Goal
Expose a bounded, deterministic, restart-safe receipt-history projection that applications can use to derive navigation such as undo/redo from Echo causal history without process-owned receipt indexes.
Required API shape
An application requests a page at an explicit worldline basis and receives canonical receipt entries ordered by causal coordinate. Each entry must expose enough retained identity to classify application transitions without interpreting domain bytes inside Echo:
- exact
CausalTickReceiptRef;
- witnessed submission id;
- retained contract evidence identity and operation kind/id when present;
- canonical causal parent receipt set;
- optional typed
ContractInverseDerivation;
- deterministic continuation cursor for bounded pagination.
The request must name:
- worldline id;
- observed frontier/basis;
- page direction or before/after coordinate;
- explicit result budget.
Acceptance criteria
- A fresh host can page edit, inverse, and inverse-of-inverse receipts after filesystem WAL recovery.
- The projection is identical before and after restart.
- Inverse entries expose their exact target and current admission basis through retained typed relations.
- Ordinary entries are distinguishable from inverse entries without a process request-to-receipt map.
- Missing basis, retention gaps, malformed witnessed ingress, and stale or invalid continuation coordinates return typed obstructions.
- Ordering is deterministic and independent of insertion order, host process lifetime, and cache state.
- Pagination neither skips nor duplicates receipts.
- Any in-memory index used to answer the query is disposable and rebuilt from WAL/WSC evidence.
- The app-facing surface exposes no scheduler, staging, WAL append, or mutation authority.
Non-goals
- Echo does not choose application undo policy.
- Echo does not call cursor movement, view state, or Vim key chords text mutations.
- Echo does not delete or rewrite prior receipts.
- Echo does not expose an unbounded “load all history” default.
- Echo does not require applications to retain full materialized snapshots.
Dependencies
Why
A durable inverse-admission API is insufficient if an application must already know the target receipt id from process memory. Applications need a bounded observer projection over retained causal receipt evidence so restart-safe undo/redo can be derived from Echo history rather than reconstructed from local stacks or maps.
Goal
Expose a bounded, deterministic, restart-safe receipt-history projection that applications can use to derive navigation such as undo/redo from Echo causal history without process-owned receipt indexes.
Required API shape
An application requests a page at an explicit worldline basis and receives canonical receipt entries ordered by causal coordinate. Each entry must expose enough retained identity to classify application transitions without interpreting domain bytes inside Echo:
CausalTickReceiptRef;ContractInverseDerivation;The request must name:
Acceptance criteria
Non-goals
Dependencies
Why
A durable inverse-admission API is insufficient if an application must already know the target receipt id from process memory. Applications need a bounded observer projection over retained causal receipt evidence so restart-safe undo/redo can be derived from Echo history rather than reconstructed from local stacks or maps.