assertIdentity(worldId, "World ID");
-        await this.ensureCurrentStorage(worldId);
-        try {
-            const operationId = await this.operations.withExclusiveWorldStateMutation(worldId, async () => {
-                await this.bindPlayCallChain(worldId);
-                const root = join(this.#worldsRoot, worldId);
-                return (await new FileNativeAuthorityV3(root).readHead()).operationId;
-            });
-            return operationId === null
-                ? { outcome: "not_started" }
-                : this.getOperationOutcome(operationId);
-        }
-        catch (error) {
-            if (error instanceof WorldOperationBusyError)
-                throw new FileNativeWorldCreationError("operation_conflict", "This world has a durable state operation and cannot repair materialization yet");
-            throw error;
-        }
-    }
     async deriveWorld(input) {
         assertIdentity(input.operationId, "Fork operation ID");
         assertIdentity(input.sourceWorldId, "Source world ID");
@@ -878,37 +813,17 @@ export class FileNativeWorldStore {
         const target = input.targetDataRoot === undefined
             ? this
             : new FileNativeWorldStore(input.targetDataRoot);
-        const operationPath = input.identityPrefix === "import"
-            ? join(target.#operationsRoot, `import-${operationDigest(input.operationId)}.json`)
-            : target.#derivationOperationPath(input.operationId);
         const requestFingerprint = derivationRequestFingerprint(input);
         const worldId = `world-${operationDigest(`${input.identityPrefix ?? "derive"}:${input.operationId}`).slice(0, 24)}`;
         const finalRoot = input.publish === false
             ? resolve(input.targetWorldRoot)
             : join(target.#worldsRoot, worldId);
-        const previous = input.publish === false
-            ? null
-            : await readOptionalJson(operationPath);
-        if (previous !== null) {
-            await target.ensureCurrentStorage(previous.worldId);
-            if (!(await derivationPublicationMatches(join(target.#worldsRoot, previous.worldId), previous, input, requestFingerprint)))
-                throw new FileNativeWorldCreationError("operation_conflict", "The same fork operation ID is bound to a different fork payload");
-            return {
-                outcome: "derived",
-                world: await target.#currentSummary(previous),
-                worldRoot: finalRoot,
-            };
-        }
         const alreadyPublished = await readOptionalJson(join(finalRoot, publicationFile));
         if (alreadyPublished !== null) {
             if (input.publish !== false)
                 await target.ensureCurrentStorage(alreadyPublished.worldId);
             if (!(await derivationPublicationMatches(finalRoot, alreadyPublished, input, requestFingerprint)))
                 throw new FileNativeWorldCreationError("operation_conflict", "Published fork world does not match the operation payload");
-            if (input.publish !== false) {
-                await mkdir(target.#operationsRoot, { recursive: true, mode: 0o700 });
-                await publishJson(operationPath, alreadyPublished);
-            }
             return {
                 outcome: "derived",
                 world: await readWorldSummaryAt(finalRoot, alreadyPublished),
@@ -920,43 +835,31 @@ export class FileNativeWorldStore {
             const sourceRoot = join(this.#worldsRoot, input.sourceWorldId);
             const sourcePublication = await readPublicationAt(sourceRoot);
             const sourceSummary = await readWorldSummaryAt(sourceRoot, sourcePublication);
-            const sourceAuthority = new FileNativeAuthorityV3(sourceRoot);
+            const sourceAuthority = new WorldLedgerAuthority(sourceRoot);
             const sourceHead = input.sourceHead === "current"
                 ? (await sourceAuthority.readHead()).head
                 : input.sourceHead;
-            if (input.requireMaterialized) {
-                const authorityHead = await sourceAuthority.readHead();
-                const materialized = await readMaterializedCheckpoint(sourceRoot);
-                if (materialized?.head !== authorityHead.head ||
-                    materialized.commitDigest !== authorityHead.commitDigest)
-                    throw new FileNativeWorldCreationError("inconsistent_materialization", "Please repair the world before exporting a backup");
-            }
             const [sourceGenesis, control] = await Promise.all([
                 readGenesisForFork(sourceRoot, input.sourceWorldId),
                 readTree(join(sourceRoot, "control")),
             ]);
             const staging = join(dirname(finalRoot), `.staging-${worldId}-${randomUUID()}`);
             await mkdir(dirname(finalRoot), { recursive: true, mode: 0o700 });
-            if (input.publish !== false)
-                await mkdir(target.#operationsRoot, { recursive: true, mode: 0o700 });
             try {
-                await mkdir(join(staging, "runtime"), { recursive: true });
-                const clonedHead = await sourceAuthority.clonePrefixTo({
-                    targetWorldRoot: staging,
-                    selectedHead: sourceHead,
-                    operationId: input.operationId,
+                await copyForkClosure(sourceRoot, staging);
+                await rewindTo(staging, headPosition(sourceHead));
+                await forkArtifactClosure(staging, {
+                    sourceWorldId: input.sourceWorldId,
+                    targetWorldId: worldId,
+                    restoredHead: sourceHead,
                 });
-                const selected = await new FileNativeAuthorityV3(staging).recoverHeadResult();
-                await writeSurface(staging, "state", selected.state);
-                await writeSurface(staging, "control", control);
+                // 分叉不信任来源的投影文件：当前文件由副本上的账本端点重建。
+                await new WorldLedgerAuthority(staging).materializeCurrentFiles();
+                const selected = await new WorldLedgerAuthority(staging).recover();
                 await PackageScriptPermissions.write(staging, input.resetPackageScriptPermissions
                     ? []
                     : await PackageScriptPermissions.read(sourceRoot));
                 await WorldExtensionControls.copy(sourceRoot, staging);
-                await mkdir(join(staging, "history"), { recursive: true });
-                for (const file of historySurfaceFiles(selected.history))
-                    await writeIdempotentText(join(staging, "history", file.path), file.contents);
-                await replaceMaterializedTree(join(staging, "runtime", "history-backgrounds"), projectHistoryBackgrounds(selected.history));
                 const genesis = {
                     schemaVersion: 1,
                     type: "file_native_genesis",
@@ -974,17 +877,6 @@ export class FileNativeWorldStore {
                     worldId,
                     history: genesis.history,
                 });
-                await writeJson(join(staging, "runtime", "additional-materials.json"), {
-                    head: sourceHead,
-                    items: selected.additionalMaterials,
-                });
-                await writeJson(join(staging, "runtime", "materialized-head.json"), {
-                    schemaVersion: 3,
-                    head: sourceHead,
-                    sequence: clonedHead.sequence,
-                    commitDigest: clonedHead.commitDigest,
-                    ...backgroundCount(selected.history),
-                });
                 await input.stageTarget?.({
                     sourceHead,
                     targetWorldRoot: staging,
@@ -1009,7 +901,6 @@ export class FileNativeWorldStore {
                     await writeJson(join(staging, "runtime", "archive-import.json"), {
                         schemaVersion: 1,
                     });
-                crashAtFileNativeAuthorityEdge("derivation_after_target_staging");
                 const publication = {
                     schemaVersion: 1,
                     worldId,
@@ -1020,13 +911,8 @@ export class FileNativeWorldStore {
                 };
                 await writeJson(join(staging, publicationFile), publication);
                 await updateWorldActivity(staging, sourceHead, selected.history, Date.now());
-                await durableTree(staging);
-                crashAtFileNativeAuthorityEdge("derivation_before_publish");
+                forgetLedger(finalRoot);
                 await rename(staging, finalRoot);
-                await syncDirectory(dirname(finalRoot));
-                crashAtFileNativeAuthorityEdge("derivation_after_publish");
-                if (input.publish !== false)
-                    await publishJson(operationPath, publication);
                 return {
                     outcome: "derived",
                     world: await readWorldSummaryAt(finalRoot, publication),
@@ -1039,8 +925,6 @@ export class FileNativeWorldStore {
                 if (published !== null) {
                     if (!(await derivationPublicationMatches(finalRoot, published, input, requestFingerprint)))
                         throw new FileNativeWorldCreationError("operation_conflict", "Published fork world does not match the operation payload");
-                    if (input.publish !== false)
-                        await publishJson(operationPath, published);
                     return {
                         outcome: "derived",
                         world: await readWorldSummaryAt(finalRoot, published),
@@ -1059,142 +943,53 @@ export class FileNativeWorldStore {
             throw error;
         }
     }
-    async failOperation(operationId, outcome = "failed") {
-        const current = await this.getOperationOutcome(operationId);
-        if (isCommittedOutcome(current))
-            return;
-        await writeJson(this.#operationOutcomePath(operationId), { outcome });
-    }
     async getOperationOutcome(operationId) {
-        return this.#readOperationOutcome(operationId);
-    }
-    async #readOperationOutcome(operationId) {
         assertIdentity(operationId, "operation ID");
-        let directRecord;
-        try {
-            let value = await readOptionalJson(this.#operationOutcomePath(operationId));
-            if (isRecord(value) &&
-                (value.outcome === "acceptance_prepared" ||
-                    value.outcome === "committed" ||
-                    value.outcome === "committed_materialization_pending") &&
-                typeof value.worldId === "string") {
-                await this.ensureCurrentStorage(value.worldId);
-                value = await readOptionalJson(this.#operationOutcomePath(operationId));
-            }
-            if (value === null)
-                directRecord = null;
-            else {
-                assertOperationOutcomeIntegrity(value);
-                directRecord = value;
-            }
-        }
-        catch (error) {
-            if (error instanceof FileNativeWorldCreationError)
-                throw error;
-            throw new FileNativeWorldCreationError("world_corrupt", "Authority operation outcome has an invalid structure", error instanceof Error ? { cause: error } : undefined);
-        }
-        if (directRecord?.outcome === "acceptance_prepared")
-            return resolvePreparedOperationOutcome(this.#worldsRoot, operationId, directRecord);
-        const direct = directRecord === null ? null : projectOperationOutcome(directRecord);
-        if (direct?.outcome === "committed" ||
-            direct?.outcome === "committed_materialization_pending") {
-            const worldRoot = join(this.#worldsRoot, direct.worldId);
-            const commit = await assertCommittedAuthorityOutcomeMatches(worldRoot, direct);
-            const materialized = await readMaterializedCheckpoint(worldRoot);
-            if (materialized !== null && materialized.sequence >= commit.sequence)
-                return { ...direct, outcome: "committed" };
-            await assertPendingMaterializationCompatible(worldRoot, direct);
-            return { ...direct, outcome: "committed_materialization_pending" };
-        }
-        return direct?.outcome === "in_progress"
-            ? { outcome: "in_progress" }
-            : (direct ?? { outcome: "not_started" });
+        const entry = this.#operationOutcomes.get(operationId);
+        if (entry === undefined)
+            return { outcome: "not_started" };
+        if (entry.phase === "in_progress")
+            return { outcome: "in_progress" };
+        const outcome = structuredClone(entry.outcome);
+        await assertCommittedAuthorityOutcomeMatches(join(this.#worldsRoot, outcome.worldId), outcome);
+        return outcome;
     }
     /**
-     * Replace one committed player message on the world's active timeline
-     * without changing world identity or destructively rewriting Authority.
-     * The new immutable commit restores the selected player's logical parent
-     * snapshot and appends the replacement player text in one acceptance step.
+     * Roll the world back to a player message's logical parent endpoint before an
+     * edited replacement is submitted (ADR-0045). Rewinding to the current head is
+     * a no-op, so the edit's steps can repeat safely.
      */
-    async reviseTimeline(input) {
-        assertIdentity(input.operationId, "Timeline-revision operation ID");
-        assertIdentity(input.worldId, "World ID");
-        if (!/^(?:genesis|commit:[1-9][0-9]*)$/u.test(input.expectedCurrentHead) ||
-            !/^(?:genesis|commit:[1-9][0-9]*)$/u.test(input.restoresHead) ||
-            !/^commit:[1-9][0-9]*$/u.test(input.replacesHead))
-            throw new TypeError("Timeline-revision endpoint is invalid");
-        if (input.replacementText.trim() === "")
-            throw new TypeError("Edited player message cannot be empty");
-        if (!/^sha256:[a-f0-9]{64}$/u.test(input.requestFingerprint))
-            throw new TypeError("Timeline-revision request fingerprint is invalid");
-        await this.ensureCurrentStorage(input.worldId);
+    async rewindPlayerRevision(worldId, restoresHead) {
+        assertIdentity(worldId, "World ID");
+        if (!/^(?:genesis|commit:[1-9][0-9]*)$/u.test(restoresHead))
+            throw new TypeError("Player-revision endpoint is invalid");
+        await this.ensureCurrentStorage(worldId);
         try {
-            return await this.operations.withExclusiveWorldStateMutation(input.worldId, () => this.#reviseTimelineUnlocked(input));
+            await this.operations.withExclusiveWorldStateMutation(worldId, () => rewindTo(join(this.#worldsRoot, worldId), headPosition(restoresHead)));
         }
         catch (error) {
             if (error instanceof WorldOperationBusyError)
-                throw new FileNativeWorldCreationError("operation_conflict", "Timeline editing is locked while a world revision is open");
+                throw new FileNativeWorldCreationError("operation_conflict", "Player edits are locked while a world revision is open");
             throw error;
         }
     }
-    async #reviseTimelineUnlocked(input) {
-        const existing = await this.getOperationOutcome(input.operationId);
-        if (isCommittedOutcome(existing)) {
-            const fact = await new FileNativeAuthorityV3(join(this.#worldsRoot, existing.worldId)).authorityFactAt(existing.head);
-            const commit = fact.commit;
-            if (existing.worldId !== input.worldId ||
-                fact.digest !== existing.commitDigest ||
-                commit?.mode !== "timeline_revision" ||
-                commit.timelineRevision?.restoresHead !== input.restoresHead ||
-                commit.timelineRevision.replacesHead !== input.replacesHead ||
-                commit.timelineRevision.requestFingerprint !==
-                    input.requestFingerprint ||
-                !isDeepStrictEqual(commit.historyAppend.map(({ role, exactText }) => ({
-                    role,
-                    exactText,
-                })), [{ role: "player", exactText: input.replacementText }]))
-                throw new FileNativeWorldCreationError("operation_conflict", "The same timeline-revision operation ID is bound to a different request");
-            return existing;
-        }
-        const root = join(this.#worldsRoot, input.worldId);
-        const authorityStore = new FileNativeAuthorityV3(root);
-        const [replaced, replacementMaterials] = await Promise.all([
-            authorityStore.commitAt(input.replacesHead),
-            authorityStore.recoverMaterials(input.restoresHead),
-        ]);
-        const logicalParent = replaced?.timelineParent.head;
-        if (replaced === null ||
-            !replaced.historyAppend.some(({ role }) => role === "player") ||
-            logicalParent !== input.restoresHead)
-            throw new FileNativeWorldCreationError("operation_conflict", "Selected player message does not match the logical parent endpoint to restore");
-        const binding = await this.bindPlayCallChainAt(input.worldId, input.restoresHead);
-        const snapshot = WorldDocumentStore.open({
-            layout: "world_state",
-            files: Object.entries(binding.files).map(([path, contents]) => ({
-                path,
-                contents,
-            })),
-        });
-        const background = snapshotBackground(captureNarrativeOrigin(snapshot, 1).value);
-        return this.#commitHistoryChange({
-            operationId: input.operationId,
-            worldId: input.worldId,
-            parentHead: input.expectedCurrentHead,
-            historyAppend: [
-                {
-                    role: "player",
-                    exactText: input.replacementText,
-                    ...backgroundField(background),
-                },
-            ],
-            nextMaterials: worldNeutralMaterials(input.worldId, replacementMaterials),
-            stateChanges: [],
-            mode: "timeline_revision",
-            timelineRevision: {
-                restoresHead: input.restoresHead,
-                replacesHead: input.replacesHead,
-                requestFingerprint: input.requestFingerprint,
-            },
+    /** The in-progress player edit record; written before the first world change. */
+    async readPlayerRevisionIntent(worldId) {
+        assertIdentity(worldId, "World ID");
+        return readOptionalJsonFile(playerRevisionIntentPath(this.#worldsRoot, worldId));
+    }
+    async writePlayerRevisionIntent(worldId, intent) {
+        assertIdentity(worldId, "World ID");
+        const path = playerRevisionIntentPath(this.#worldsRoot, worldId);
+        await mkdir(dirname(path), { recursive: true });
+        const temporary = `${path}.${randomUUID()}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(intent)}\n`, "utf8");
+        await rename(temporary, path);
+    }
+    async clearPlayerRevisionIntent(worldId) {
+        assertIdentity(worldId, "World ID");
+        await rm(playerRevisionIntentPath(this.#worldsRoot, worldId), {
+            force: true,
         });
     }
     async commitCorrection(input) {
@@ -1262,83 +1057,51 @@ export class FileNativeWorldStore {
         }
     }
     async #commitHistoryChange(input) {
-        const existing = await this.getOperationOutcome(input.operationId);
-        if (isCommittedOutcome(existing)) {
-            assertSameOperationOutcome(existing, input);
-            const authority = new FileNativeAuthorityV3(join(this.#worldsRoot, existing.worldId));
-            const fact = await authority.authorityFactAt(existing.head);
-            if (fact.digest !== existing.commitDigest ||
+        const existing = this.#operationOutcomes.get(input.operationId);
+        if (existing?.phase === "done") {
+            const outcome = existing.outcome;
+            assertSameOperationOutcome(outcome, input);
+            const fact = await new WorldLedgerAuthority(join(this.#worldsRoot, outcome.worldId)).authorityFactAt(outcome.head);
+            if (fact.digest !== outcome.commitDigest ||
                 !authorityCommitMatchesInput(fact.commit, input))
                 throw new FileNativeWorldCreationError("operation_conflict", "The same play operation ID is bound to a different complete commit payload");
-            return existing;
-        }
-        const prepared = existing.outcome === "in_progress"
-            ? await readAcceptancePreparedOutcome(this.#operationOutcomePath(input.operationId))
-            : null;
-        if (prepared !== null) {
-            const comparable = {
-                ...structuredClone(prepared),
-                outcome: "committed_materialization_pending",
-            };
-            assertSameOperationOutcome(comparable, input);
+            return outcome;
         }
-        if (existing.outcome !== "not_started" &&
-            !(existing.outcome === "in_progress" &&
-                (input.operationReserved === true || prepared !== null)))
+        if (existing?.phase === "in_progress" && input.operationReserved !== true)
             throw new FileNativeWorldCreationError("operation_conflict", "The same play operation ID is occupied by another durable operation");
         const root = join(this.#worldsRoot, input.worldId);
         try {
             return await this.operations.withWorldAuthorityLock(input.worldId, async () => {
-                const concurrent = await this.#readOperationOutcome(input.operationId);
-                if (isCommittedOutcome(concurrent)) {
-                    assertSameOperationOutcome(concurrent, input);
-                    const known = await new FileNativeAuthorityV3(join(this.#worldsRoot, concurrent.worldId)).authorityFactAt(concurrent.head);
-                    if (known.digest !== concurrent.commitDigest ||
+                const concurrent = this.#operationOutcomes.get(input.operationId);
+                if (concurrent?.phase === "done") {
+                    const outcome = concurrent.outcome;
+                    assertSameOperationOutcome(outcome, input);
+                    const known = await new WorldLedgerAuthority(join(this.#worldsRoot, outcome.worldId)).authorityFactAt(outcome.head);
+                    if (known.digest !== outcome.commitDigest ||
                         !authorityCommitMatchesInput(known.commit, input))
                         throw new FileNativeWorldCreationError("operation_conflict", "The same play operation ID is bound to a different complete commit payload");
-                    return concurrent;
+                    return outcome;
                 }
-                const concurrentPrepared = concurrent.outcome === "in_progress"
-                    ? await readAcceptancePreparedOutcome(this.#operationOutcomePath(input.operationId))
-                    : null;
-                if (concurrentPrepared !== null)
-                    assertSameOperationOutcome({
-                        ...structuredClone(concurrentPrepared),
-                        outcome: "committed_materialization_pending",
-                    }, input);
-                else if (concurrent.outcome === "in_progress" &&
+                if (concurrent?.phase === "in_progress" &&
                     input.operationReserved !== true)
                     throw new FileNativeWorldCreationError("operation_conflict", "The same play operation ID is occupied by another durable operation");
-                const authorityStore = new FileNativeAuthorityV3(root);
+                const authorityStore = new WorldLedgerAuthority(root);
                 const authority = await authorityStore.readHead();
-                if (authority.head !== input.parentHead) {
+                if (authority.head !== input.parentHead)
                     throw new FileNativeWorldCreationError("operation_conflict", "The parent endpoint of the play operation has changed");
-                }
-                const materialized = await readOptionalJson(join(root, "runtime", "materialized-head.json"));
-                if ((materialized?.head ?? "genesis") !== authority.head)
-                    throw new FileNativeWorldCreationError("operation_conflict", "The world has accepted but unrepaired materialization; new competing writes are forbidden");
                 const [basisState, storedControl] = await Promise.all([
-                    authorityStore.recoverState(input.timelineRevision?.restoresHead ?? authority.head),
+                    authorityStore.recoverState(authority.head),
                     readTree(join(root, "control")),
                 ]);
                 const candidateState = new Map(basisState.map((file) => [file.path, file.contents]));
-                if (input.mode === "timeline_revision") {
-                    if (input.timelineRevision === undefined ||
-                        input.stateChanges.length !== 0)
-                        throw new FileNativeWorldCreationError("operation_conflict", "Timeline-revision commit payload is invalid");
-                }
-                else {
-                    if (input.timelineRevision !== undefined)
-                        throw new FileNativeWorldCreationError("operation_conflict", "A regular commit cannot carry a timeline-revision payload");
-                    for (const change of input.stateChanges) {
-                        assertRelativePath(change.relativePath);
-                        const previous = candidateState.get(change.relativePath);
-                        const previousHash = previous === undefined ? null : sha256(previous);
-                        if (previousHash !== change.expectedPreviousHash ||
-                            sha256(change.canonicalNextBytes) !== change.nextHash)
-                            throw new FileNativeWorldCreationError("operation_conflict", `State-change hash conflicts: ${change.relativePath}`);
-                        candidateState.set(change.relativePath, change.canonicalNextBytes);
-                    }
+                for (const change of input.stateChanges) {
+                    assertRelativePath(change.relativePath);
+                    const previous = candidateState.get(change.relativePath);
+                    const previousHash = previous === undefined ? null : sha256(previous);
+                    if (previousHash !== change.expectedPreviousHash ||
+                        sha256(change.canonicalNextBytes) !== change.nextHash)
+                        throw new FileNativeWorldCreationError("operation_conflict", `State-change hash conflicts: ${change.relativePath}`);
+                    candidateState.set(change.relativePath, change.canonicalNextBytes);
                 }
                 const inspection = inspectContentPackageCurrentTree([
                     ...[...candidateState].map(([path, contents]) => ({
@@ -1352,10 +1115,7 @@ export class FileNativeWorldStore {
                 ], { requireOpening: false });
                 if (inspection.status !== "usable")
                     throw new FileNativeWorldCreationError("candidate_validation_failed", `Candidate world failed mechanical validation: ${inspection.issues.map(({ message }) => message).join("; ")}`);
-                if (concurrentPrepared === null)
-                    await authorityStore.discardUnacceptedNextEpoch();
-                crashAtFileNativeAuthorityEdge("before_commit_acceptance");
-                const preparedAppend = await authorityStore.prepareAppend({
+                const { commit, commitDigest } = await authorityStore.appendCommit({
                     ...(input.playContext === undefined
                         ? {}
                         : { playContext: input.playContext }),
@@ -1364,12 +1124,9 @@ export class FileNativeWorldStore {
                         : { worldClock: input.worldClock }),
                     operationId: input.operationId,
                     parentHead: input.parentHead,
-                    ...(input.timelineRevision === undefined
-                        ? {}
-                        : { timelineParentHead: input.timelineRevision.restoresHead }),
                     mode: input.mode,
                     historyAppend: input.historyAppend,
-                    stateChanges: structuredClone(input.stateChanges),
+                    stateChanges: input.stateChanges,
                     nextMaterials: input.nextMaterials,
                     ...(input.narrativeCheckpoint === undefined
                         ? {}
@@ -1380,57 +1137,27 @@ export class FileNativeWorldStore {
                             corrects: input.parentHead,
                         }
                         : {}),
-                    ...(input.timelineRevision === undefined
-                        ? {}
-                        : { timelineRevision: input.timelineRevision }),
                 });
-                crashAtFileNativeAuthorityEdge("after_authority_objects");
-                const acceptedPreparation = concurrentPrepared ?? prepared;
-                if (acceptedPreparation !== null &&
-                    acceptedPreparation.commitDigest !== preparedAppend.commitDigest)
-                    throw new FileNativeWorldCreationError("operation_conflict", "The prepared Authority fact does not match the reserved operation");
-                const { commit } = preparedAppend;
-                const pending = {
-                    outcome: "committed_materialization_pending",
+                const outcome = {
+                    outcome: "committed",
                     worldId: input.worldId,
                     parentHead: input.parentHead,
                     head: commit.head,
-                    commitDigest: preparedAppend.commitDigest,
+                    commitDigest,
                     historyAppend: structuredClone(input.historyAppend),
                     nextAdditionalMaterials: structuredClone(input.nextMaterials),
                     mode: input.mode,
                 };
-                await publishJson(this.#operationOutcomePath(input.operationId), {
-                    ...pending,
-                    outcome: "acceptance_prepared",
-                });
-                crashAtFileNativeAuthorityEdge("after_acceptance_prepared");
-                await authorityStore.publishPrepared(preparedAppend);
-                const acceptedAt = Date.now();
-                crashAtFileNativeAuthorityEdge("after_commit_acceptance");
-                await publishJson(this.#operationOutcomePath(input.operationId), pending);
-                try {
-                    const recovered = await authorityStore.recover(commit.head);
-                    await assertPendingMaterializationCompatible(root, pending);
-                    await materializeRecoveredEndpoint(root, preparedAppend.nextHead, recovered, acceptedAt);
-                    crashAtFileNativeAuthorityEdge("after_materialization");
-                    const outcome = { ...pending, outcome: "committed" };
-                    await publishJson(this.#operationOutcomePath(input.operationId), outcome);
-                    return outcome;
-                }
-                catch (error) {
-                    if (error instanceof FileNativeWorldCreationError &&
-                        (error.code === "world_corrupt" ||
-                            error.code === "inconsistent_materialization"))
-                        throw error;
-                    return pending;
-                }
+                this.#rememberOperationOutcome(input.worldId, input.operationId, outcome);
+                const recovered = await authorityStore.recover(commit.head);
+                await updateWorldActivity(root, commit.head, recovered.history, Date.now());
+                return outcome;
             });
         }
         catch (error) {
             if (error instanceof WorldOperationBusyError)
                 throw new FileNativeWorldCreationError("operation_conflict", "World Authority commit is being serialized by another process");
-            if (error instanceof FileNativeAuthorityV3Error)
+            if (error instanceof WorldAuthorityError)
                 throw new FileNativeWorldCreationError(error.code === "corrupt" ? "world_corrupt" : "operation_conflict", error.message, { cause: error });
             throw error;
         }
@@ -1440,7 +1167,7 @@ export class FileNativeWorldStore {
         await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
-        const authority = await new FileNativeAuthorityV3(root).readHistory();
+        const authority = await new WorldLedgerAuthority(root).readHistory();
         return structuredClone(authority);
     }
     async inspectDocumentMaintenance(worldId, head) {
@@ -1463,7 +1190,7 @@ export class FileNativeWorldStore {
         await this.ensureCurrentStorage(worldId);
         const root = join(this.#worldsRoot, worldId);
         await readPublicationAt(root);
-        const authority = new FileNativeAuthorityV3(root);
+        const authority = new WorldLedgerAuthority(root);
         const selectedHead = head ?? (await authority.readHead()).head;
         let cache = this.#documentMaintenanceCache.get(worldId);
         if (cache === undefined) {
@@ -1501,49 +1228,25 @@ export class FileNativeWorldStore {
         };
     }
     async #readPublication(operationId) {
+        // The world root's own publication record is the only creation receipt.
+        const worldId = `world-${operationDigest(operationId).slice(0, 24)}`;
         let publication;
         try {
-            publication = await readJson(this.#operationPath(operationId));
+            publication = await readPublicationAt(join(this.#worldsRoot, worldId));
         }
         catch (error) {
-            if (isNodeError(error) && error.code === "ENOENT") {
-                const worldId = `world-${operationDigest(operationId).slice(0, 24)}`;
-                try {
-                    publication = await readPublicationAt(join(this.#worldsRoot, worldId));
-                }
-                catch (worldError) {
-                    if (isNodeError(worldError) && worldError.code === "ENOENT")
-                        return null;
-                    throw worldError;
-                }
-                if (publication.operationId !== operationId) {
-                    throw new FileNativeWorldCreationError("operation_conflict", "Deterministic world identity is occupied by another creation operation");
-                }
-                await mkdir(this.#operationsRoot, { recursive: true, mode: 0o700 });
-                await publishOperation(this.#operationPath(operationId), publication);
-            }
-            else {
-                throw error;
-            }
+            if (isNodeError(error) && error.code === "ENOENT")
+                return null;
+            throw error;
         }
-        const worldPublication = await readPublicationAt(join(this.#worldsRoot, publication.worldId));
-        if (JSON.stringify(worldPublication) !== JSON.stringify(publication)) {
-            throw new FileNativeWorldCreationError("world_corrupt", "Creation operation does not match the world publication record");
+        if (publication.operationId !== operationId) {
+            throw new FileNativeWorldCreationError("operation_conflict", "Deterministic world identity is occupied by another creation operation");
         }
         return publication;
     }
     #currentSummary(publication) {
         return readWorldSummaryAt(join(this.#worldsRoot, publication.worldId), publication);
     }
-    #operationPath(operationId) {
-        return join(this.#operationsRoot, `${operationDigest(operationId)}.json`);
-    }
-    #operationOutcomePath(operationId) {
-        return join(this.#operationsRoot, `outcome-${operationDigest(operationId)}.json`);
-    }
-    #derivationOperationPath(operationId) {
-        return join(this.#operationsRoot, `derive-${operationDigest(operationId)}.json`);
-    }
     #preview(input, worldId) {
         const openingMessage = genesisOpeningMessage(openingText(input.packageFiles));
         return this.#promptCompiler.preview({
@@ -1681,12 +1384,6 @@ function contentPackageCreationFingerprint(title, files) {
 function operationDigest(operationId) {
     return createHash("sha256").update(operationId).digest("hex");
 }
-async function publishOperation(path, value) {
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    await writeJson(temporary, value);
-    await rename(temporary, path);
-    await syncDirectory(dirname(path));
-}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1699,93 +1396,14 @@ function hasRequiredAndOptionalKeys(value, required, optional) {
     return (required.every((key) => Object.hasOwn(value, key)) &&
         Object.keys(value).every((key) => allowed.has(key)));
 }
-function assertOperationOutcomeIntegrity(value) {
-    if (!isRecord(value) || typeof value.outcome !== "string")
-        throw corruptOperationOutcome();
-    if (value.outcome === "in_progress") {
-        if (!hasExactKeys(value, ["outcome"]))
-            throw corruptOperationOutcome();
-        return;
-    }
-    if (value.outcome === "failed" || value.outcome === "cancelled") {
-        if (!hasExactKeys(value, ["outcome"]))
-            throw corruptOperationOutcome();
-        return;
-    }
-    if (value.outcome === "acceptance_prepared" ||
-        value.outcome === "committed" ||
-        value.outcome === "committed_materialization_pending") {
-        if (!hasExactKeys(value, [
-            "outcome",
-            "worldId",
-            "parentHead",
-            "head",
-            "commitDigest",
-            "historyAppend",
-            "nextAdditionalMaterials",
-            "mode",
-        ]) ||
-            typeof value.worldId !== "string" ||
-            value.worldId.length === 0 ||
-            typeof value.parentHead !== "string" ||
-            !/^(?:genesis|commit:[1-9][0-9]*)$/u.test(value.parentHead) ||
-            typeof value.head !== "string" ||
-            !/^commit:[1-9][0-9]*$/u.test(value.head) ||
-            typeof value.commitDigest !== "string" ||
-            !/^[a-f0-9]{64}$/u.test(value.commitDigest) ||
-            !Array.isArray(value.historyAppend) ||
-            !value.historyAppend.every(isPlayHistoryAppendInput) ||
-            !Array.isArray(value.nextAdditionalMaterials) ||
-            !value.nextAdditionalMaterials.every(isAuthorityMaterialSelection) ||
-            !(value.mode === "play" ||
-                value.mode === "correction" ||
-                value.mode === "timeline_revision"))
-            throw corruptOperationOutcome();
-        return;
-    }
-    throw corruptOperationOutcome();
-}
-function projectOperationOutcome(value) {
-    return structuredClone(value);
-}
-async function readAcceptancePreparedOutcome(path) {
-    const value = await readOptionalJson(path);
-    if (value === null)
-        return null;
-    assertOperationOutcomeIntegrity(value);
-    if (value.outcome !== "acceptance_prepared")
-        return null;
-    return structuredClone(value);
-}
-async function resolvePreparedOperationOutcome(worldsRoot, operationId, value) {
-    const prepared = value;
-    const worldRoot = join(worldsRoot, prepared.worldId);
-    const authorityStore = new FileNativeAuthorityV3(worldRoot);
-    const authority = await authorityStore.readHead();
-    if (authority.head === prepared.parentHead)
-        return { outcome: "in_progress" };
-    if (authority.operationId !== operationId)
-        throw corruptOperationOutcome();
-    const commit = await assertCommittedAuthorityOutcomeMatches(worldRoot, prepared);
-    if (authority.sequence < commit.sequence)
-        throw corruptOperationOutcome();
-    const materialized = await readMaterializedCheckpoint(worldRoot);
-    const outcome = materialized !== null && materialized.sequence >= commit.sequence
-        ? "committed"
-        : "committed_materialization_pending";
-    const resolved = { ...structuredClone(prepared), outcome };
-    if (outcome === "committed_materialization_pending")
-        await assertPendingMaterializationCompatible(worldRoot, resolved);
-    return resolved;
-}
 function corruptOperationOutcome() {
     return new FileNativeWorldCreationError("world_corrupt", "Authority operation outcome structure or operation identity is invalid");
 }
 async function assertCommittedAuthorityOutcomeMatches(worldRoot, outcome) {
-    const fact = await new FileNativeAuthorityV3(worldRoot).authorityFactAt(outcome.head);
+    const fact = await new WorldLedgerAuthority(worldRoot).authorityFactAt(outcome.head);
     const { commit } = fact;
     if (fact.digest !== outcome.commitDigest ||
-        commit.auditParent.head !== outcome.parentHead ||
+        commit.parentHead !== outcome.parentHead ||
         commit.head !== outcome.head ||
         commit.mode !== outcome.mode ||
         !isDeepStrictEqual(commit.historyAppend.map(({ role, exactText, background }) => ({
@@ -1797,143 +1415,6 @@ async function assertCommittedAuthorityOutcomeMatches(worldRoot, outcome) {
         throw corruptOperationOutcome();
     return commit;
 }
-async function assertPendingMaterializationCompatible(worldRoot, outcome) {
-    const authority = new FileNativeAuthorityV3(worldRoot);
-    await assertCommittedAuthorityOutcomeMatches(worldRoot, outcome);
-    const [parent, target, state, history] = await Promise.all([
-        authority.recover(outcome.parentHead),
-        authority.recover(outcome.head),
-        readTree(join(worldRoot, "state")),
-        readTree(join(worldRoot, "history")),
-    ]);
-    assertProjectionBetweenEndpoints("state", state, parent.state, target.state);
-    assertHistoryProjectionBetweenEndpoints(history, historySurfaceFiles(parent.history), historySurfaceFiles(target.history));
-    const existingMaterials = await readOptionalJson(join(worldRoot, "runtime", "additional-materials.json"));
-    if (existingMaterials !== null &&
-        !((existingMaterials.head === parent.head &&
-            isDeepStrictEqual(existingMaterials.items, parent.additionalMaterials)) ||
-            (existingMaterials.head === target.head &&
-                isDeepStrictEqual(existingMaterials.items, target.additionalMaterials))))
-        throw new FileNativeWorldCreationError("inconsistent_materialization", "Additional-material list content conflicts at the same endpoint");
-}
-function assertProjectionBetweenEndpoints(surface, current, parent, target) {
-    const parentFiles = new Map(parent.map((file) => [file.path, file.contents]));
-    const targetFiles = new Map(target.map((file) => [file.path, file.contents]));
-    for (const file of current) {
-        if (file.contents !== parentFiles.get(file.path) &&
-            file.contents !== targetFiles.get(file.path))
-            throw new FileNativeWorldCreationError("inconsistent_materialization", `World ${surface} projection conflicts with both accepted endpoints: ${file.path}`);
-    }
-}
-function assertHistoryProjectionBetweenEndpoints(current, parent, target) {
-    const byMessageId = (files) => new Map(files.map((file) => [
-        fileNativeHistoryMessageIdFromProjectionPath(file.path),
-        file.contents,
-    ]));
-    const parentFiles = byMessageId(parent);
-    const targetFiles = byMessageId(target);
-    const seen = new Set();
-    for (const file of current) {
-        const messageId = fileNativeHistoryMessageIdFromProjectionPath(file.path);
-        if (messageId === null ||
-            seen.has(messageId) ||
-            (file.contents !== parentFiles.get(messageId) &&
-                file.contents !== targetFiles.get(messageId)))
-            throw new FileNativeWorldCreationError("inconsistent_materialization", `World history projection conflicts with both accepted endpoints: ${file.path}`);
-        seen.add(messageId);
-    }
-}
-function isAuthorityMaterialSelection(value) {
-    if (!isRecord(value))
-        return false;
-    if (value.kind === "document")
-        return (hasExactKeys(value, ["kind", "document"]) &&
-            typeof value.document === "string");
-    if (value.kind === "node")
-        return (hasExactKeys(value, ["kind", "document", "locator"]) &&
-            typeof value.document === "string" &&
-            isAuthorityMaterialLocator(value.locator));
-    if (value.kind === "history_message")
-        return (hasExactKeys(value, ["kind", "message"]) &&
-            typeof value.message === "string");
-    return (value.kind === "history_commit" &&
-        hasExactKeys(value, ["kind", "commit"]) &&
-        typeof value.commit === "string");
-}
-function isAuthorityMaterialLocator(value) {
-    return (isRecord(value) &&
-        hasRequiredAndOptionalKeys(value, [], ["yaml", "markdown"]) &&
-        (value.yaml === undefined ||
-            (Array.isArray(value.yaml) &&
-                value.yaml.every((segment) => typeof segment === "string" || Number.isSafeInteger(segment)))) &&
-        (value.markdown === undefined ||
-            (Array.isArray(value.markdown) &&
-                value.markdown.every((segment) => typeof segment === "string"))));
-}
-async function publishJson(path, value) {
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    await writeJson(temporary, value);
-    await rename(temporary, path);
-    await syncDirectory(dirname(path));
-}
-async function readMaterializedCheckpoint(root) {
-    const value = await readOptionalJson(join(root, "runtime", "materialized-head.json"));
-    if (value === null)
-        return null;
-    if (!isRecord(value) ||
-        !hasRequiredAndOptionalKeys(value, ["schemaVersion", "head", "sequence", "commitDigest"], ["historyBackgroundCount"]) ||
-        (value.historyBackgroundCount !== undefined &&
-            (!Number.isSafeInteger(value.historyBackgroundCount) ||
-                Number(value.historyBackgroundCount) < 1)) ||
-        value.schemaVersion !== 3 ||
-        typeof value.head !== "string" ||
-        !Number.isSafeInteger(value.sequence) ||
-        Number(value.sequence) < 0 ||
-        (value.commitDigest !== null &&
-            (typeof value.commitDigest !== "string" ||
-                !/^[a-f0-9]{64}$/u.test(value.commitDigest))) ||
-        (Number(value.sequence) === 0
-            ? value.head !== "genesis" || value.commitDigest !== null
-            : value.head !== `commit:${String(value.sequence)}` ||
-                value.commitDigest === null))
-        throw new FileNativeWorldCreationError("world_corrupt", "Materialized world checkpoint has an invalid shape");
-    return value;
-}
-function sameMaterializedEndpoint(checkpoint, authority) {
-    return (checkpoint !== null &&
-        checkpoint.head === authority.head &&
-        checkpoint.sequence === authority.sequence &&
-        checkpoint.commitDigest === authority.commitDigest);
-}
-function isPlayHistoryAppendInput(value) {
-    return (isRecord(value) &&
-        hasRequiredAndOptionalKeys(value, ["role", "exactText"], ["background"]) &&
-        (value.background === undefined ||
-            (isHistoryBackground(value.background) &&
-                (value.role !== "player" || value.background.kind === "snapshot"))) &&
-        (value.role === "player" || value.role === "narrator") &&
-        typeof value.exactText === "string");
-}
-async function materializeRecoveredEndpoint(root, authority, endpoint, lastActivityAt = null) {
-    if (authority.head !== endpoint.head)
-        throw new FileNativeWorldCreationError("world_corrupt", "Recovered endpoint does not match the Authority head to materialize");
-    await replaceMaterializedTree(join(root, "state"), endpoint.state);
-    crashAtFileNativeAuthorityEdge("after_state_materialization");
-    await replaceMaterializedTree(join(root, "history"), historySurfaceFiles(endpoint.history));
-    await replaceMaterializedTree(join(root, "runtime", "history-backgrounds"), projectHistoryBackgrounds(endpoint.history));
-    await publishJson(join(root, "runtime", "additional-materials.json"), {
-        head: authority.head,
-        items: endpoint.additionalMaterials,
-    });
-    await publishJson(join(root, "runtime", "materialized-head.json"), {
-        schemaVersion: 3,
-        head: authority.head,
-        sequence: authority.sequence,
-        commitDigest: authority.commitDigest,
-        ...backgroundCount(endpoint.history),
-    });
-    await updateWorldActivity(root, authority.head, endpoint.history, lastActivityAt);
-}
 async function replaceMaterializedTree(root, files) {
     const next = new Map();
     for (const file of files) {
@@ -1953,34 +1434,19 @@ async function replaceMaterializedTree(root, files) {
             continue;
         const path = join(root, file.path);
         await rm(path, { force: true });
-        await syncDirectory(dirname(path));
     }
 }
 async function publishText(path, contents) {
     await mkdir(dirname(path), { recursive: true });
     const temporary = `${path}.${randomUUID()}.tmp`;
     await writeFile(temporary, contents, "utf8");
-    await syncFile(temporary);
     await rename(temporary, path);
-    await syncDirectory(dirname(path));
 }
 function historySurfaceFiles(messages) {
     return projectFileNativeHistorySurface(messages, (messageId) => {
         throw new FileNativeWorldCreationError("world_corrupt", `History-message identity cannot form a materialization path: ${messageId}`);
     });
 }
-function materializedHistoryRecord(files) {
-    const result = {};
-    for (const file of files) {
-        const messageId = fileNativeHistoryMessageIdFromProjectionPath(file.path);
-        if (messageId === null)
-            throw new FileNativeWorldCreationError("world_corrupt", `Materialized history path is invalid: ${file.path}`);
-        if (messageId in result)
-            throw new FileNativeWorldCreationError("world_corrupt", `Materialized history contains a duplicate message: ${messageId}`);
-        result[messageId] = file.contents;
-    }
-    return result;
-}
 async function writeIdempotentText(path, contents) {
     try {
         const existing = await readFile(path, "utf8");
@@ -1992,15 +1458,9 @@ async function writeIdempotentText(path, contents) {
             throw error;
         const temporary = `${path}.${randomUUID()}.tmp`;
         await writeFile(temporary, contents, "utf8");
-        await syncFile(temporary);
         await rename(temporary, path);
-        await syncDirectory(dirname(path));
     }
 }
-function isCommittedOutcome(outcome) {
-    return (outcome.outcome === "committed" ||
-        outcome.outcome === "committed_materialization_pending");
-}
 function assertSameOperationOutcome(outcome, input) {
     if (outcome.worldId !== input.worldId ||
         outcome.parentHead !== input.parentHead ||
@@ -2037,8 +1497,7 @@ function authorityCommitMatchesInput(commit, input) {
             const candidate = input.stateChanges[index];
             if (candidate === undefined)
                 return false;
-            const { nextBlob, ...metadata } = stored;
-            const expected = {
+            return isDeepStrictEqual(stored, {
                 kind: candidate.kind,
                 documentId: candidate.documentId,
                 stableShortRef: candidate.stableShortRef,
@@ -2046,10 +1505,7 @@ function authorityCommitMatchesInput(commit, input) {
                 codec: candidate.codec,
                 expectedPreviousHash: candidate.expectedPreviousHash,
                 nextHash: candidate.nextHash,
-            };
-            return (nextBlob.epoch === commit.sequence &&
-                `sha256:${nextBlob.digest}` === candidate.nextHash &&
-                isDeepStrictEqual(metadata, expected));
+            });
         });
     const expectedCorrection = input.mode === "correction"
         ? input.stateChanges.map(({ documentId }) => documentId)
@@ -2057,9 +1513,7 @@ function authorityCommitMatchesInput(commit, input) {
     return (commit.mode === input.mode &&
         commit.playContext === input.playContext &&
         commit.worldClock === input.worldClock &&
-        commit.auditParent.head === input.parentHead &&
-        commit.timelineParent.head ===
-            (input.timelineRevision?.restoresHead ?? input.parentHead) &&
+        commit.parentHead === input.parentHead &&
         isDeepStrictEqual(commit.historyAppend.map(({ role, exactText, background }) => ({
             role,
             exactText,
@@ -2067,12 +1521,48 @@ function authorityCommitMatchesInput(commit, input) {
         })), input.historyAppend) &&
         stateChangesMatch &&
         isDeepStrictEqual(commit.nextAdditionalMaterials, input.nextMaterials) &&
-        isDeepStrictEqual(commit.timelineRevision, input.timelineRevision) &&
         isDeepStrictEqual(commit.narrativeCheckpoint, input.narrativeCheckpoint) &&
         isDeepStrictEqual(commit.correctionTargets, expectedCorrection) &&
         commit.corrects ===
             (input.mode === "correction" ? input.parentHead : undefined));
 }
+function headPosition(head) {
+    if (head === "genesis")
+        return 0;
+    const match = /^commit:([1-9][0-9]*)$/u.exec(head);
+    if (match === null)
+        throw new TypeError(`Endpoint is invalid: ${head}`);
+    return Number.parseInt(match[1], 10);
+}
+// 分叉只复制一个世界的闭包；回退与身份重分配由调用方在副本上完成。
+const forkClosureEntries = [
+    "state",
+    "control",
+    "history",
+    join("runtime", "head.json"),
+    join("runtime", "turns"),
+    join("runtime", "history-backgrounds"),
+    join("runtime", "additional-materials.json"),
+    join("runtime", "genesis.json"),
+    join("runtime", "play-genesis-timeline.json"),
+    "artifacts",
+];
+async function copyForkClosure(sourceRoot, target) {
+    await mkdir(join(target, "runtime"), { recursive: true, mode: 0o700 });
+    for (const entry of forkClosureEntries) {
+        const source = join(sourceRoot, entry);
+        try {
+            await stat(source);
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        await mkdir(dirname(join(target, entry)), { recursive: true, mode: 0o700 });
+        await cp(source, join(target, entry), { recursive: true });
+    }
+}
 function openWorldDocumentSnapshot(files) {
     return WorldDocumentStore.open({
         layout: "world_state",
@@ -2089,36 +1579,11 @@ async function writeJson(path, value) {
         encoding: "utf8",
         mode: 0o600,
     });
-    await syncFile(path);
 }
-async function syncFile(path) {
-    const handle = await open(path, "r");
-    try {
-        await handle.sync();
-    }
-    finally {
-        await handle.close();
-    }
-}
-async function syncDirectory(path) {
-    const handle = await open(path, "r");
-    try {
-        await handle.sync();
-    }
-    finally {
-        await handle.close();
-    }
-}
-async function durableTree(root) {
-    const entries = await readdir(root, { withFileTypes: true });
-    for (const entry of entries) {
-        const path = join(root, entry.name);
-        if (entry.isDirectory())
-            await durableTree(path);
-        else if (entry.isFile())
-            await syncFile(path);
-    }
-    await syncDirectory(root);
+async function publishJson(path, value) {
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    await writeJson(temporary, value);
+    await rename(temporary, path);
 }
 async function readGenesisForFork(worldRoot, worldId) {
     const value = await readJson(join(worldRoot, "runtime", "genesis.json"));
@@ -2191,15 +1656,15 @@ async function readPublicationAt(root) {
 async function readWorldSummaryAt(root, publication, serializeRebuild) {
     const published = publication ?? (await readPublicationAt(root));
     const gameplay = await readWorldGameplayAt(root);
-    const { lastActivityAt, excerpt, playerTurns } = await readWorldActivity(root, serializeRebuild);
-    const summary = {
+    const activity = await readWorldActivity(root, serializeRebuild);
+    return {
         ...toSummary(published, gameplay),
         title: await readWorldTitleAt(root, published),
-        lastActivityAt,
-        excerpt,
-        playerTurns,
+        lastActivityAt: activity.lastActivityAt,
+        excerpt: activity.excerpt,
+        playerTurns: activity.playerTurns,
+        ...(activity.pendingUpgrade === true ? { pendingUpgrade: true } : {}),
     };
-    return summary;
 }
 async function readWorldTitleAt(root, published) {
     const metadata = await readOptionalJson(join(root, localMetadataFile));
@@ -2318,36 +1783,20 @@ function assertRelativePath(path) {
 function isNodeError(error) {
     return error instanceof Error && "code" in error;
 }
-function crashAtFileNativeWorldCreationEdge(edge) {
-    if (process.env.NODE_ENV === "test" &&
-        process.env
-            .NARRAEON_INTERNAL_TEST_CRASH_AT_FILE_NATIVE_WORLD_CREATION_EDGE === edge) {
-        process.kill(process.pid, "SIGKILL");
-    }
-}
-function crashAtFileNativeAuthorityEdge(edge) {
-    if (process.env.NODE_ENV === "test" &&
-        process.env.NARRAEON_INTERNAL_TEST_CRASH_AT_FILE_NATIVE_AUTHORITY_EDGE ===
-            edge) {
-        process.kill(process.pid, "SIGKILL");
-    }
-}
 import { readDocumentMaintenanceFacts, } from "./WorldDocumentMaintenance.js";
 function backgroundField(background) {
     return background === undefined ? {} : { background };
 }
-function materializedBackgroundRecord(files, history) {
-    return Object.fromEntries(files.map(({ path, contents }) => {
-        const id = path.replace(/\.json$/u, "");
-        const value = JSON.parse(contents);
-        if (path !== `${id}.json` ||
-            !Object.hasOwn(history, id) ||
-            !isHistoryBackground(value))
-            throw new FileNativeWorldCreationError("world_corrupt", "Materialized history background is invalid or unreachable");
-        return [id, value];
-    }));
+function playerRevisionIntentPath(worldsRoot, worldId) {
+    return join(worldsRoot, worldId, "runtime", "player-revision-intent.json");
 }
-function backgroundCount(messages) {
-    const count = messages.filter(({ background }) => background !== undefined).length;
-    return count === 0 ? {} : { historyBackgroundCount: count };
+async function readOptionalJsonFile(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
 }