timeline: journal-durable CreateAsset/RemoveAsset commands

[shipyard-local]

What

Adds a journal-durable CreateAsset command (with its RemoveAsset inverse) to the timeline command vocabulary — the foundational slice of Phase-2R item #4 (the journal survives recording). Independent of Phase-2 playback/delivery: pure core/timeline model + journal, built on current main.

Until now assets could only enter a document at construction / deserialize via ProjectInput.assets; there was no asset-mutating command, so a recording or import could not be captured as a replayable journal entry.

The sealed-content / determinism contract

• CreateAsset carries the whole MediaAsset by value, including the ContentHash that is the asset's durable identity (assets.hpp: "SHA-256 is the durable identity of media bytes; paths must never participate in identity").
• The reducer plans the ItemKind::Asset identity exactly like a clip insert (plan_identity_insert) and appends the sealed asset by reference to its hash via Project::append_asset.
• Replay never re-captures or re-hashes media bytes — the same checkpoint + journal reproduce a byte-identical asset table. Proven by a test that serializes the committed vs replayed documents and asserts the canonical JSON is identical.
• Journal replay already passes allow_tombstone_restore = (entry.kind == History) and asserts the replayed dirty set matches the recorded one; the new commands' deterministic dirty items satisfy that.

Shape (clean extension, not a break)

CreateAsset/RemoveAsset are the asset-table mirror of InsertClip/RemoveClip, preserving the §1 determinism contract and the reducer's one-inverse-per-command invariant:

• RemoveAsset fails closed while any clip's MediaRef still references the asset, tombstones the identity like a clip removal, and its inverse re-creates the sealed asset — undo/redo stays whole.
• Asset validation and identity-mutation application are factored into shared model.cpp helpers so construction, sequence replacement, and asset mutation enforce one sealed-identity and one identity-transition path.
• An invalid/empty ContentHash is rejected before the asset can enter the document.

Tests (ship with the fix)

• Reducer append preserves content_hash and consumes one id.
• Journal replay determinism — committed vs replayed serialize byte-identically.
• Created asset round-trips through the project schema (serialize → deserialize).
• Undo/redo cycles a create through its RemoveAsset inverse (tombstone → reactivate).
• Negative/defensive: duplicate live id → IdentityNotAvailable; empty/invalid ContentHash → fail-closed InvalidContentHash; RemoveAsset of a referenced asset → fail-closed MissingAsset.

Validation

• Full cmake --build over all targets (incl. GPU): 0 errors (the Command variant grew by two alternatives).
• ctest -R "timeline|playback": 82/82 pass; the two touched suites add 4066 + 160 assertions.
• -fno-exceptions -fno-rtti timeline TU builds clean.
• gates.sh / docs-noise / skill-sync (timeline SKILL.md updated; web-plugins skip trailer) / version-bump (version-at-land) / planning-gitlink: all clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TVQHcnbg3t6TvXsdv6gXhS

---

🔎 Provenance

Agent	claude
Machine	m3
Tab	Timeline v3
Directory	/Volumes/Workshop/Code/pulp-journal2r
Session	c66f4a64-25ea-42e5-b184-d48611a066a2

Resume

claude --resume c66f4a64-25ea-42e5-b184-d48611a066a2

Jump to this tab

cmux surface focus C0B3DA54-39AF-4DAA-8089-AA08DAB71968

Relaunch (any agent)

cmux surface resume get --surface C0B3DA54-39AF-4DAA-8089-AA08DAB71968

Restore URL — https://claude.ai/code/session_01TVQHcnbg3t6TvXsdv6gXhS

_{stamped 2026-07-22 04:21 UTC}