rapier-markdown-kit 1.1.90 → 1.1.92

package/dist/kit/ledger/journal-records.mjs

@@ -31,19 +31,203 @@ function _rapierTransformSplices(text, splices, inverse = false) {
 	} catch (_) { return null; }
 }
 
+function _rapierPlainLedgerData(record) {
+	try {
+		const active = new Set(), pending = [[record, false]];
+		while (pending.length) {
+			const [value, leaving] = pending.pop();
+			if (leaving) { active.delete(value); continue; }
+			if (value === null || typeof value === 'boolean') continue;
+			if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) return false; continue; }
+			if (typeof value === 'number') { if (!Number.isFinite(value) || Object.is(value, -0)) return false; continue; }
+			if (!value || typeof value !== 'object' || active.has(value)) return false;
+			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
+				Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) return false;
+			const keys = Reflect.ownKeys(value);
+			if (array && keys.length !== value.length + 1) return false;
+			active.add(value); pending.push([value, true]);
+			for (const key of keys) {
+				if (array && key === 'length') continue;
+				if (typeof key !== 'string' || ['__proto__', 'constructor', 'prototype'].includes(key) ||
+					(array && (!Number.isSafeInteger(Number(key)) || Number(key) < 0 || Number(key) >= value.length || String(Number(key)) !== key))) return false;
+				const field = Object.getOwnPropertyDescriptor(value, key);
+				if (!field || !Object.hasOwn(field, 'value') || !field.enumerable) return false;
+				pending.push([field.value, false]);
+			}
+		}
+		return true;
+	} catch (_) { return false; }
+}
+
+const _rapierMetadataValue = (key, value) => key === 'filename'
+	? typeof value === 'string' && value.trim().length > 0 && value.length <= 512 &&
+		!/[<>"\x00-\x1f\x7f/\\\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff\uD800-\uDFFF]/u.test(value) && value !== '.' && value !== '..'
+	: key === 'docKind' && ['markdown', 'text', 'code'].includes(value);
+
+function _rapierValidMetadata(value) {
+	return _rapierPlainLedgerData(value) && value && !Array.isArray(value) &&
+		Object.keys(value).length === 2 && ['filename', 'docKind'].every(key => Object.hasOwn(value, key) && _rapierMetadataValue(key, value[key]));
+}
+
+function _rapierValidMetadataEffect(effect) {
+	return _rapierPlainLedgerData(effect) && effect && !Array.isArray(effect) &&
+		Object.keys(effect).length > 0 && Object.keys(effect).every(key => {
+			const pair = effect[key];
+			return pair && !Array.isArray(pair) && Object.keys(pair).length === 2 &&
+				Object.hasOwn(pair, 'before') && Object.hasOwn(pair, 'after') &&
+				_rapierMetadataValue(key, pair.before) && _rapierMetadataValue(key, pair.after);
+		});
+}
+
+function _rapierMetadataDelta(before, after, {assign = []} = {}) {
+	if (!_rapierValidMetadata(before) || !_rapierValidMetadata(after)) return null;
+	const effect = {};
+	for (const key of ['filename', 'docKind']) if (before[key] !== after[key] || assign.includes(key)) effect[key] = {before: before[key], after: after[key]};
+	return Object.keys(effect).length ? effect : null;
+}
+
+function _rapierTransformMetadata(value, effect, inverse = false) {
+	if (!_rapierValidMetadata(value) || (effect != null && !_rapierValidMetadataEffect(effect))) return null;
+	const next = {...value};
+	for (const [key, pair] of Object.entries(effect || {})) {
+		if (next[key] !== pair[inverse ? 'after' : 'before']) return null;
+		next[key] = pair[inverse ? 'before' : 'after'];
+	}
+	return next;
+}
+
+// An origin binds transported placement to exact authored rows and their causal basis.
+function _rapierValidAuthored(origin) {
+	if (!_rapierPlainLedgerData(origin) || !origin || Array.isArray(origin) ||
+		Object.keys(origin).length !== 3 || !Array.isArray(origin.basis) ||
+		new Set(origin.basis).size !== origin.basis.length || origin.basis.some((id, index) => index && origin.basis[index - 1] >= id) ||
+		!origin.basis.every(id => typeof id === 'string' && id.length > 0 && id.length <= 256) ||
+		typeof origin.source !== 'string' || !/^[a-f0-9]{64}$/.test(origin.source) ||
+		!Array.isArray(origin.splices) || origin.splices.length > 64) return false;
+	return origin.splices.every(row => row && !Array.isArray(row) && Object.keys(row).length === 3 &&
+		Number.isSafeInteger(row.pos) && row.pos >= 0 && !Object.is(row.pos, -0) &&
+		typeof row.removed === 'string' && typeof row.inserted === 'string' &&
+		!/[\uD800-\uDFFF]/u.test(row.removed) && !/[\uD800-\uDFFF]/u.test(row.inserted));
+}
+
 function _rapierRecordSplices(entry, ledger) {
 	try {
-		if (entry && Array.isArray(entry.splices) && entry.splices.length) return entry.splices;
-		const transaction = entry && entry.transaction;
-		const targetId = String(transaction?.reverts || transaction?.reapplies || '');
-		const target = targetId && (ledger || []).find(record => record?.transaction?.id === targetId);
-		if (!target || !Array.isArray(target.splices) || !target.splices.length) return null;
-		return transaction.reverts ? target.splices.slice().reverse().map(row => ({
-			pos: row.pos, removed: row.inserted, inserted: row.removed,
-		})) : target.splices;
+		if (entry && Array.isArray(entry.splices)) return entry.splices;
+		const tx = entry?.transaction, targetId = tx?.reverts || tx?.reapplies;
+		const prior = (ledger || []).filter(record => record?.transaction?.revision < tx?.revision);
+		const target = targetId && prior.find(record => record?.transaction?.id === targetId);
+		if (!target) return null;
+		const rows = _rapierRecordSplices(target, prior);
+		if (!rows) return null;
+		return tx.reverts ? rows.slice().reverse().map(row => ({pos: row.pos, removed: row.inserted, inserted: row.removed})) : rows;
 	} catch (_) { return null; }
 }
 
+function _rapierRecordMetadata(entry, ledger) {
+	try {
+		if (Object.hasOwn(entry, 'metadata')) return _rapierValidMetadataEffect(entry.metadata) ? entry.metadata : undefined;
+		// An expanded record owns its complete effect; only compact navigation inherits one.
+		if (Array.isArray(entry.splices)) return null;
+		const tx = entry.transaction, targetId = tx.reverts || tx.reapplies;
+		const prior = (ledger || []).filter(record => record?.transaction?.revision < tx.revision);
+		const target = targetId && prior.find(record => record?.transaction?.id === targetId);
+		if (!target) return undefined;
+		const effect = _rapierRecordMetadata(target, prior);
+		if (effect == null) return effect;
+		return tx.reverts ? Object.fromEntries(Object.entries(effect).map(([key, pair]) =>
+			[key, {before: pair.after, after: pair.before}])) : effect;
+	} catch (_) { return undefined; }
+}
+
+// Active inverses suppress their targets. Reversing an inverse restores its targets,
+// including assignments hidden by later choices. Nothing outside these records is retained.
+function _rapierHistoryEffects(records, visit = null) {
+	try {
+		if (!Array.isArray(records)) return {ok: false};
+		const nodes = new Map(), references = new Map();
+		const update = (target, delta) => {
+			const pending = [[target, delta]];
+			while (pending.length) {
+				const [id, change] = pending.pop(), node = nodes.get(id), was = node.active;
+				node.blockers += change;
+				if (node.blockers < 0) throw Error('effect');
+				node.active = node.blockers === 0;
+				if (was !== node.active) for (const ref of node.references) pending.push([ref, node.active ? 1 : -1]);
+			}
+		};
+		const lastUndo = new Map();
+		for (const record of records) {
+			const tx = record?.transaction;
+			if (!tx || typeof tx.id !== 'string' || !tx.id || nodes.has(tx.id) || (tx.reverts && tx.reapplies)) return {ok: false};
+			const supplied = tx.sourceTransactionIds || (tx.sourceTransactionId ? [tx.sourceTransactionId] : []);
+			if (!Array.isArray(supplied) || new Set(supplied).size !== supplied.length ||
+				(tx.sourceTransactionIds && tx.sourceTransactionId && (supplied.length !== 1 || supplied[0] !== tx.sourceTransactionId))) return {ok: false};
+			let refs = supplied;
+			if (tx.reverts || tx.reapplies) {
+				const target = tx.reverts || tx.reapplies;
+				if (!nodes.has(target) || (supplied.length && (supplied.length !== 1 || supplied[0] !== target))) return {ok: false};
+				if (tx.reverts) refs = [target];
+				else {
+					const undo = lastUndo.get(target);
+					if (!undo || !nodes.get(undo).active) return {ok: false};
+					refs = [undo];
+				}
+			}
+			if (refs.some(id => typeof id !== 'string' || !nodes.get(id)?.active)) return {ok: false};
+			nodes.set(tx.id, {active: true, blockers: 0, references: refs}); references.set(tx.id, refs.slice());
+			for (const ref of refs) update(ref, 1);
+			if (tx.reverts) lastUndo.set(tx.reverts, tx.id);
+			if (visit) visit(record, nodes, refs);
+		}
+		const effectiveActIds = [...nodes].filter(([, node]) => node.active).map(([id]) => id);
+		return {ok: true, effectiveActIds, active: new Set(effectiveActIds), references};
+	} catch (_) { return {ok: false}; }
+}
+
+function _rapierMetadataState(initial, records, effects = _rapierHistoryEffects(records)) {
+	if (!_rapierValidMetadata(initial) || !effects.ok) return null;
+	const state = {...initial};
+	for (const record of records) if (effects.active.has(record.transaction.id) && !effects.references.get(record.transaction.id)?.length) {
+		const effect = _rapierRecordMetadata(record, records);
+		if (effect === undefined) return null;
+		for (const [key, pair] of Object.entries(effect || {})) state[key] = pair.after;
+	}
+	return state;
+}
+
+// Prove each recorded transition and each inverse's semantic result, not only the final values.
+function _rapierReplayMetadata(initial, records) {
+	if (!_rapierValidMetadata(initial)) return null;
+	let state = {...initial};
+	const earlier = [], assignments = {filename: [], docKind: []};
+	const effects = _rapierHistoryEffects(records, (record, nodes, refs) => {
+		const effect = _rapierRecordMetadata(record, earlier);
+		if (effect === undefined) throw Error('metadata');
+		state = _rapierTransformMetadata(state, effect);
+		if (!state) throw Error('metadata');
+		if (!refs.length) for (const [key, pair] of Object.entries(effect || {}))
+			assignments[key].push({id: record.transaction.id, value: pair.after});
+		for (const key of ['filename', 'docKind']) {
+			let expected = initial[key];
+			for (let i = assignments[key].length - 1; i >= 0; i--) if (nodes.get(assignments[key][i].id).active) {
+				expected = assignments[key][i].value; break;
+			}
+			if (state[key] !== expected) throw Error('metadata_effect');
+		}
+		earlier.push(record);
+	});
+	return effects.ok ? state : null;
+}
+
+function _rapierHasHistoryEffect(record, earlier = []) {
+	const tx = record?.transaction;
+	if (!tx || !(tx.reverts || tx.reapplies || tx.sourceTransactionId || tx.sourceTransactionIds?.length)) return false;
+	let id = tx.id;
+	if (!id) { id = 'candidate'; while (earlier.some(row => row?.transaction?.id === id)) id += ':'; }
+	return _rapierHistoryEffects([...earlier, {...record, transaction: {...tx, id}}]).ok;
+}
+
 // A ledger record as the journal and the Notes return validate it below: plain data, nothing
 // undefined anywhere in it. A live record could carry a row whose type or order is not yet known (a
 // block just inserted, before its first render: `type: undefined`), and the validator would refuse
@@ -65,48 +249,30 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 	// Iterative traversal refuses cycles without exhausting the call stack. Proxies/counters that
 	// throw are refused by the same gate rather than escaping into document recovery.
 	try {
-		const active = new Set(), pending = [[record, false]];
-		while (pending.length) {
-			const [value, leaving] = pending.pop();
-			if (leaving) { active.delete(value); continue; }
-			if (value === null || typeof value === 'string' || typeof value === 'boolean') continue;
-			if (typeof value === 'number') { if (!Number.isFinite(value)) return false; continue; }
-			if (!value || typeof value !== 'object' || active.has(value)) return false;
-			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
-			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
-					Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) return false;
-			const keys = Reflect.ownKeys(value);
-			if (array && keys.length !== value.length + 1) return false;
-			active.add(value); pending.push([value, true]);
-			for (const key of keys) {
-				if (array && key === 'length') continue;
-				if (typeof key !== 'string' || key === '__proto__' || key === 'constructor' || key === 'prototype' ||
-						(array && (!Number.isSafeInteger(Number(key)) || Number(key) < 0 ||
-							Number(key) >= value.length || String(Number(key)) !== key))) return false;
-				const field = Object.getOwnPropertyDescriptor(value, key);
-				if (!field || !Object.hasOwn(field, 'value')) return false;
-				pending.push([field.value, false]);
-			}
-		}
+		if (!_rapierPlainLedgerData(record) || (Object.hasOwn(record, 'authored') && !_rapierValidAuthored(record.authored))) return false;
 		if (!record || typeof record !== 'object' ||
 				typeof record.beforeHash !== 'string' || !record.beforeHash.length ||
-				typeof record.afterHash !== 'string' || !record.afterHash.length || record.beforeHash === record.afterHash) return false;
-		const own = Array.isArray(record.splices) && record.splices.length;
-		const navigation = !!(record.transaction?.reverts || record.transaction?.reapplies);
+				typeof record.afterHash !== 'string' || !record.afterHash.length) return false;
+		const own = Array.isArray(record.splices), navigation = !!(record.transaction?.reverts || record.transaction?.reapplies);
 		if ((!own && !navigation) || (own && record.splices.length > 64) ||
-				(record.transaction?.reverts && record.transaction?.reapplies)) return false;
-		const splices = _rapierRecordSplices(record, earlier);
+			(record.transaction?.reverts && record.transaction?.reapplies)) return false;
+		const splices = _rapierRecordSplices(record, earlier), metadata = _rapierRecordMetadata(record, earlier);
+		const semantic = _rapierHasHistoryEffect(record, earlier);
+		if (metadata === undefined || (!splices?.length && !Object.values(metadata || {}).some(pair => pair.before !== pair.after) && !semantic) ||
+			(record.beforeHash === record.afterHash && splices?.length) ||
+			(record.beforeHash !== record.afterHash && !splices?.length) ||
+			((record.transaction?.sourceTransactionId || record.transaction?.sourceTransactionIds?.length || navigation) && !semantic)) return false;
 		if (!splices || splices.length > 64 || !splices.every(row =>
 				row && Number.isSafeInteger(row.pos) && row.pos >= 0 && !Object.is(row.pos, -0) &&
 				typeof row.removed === 'string' && typeof row.inserted === 'string' &&
 				!/[\uD800-\uDFFF]/u.test(row.removed) && !/[\uD800-\uDFFF]/u.test(row.inserted) &&
 				utf8Length(row.removed) <= maxDocumentBytes &&
 				utf8Length(row.inserted) <= maxDocumentBytes)) return false;
+		if (record.authored && record.authored.splices.some(row => utf8Length(row.removed) > maxDocumentBytes || utf8Length(row.inserted) > maxDocumentBytes)) return false;
 		const transaction = record.transaction;
 		const nullableText = (value, limit, empty = true) => value === null ||
 			(typeof value === 'string' && value.length <= limit && (empty || value.length > 0));
-		// A grouped agent contribution's optional fields, bounded like the identities beside them: a name of 1 to 120 characters, a
-		// revision, at most 500 source identities (the journal the kernel retains) of 1 to 160, and a hosted row's identity of 1 to 256.
+		// Identity fields are bounded individually; durable history has no record-count limit.
 		const optional = (value, valid) => value === undefined || valid(value);
 		const identity = (value, limit) => typeof value === 'string' && value.length > 0 && value.length <= limit;
 		if (!transaction || typeof transaction.id !== 'string' || !transaction.id.length ||
@@ -118,17 +284,21 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 				typeof transaction.operation !== 'string' || !transaction.operation.length ||
 				transaction.operation.length > _RAPIER_TRANSACTION_OPERATION_LIMIT ||
 				!nullableText(transaction.requestId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
-				!nullableText(transaction.sourceTransactionId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
+				!nullableText(transaction.sourceTransactionId, 256, false) ||
+				!optional(transaction.label, value => nullableText(value, 120)) ||
+				!optional(transaction.turnBaseRevision, value => Number.isSafeInteger(value) && value >= 0) ||
+				!optional(transaction.turnId, value => value === null || identity(value, 160)) ||
+				!optional(transaction.turnLabel, value => value === null || identity(value, 120)) ||
 				!optional(transaction.contribution, value => identity(value, 120)) ||
 				!optional(transaction.contributionBaseRevision, value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0)) ||
-				!optional(transaction.sourceTransactionIds, value => Array.isArray(value) && value.length <= 500 &&
-					value.every(id => identity(id, _RAPIER_TRANSACTION_REQUEST_LIMIT))) ||
+				!optional(transaction.sourceTransactionIds, value => Array.isArray(value) && value.length > 0 &&
+					new Set(value).size === value.length && value.every(id => identity(id, 256))) ||
 				!optional(transaction.remoteTransactionId, value => identity(value, 256)) ||
 				!nullableText(transaction.parent, 256, false) ||
 				!nullableText(transaction.reverts, 256, false) ||
 				!nullableText(transaction.reapplies, 256, false) ||
-				!Number.isSafeInteger(transaction.createdAt) || transaction.createdAt < 0 ||
-				!Array.isArray(transaction.affectedBlockIds) || transaction.affectedBlockIds.length > 64 ||
+				!(transaction.createdAt === null || (Number.isSafeInteger(transaction.createdAt) && transaction.createdAt >= 0)) ||
+				!Array.isArray(transaction.affectedBlockIds) ||
 				!transaction.affectedBlockIds.every(id => Number.isSafeInteger(id) && id >= 0) ||
 				!Number.isSafeInteger(transaction.revision) || transaction.revision < 1 ||
 				!Number.isSafeInteger(transaction.baseRevision) ||
@@ -140,8 +310,9 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 		return !!transaction.actor && typeof transaction.actor.kind === 'string' &&
 			/^(?:human|agent|system)$/.test(transaction.actor.kind) &&
 			typeof transaction.actor.id === 'string' && transaction.actor.id.length > 0 &&
-			transaction.actor.id.length <= _RAPIER_TRANSACTION_ACTOR_LIMIT;
+			transaction.actor.id.length <= _RAPIER_TRANSACTION_ACTOR_LIMIT &&
+			optional(transaction.actor.name, value => nullableText(value, 120, false));
 	} catch (_) { return false; }
 }
 
-export { _RAPIER_TRANSACTION_ACTOR_LIMIT, _RAPIER_TRANSACTION_OPERATION_LIMIT, _RAPIER_TRANSACTION_REQUEST_LIMIT, _rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord, _rapierJournalRecord};
+export { _rapierValidAuthored, _RAPIER_TRANSACTION_ACTOR_LIMIT, _RAPIER_TRANSACTION_OPERATION_LIMIT, _RAPIER_TRANSACTION_REQUEST_LIMIT, _rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord, _rapierJournalRecord, _rapierValidMetadata, _rapierValidMetadataEffect, _rapierMetadataDelta, _rapierTransformMetadata, _rapierRecordMetadata, _rapierHistoryEffects, _rapierMetadataState, _rapierReplayMetadata, _rapierHasHistoryEffect};

package/dist/kit/ledger/merge.mjs

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: MIT
 import {readLedger, exportLedger, rootAfter} from './format.mjs';
-import {_rapierTransformSplices} from './journal-records.mjs';
+import {_rapierTransformSplices, _rapierTransformMetadata, _rapierMetadataDelta, _rapierHistoryEffects, _rapierMetadataState} from './journal-records.mjs';
 import {mergeText} from './text-merge.mjs';
+import {transposeAuthored, authoredPlacements} from './transport.mjs';
 import {parseWill} from '../../agent/will.mjs';
 import {sha256} from './hash.mjs';
 import {canonicalJSON, fault} from './data.mjs';
@@ -31,18 +32,30 @@ export function transportTouchedInterval(start, end, splices) {
   }
   return range;
 }
-function over(row, other) {
-  // Equal-position insertions have no ordering evidence. Review, never a lexical winner.
-  if (!row.removed.length && !other.removed.length && row.pos === other.pos) return null;
-  const range = transportInterval(row.pos, row.pos + row.removed.length, [other]);
-  return range ? {...row, pos: range.start} : null;
-}
 const recordKey = record => sha256(canonicalJSON(record));
-const origin = record => record.transaction.sourceTransactionId?.startsWith('ledger:') ? record.transaction.sourceTransactionId : 'ledger:' + recordKey(record);
+// Identity survives rebasing. Position, roots, revision and parent are local placement,
+// while authorial choices and semantic inverse targets belong to the original act.
+function actFingerprint(record, effects) {
+  const tx = record.transaction, references = effects.references.get(tx.id) || [];
+  const {id, documentAuthority, baseRevision, revision, parent, reverts, reapplies,
+    sourceTransactionId, sourceTransactionIds, remoteTransactionId, ...authored} = tx;
+  return sha256(canonicalJSON({transaction: authored, references,
+    changeSet: record.changeSet ?? null, derivedCommentIndex: record.derivedCommentIndex ?? null,
+    // Applied source placement is proved below, never inferred from this fingerprint.
+    // An inverse's physical metadata is projected from its targets at the destination.
+    metadata: references.length ? null : Object.fromEntries(Object.entries(record.metadata || {}).map(([key, pair]) => [key, pair.after]))}));
+}
+const mergeIdentity = (localDigest, incomingDigest) => 'merge:' + sha256(canonicalJSON([localDigest, incomingDigest]));
 function checkpointList(read) {
-  const list = [{root: read.ledger.start.root, text: read.ledger.start.text, index: 0}], records = read.ledger.records;
-  let text = read.ledger.start.text;
-  for (let i = 0; i < records.length; i++) { text = _rapierTransformSplices(text, records[i].splices); list.push({root: records[i].afterHash, text, index: i + 1}); }
+  const list = [{root: read.ledger.start.root, text: read.ledger.start.text, metadata: read.ledger.start.metadata,
+    revision: read.ledger.start.revision, identity: null, index: 0}], records = read.ledger.records;
+  let text = read.ledger.start.text, metadata = read.ledger.start.metadata;
+  for (let i = 0; i < records.length; i++) {
+    text = _rapierTransformSplices(text, records[i].splices);
+    metadata = _rapierTransformMetadata(metadata, records[i].metadata);
+    list.push({root: records[i].afterHash, text, metadata, revision: records[i].transaction.revision,
+      identity: recordKey(records[i]), index: i + 1});
+  }
   return list;
 }
 function kept(text) {
@@ -50,67 +63,194 @@ function kept(text) {
   if (will.fault) return {fault: will.fault, text};
   return will.regions.filter(region => region.law === 'keep').map(region => text.slice(region.start, region.end));
 }
+// A retained suffix can reuse a prefix only when an existing ledger proves its
+// exact source, metadata, revision and path root. Export then rechecks the whole
+// chain, including the boundary parent. No missing act is invented.
+function expandRetainedStart(shorter, longer) {
+  if (shorter.ledger.documentAuthority !== longer.ledger.documentAuthority ||
+      shorter.ledger.start.revision <= longer.ledger.start.revision) return null;
+  const start = shorter.ledger.start, point = checkpointList(longer).find(point =>
+    point.revision === start.revision && point.root === start.root && point.text === start.text &&
+    canonicalJSON(point.metadata) === canonicalJSON(start.metadata));
+  if (!point) return null;
+  try { return exportLedger({text: shorter.text, metadata: shorter.metadata,
+    records: [...longer.ledger.records.slice(0, point.index), ...shorter.ledger.records],
+    documentAuthority: shorter.ledger.documentAuthority, revision: shorter.revision, root: shorter.root,
+    complete: longer.complete}); } catch (_) { return null; }
+}
+
 export function merge(first, second) {
   const ours = readLedger(first), theirs = readLedger(second);
-  // A reviewed conflict receipt names the complete incoming envelope: it too is idempotent.
-  if (ours.ledger.records.some(record => record.transaction.operation === 'document.merge' && record.transaction.sourceTransactionId === 'ledger:' + theirs.ledger.sha256)) {
-    const clean = !ours.text.includes('<!-- note-conflict:v1 ');
-    return {text: ours.text, ledger: ours.ledger, clean, conflicts: [], review: {required: !clean, base: ours.text, proposed: ours.text}};
+  const expandedTheirs = expandRetainedStart(theirs, ours);
+  if (expandedTheirs) return merge(ours.ledger, expandedTheirs);
+  const expandedOurs = expandRetainedStart(ours, theirs);
+  if (expandedOurs) {
+    const result = merge(expandedOurs, theirs.ledger);
+    // A refused join still returns the caller's exact retained envelope.
+    return !result.clean && result.ledger.sha256 === expandedOurs.sha256
+      ? {...result, ledger: ours.ledger} : result;
+  }
+  const localEffects = _rapierHistoryEffects(ours.ledger.records), incomingEffects = _rapierHistoryEffects(theirs.ledger.records);
+  const localOrigins = authoredPlacements(ours.ledger.start.text, ours.ledger.records),
+    incomingOrigins = authoredPlacements(theirs.ledger.start.text, theirs.ledger.records);
+  const localIds = new Map(ours.ledger.records.map(record => [record.transaction.id, record])), unproved = new Set();
+  for (const record of theirs.ledger.records) {
+    const local = localIds.get(record.transaction.id);
+    if (local && actFingerprint(local, localEffects) !== actFingerprint(record, incomingEffects)) return {text: ours.text, metadata: ours.metadata, ledger: ours.ledger,
+      clean: false, conflicts: [{kind: 'identity', code: 'act_identity_conflict', actId: record.transaction.id}],
+      review: {required: true, base: ours.text, proposed: theirs.text}};
+    if (local && canonicalJSON(localOrigins.get(local.transaction.id)) !== canonicalJSON(incomingOrigins.get(record.transaction.id)))
+      return {text: ours.text, metadata: ours.metadata, ledger: ours.ledger, clean: false,
+        conflicts: [{kind: 'identity', code: 'act_order_conflict', actId: record.transaction.id}],
+        review: {required: true, base: ours.text, proposed: theirs.text}};
+    if (local && (canonicalJSON(local.splices) !== canonicalJSON(record.splices) ||
+        canonicalJSON(local.metadata || {}) !== canonicalJSON(record.metadata || {}))) unproved.add(record.transaction.id);
   }
   const a = checkpointList(ours), b = checkpointList(theirs);
+  // A synthetic conflict act has one identity derived from both original envelopes.
+  // Reconstruct its exact local prefix to recognize a repeat without aliasing act IDs.
+  for (const [index, record] of ours.ledger.records.entries()) {
+    if (record.transaction.operation !== 'document.merge') continue;
+    const point = a[index], prefix = exportLedger({text: point.text, metadata: point.metadata,
+      records: ours.ledger.records.slice(0, index), documentAuthority: ours.ledger.documentAuthority,
+      revision: point.revision, root: point.root, complete: ours.complete});
+    if (record.transaction.id !== mergeIdentity(prefix.sha256, theirs.ledger.sha256)) continue;
+    const clean = !ours.text.includes('<!-- note-conflict:v1 ');
+    return {text: ours.text, metadata: ours.metadata, ledger: ours.ledger, clean, conflicts: [], review: {required: !clean, base: ours.text, proposed: ours.text}};
+  }
   let common = null;
   for (let i = b.length - 1; i >= 0 && !common; i--) {
-    const found = a.findLast(point => point.root === b[i].root && point.text === b[i].text);
-    if (found) common = {ours: found.index, theirs: b[i].index, text: found.text};
+    if (theirs.ledger.records.slice(0, b[i].index).some(row => unproved.has(row.transaction.id))) continue;
+    const found = a.findLast(point => !ours.ledger.records.slice(0, point.index).some(row => unproved.has(row.transaction.id)) && point.root === b[i].root && point.text === b[i].text && point.revision === b[i].revision &&
+      point.identity === b[i].identity && canonicalJSON(point.metadata) === canonicalJSON(b[i].metadata));
+    if (found) common = {ours: found.index, theirs: b[i].index, text: found.text, metadata: found.metadata};
   }
   if (!common) throw fault('copies have no proven common start');
-  const records = ours.ledger.records.slice(), imported = new Set(records.map(origin));
-  let text = ours.text, root = ours.root;
-  const append = (splices, actor, sourceId, operation, at) => {
+  // A prior join can contain our acts in a different transported order. After
+  // proving their placement below, keep the complete superset's representation.
+  const incomingIds = new Set(theirs.ledger.records.map(row => row.transaction.id));
+  const sameStart = ours.complete && theirs.complete && ours.ledger.documentAuthority === theirs.ledger.documentAuthority &&
+    canonicalJSON(ours.ledger.start) === canonicalJSON(theirs.ledger.start);
+  const oursContained = sameStart && [...localIds.keys()].every(id => incomingIds.has(id));
+  const theirsContained = sameStart && [...incomingIds].every(id => localIds.has(id));
+  const settled = read => ({text: read.text, metadata: read.metadata, ledger: read.ledger,
+    clean: !read.text.includes('<!-- note-conflict:v1 '), conflicts: [],
+    review: {required: read.text.includes('<!-- note-conflict:v1 '), base: ours.text, proposed: read.text}});
+  if (oursContained && theirsContained) {
+    if (ours.text !== theirs.text || canonicalJSON(ours.metadata) !== canonicalJSON(theirs.metadata))
+      return {text: ours.text, metadata: ours.metadata, ledger: ours.ledger, clean: false,
+        conflicts: [{kind: 'identity', code: 'act_order_conflict'}], review: {required: true, base: ours.text, proposed: theirs.text}};
+  }
+  const records = ours.ledger.records.slice(), imported = new Set(localIds.keys());
+  let text = ours.text, metadata = {...ours.metadata}, root = ours.root;
+  const append = (splices, original, effect = null, inverseIds = [], origin = original.authored) => {
     const next = _rapierTransformSplices(text, splices);
-    if (next === null) throw fault('transported record failed replay');
+    if (next === null) return null;
     const beforeHash = root, revision = (records.at(-1)?.transaction.revision ?? ours.ledger.start.revision) + 1;
-    for (const row of splices) root = rootAfter(root, row);
-    records.push({beforeHash, afterHash: root, splices, transaction: {
-      id: ours.ledger.documentAuthority.slice(0, 48) + ':merge:' + revision.toString(36), documentAuthority: ours.ledger.documentAuthority,
-      baseRevision: revision - 1, revision, actor, transport: 'platform', operation, requestId: null,
-      sourceTransactionId: sourceId, affectedBlockIds: [], parent: records.at(-1)?.transaction.id ?? null,
-      reverts: null, reapplies: null, createdAt: at,
-    }}); text = next;
+    let nextRoot = root;
+    for (const row of splices) nextRoot = rootAfter(nextRoot, row);
+    const {remoteTransactionId, sourceTransactionId, sourceTransactionIds, ...tx} = original.transaction;
+    const record = {beforeHash, afterHash: nextRoot, splices, ...(origin ? {authored: origin} : {}), transaction: {
+      ...tx, id: tx.id, documentAuthority: ours.ledger.documentAuthority,
+      baseRevision: revision - 1, revision, actor: tx.actor, transport: tx.transport, operation: tx.operation, requestId: tx.requestId,
+      sourceTransactionId: inverseIds.length === 1 ? inverseIds[0] : null,
+      ...(inverseIds.length > 1 ? {sourceTransactionIds: inverseIds} : {}),
+      ...(tx.turnId ? {turnId: tx.turnId} : {}), affectedBlockIds: tx.affectedBlockIds.slice(),
+      parent: records.at(-1)?.transaction.id ?? null, reverts: null, reapplies: null, createdAt: tx.createdAt,
+    }, ...(original.changeSet ? {changeSet: original.changeSet} : {}),
+      ...(original.derivedCommentIndex == null ? {} : {derivedCommentIndex: original.derivedCommentIndex})};
+    if (inverseIds.length) {
+      const after = _rapierMetadataState(ours.ledger.start.metadata, [...records, record]);
+      if (!after) return null;
+      effect = _rapierMetadataDelta(metadata, after);
+    }
+    const nextMetadata = _rapierTransformMetadata(metadata, effect);
+    if (!nextMetadata) return null;
+    if (effect) record.metadata = effect;
+    records.push(record); text = next; metadata = nextMetadata; root = nextRoot;
+    return record.transaction.id;
   };
-  let against = ours.ledger.records.slice(common.ours).flatMap(record => record.splices.map(row => ({...row})));
+  let against = ours.ledger.records.slice(common.ours);
   const incoming = theirs.ledger.records.slice(common.theirs);
-  // Complete repeats are detected by record content, never the revision ID (copies can reuse IDs).
-  const unseen = incoming.filter(record => !imported.has(origin(record)));
+  // The same original ID is a repeat only after its immutable fingerprint agrees.
+  const unseen = incoming.filter(record => !imported.has(record.transaction.id));
+  const refused = (kind, code, details = {}) => ({text: ours.text, metadata: ours.metadata, ledger: ours.ledger,
+    clean: false, conflicts: [{kind, code, ...details}],
+    review: {required: true, base: ours.text, proposed: theirs.text}});
+  const metadataConflict = (code, details) => refused('metadata', code, details);
+  const incomingFields = new Set(unseen.flatMap(record => Object.keys(record.metadata || {})));
+  const assignmentFields = (record, effects) => effects.references.get(record.transaction.id)?.length ? [] : Object.keys(record.metadata || {});
+  const competingFields = (record, pending) => {
+    const fields = new Set(pending.flatMap(row => assignmentFields(row, localEffects)));
+    return assignmentFields(record, incomingEffects).filter(key => fields.has(key));
+  };
+  const mappedIds = new Map();
+  for (const record of theirs.ledger.records) {
+    const local = localIds.get(record.transaction.id);
+    if (local) mappedIds.set(record.transaction.id, local.transaction.id);
+  }
   const keepDiffers = canonicalJSON(kept(ours.text)) !== canonicalJSON(kept(theirs.text));
-  let conflicted = keepDiffers && unseen.length > 0;
-  if (!conflicted && unseen.length && unseen.length !== incoming.length) conflicted = true; // partial receipt needs a common text merge
-  if (!conflicted) for (const record of unseen) {
-    const moved = [];
-    for (const splice of record.splices) {
-      let row = {...splice}; const nextAgainst = [];
-      for (const other of against) {
-        const next = over(row, other), otherNext = over(other, row);
-        if (!next || !otherNext) { conflicted = true; break; }
-        nextAgainst.push(otherNext); row = next;
-      }
-      if (conflicted) break;
-      moved.push(row); against = nextAgainst;
+  let conflicted = keepDiffers && unseen.length > 0, incomingSource = common.text;
+  if (!conflicted) for (const record of incoming) {
+    const beforeSource = incomingSource;
+    incomingSource = _rapierTransformSplices(incomingSource, record.splices);
+    if (incomingSource === null) return refused('history', 'record_transport_conflict');
+    if (imported.has(record.transaction.id)) {
+      const index = against.findIndex(row => row.transaction.id === record.transaction.id);
+      if (index < 0) return refused('identity', 'act_order_conflict', {actId: record.transaction.id});
+      const preceding = against.slice(0, index), competing = competingFields(record, preceding);
+      if (competing.length) return metadataConflict('metadata_assignment_conflict', {fields: competing});
+      unproved.delete(record.transaction.id);
+      against = against.filter(row => row.transaction.id !== record.transaction.id);
+      continue;
+    }
+    const competing = competingFields(record, against);
+    if (competing.length) return metadataConflict('metadata_assignment_conflict', {fields: competing});
+    const references = incomingEffects.references.get(record.transaction.id) || [];
+    const inverseIds = references.map(id => mappedIds.get(id));
+    if (inverseIds.some(id => !id || !_rapierHistoryEffects(records).active.has(id))) return metadataConflict('inverse_target_unavailable');
+    let moved;
+    try { moved = transposeAuthored(ours.ledger.start.text, records, {...record, authored: incomingOrigins.get(record.transaction.id)},
+      theirs.ledger.records.slice(0, theirs.ledger.records.indexOf(record)).map(row => row.transaction.id)); } catch (_) {}
+    if (!moved || moved.submittedBefore !== beforeSource || moved.submitted !== incomingSource ||
+      _rapierTransformSplices(text, moved.splices) === null) { conflicted = true; break; }
+    const effect = record.metadata ? Object.fromEntries(Object.entries(record.metadata).map(([key, pair]) =>
+      [key, {before: metadata[key], after: pair.after}])) : null;
+    const origin = record.authored ?? (against.length ? incomingOrigins.get(record.transaction.id) : null);
+    const mapped = append(moved.splices, record, effect, inverseIds, origin);
+    if (!mapped) return metadataConflict(inverseIds.length ? 'inverse_target_unavailable' : 'record_transport_conflict');
+    against = against.filter(row => row.transaction.id !== record.transaction.id);
+    mappedIds.set(record.transaction.id, mapped);
+  }
+  if (!conflicted) {
+    if (unproved.size) return refused('identity', 'act_order_conflict', {actId: unproved.values().next().value});
+    if (theirsContained) {
+      // Only equivalent proved states choose a representation, never competing authored values.
+      return settled(oursContained && theirs.ledger.sha256 < ours.ledger.sha256 ? theirs : ours);
+    }
+    if (oursContained) {
+      if (text !== theirs.text || canonicalJSON(metadata) !== canonicalJSON(theirs.metadata))
+        return refused('identity', 'act_order_conflict');
+      return settled(theirs);
     }
-    if (conflicted || _rapierTransformSplices(text, moved) === null) { conflicted = true; break; }
-    append(moved, record.transaction.actor, origin(record), record.transaction.operation, record.transaction.createdAt);
   }
   let conflicts = [];
   if (conflicted) {
+    if (unseen.length !== incoming.length) return refused('history', 'record_transport_conflict');
+    if (incomingFields.size || unseen.some(record => incomingEffects.references.get(record.transaction.id)?.length))
+      return metadataConflict('record_transport_conflict', {fields: [...incomingFields]});
     // Restart from the original local head: partially transported records never leak into a conflict result.
-    records.splice(ours.ledger.records.length); text = ours.text; root = ours.root;
+    records.splice(ours.ledger.records.length); text = ours.text; metadata = {...ours.metadata}; root = ours.root;
     const merged = mergeText(keepDiffers ? null : common.text, ours.text, theirs.text, {oursId: 'copy-' + ours.ledger.sha256.slice(0, 16), theirsId: 'copy-' + theirs.ledger.sha256.slice(0, 16)});
     conflicts = merged.conflicts;
-    if (merged.text !== text) append([{pos: 0, removed: text, inserted: merged.text}], {kind: 'system', id: 'merge'},
-      'ledger:' + theirs.ledger.sha256, 'document.merge', Math.max(0, ...incoming.map(record => record.transaction.createdAt)));
+    // Text equality cannot replace the unproved original acts with a clean receipt.
+    if (!conflicts.length) return refused('history', 'record_transport_conflict');
+    if (merged.text !== text) append([{pos: 0, removed: text, inserted: merged.text}], {transaction: {
+      id: mergeIdentity(ours.ledger.sha256, theirs.ledger.sha256), actor: {kind: 'system', id: 'merge'}, transport: 'platform', operation: 'document.merge', requestId: null,
+      affectedBlockIds: [], createdAt: null}});
   }
-  const ledger = exportLedger({text, records, documentAuthority: ours.ledger.documentAuthority, root,
+  const ledger = exportLedger({text, metadata, records, documentAuthority: ours.ledger.documentAuthority, root,
     revision: records.at(-1)?.transaction.revision ?? ours.revision, complete: ours.complete});
   const clean = !conflicts.length && !text.includes('<!-- note-conflict:v1 ');
-  return {text, ledger, clean, conflicts, review: {required: !clean, base: ours.text, proposed: text}};
+  return {text, metadata, ledger, clean, conflicts, review: {required: !clean, base: ours.text, proposed: text}};
 }