{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[9ecc4e2e] nice\n\nSide A — unified diff (full patch):\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex 5675dcd2e28062acbe3c037b94b77c33adf32474..a18241f3ed7b4a248748fcefc799f9801ca62461 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -936,7 +936,15 @@ pub async fn handle_rpc_batch(\n                 line_ok(RpcResult::ForumThreads(rpc_list_forum_threads(&reduced, &room)))\n             }\n             RpcCommand::RoomCreate { slug, visibility } => {\n-                match verify_bearer_principal(&headers, &*state.reduced.read().await) {\n+                // Scope the first read so its guard drops before any nested `read().await` / `write().await`.\n+                // A guard from `match verify(..., &*state.reduced.read().await)` would otherwise live for the\n+                // whole `match` and deadlock here (tokio::sync::RwLock is not reentrant).\n+                let principal = {\n+                    let reduced = state.reduced.read().await;\n+                    verify_bearer_principal(&headers, &*reduced)\n+                };\n+                match principal {\n+                    Err((_, m)) => line_err(m, None),\n                     Ok(principal) => {\n                         let slug = slug.trim().to_lowercase();\n                         if slug.is_empty() || slug.len() > 64 {\n@@ -994,7 +1002,6 @@ pub async fn handle_rpc_batch(\n                             }\n                         }\n                     }\n-                    Err((_, m)) => line_err(m, None),\n                 }\n             }\n             RpcCommand::RoomGrant {\n@@ -1002,17 +1009,28 @@ pub async fn handle_rpc_batch(\n                 username,\n                 capability,\n             } => {\n-                match verify_bearer_principal(&headers, &*state.reduced.read().await) {\n+                let principal = {\n+                    let reduced = state.reduced.read().await;\n+                    verify_bearer_principal(&headers, &*reduced)\n+                };\n+                match principal {\n                     Err((_, m)) => line_err(m, None),\n                     Ok(principal) => {\n-                        let reduced = state.reduced.read().await;\n-                        if !reduced.user_has_cap(&room, &principal, ThreadCapability::Manage) {\n+                        let can_manage = {\n+                            let reduced = state.reduced.read().await;\n+                            reduced.user_has_cap(&room, &principal, ThreadCapability::Manage)\n+                        };\n+                        if !can_manage {\n                             line_err(\"requires Manage capability\", None)\n                         } else {\n                             match parse_username(&username) {\n                                 Err(msg) => line_err(\"invalid username\", Some(msg)),\n                                 Ok(target) => {\n-                                    if !reduced.users_by_provider.values().any(|u| u == &target) {\n+                                    let user_exists = {\n+                                        let reduced = state.reduced.read().await;\n+                                        reduced.users_by_provider.values().any(|u| u == &target)\n+                                    };\n+                                    if !user_exists {\n                                         line_err(format!(\"user @{target} not found\"), None)\n                                     } else {\n                                         match parse_capability(&capability) {\ndiff --git a/server/tests/integration.rs b/server/tests/integration.rs\nindex 9162bd5bee84035e3908bfb9c8e201b7878ca339..b930120da09fe7d307f0411b84fb639fb8bd0b15 100644\n--- a/server/tests/integration.rs\n+++ b/server/tests/integration.rs\n@@ -95,6 +95,23 @@ async fn test_healthz() {\n     assert_eq!(response.text().await.unwrap(), \"ok\");\n }\n \n+#[tokio::test]\n+async fn test_room_create_private_rpc() {\n+    let (addr, _tmp, _log, _handle) = create_test_server().await;\n+    let client = reqwest::Client::new();\n+    let batch = serde_json::json!([{\n+        \"RoomCreate\": { \"slug\": \"secret-project\", \"visibility\": \"private\" }\n+    }]);\n+    let body = rpc_batch(&client, addr, Some(&test_bearer()), batch).await;\n+    let line = &body[\"results\"][0];\n+    assert_eq!(line[\"ok\"], true, \"room create: {:?}\", line);\n+    let room_id = line[\"result\"][\"RoomCreated\"][\"room_id\"].as_str().unwrap();\n+    assert!(\n+        room_id.contains(\"/secret-project\"),\n+        \"expected room_id to contain slug, got {room_id}\"\n+    );\n+}\n+\n #[tokio::test]\n async fn test_index_page() {\n     // HTML routes are offline during the auth-v3 refactor.\ndiff --git a/test/auth.bb b/test/auth.bb\nindex 611e04f1806ef81d678a91f499597fe55f691dd7..a67cc1de763434176d2f68e419dd37a8cd328395 100644\n--- a/test/auth.bb\n+++ b/test/auth.bb\n@@ -176,7 +176,7 @@\n          (assert! (= 200 (:status poll)) \"pending-session poll returns 200\")\n          (let [poll-json (json/parse-string (:body poll) true)]\n            (assert! (:complete poll-json) \"pending session complete=true\")\n-           (assert! (= \"@bbuser\" (:user poll-json)) \"poll returns @bbuser\")\n+           (assert! (= \"bbuser\" (:user poll-json)) \"poll returns stored username bbuser\")\n            (assert! (clojure.string/starts-with? (:token poll-json) \"slug_\") \"poll returns bearer token\")\n \n            (println \"\\nwhoami…\")\n@@ -184,7 +184,7 @@\n                                :headers {\"Authorization\" (str \"Bearer \" (:token poll-json))})]\n              (assert! (= 200 (:status who)) \"whoami returns 200\")\n              (let [who-json (json/parse-string (:body who) true)]\n-               (assert! (= \"@bbuser\" (:user who-json)) \"whoami user is @bbuser\"))))))\n+               (assert! (= \"bbuser\" (:user who-json)) \"whoami user is bbuser (stored form)\"))))))\n \n      (println \"\\nCLI: identity start → OAuth → identity poll → whoami…\")\n      (let [cli-home (str tmp-dir \"/cli-home\")\n@@ -208,7 +208,7 @@\n                       (str \"identity poll exits 0 (stderr: \" (:err poll-proc) \")\"))\n              (let [poll-cli (json/parse-string (:out poll-proc) true)]\n                (assert! (= \"complete\" (:phase poll-cli)) \"identity poll --json phase\")\n-               (assert! (= \"@cliuser\" (:user poll-cli)) \"CLI poll user\")\n+               (assert! (= \"cliuser\" (:user poll-cli)) \"CLI poll user (stored form)\")\n                (assert! (clojure.string/starts-with? (:token poll-cli) \"slug_\") \"CLI poll token\")\n                (let [token-path (str cli-home \"/.config/slugsocial/token\")]\n                  (assert! (fs/exists? token-path) \"token written under isolated HOME\")\n@@ -219,7 +219,7 @@\n                  (assert! (zero? (:exit who-proc))\n                           (str \"whoami exits 0 (stderr: \" (:err who-proc) \")\"))\n                  (let [who-cli (json/parse-string (:out who-proc) true)]\n-                   (assert! (= \"@cliuser\" (:user who-cli)) \"CLI whoami uses saved token\"))))))))\n+                   (assert! (= \"cliuser\" (:user who-cli)) \"CLI whoami uses saved token\"))))))))\n \n      (finally\n        (when-some [s @!server] (common/kill-server s))\ndiff --git a/test/common.bb b/test/common.bb\nindex ebb16c615a8b40e8830b5d5765d1e935a45538d0..4ed450377cdbb020f5ff164a812dfbbfc23c0f47 100644\n--- a/test/common.bb\n+++ b/test/common.bb\n@@ -78,9 +78,20 @@\n \n (defn start-server\n   \"Start the slugsocial-server binary with the given env map.\n-   Returns the babashka.process map.\"\n-  [server-bin env-map]\n-  (p/process [server-bin] {:out :inherit :err :inherit :env env-map}))\n+   Returns the babashka.process map.\n+\n+   When `log-file` (string path) is provided, stdout and stderr are appended there\n+   instead of inheriting the parent descriptors. Inheriting shared pipes while the\n+   parent blocks on HTTP I/O can fill the pipe buffer and deadlock the server on log writes.\"\n+  ([server-bin env-map]\n+   (start-server server-bin env-map nil))\n+  ([server-bin env-map log-file]\n+   (p/process [server-bin]\n+              (if log-file\n+                ;; Two string paths (same file): babashka.process can deref the process cleanly.\n+                ;; :err :out + ProcessBuilder$Redirect breaks stream copying in deref/kill-server.\n+                {:env env-map :out log-file :err log-file}\n+                {:out :inherit :err :inherit :env env-map}))))\n \n (defn kill-server\n   \"Forcibly kill a server process (babashka.process map) and wait for it to exit.\"\ndiff --git a/test/grants.bb b/test/grants.bb\nindex 7066c1f2a57f39a362052f8524206dccf37bb7b1..793ba216f2de76a77eb20a76d08403db07ff411b 100644\n--- a/test/grants.bb\n+++ b/test/grants.bb\n@@ -35,13 +35,14 @@\n (defn- http-client []\n   (-> (java.net.http.HttpClient/newBuilder)\n       (.followRedirects java.net.http.HttpClient$Redirect/ALWAYS)\n+      (.connectTimeout (java.time.Duration/ofSeconds 15))\n       (.build)))\n \n (defn- http-get [url & {:keys [headers]}]\n   (let [b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]\n     (doseq [[k v] (or headers {})]\n       (.header b k v))\n-    (let [req (-> b (.GET) (.build))\n+    (let [req (-> b (.timeout (java.time.Duration/ofSeconds 60)) (.GET) (.build))\n           resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]\n       {:status (.statusCode resp) :body (.body resp)})))\n \n@@ -52,6 +53,7 @@\n     (doseq [[k v] (or headers {})]\n       (.header b k v))\n     (let [req (-> b\n+                  (.timeout (java.time.Duration/ofSeconds 60))\n                   (.POST (java.net.http.HttpRequest$BodyPublishers/ofString body))\n                   (.build))\n           resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]\n@@ -67,6 +69,7 @@\n         b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]\n     (.header b \"Content-Type\" \"application/x-www-form-urlencoded\")\n     (let [req (-> b\n+                  (.timeout (java.time.Duration/ofSeconds 60))\n                   (.POST (java.net.http.HttpRequest$BodyPublishers/ofString pairs))\n                   (.build))\n           resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[a2a83d76] plan\n\nSide B — unified diff (full patch):\ndiff --git a/PLAN.md b/PLAN.md\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..38291545caebde2632e3fe409ea54c63abc30f5a\n--- /dev/null\n+++ b/PLAN.md\n@@ -0,0 +1,337 @@\n+# sorter2 storage & memory plan\n+\n+## Goal\n+\n+Fit a **decent chunk of Reddit** into a **256MB** Fly VM while keeping the product simple: one Rust binary, no external database service.\n+\n+**RAM should be bounded by query shape**, not dataset size — ideally one rank-centrality graph in memory at a time, plus runtime overhead.\n+\n+**`events.jsonl` remains the main database.** Everything on disk elsewhere is a **rebuildable projection**.\n+\n+---\n+\n+## Architecture (target)\n+\n+```\n+                    ┌─────────────────────────────────┐\n+                    │  events.jsonl (source of truth) │\n+                    └───────────────┬─────────────────┘\n+                                    │\n+                         append on every mutation\n+                                    │\n+                                    ▼\n+         ┌──────────────────────────────────────────────┐\n+         │  apply event → durable projection (on disk)     │\n+         │  (same semantics as today's in-memory reducer)  │\n+         └──────────────────────────────────────────────┘\n+                    │                    │\n+                    ▼                    ▼\n+         ┌──────────────────┐   ┌──────────────────────────┐\n+         │ entity_payloads  │   │ reducer state per scope   │\n+         │ (fat Reddit JSON)│   │ nodes, children, edges, … │\n+         └──────────────────┘   └──────────────────────────┘\n+                    │                    │\n+                    └────────┬───────────┘\n+                             ▼\n+         ┌──────────────────────────────────────────────┐\n+         │  RAM per request (or small LRU cache)         │\n+         │  • one scope's GroupState for rank-centrality │\n+         │  • children + EntityData (small views)        │\n+         │  • RC scratch allocations                     │\n+         │  → compute → render → drop / evict            │\n+         └──────────────────────────────────────────────┘\n+```\n+\n+This is **event sourcing / CQRS**:\n+\n+| Layer | Role |\n+|-------|------|\n+| **JSONL** | Canonical write log; audit; disaster recovery |\n+| **Durable (RocksDB)** | Materialized read model + payload store; rebuildable from JSONL |\n+| **RAM** | One (or few) hot scopes for ranking and render |\n+\n+Durable is **not** a second source of truth. If projection and log diverge, **stream JSONL and rebuild durable**.\n+\n+---\n+\n+## What we have today (baseline)\n+\n+| Piece | Status |\n+|-------|--------|\n+| `events.jsonl` append-only log | ✓ source of truth |\n+| `EventLog::replay` streaming one event at a time | ✓ no full `Vec<Event>` at startup |\n+| `entity_store` / `entity_db` (RocksDB via `durable`) | ✓ fat payloads off-heap |\n+| `EntityData` in `GlobalTree` | ✓ small derived views in RAM |\n+| Full `GlobalTree` replayed at boot | ✗ all nodes, all scopes' `GroupState` in RAM |\n+| Rank-centrality | ✓ already scoped per parent; reads in-memory `GroupState` |\n+\n+**Measured RSS (release, ~395 imports, 2.8MB JSONL):**\n+\n+| Scenario | RSS |\n+|----------|-----|\n+| Empty data dir | ~14 MB (+ RocksDB baseline) |\n+| After boot with data | ~21–22 MB |\n+| Pre-offload (in-tree payloads + vec replay) | ~25–34 MB |\n+\n+Payload offload + streaming replay helped startup peak, but **the full in-memory reducer** is still the scaling ceiling.\n+\n+---\n+\n+## What lives where (target)\n+\n+### JSONL (`events.jsonl`)\n+\n+All mutations, append-only:\n+\n+- `VoteRecorded` — scope, pair, ratios\n+- `EntityImported` — id, full upstream payload\n+- `NodeEnsured` — register path\n+- (legacy / other event types as present in log)\n+\n+### Durable / RocksDB (`{data_dir}/…`)\n+\n+Single embedded DB directory. Collections (names tentative):\n+\n+| Collection | Contents | Notes |\n+|------------|----------|-------|\n+| `entity_payloads` | `ItemId → JSON string` | **Done.** Fat Reddit API blobs |\n+| `nodes` | `ItemId → { data: EntityData, children: … }` | Small; no raw payload |\n+| `scopes/{parent}/…` | `GroupState` materialization | edges, voted_pairs, item_to_idx, recent_votes (capped) |\n+\n+Nested layout can follow durable's `Map → Map → Vec` patterns (see `durable/docs/001.md` Sorter sketch).\n+\n+### RAM\n+\n+| Resident | When |\n+|----------|------|\n+| Tokio, Axum, reqwest, RocksDB block cache (tuned) | always |\n+| **One scope slice** | per request (or LRU of few scopes, byte-capped) |\n+| Rank-centrality temporaries | during render for that scope |\n+\n+**Not** in RAM at steady state: all subreddits, all vote graphs, all payloads.\n+\n+---\n+\n+## Write path\n+\n+Order matters:\n+\n+1. Append event to `events.jsonl` (must durably succeed first)\n+2. Apply event to durable projection (same logic as today's `apply_event`)\n+3. Invalidate / update in-memory scope cache if that scope is hot\n+\n+Journal worker already serializes votes disk → tree; extend to **disk → durable** instead of (eventually) **disk → full GlobalTree**.\n+\n+```rust\n+// conceptual\n+append(jsonl, event)?;\n+apply_to_durable(event)?;\n+scope_cache.invalidate(scope_for(event));\n+```\n+\n+On failure after (1): replay from log repairs projection on next boot or via `replay-index` command.\n+\n+---\n+\n+## Read path\n+\n+For a page under parent scope `P` (e.g. `reddit.com/r/rust`):\n+\n+1. **Load scope** from durable (or scope LRU hit)\n+   - `EntityData` + children for listing\n+   - `GroupState` for ranking and pair selection\n+2. **Run rank-centrality** on that `GroupState` (requires RAM — that's fine)\n+3. **Render**\n+4. **Drop** scope from RAM or return to LRU\n+\n+Payload fetch (rare): `entity_store.get(id)` only when render needs fields not in `EntityData`.\n+\n+---\n+\n+## Startup & recovery\n+\n+### Normal startup\n+\n+```\n+open entity_db (RocksDB)\n+open / validate scope indexes in same DB\n+do NOT replay JSONL into RAM\n+serve requests (cold scopes loaded on demand)\n+```\n+\n+### Rebuild projection\n+\n+```\n+stream events.jsonl → apply_event → durable\n+(one line at a time; same as EventLog::replay today)\n+```\n+\n+Run when:\n+\n+- First deploy of projection layer\n+- Detected corruption / missing durable dir\n+- Manual `replay-index` after restoring JSONL from backup\n+\n+JSONL is the only file you need to trust for recovery.\n+\n+---\n+\n+## Scope cache (RAM bound)\n+\n+**Strict mode:** one scope in RAM at a time — simplest, lowest RAM.\n+\n+**Practical mode:** LRU cache with **byte budget** (e.g. 64–128MB for scopes on a 256MB VM):\n+\n+- Evict least-recently-used scope's `GroupState` + child views\n+- Reload from durable on next visit\n+\n+Eviction policy is independent of storage engine.\n+\n+---\n+\n+## Rank-centrality\n+\n+No change to the algorithm. It already assumes a whole `GroupState` for one parent scope.\n+\n+Moving reducer to durable does **not** remove RC memory cost — it removes **holding every scope's graph at once**.\n+\n+Optional later: materialized score vectors on disk, invalidated on vote. Not required for v1 of this plan.\n+\n+---\n+\n+## Durable mutations (future API)\n+\n+Separate **intent** from **apply** for batching and testability:\n+\n+```rust\n+let m = rankings.path().key(\"rust\").key(day).push_end(score);\n+db.apply(m)?;  // or batch.apply(&[m1, m2, m3])\n+```\n+\n+Benefits:\n+\n+- One RocksDB `WriteBatch` / one WAL flush per vote or import batch\n+- Serializable ops for tests\n+- Aligns with JSONL events at the app layer and storage ops at the durable layer\n+\n+Keep chained `entry().push()` as sugar over `path().…; apply()`.\n+\n+Type safety: use type-state path builders if we want compile-time nesting; erased `Vec<Op>` only if we accept runtime errors at apply.\n+\n+---\n+\n+## Storage engine: RocksDB vs alternatives\n+\n+**Current choice:** RocksDB via vendored `durable/` workspace crate.\n+\n+| Engine | Verdict for sorter2 |\n+|--------|---------------------|\n+| **RocksDB** | Good default for LSM, prefix scans, write-heavy votes + bulk imports. C++ dep, tune block cache for 256MB. |\n+| **sled** | Pure Rust appeal; production reliability history gives pause. Not a priority switch. |\n+| **fjall** | Pure Rust LSM; evaluate with benchmarks if leaving RocksDB. |\n+| **redb** | Lighter pure Rust; fine for payload-only store; less ideal for heavy scattered writes across scopes. |\n+| **SQLite** | Wrong shape for nested fractal tree; OK for a single KV table only. |\n+\n+**Switching engines matters less than:**\n+\n+1. Batched durable writes\n+2. Not materializing full reducer in RAM\n+3. Scope-local load/evict\n+\n+RocksDB stays **narrow**: blob attic + materialized reducer projection. Not a replacement for JSONL.\n+\n+---\n+\n+## Scaling story (before vs after)\n+\n+| | In-memory reducer (today) | Target (JSONL + durable projection) |\n+|--|---------------------------|-------------------------------------|\n+| **RAM grows with** | Total nodes + all scopes + (was) payloads | Hot scope count × scope size + runtime |\n+| **Disk grows with** | JSONL (+ entity_db payloads today) | JSONL + full durable projection |\n+| **Startup** | O(events) replay into RAM | O(1) open DB |\n+| **Fails when** | RSS > VM limit | Scope too large for one RC graph, or disk full |\n+| **Recovery** | Replay JSONL | Replay JSONL → rebuild durable |\n+\n+**Rough RAM per active subreddit (~500 posts, moderate votes):**\n+\n+| Component | Order of magnitude |\n+|-----------|-------------------|\n+| `EntityData` × 500 | 0.5–2 MB |\n+| `GroupState` | 1–5 MB |\n+| RC scratch | 1–5 MB |\n+| Runtime + tuned RocksDB | 15–25 MB |\n+| **Total one hot scope** | **~20–40 MB** |\n+\n+Multiple subreddits fit on 256MB with LRU eviction, not all resident at once.\n+\n+---\n+\n+## Implementation phases\n+\n+### Phase 0 — Done\n+\n+- [x] Vend `durable` as workspace crate (`durable/`)\n+- [x] `entity_store`: payloads in `{data_dir}/entity_db`\n+- [x] Remove `entity_raw` from `NodeState`\n+- [x] `EventLog::replay`: stream JSONL, one `Event` at a time\n+- [x] `apply_event` in `state.rs` for replay semantics\n+\n+### Phase 1 — Durable projection (write path)\n+\n+- [ ] Single `Db` under `{data_dir}/store` (payloads + reducer)\n+- [ ] `apply_event` writes to durable collections (nodes, scopes) in addition to or instead of `GlobalTree`\n+- [ ] Journal + Reddit import paths use same apply\n+- [ ] Batched writes where possible (one flush per vote / per import batch)\n+- [ ] Tests: apply event → read back from durable\n+\n+### Phase 2 — Stop full tree at boot\n+\n+- [ ] Startup: open durable only; no `GlobalTree::new()` + full replay into RAM\n+- [ ] `replay-index` command / flag: stream JSONL → durable (offline rebuild)\n+- [ ] Integration tests use replay-index fixture or temp DB\n+\n+### Phase 3 — Scope load on read\n+\n+- [ ] `ScopeView { parent, children, group }` loaded from durable\n+- [ ] HTML / vote / pair / fetch handlers take `ScopeView` instead of `&GlobalTree`\n+- [ ] Remove or shrink `Arc<RwLock<GlobalTree>>`\n+\n+### Phase 4 — Scope cache\n+\n+- [ ] LRU with byte budget for hot scopes\n+- [ ] Invalidate on write to that scope\n+- [ ] Metrics: cache hit/miss, evictions, scope load time\n+\n+### Phase 5 — Durable API polish (optional)\n+\n+- [ ] Reified path/mutation API + `WriteBatch` integration in `durable`\n+- [ ] RocksDB tuning preset for 256MB Fly (`block_cache`, write buffers)\n+- [ ] Document `replay-index` in AGENTS.md\n+\n+---\n+\n+## Non-goals (for now)\n+\n+- Distributed replication or multi-writer\n+- Replacing JSONL as canonical store\n+- SQL query layer over state\n+- Materialized rank scores on disk (unless RC latency forces it)\n+- Switching from RocksDB to sled without benchmarks\n+\n+---\n+\n+## Open questions\n+\n+1. **One DB or two?** `{data_dir}/entity_db` today vs single `{data_dir}/store` — merge on Phase 1?\n+2. **Scope key encoding** — string `ItemId` paths vs hashed; must match event `scope` field.\n+3. **Child scope wiring** — Reddit `apply_entity_under_parent` creates children without full path ensure; durable schema must preserve this.\n+4. **Clojure smoke tests** — still read `events.jsonl`; durable is internal. No change expected.\n+5. **Fly volume** — `/data` holds JSONL + RocksDB; monitor disk alongside RAM.\n+\n+---\n+\n+## Summary\n+\n+**JSONL = write log. Durable = full reducer on disk + fat payloads. RAM = one rank-centrality graph (or a small LRU of scopes).**\n+\n+Option B from design discussions is not separate from “reducer in durable” — it **is** reducer in durable, with JSONL still owning writes and recovery. The incremental work is: projection on apply, drop full tree at boot, scope load on read, then cache with eviction.\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}