#[repr(u16)]pub enum Kind {
Show 15 variants
Pack = 1,
Refs = 2,
ControlBlob = 3,
ControlDoc = 4,
Secret = 5,
LfsPut = 6,
LfsDelete = 7,
RepoStore = 8,
Kek = 9,
Append = 10,
File = 11,
SnapshotAt = 12,
Redacted = 13,
Erase = 14,
Activity = 15,
}Expand description
The kinds of transaction, one per mutation seam. The number is the wire and disk value; never renumber, only add.
Variants§
Pack = 1
A pack landed in a repository: blob = the pack bytes as the client
sent them. Meta: Meta::Pack.
Refs = 2
One or more reference edits in a repository, every ref kind — heads,
tags, notes, remotes, salvage, superseded, and HEAD. No blob.
Meta: Meta::Refs.
ControlBlob = 3
A content-addressed blob of the control store (a document shard or a document root). Blob = the bytes; meta carries the sha-256 id.
ControlDoc = 4
A control-store document pointer moved (commit_doc): the catalog
(repositories, visibility, tombstones), the identity table
(principals, keys, grants, tokens, memberships, gates), PKI, mirrors,
flow, pulls, policy, entitlements. No blob; the bytes arrived as
Kind::ControlBlob entries before it.
Secret = 5
A sealed secret was written or tombstoned. Blob = the sealed bytes exactly as the secret store holds them (sealed with the box’s KEK).
LfsPut = 6
An LFS object landed. Blob = the object bytes. Meta: Meta::Lfs.
LfsDelete = 7
An LFS object was removed. No blob.
RepoStore = 8
A repository’s object store was created or purged on disk (the
catalog row is a ControlDoc; this is the store beside it).
Kek = 9
The box’s key-encrypting key — the first frame of a primary’s log,
so a restore into a fresh box can read every Secret frame after it.
Blob = the 32 KEK bytes exactly as secrets.kek holds them. The twin
holds it: a twin that held every sealed secret and not the key would be
a backup of nothing.
Append = 10
One line appended to an append-only signed log under the data root
(attestations, transparency heads, forge events, build records,
membership). Blob = the line without its newline. Meta: Meta::Append.
File = 11
A whole document under the data root replaced or removed
(replication.json, webhooks.json). Blob = the bytes. Meta: Meta::File.
SnapshotAt = 12
Never in a log: the terminator of a twin SNAPSHOT stream
(Mirror.SnapshotFetch, Bootstrap.Restore). Every item before it is an
entry of the kinds above with seq 0; this one says at which sequence the
state they carry was taken. Meta: Meta::SnapshotAt.
Redacted = 13
A frame whose content was ERASED in place (Log::erase): it was a
Pack, Refs, LfsPut or LfsDelete of a repository whose account was
deleted. The meta is the original one (it still names the repository);
the blob reads as empty and its bytes are gone from the file. Never
appended — only ever written over a frame that is already there, so the
sequence, the offsets and the twin’s gap rule stay exactly as they were.
Applying one does nothing: the data it carried is what was deleted.
Erase = 14
An account’s data was deleted (owner ruling g-nonpay, 2026-09-29):
every frame BEFORE this one of the repositories it names is erased
(Log::erase) — on the primary when it appends it, on the twin when it
stores it, on a box being restored when it replays it. No blob.
Meta: Meta::Erase.
Activity = 15
Last-seen stamps (owner, 2026-10-21): the principals whose last
sign-in or last operation moved since the previous flush, ONE frame per
flush (crate::activity). Blob = JSON, principal id → stamps. Applied
on the twin into the same control-database table; a snapshot carries
the whole table as one item of this kind. Meta: Meta::Activity.