Snapshots and branches

Explore independent branches while sharing unchanged state and preserving current authority.

The owner service exposes branches as a query on branch 1 with empty arguments. It returns numeric branch identities, parent identity, fork base head, creation sequence, current head, deleted state and record count. Entries are sorted by ID; main and deleted data ancestors remain visible, while internal/control branches are excluded. Positions and counts are canonical decimal strings. The result includes an observed sequence and the main snapshot in its view stamp.

The engine's branchInfos(allocator, maximum) returns an owned inventory, including tombstones, and rejects an oversized population before allocation. Database.branchInventory validates freshness and copies it under the publication mutex. The service captures inventory, main head and control authority under its admission gate. No borrowed map pointer escapes. The caller frees inventory bytes; reads do not alter durable state. Service enumeration allows at most 1024 engine slots and 1MiB response bytes, with deadline checks. It returns an explicit limit error instead of truncating.

Existing fork and drop commands retain their journal semantics. User branch IDs start at 3. Fork copies the source's retained data root at its expected head; subsequent writes are isolated. Drop tombstones the identity without deleting descendants, and IDs cannot be reused. Fork receipts belong to the target branch; drop receipts belong to the dropped branch. Original authenticated receipts replay before live-branch lookup, including after deletion and restart.

Tests use the real application/database to fork a child and grandchild, edit the child, drop the parent, reopen storage, inspect sorted lineage, read copied schemas and graph edges, and replay original receipts without mutation. Private branch requests, private targets, main drops, malformed arguments, stale heads and reused targets are rejected. Allocation-failure tests cover inventory and service response ownership. These checks do not establish native UI acceptance.

The separate catalog and pin components model names and exact (branch,head) root references. They are not an integrated atomic named catalog or durable historical merge-base store. Numeric inventory uses existing engine lineage; this packet changes no journal format. Compare/merge and full V04 acceptance remain outside this delivery.