Module journal 

Transactional fact-create outbox for device-primary replication.

V37 journal rows are retained as legacy_unverified. V38 introduces an explicit stream epoch, transaction-owned sequence/head state, and a domain-separated digest chain. Only exact typed payload bytes are canonical; derived embeddings and indexes are rebuilt by the replica.

Structs

ExportedBatch

Legacy shape retained for current callers. It exports only verified epoch-1 records and does not hide corruption as successful completion.

FactCreatePayloadV1

Canonical fact-create authority payload. Field order is fixed by this struct.

FactCreateReplicaEnvelopeV1

Closed receiver-side representation of one verified fact-create record.

JournalEntry

A verified outbox entry. V37 rows can still be inspected directly in SQLite but are never returned by the verified export API.

VerifiedExportBatch

Enums

ExportStatus

ReplayOutcome

Compatibility-only replay result. New remote admission must use the closed typed fact-create dispatcher, not this closure-based adapter.

ReplicaApplyOutcome

Durable receiver decision for a fact-create record.

Constants

FACT_CREATE_OPERATION

FACT_CREATE_PAYLOAD_SCHEMA

GENESIS_PREDECESSOR

LEGACY_RECORD_STATE

MIGRATION_V37

V37 migration retained for compatibility. These rows have no cryptographic chain and become explicitly legacy_unverified under V38.

MIGRATION_V38

V38 verified stream state. SQLite ALTER defaults are literal constants so existing V37 databases migrate without fabricating verified metadata.

MIGRATION_V39

V39 receiver-side stream, inbox, and durable ACK projection.

VERIFIED_RECORD_STATE

Functions

append_journal_entryDeprecated

Compatibility helper for fact-create tests and offline tools. It owns a transaction and therefore remains atomic, but callers should use the real MemoryStore fact mutation path instead.

append_verified_in_tx

Append a verified record while the caller’s semantic mutation transaction is active. The stream row is the allocator; no sequence is derived from journal contents.

digest_fields

Domain-separated SHA-256 over length-prefixed exact fields.

encode_fact_create_payload

envelope_digest

export_contiguousDeprecated

export_verified_contiguous

Export and verify a contiguous prefix. Legacy V37 rows are never promoted into this API and any stored digest/chain mismatch is typed as corruption.

mutate_and_journalDeprecated

Compatibility mutation wrapper. The semantic mutation and outbox record are committed together, and a failed closure consumes no sequence.

next_expected_sequenceDeprecated

next_expected_sequence_for_epoch

payload_digest

replay_journal_entryDeprecated

validate_fact_create_replica_envelope

Validate a receiver envelope and decode its strict canonical payload.