# ADR 012 — Active-Head Non-Destructive History **Status:** Accepted; implemented in M3 **Date:** 2026-09-03 ## Decision Where the story is being read and how much story is retained are **two separate facts**, stored separately and answered by different code. - The **active head** is a stored position — a branch and a depth on it. It is where the story currently ends as far as the reader, the narrator prompt, and every feature built on them are concerned. - The **retained tip** is the deepest node still kept on the same lineage. It may be ahead of the head. Undo and Redo move the active head. They delete nothing, restore nothing from a log, and recompute nothing. Every ordinary read of the story is bounded by the head; retained story beyond it stays live in the database, reachable by Redo, and available to a divergence. Concretely, and as implemented: 1. The active head is persisted on the campaign, not derived from the newest row. It is a decision, and no read may re-derive it. 2. Lineage resolution caps every entry at the head, in one place, so the transcript, the assembled context, take/parent resolution and memory retrieval narrow together and cannot disagree. 3. Reading past the head is possible through one narrow, named exception, and only two callers may use it: Redo, and the check that decides whether a write must fork. 4. The state belonging to a position is recorded on the node that produced it, so moving the head is a row lookup plus a restore — the same cost at any distance, in either direction. 5. Undo alone never forks. The **first write below a moved-back head** is the divergence: it creates a new continuation, and the displaced future stays where it was written, on the line it was written on. 6. Whether an ordinary Redo exists is decided by the lineage, not by a flag. After a divergence the displaced future is no longer on the lineage, so there is nothing ahead to walk into and no state to invalidate. 7. A branch the story has left records the depth it was left at and when, as metadata that **nothing reads to decide behavior**. It exists so a divergence is observable and so later cleanup and recovery features have something to select on. 8. Derived work — memories, summary coverage — is anchored to the node it came from and is therefore filtered by the same capped lineage. Undo prunes nothing; Redo re-derives nothing. 9. Export carries the active head, because it is a chosen position rather than a fact about the newest row. Import honors it. A file that predates the field is opened at its tip, which is the position such a file recorded. ## Context ADR 005 states the **product requirement**: returning to an earlier point preserves abandoned future history rather than erasing it, and the user sees Undo/Redo/Retry/Save Point rather than branch management. It names a movable active head as the implementation direction and stops there. This ADR records the **architecture selected to implement it**, as built and demonstrated in M3. It does not restate or revise ADR 005. The production base shipped a destructive Undo: it deleted the trailing turns, pruned the memories covering them, and let the tip fall back to whatever survived. That made the head a derived value, made Redo impossible, and — as Phase 0B found — let an export silently reopen an undone campaign at its newest retained turn. ## Alternatives Considered - **Keep the head derived and mark rows inactive.** Rejected: every read would need its own filter, and the filters would drift. Capping the lineage once is what makes the whole application agree about where the story ends. - **Rebuild state by replaying events from the opening.** Rejected: it makes the cost of Undo proportional to campaign length, and long campaigns are the case this product exists for. - **Fork on Undo rather than on the first write below the head.** Rejected: moving the head is not a decision to abandon anything — the user may be reading, or about to Redo — and forking on every Undo fills the branch table with branches nobody chose. Redo could not survive it. - **Decide Redo from a stored flag.** Rejected: a flag can be stale or hand-edited, and a wrong value would produce a wrong story. Deriving it from the lineage cannot. ## Reason The head is the smallest thing that can move. Making it a stored position rather than a derived one turns Undo from an operation that destroys accepted story into one that changes a coordinate, and everything else — Redo, divergence preserving the old future, memory isolation, an export that reopens where the user left it — follows from that single change rather than needing machinery of its own. ## Consequences - **Undo deletes zero accepted rows.** This is the invariant the architecture exists to hold, and it is asserted directly on row identity. - **Retained history accumulates.** v1 requires no automatic cleanup; the disposition metadata is what a later cleanup or recovery feature will select on. - **Any operation that changes what the story says at a position must ask whether story descends from that position and is off screen.** Switching the selected take and editing a turn's text in place both must refuse in that situation rather than act silently. See `STORY-BRANCH-SEMANTICS.md` §10 and §14A. - **Undo crosses fork points**, because a forked story includes the story it was forked out of and nothing is being deleted. The floor is the campaign opening. - **Save Points must reuse this mechanism.** A named save point is a durable coordinate; restoring one is head movement with a bounds check. Introducing a second restore path would reintroduce exactly the divergence this ADR removes. - **The narrative-state model must keep state efficiently recoverable at a position** — a per-node snapshot or an equivalent cache — or Undo, Redo and Save Point restore all become proportional to campaign length. This is a constraint on ADR 010's engine, not a reversal of it. - **Every feature that reads story must read it through the capped lineage.** Anything that queries rows directly will see retained history the story is not telling.