2 months ago
0d52263Mutation wrappers open the library DB, begin one SQLite transaction, run the caller mutation on that connection, write remote_publish_outbox with full song_ids on the same transaction, then commit. Songs and change set are atomic; rollback clears both. Control projection is fail-closed and only deletes the library outbox after Pending+Dirty succeeds. Candidate freeze clears outbox so machine-local metadata never ships with a generation database. Command call sites now receive the transaction connection instead of opening a separate library handle.
Parent9e51a36