the proposal board: a Space's pinned playlist takes signed proposals, and an accept republishes it

src-tauri/src/lib.rs

@@ -27,6 +27,7 @@ mod shazam;
 mod slsk_link;
 mod smtc;
 mod spaces;
+mod proposals;
 mod state;
 mod thumbbar;
 mod vocal_sep;
@@ -159,6 +160,9 @@ pub fn run() {
             spaces::space_remove_member,
             spaces::space_set_pinned,
             spaces::space_leave,
+            proposals::space_board,
+            proposals::space_propose,
+            proposals::space_decide,
             commands::buddy_list,
             commands::buddy_add,
             commands::buddy_remove,

src-tauri/src/playlists.rs

@@ -22,7 +22,7 @@ fn now_secs() -> i64 {
         .unwrap_or(0)
 }
 
-fn changed(app: &tauri::AppHandle) {
+pub(crate) fn changed(app: &tauri::AppHandle) {
     let _ = app.emit("soulseek:playlists-changed", ());
 }
 

src-tauri/src/proposals.rs

@@ -0,0 +1,646 @@
+//! The proposal board (F7 → the app). A Space's pinned playlist gets a
+//! multi-writer board beside it, keyed by (playlist owner, uuid). Members
+//! propose bounded edits — add, remove, move — against the EXACT revision
+//! they were looking at; the playlist's owner accepts or rejects, and every
+//! decision is a signed line in the audit trail. Accepting applies the ops
+//! to the owner's local playlist and publishes it as the next revision; the
+//! decision then names that revision's hash. The canonical playlist never
+//! lives in here.
+//!
+//! The roster is the Space's: when the playlist owner opens the board and
+//! the contributors differ from the Space's members, a new epoch is signed.
+//! Dropping a member is revocation — their pending proposals leave the board
+//! on every node, deterministically.
+//!
+//! The contract is a bundled commitment (`assets/proposal_contract.wasm`,
+//! built from crates/proposal-contract; its code hash is pinned by a test).
+
+use std::collections::{BTreeMap, BTreeSet, VecDeque};
+use std::path::PathBuf;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use freenet_adapter::FreenetAdapter;
+use library::{NewPlaylistItem, PlaylistItem};
+use persona_state::playlist as pl;
+use persona_state::proposals as pr;
+use serde::{Deserialize, Serialize};
+use tauri::Manager;
+
+use crate::persona;
+use crate::pipeline::LibraryState;
+use crate::playlists;
+use crate::shared_playlists::{self, Published};
+use crate::slsk_link;
+use crate::spaces;
+use crate::state::AppState;
+
+const BOARD_WASM: &[u8] = include_bytes!("../assets/proposal_contract.wasm");
+
+#[derive(Default, Clone, Serialize, Deserialize)]
+struct BoardRecord {
+    #[serde(default)]
+    last_epoch: u64,
+    #[serde(default)]
+    last_seq: u64,
+}
+
+#[derive(Default, Serialize, Deserialize)]
+struct Ledger {
+    #[serde(default)]
+    boards: BTreeMap<String, BoardRecord>,
+}
+
+// ---------------------------------------------------------------- views
+
+#[derive(Debug, Serialize)]
+pub struct BoardEntry {
+    pub entry_id: String,
+    pub position: u32,
+    pub title: String,
+    pub artist: String,
+    pub album: String,
+    pub duration_secs: Option<u32>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct OpView {
+    /// "add" | "remove" | "move"
+    pub kind: String,
+    pub position: Option<u32>,
+    pub entry_id: Option<String>,
+    pub title: String,
+    pub artist: String,
+    /// False when a remove/move names an entry the current revision no
+    /// longer has (a stale proposal).
+    pub known: bool,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ProposalView {
+    pub id: String,
+    pub author: String,
+    pub username: Option<String>,
+    pub is_me: bool,
+    pub created_at: u64,
+    pub note: String,
+    pub base: String,
+    /// Its base is not the current revision: the owner can only reject it
+    /// and ask for a re-submit.
+    pub stale: bool,
+    pub ops: Vec<OpView>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct DecisionView {
+    pub proposal_id: String,
+    pub accept: bool,
+    pub seq: u64,
+    pub reason: String,
+    pub result_hash: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ContributorView {
+    pub key: String,
+    pub username: Option<String>,
+    pub is_me: bool,
+}
+
+#[derive(Debug, Serialize)]
+pub struct BoardView {
+    pub owner: String,
+    pub uuid: String,
+    pub name: String,
+    pub revision_seq: u64,
+    /// The current revision's content hash (b58) — what a proposal binds to.
+    pub base: String,
+    pub withdrawn: bool,
+    pub entries: Vec<BoardEntry>,
+    /// The board contract exists on the network.
+    pub reachable: bool,
+    pub epoch: u64,
+    pub contributors: Vec<ContributorView>,
+    pub i_am_owner: bool,
+    pub can_propose: bool,
+    pub proposals: Vec<ProposalView>,
+    /// Newest first.
+    pub decisions: Vec<DecisionView>,
+    pub pending_mine: u32,
+}
+
+/// One op as the composer sends it.
+#[derive(Debug, Deserialize)]
+#[serde(tag = "kind", rename_all = "lowercase")]
+pub enum OpInput {
+    Add {
+        position: u32,
+        title: String,
+        artist: String,
+        #[serde(default)]
+        album: String,
+        #[serde(default)]
+        duration_secs: Option<u32>,
+        #[serde(default)]
+        track_id: Option<String>,
+        /// The composer's handle for this row ("new:3"), so a later remove
+        /// or move in the same proposal can name a track it just added.
+        #[serde(default)]
+        token: Option<String>,
+    },
+    Remove {
+        entry_id: String,
+    },
+    Move {
+        entry_id: String,
+        to_position: u32,
+    },
+}
+
+// ---------------------------------------------------------------- helpers
+
+fn now_secs() -> u64 {
+    SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0)
+}
+fn rand16() -> [u8; 16] {
+    use rand::RngCore;
+    let mut n = [0u8; 16];
+    rand::thread_rng().fill_bytes(&mut n);
+    n
+}
+fn b58(bytes: &[u8]) -> String {
+    bs58::encode(bytes).into_string()
+}
+fn key_of(s: &str) -> Result<[u8; 32], String> {
+    let v = bs58::decode(s.trim()).into_vec().map_err(|_| "not a base58 key")?;
+    v.try_into().map_err(|_| "a key is 32 bytes".to_string())
+}
+fn id_of(s: &str) -> Result<[u8; 16], String> {
+    let v = bs58::decode(s.trim()).into_vec().map_err(|_| "not a base58 id")?;
+    v.try_into().map_err(|_| "an id is 16 bytes".to_string())
+}
+fn cap(s: &str, max: usize) -> String {
+    if s.len() <= max {
+        return s.to_string();
+    }
+    let mut end = max;
+    while !s.is_char_boundary(end) {
+        end -= 1;
+    }
+    s[..end].to_string()
+}
+fn board_id(owner: &[u8; 32], uuid: &[u8; 16]) -> String {
+    format!("{}/{}", b58(owner), b58(uuid))
+}
+
+fn path(app: &tauri::AppHandle) -> Result<PathBuf, String> {
+    Ok(app.path().app_data_dir().map_err(|e| e.to_string())?.join("freenet").join("boards.json"))
+}
+fn load(app: &tauri::AppHandle) -> Ledger {
+    path(app)
+        .ok()
+        .and_then(|p| std::fs::read(p).ok())
+        .and_then(|b| serde_json::from_slice(&b).ok())
+        .unwrap_or_default()
+}
+fn save(app: &tauri::AppHandle, l: &Ledger) -> Result<(), String> {
+    let p = path(app)?;
+    if let Some(dir) = p.parent() {
+        std::fs::create_dir_all(dir).map_err(|e| e.to_string())?;
+    }
+    std::fs::write(&p, serde_json::to_vec_pretty(l).map_err(|e| e.to_string())?).map_err(|e| e.to_string())
+}
+
+async fn my_key(app: &tauri::AppHandle) -> Result<[u8; 32], String> {
+    let adapter = app.state::<AppState>().freenet.clone();
+    let info = persona::current(&adapter).await?.ok_or("create a SoulStream identity first")?;
+    key_of(&info.public_key)
+}
+async fn sign(app: &tauri::AppHandle, payload: Vec<u8>) -> Result<Vec<u8>, String> {
+    let adapter = app.state::<AppState>().freenet.clone();
+    persona::sign(&adapter, pr::SIGN_DOMAIN, payload).await
+}
+
+async fn fetch_board(app: &tauri::AppHandle, owner: &[u8; 32], uuid: &[u8; 16]) -> Result<(pr::BoardState, bool), String> {
+    let adapter = app.state::<AppState>().freenet.clone();
+    let ids = FreenetAdapter::contract_ids(BOARD_WASM.to_vec(), &pr::make_params(owner, uuid));
+    match adapter.contract_get(&ids.instance, false).await {
+        Ok(bytes) => Ok((pr::merge_board(owner, uuid, &[&bytes]), true)),
+        Err(e) if e.to_string().contains("not found") => Ok((pr::BoardState::default(), false)),
+        Err(e) => Err(e.to_string()),
+    }
+}
+
+async fn offer_board(app: &tauri::AppHandle, owner: &[u8; 32], uuid: &[u8; 16], state: &pr::BoardState, first: bool) -> Result<(), String> {
+    let adapter = app.state::<AppState>().freenet.clone();
+    let bytes = bincode::serialize(state).map_err(|e| e.to_string())?;
+    let params = pr::make_params(owner, uuid);
+    if first {
+        adapter.contract_put(BOARD_WASM.to_vec(), &params, bytes, false).await.map(|_| ())
+    } else {
+        adapter.get_then_update(BOARD_WASM.to_vec(), &params, bytes).await.map(|_| ())
+    }
+    .map_err(|e| e.to_string())
+}
+
+fn partial(owner: &[u8; 32], uuid: &[u8; 16], authority: Option<pr::AuthorityCheckpoint>, proposals: Vec<pr::Proposal>, decisions: Vec<pr::Decision>) -> pr::BoardState {
+    pr::BoardState { schema_version: pr::SCHEMA_VERSION, owner: *owner, playlist_uuid: *uuid, authority, proposals, decisions }
+}
+
+/// What a Space pins, plus its roster — the board's owner and contributors.
+struct Pinned {
+    owner: [u8; 32],
+    uuid: [u8; 16],
+    members: Vec<[u8; 32]>,
+}
+
+async fn pinned_of(app: &tauri::AppHandle, space_owner_b58: &str, space_b58: &str) -> Result<Pinned, String> {
+    let owner = key_of(space_owner_b58)?;
+    let space_id = id_of(space_b58)?;
+    let (state, _) = spaces::fetch_state(app, &owner, &space_id).await?;
+    let c = state.checkpoint.ok_or("the Space has not reached this node yet")?;
+    let p = c.pinned.ok_or("this Space has no pinned playlist — a board lives beside one")?;
+    Ok(Pinned { owner: p.owner, uuid: p.uuid, members: c.members.iter().map(|m| m.key).collect() })
+}
+
+type Current = (pl::ManifestV1, [u8; 32]);
+
+fn view_of(app: &tauri::AppHandle, pin: &Pinned, current: Option<&Current>, board: &pr::BoardState, me: &[u8; 32], reachable: bool) -> BoardView {
+    let entries: Vec<BoardEntry> = current
+        .map(|(m, _)| {
+            m.entries
+                .iter()
+                .map(|e| BoardEntry {
+                    entry_id: b58(&e.entry_id),
+                    position: e.position,
+                    title: e.recording.title.clone(),
+                    artist: e.recording.artists.join(", "),
+                    album: e.recording.album.clone(),
+                    duration_secs: e.recording.duration_ms.map(|ms| ms / 1000),
+                })
+                .collect()
+        })
+        .unwrap_or_default();
+    // A remove or move may name a row the same proposal added a step earlier.
+    let named = |p: &pr::Proposal, id: &[u8; 16]| -> Option<(String, String)> {
+        current
+            .and_then(|(m, _)| m.entries.iter().find(|e| &e.entry_id == id))
+            .or_else(|| {
+                p.ops.iter().find_map(|op| match op {
+                    pr::ProposalOp::Add { entry, .. } if &entry.entry_id == id => Some(entry),
+                    _ => None,
+                })
+            })
+            .map(|e| (e.recording.title.clone(), e.recording.artists.join(", ")))
+    };
+    let roster: Vec<[u8; 32]> = board.authority.as_ref().map(|a| a.contributors.clone()).unwrap_or_default();
+    let proposals = board
+        .proposals
+        .iter()
+        .map(|p| ProposalView {
+            id: b58(&p.proposal_id),
+            author: b58(&p.author),
+            username: slsk_link::username_for_key(app, &b58(&p.author)),
+            is_me: &p.author == me,
+            created_at: p.created_at,
+            note: p.note.clone(),
+            base: b58(&p.base_revision_hash),
+            stale: current.map(|(_, h)| h != &p.base_revision_hash).unwrap_or(true),
+            ops: p
+                .ops
+                .iter()
+                .map(|op| match op {
+                    pr::ProposalOp::Add { position, entry } => OpView {
+                        kind: "add".into(),
+                        position: Some(*position),
+                        entry_id: None,
+                        title: entry.recording.title.clone(),
+                        artist: entry.recording.artists.join(", "),
+                        known: true,
+                    },
+                    pr::ProposalOp::Remove { entry_id } => {
+                        let n = named(p, entry_id);
+                        OpView {
+                            kind: "remove".into(),
+                            position: None,
+                            entry_id: Some(b58(entry_id)),
+                            title: n.as_ref().map(|x| x.0.clone()).unwrap_or_default(),
+                            artist: n.as_ref().map(|x| x.1.clone()).unwrap_or_default(),
+                            known: n.is_some(),
+                        }
+                    }
+                    pr::ProposalOp::Move { entry_id, to_position } => {
+                        let n = named(p, entry_id);
+                        OpView {
+                            kind: "move".into(),
+                            position: Some(*to_position),
+                            entry_id: Some(b58(entry_id)),
+                            title: n.as_ref().map(|x| x.0.clone()).unwrap_or_default(),
+                            artist: n.as_ref().map(|x| x.1.clone()).unwrap_or_default(),
+                            known: n.is_some(),
+                        }
+                    }
+                })
+                .collect(),
+        })
+        .collect();
+    let decisions = board
+        .decisions
+        .iter()
+        .rev()
+        .map(|d| DecisionView {
+            proposal_id: b58(&d.proposal_id),
+            accept: d.accept,
+            seq: d.seq,
+            reason: d.reason.clone(),
+            result_hash: d.result_revision_hash.as_ref().map(|h| b58(h)),
+        })
+        .collect();
+    BoardView {
+        owner: b58(&pin.owner),
+        uuid: b58(&pin.uuid),
+        name: current.map(|(m, _)| m.name.clone()).unwrap_or_default(),
+        revision_seq: current.map(|(m, _)| m.revision_seq).unwrap_or(0),
+        base: current.map(|(_, h)| b58(h)).unwrap_or_default(),
+        withdrawn: current.is_none(),
+        entries,
+        reachable,
+        epoch: board.authority.as_ref().map(|a| a.epoch).unwrap_or(0),
+        contributors: roster
+            .iter()
+            .map(|k| ContributorView { key: b58(k), username: slsk_link::username_for_key(app, &b58(k)), is_me: k == me })
+            .collect(),
+        i_am_owner: &pin.owner == me,
+        can_propose: reachable && current.is_some() && roster.contains(me),
+        proposals,
+        decisions,
+        pending_mine: board.proposals.iter().filter(|p| &p.author == me).count() as u32,
+    }
+}
+
+// ---------------------------------------------------------------- actions
+
+/// Read the board beside a Space's pinned playlist. The playlist's owner
+/// also brings the roster in line with the Space's members here — a new
+/// signed epoch whenever they differ.
+pub async fn open(app: &tauri::AppHandle, space_owner_b58: &str, space_b58: &str) -> Result<BoardView, String> {
+    let me = my_key(app).await?;
+    let pin = pinned_of(app, space_owner_b58, space_b58).await?;
+    let current = shared_playlists::current_revision(app, &pin.owner, &pin.uuid).await?;
+    let (mut board, mut exists) = fetch_board(app, &pin.owner, &pin.uuid).await?;
+    if pin.owner == me {
+        let want: Vec<[u8; 32]> = pin.members.iter().copied().take(pr::MAX_CONTRIBUTORS).collect();
+        let have: Vec<[u8; 32]> = board.authority.as_ref().map(|a| a.contributors.clone()).unwrap_or_default();
+        let same = want.iter().collect::<BTreeSet<_>>() == have.iter().collect::<BTreeSet<_>>();
+        if !same {
+            let bid = board_id(&pin.owner, &pin.uuid);
+            let mut l = load(app);
+            let rec = l.boards.get(&bid).cloned().unwrap_or_default();
+            let epoch = board.authority.as_ref().map(|a| a.epoch).unwrap_or(0).max(rec.last_epoch) + 1;
+            let mut c = pr::AuthorityCheckpoint { epoch, contributors: want, sig: vec![] };
+            c.sig = sign(app, pr::sign_payload(&pr::checkpoint_sig_body(&c))).await?;
+            let offer = partial(&pin.owner, &pin.uuid, Some(c), vec![], vec![]);
+            offer_board(app, &pin.owner, &pin.uuid, &offer, !exists).await?;
+            l.boards.insert(bid, BoardRecord { last_epoch: epoch, ..rec });
+            save(app, &l)?;
+            let a = bincode::serialize(&board).map_err(|e| e.to_string())?;
+            let b = bincode::serialize(&offer).map_err(|e| e.to_string())?;
+            board = pr::merge_board(&pin.owner, &pin.uuid, &[&a, &b]);
+            exists = true;
+            log::info!("proposals: roster epoch {} for board {}", epoch, b58(&pin.uuid));
+        }
+    }
+    Ok(view_of(app, &pin, current.as_ref(), &board, &me, exists))
+}
+
+/// A member proposes: the ops are dry-run against the exact base first, so
+/// a broken composition never leaves this device.
+pub async fn propose(app: &tauri::AppHandle, space_owner_b58: &str, space_b58: &str, base_b58: &str, ops: Vec<OpInput>, note: &str) -> Result<BoardView, String> {
+    let me = my_key(app).await?;
+    let pin = pinned_of(app, space_owner_b58, space_b58).await?;
+    if ops.is_empty() {
+        return Err("nothing proposed yet".into());
+    }
+    if ops.len() > pr::MAX_OPS_PER_PROPOSAL {
+        return Err(format!("over {} changes in one proposal", pr::MAX_OPS_PER_PROPOSAL));
+    }
+    let (manifest, hash) = shared_playlists::current_revision(app, &pin.owner, &pin.uuid)
+        .await?
+        .ok_or("the owner withdrew this playlist")?;
+    if b58(&hash) != base_b58.trim() {
+        return Err("the playlist moved to a newer revision while you were composing — reload the board and try again".into());
+    }
+    let (board, exists) = fetch_board(app, &pin.owner, &pin.uuid).await?;
+    if !exists {
+        return Err("the owner has not opened this board yet".into());
+    }
+    let auth = board.authority.as_ref().ok_or("the board has no roster yet")?;
+    if !auth.contributors.contains(&me) {
+        return Err("you are not on this board's roster — the owner refreshes it from the Space's members".into());
+    }
+    let mut fresh: BTreeMap<String, [u8; 16]> = BTreeMap::new();
+    let resolve = |fresh: &BTreeMap<String, [u8; 16]>, s: &str| -> Result<[u8; 16], String> {
+        match fresh.get(s.trim()) {
+            Some(id) => Ok(*id),
+            None => id_of(s),
+        }
+    };
+    let mut pops = Vec::with_capacity(ops.len());
+    for op in ops {
+        pops.push(match op {
+            OpInput::Add { position, title, artist, album, duration_secs, track_id, token } => {
+                let title = cap(title.trim(), pl::MAX_FIELD_BYTES);
+                let artist = cap(artist.trim(), pl::MAX_FIELD_BYTES);
+                if title.is_empty() {
+                    return Err("an added track needs a title".into());
+                }
+                let entry_id = rand16();
+                if let Some(t) = token {
+                    fresh.insert(t, entry_id);
+                }
+                pr::ProposalOp::Add {
+                    position,
+                    entry: pl::EntryV1 {
+                        entry_id,
+                        position,
+                        recording: pl::RecordingRef {
+                            musicbrainz_recording_id: None,
+                            isrcs: vec![],
+                            deezer_id: track_id.filter(|t| !t.is_empty()),
+                            apple_music_id: None,
+                            title: title.clone(),
+                            artists: vec![artist.clone()],
+                            album: cap(album.trim(), pl::MAX_FIELD_BYTES),
+                            duration_ms: duration_secs.map(|s| s.saturating_mul(1000)),
+                            release_year: None,
+                        },
+                        note: None,
+                        slsk_hint: Some(cap(&format!("{artist} {title}"), pl::MAX_FIELD_BYTES)),
+                    },
+                }
+            }
+            OpInput::Remove { entry_id } => pr::ProposalOp::Remove { entry_id: resolve(&fresh, &entry_id)? },
+            OpInput::Move { entry_id, to_position } => pr::ProposalOp::Move { entry_id: resolve(&fresh, &entry_id)?, to_position },
+        });
+    }
+    let mut p = pr::Proposal {
+        proposal_id: rand16(),
+        author: me,
+        authority_epoch: auth.epoch,
+        base_revision_hash: hash,
+        ops: pops,
+        note: cap(note.trim(), pl::MAX_DESC_BYTES),
+        created_at: now_secs(),
+        sig: vec![],
+    };
+    pr::apply_proposal(&manifest, &hash, &p).map_err(|e| e.to_string())?;
+    p.sig = sign(app, pr::sign_payload(&pr::proposal_sig_body(&p))).await?;
+    if !pr::proposal_valid(&p) {
+        return Err("the proposal did not validate (a size or field cap)".into());
+    }
+    offer_board(app, &pin.owner, &pin.uuid, &partial(&pin.owner, &pin.uuid, None, vec![p], vec![]), false).await?;
+    log::info!("proposals: offered a proposal to board {}", b58(&pin.uuid));
+    open(app, space_owner_b58, space_b58).await
+}
+
+/// The owner decides. Accepting brings the local playlist to the proposed
+/// order, publishes it as the next revision, and the decision names that
+/// revision; rejecting records the reason. Either way it is signed.
+pub async fn decide(app: &tauri::AppHandle, space_owner_b58: &str, space_b58: &str, proposal_b58: &str, accept: bool, reason: &str) -> Result<BoardView, String> {
+    let me = my_key(app).await?;
+    let pin = pinned_of(app, space_owner_b58, space_b58).await?;
+    if pin.owner != me {
+        return Err("only the playlist's owner decides".into());
+    }
+    let pid = id_of(proposal_b58)?;
+    let (board, exists) = fetch_board(app, &pin.owner, &pin.uuid).await?;
+    if !exists {
+        return Err("the board has not reached this node".into());
+    }
+    let p = board.proposals.iter().find(|p| p.proposal_id == pid).cloned().ok_or("that proposal is no longer pending")?;
+    let bid = board_id(&pin.owner, &pin.uuid);
+    let mut l = load(app);
+    let rec = l.boards.get(&bid).cloned().unwrap_or_default();
+    let seq = board.decisions.iter().map(|d| d.seq).max().unwrap_or(0).max(rec.last_seq) + 1;
+    let mut reason = cap(reason.trim(), pr::MAX_REASON_BYTES);
+    let result = if accept {
+        let (manifest, hash) = shared_playlists::current_revision(app, &pin.owner, &pin.uuid)
+            .await?
+            .ok_or("the playlist is withdrawn — publish it again before accepting")?;
+        let entries = pr::apply_proposal(&manifest, &hash, &p).map_err(|e| e.to_string())?;
+        let published = apply_locally(app, &pin.uuid, &manifest, entries).await?;
+        if reason.is_empty() {
+            reason = format!("applied as revision {}", published.revision_seq);
+        }
+        Some(key_of(published.current_hash.as_deref().unwrap_or_default())?)
+    } else {
+        if reason.is_empty() {
+            reason = "declined".into();
+        }
+        None
+    };
+    let mut d = pr::Decision { proposal_id: pid, accept, seq, reason, result_revision_hash: result, sig: vec![] };
+    d.sig = sign(app, pr::sign_payload(&pr::decision_sig_body(&d))).await?;
+    offer_board(app, &pin.owner, &pin.uuid, &partial(&pin.owner, &pin.uuid, None, vec![], vec![d]), false).await?;
+    l.boards.insert(bid, BoardRecord { last_seq: seq, ..rec });
+    save(app, &l)?;
+    log::info!("proposals: decision {} ({}) on board {}", seq, if accept { "accept" } else { "reject" }, b58(&pin.uuid));
+    open(app, space_owner_b58, space_b58).await
+}
+
+/// Bring the owner's local playlist to `entries`, then publish it as the
+/// next revision. Refused when the local copy has drifted from the base
+/// revision — the exact-base rule holds on this side too.
+async fn apply_locally(app: &tauri::AppHandle, uuid: &[u8; 16], base: &pl::ManifestV1, entries: Vec<pl::EntryV1>) -> Result<Published, String> {
+    let published = shared_playlists::published_for_uuid(app, &b58(uuid)).ok_or("this device did not publish that playlist")?;
+    let playlist_id = published.playlist_id;
+    let lib = app.state::<LibraryState>();
+    let l = lib.library.clone();
+    let items: Vec<PlaylistItem> = tauri::async_runtime::spawn_blocking(move || l.playlist_items(playlist_id).map_err(|e| e.to_string()))
+        .await
+        .map_err(|e| e.to_string())??;
+    let local_ids: Vec<[u8; 16]> = items.iter().map(|it| shared_playlists::entry_id_for(uuid, it.id)).collect();
+    let base_ids: Vec<[u8; 16]> = base.entries.iter().map(|e| e.entry_id).collect();
+    if local_ids != base_ids {
+        return Err(format!(
+            "your local copy of this playlist has changed since revision {} was published — publish it again, then ask for a re-submit",
+            base.revision_seq
+        ));
+    }
+    let uuid = *uuid;
+    let keep: BTreeSet<[u8; 16]> = entries.iter().map(|e| e.entry_id).collect();
+    let remove: Vec<i64> = items.iter().zip(&local_ids).filter(|(_, id)| !keep.contains(*id)).map(|(it, _)| it.id).collect();
+    let existing: BTreeSet<[u8; 16]> = local_ids.iter().copied().collect();
+    let adds: Vec<NewPlaylistItem> = entries
+        .iter()
+        .filter(|e| !existing.contains(&e.entry_id))
+        .map(|e| NewPlaylistItem {
+            title: e.recording.title.clone(),
+            artist: e.recording.artists.join(", "),
+            album: Some(e.recording.album.clone()).filter(|a| !a.is_empty()),
+            duration_secs: e.recording.duration_ms.map(|ms| ms / 1000),
+            path: None,
+            art_path: None,
+            kind: String::new(),
+            source_line: e.slsk_hint.clone(),
+            start_ms: None,
+            note: e.note.clone(),
+            track_id: e.recording.deezer_id.clone(),
+            art_url: None,
+        })
+        .collect();
+    let before: BTreeSet<i64> = items.iter().map(|it| it.id).collect();
+    let now = now_secs() as i64;
+    let l = lib.library.clone();
+    let after: Vec<PlaylistItem> = tauri::async_runtime::spawn_blocking(move || -> Result<Vec<PlaylistItem>, String> {
+        if !remove.is_empty() {
+            l.remove_playlist_items(playlist_id, &remove, now).map_err(|e| e.to_string())?;
+        }
+        if !adds.is_empty() {
+            l.add_playlist_items(playlist_id, &adds, None, now).map_err(|e| e.to_string())?;
+        }
+        l.playlist_items(playlist_id).map_err(|e| e.to_string())
+    })
+    .await
+    .map_err(|e| e.to_string())??;
+    let mut fresh: VecDeque<i64> = after.iter().filter(|it| !before.contains(&it.id)).map(|it| it.id).collect();
+    let by_entry: BTreeMap<[u8; 16], i64> = after.iter().map(|it| (shared_playlists::entry_id_for(&uuid, it.id), it.id)).collect();
+    let mut ordered = Vec::with_capacity(entries.len());
+    for e in &entries {
+        match by_entry.get(&e.entry_id) {
+            Some(id) => ordered.push(*id),
+            None => ordered.push(fresh.pop_front().ok_or("the added rows did not come back from the library")?),
+        }
+    }
+    let l = lib.library.clone();
+    tauri::async_runtime::spawn_blocking(move || l.set_playlist_order(playlist_id, &ordered, now).map_err(|e| e.to_string()))
+        .await
+        .map_err(|e| e.to_string())??;
+    playlists::changed(app);
+    shared_playlists::publish(app, &lib, playlist_id).await
+}
+
+// ---------------------------------------------------------------- commands
+
+#[tauri::command]
+pub async fn space_board(app: tauri::AppHandle, owner: String, space: String) -> Result<BoardView, String> {
+    open(&app, &owner, &space).await
+}
+#[tauri::command]
+pub async fn space_propose(app: tauri::AppHandle, owner: String, space: String, base: String, ops: Vec<OpInput>, note: String) -> Result<BoardView, String> {
+    propose(&app, &owner, &space, &base, ops, &note).await
+}
+#[tauri::command]
+pub async fn space_decide(app: tauri::AppHandle, owner: String, space: String, proposal: String, accept: bool, reason: String) -> Result<BoardView, String> {
+    decide(&app, &owner, &space, &proposal, accept, &reason).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn contract_generation_is_pinned() {
+        let ids = FreenetAdapter::contract_ids(BOARD_WASM.to_vec(), &pr::make_params(&[7u8; 32], &[1u8; 16]));
+        assert_eq!(ids.code_hash, "3oBYSW1pP9GfX7v4Q1CtP2ikiKcc1yT48U7wxMnTTFho");
+    }
+}

src-tauri/src/shared_playlists.rs

@@ -98,6 +98,8 @@ struct ShareRef {
 
 #[derive(Debug, Serialize)]
 pub struct ShareEntry {
+    /// The occurrence id (b58) — what a proposal's remove or move names.
+    pub entry_id: String,
     pub position: u32,
     pub title: String,
     pub artist: String,
@@ -245,12 +247,12 @@ pub async fn publish(app: &tauri::AppHandle, lib: &LibraryState, playlist_id: i6
         .iter()
         .enumerate()
         .map(|(i, it)| pl::EntryV1 {
-            entry_id: rand16(),
+            entry_id: entry_id_for(&uuid, it.id),
             position: i as u32,
             recording: pl::RecordingRef {
                 musicbrainz_recording_id: None,
                 isrcs: vec![],
-                deezer_id: None,
+                deezer_id: it.track_id.clone().filter(|t| !t.is_empty()),
                 apple_music_id: None,
                 title: cap(&it.title, pl::MAX_FIELD_BYTES),
                 artists: vec![cap(&it.artist, pl::MAX_FIELD_BYTES)],
@@ -281,6 +283,7 @@ pub async fn publish(app: &tauri::AppHandle, lib: &LibraryState, playlist_id: i6
         .contract_put(REV_WASM.to_vec(), &pl::make_rev_params(&owner, &hash), bytes.clone(), false)
         .await
         .map_err(|e| e.to_string())?;
+    cache_revision(app, &hash, &bytes);
     let pointer_seq = prev.as_ref().map(|p| p.pointer_seq + 1).unwrap_or(1);
     let mut p = pl::PointerState {
         schema_version: pl::SCHEMA_VERSION,
@@ -385,10 +388,7 @@ pub async fn fetch(app: &tauri::AppHandle, owner_b58: &str, uuid_b58: &str) -> R
             entries: vec![],
         });
     };
-    let rev_ids = FreenetAdapter::contract_ids(REV_WASM.to_vec(), &pl::make_rev_params(&owner, &r.content_hash));
-    let rbytes = adapter.contract_get(&rev_ids.instance, false).await.map_err(|e| e.to_string())?;
-    let m = pl::validate_revision(&owner, &r.content_hash, &rbytes)
-        .map_err(|e| format!("revision failed verification: {e}"))?;
+    let (m, _) = revision_by_hash(app, &owner, &r.content_hash).await?;
     Ok(ShareView {
         owner_key: owner_b58.to_string(),
         playlist_uuid: uuid_b58.to_string(),
@@ -401,6 +401,7 @@ pub async fn fetch(app: &tauri::AppHandle, owner_b58: &str, uuid_b58: &str) -> R
             .entries
             .into_iter()
             .map(|e| ShareEntry {
+                entry_id: b58(&e.entry_id),
                 position: e.position,
                 title: e.recording.title,
                 artist: e.recording.artists.join(", "),
@@ -412,6 +413,79 @@ pub async fn fetch(app: &tauri::AppHandle, owner_b58: &str, uuid_b58: &str) -> R
     })
 }
 
+/// The occurrence id a local row publishes under: derived from the playlist
+/// uuid and the row id, so it survives re-publication — a proposal's remove
+/// or move names the same row the owner has.
+pub(crate) fn entry_id_for(uuid: &[u8; 16], item_id: i64) -> [u8; 16] {
+    let mut buf = Vec::with_capacity(48);
+    buf.extend_from_slice(b"soulstream.entry.v1");
+    buf.extend_from_slice(uuid);
+    buf.extend_from_slice(&item_id.to_le_bytes());
+    ps::content_hash(&buf)[..16].try_into().unwrap()
+}
+
+fn revisions_dir(app: &tauri::AppHandle) -> Option<PathBuf> {
+    app.path().app_data_dir().ok().map(|d| d.join("freenet").join("revisions"))
+}
+
+/// Revisions are kept on disk by hash: the owner's accept path needs the
+/// exact base bytes, and a network GET for them costs seconds.
+fn cache_revision(app: &tauri::AppHandle, hash: &[u8; 32], bytes: &[u8]) {
+    if let Some(dir) = revisions_dir(app) {
+        let _ = std::fs::create_dir_all(&dir);
+        let _ = std::fs::write(dir.join(format!("{}.bin", b58(hash))), bytes);
+    }
+}
+
+/// A revision by content hash — the local cache first, the network after —
+/// verified against the owner's key either way.
+pub(crate) async fn revision_by_hash(
+    app: &tauri::AppHandle,
+    owner: &[u8; 32],
+    hash: &[u8; 32],
+) -> Result<(pl::ManifestV1, Vec<u8>), String> {
+    let cached = revisions_dir(app).and_then(|d| std::fs::read(d.join(format!("{}.bin", b58(hash)))).ok());
+    let bytes = match cached {
+        Some(b) => b,
+        None => {
+            let adapter = app.state::<AppState>().freenet.clone();
+            let ids = FreenetAdapter::contract_ids(REV_WASM.to_vec(), &pl::make_rev_params(owner, hash));
+            let b = adapter.contract_get(&ids.instance, false).await.map_err(|e| e.to_string())?;
+            cache_revision(app, hash, &b);
+            b
+        }
+    };
+    let m = pl::validate_revision(owner, hash, &bytes).map_err(|e| format!("revision failed verification: {e}"))?;
+    Ok((m, bytes))
+}
+
+/// The current revision of (owner, uuid): the pointer, then the revision it
+/// names. None when the pointer says withdrawn.
+pub(crate) async fn current_revision(
+    app: &tauri::AppHandle,
+    owner: &[u8; 32],
+    uuid: &[u8; 16],
+) -> Result<Option<(pl::ManifestV1, [u8; 32])>, String> {
+    let adapter = app.state::<AppState>().freenet.clone();
+    let ptr_ids = FreenetAdapter::contract_ids(PTR_WASM.to_vec(), &pl::make_ptr_params(owner, uuid));
+    let pbytes = adapter.contract_get(&ptr_ids.instance, false).await.map_err(|e| {
+        if e.to_string().contains("not found") {
+            "no such shared playlist on the network (or not reachable yet)".to_string()
+        } else {
+            e.to_string()
+        }
+    })?;
+    let p = pl::validate_pointer(owner, uuid, &pbytes).map_err(|e| format!("pointer failed verification: {e}"))?;
+    let Some(r) = p.current.filter(|_| !p.withdrawn) else { return Ok(None) };
+    let (m, _) = revision_by_hash(app, owner, &r.content_hash).await?;
+    Ok(Some((m, r.content_hash)))
+}
+
+/// The local playlist behind a published uuid, when this device published it.
+pub(crate) fn published_for_uuid(app: &tauri::AppHandle, uuid_b58: &str) -> Option<Published> {
+    load(app).published.into_values().find(|p| p.uuid == uuid_b58)
+}
+
 /// A verified shared playlist staged through the app's own import path.
 pub async fn import(
     app: &tauri::AppHandle,

src-tauri/src/spaces.rs

@@ -191,7 +191,7 @@ async fn sign(app: &tauri::AppHandle, payload: Vec<u8>) -> Result<Vec<u8>, Strin
     persona::sign(&adapter, sp::SIGN_DOMAIN, payload).await
 }
 
-async fn fetch_state(app: &tauri::AppHandle, owner: &[u8; 32], space_id: &[u8; 16]) -> Result<(sp::SpaceState, bool), String> {
+pub(crate) async fn fetch_state(app: &tauri::AppHandle, owner: &[u8; 32], space_id: &[u8; 16]) -> Result<(sp::SpaceState, bool), String> {
     let adapter = app.state::<AppState>().freenet.clone();
     let ids = FreenetAdapter::contract_ids(SPACE_WASM.to_vec(), &sp::make_params(owner, space_id));
     match adapter.contract_get(&ids.instance, false).await {