Module journal 

Bounded append-only record of published events, per view.

The entity cache is a latest-state projection: deep_merge_with_append folds each patch into the resident entity, so an intermediate occurrence is unrecoverable however large the cache is. Resuming a consumer therefore cannot be served from it — a replayable subscription needs the events themselves, kept in arrival order.

Cursors

Each view has its own dense monotonic offset, assigned here at append time. The wire _seq ({slot}:{slot_index:012}) is deliberately not used as the replay cursor: slot_index is txn_index for instruction updates, so every event decoded from one transaction shares it and “replay each occurrence exactly once” is not expressible. An append-assigned offset is unique and gap-free by construction.

A cursor is {epoch}:{offset}. The epoch identifies one tape lifetime. Offsets restart at zero whenever a tape is built without restoring one (snapshots disabled, a rejected or corrupt blob, any cold start), and dense offsets make a stale cursor indistinguishable from a live one — so without the epoch, a cursor from a previous lifetime would eventually land inside the new window and replay unrelated events as a continuation. The epoch makes that fail closed.

Offsets are per view and are not comparable across views.

Structs

Cursor

A cursor as it travels on the wire: {epoch}:{offset}.

EventJournal

Per-view append-only event log with bounded retention.

JournalConfig

Retention bounds for the event journal. Whichever bound bites first wins.

JournalEpoch

Identifies one tape lifetime, so a cursor minted by a previous one cannot be mistaken for a live offset.

JournalRecord

One published event, retained verbatim.

JournalSnapshot

The retained tape for every view, carried in the snapshot payload.

PersistedRecord

Durable form of one retained record.

PersistedViewJournal

ReplayWindow

The offsets a view can currently serve.

Enums

ReplayError

Why a replay could not be served.

Functions

mark_stream_gap

Called by the generated runtime when it starts the stream live over a hole, so a replay across that hole is refused instead of served as an unbroken continuation.