Architecture (hypotheses, refinable with evidence)

• Rust canonical core under crates/. TypeScript only for SDKs and integrations.
• Topology (decided, D-038, D-048): one always-on server holds the authoritative full replica and computes derived data (state, conflicts, projection, digests, history indexes) incrementally. Clients are thin, partial replicas (a server base snapshot + a window of ops + an own-op ledger, blobs on demand, sparse checkout, bounded cache) or use the server's HTTP API. Authority means availability, durability, admission and derived data; it never means ordering: ops keep their authors' ids and causal deps, and every replica converges by the same rules. Spec: Online-First (Repository-Semantics §6).
• Superseded: the implicit premise that every replica is a full, offline-first replica (direction A, rejected by D-048). Full replicas remain (the server; opt-in for users, Online-First E-B4).
• Pipeline: Intent → Command → Transaction → Operations → CRDT State → Repository → Filesystem View.
• Nodes {id, kind, parent, name, content}. NodeId is persistent; a path is not identity. Rename and move preserve NodeId.
• Immutable operations with causal deps; never wall-clock ordering. History is a causal graph.
• Invariant: Ops(A)==Ops(B) ⇒ State(A)==State(B).
• Structural conflicts are distinct from semantic conflicts. Preserve intent, converge deterministically, never silently drop concurrent intent.
• CRDT engine: the tree/op CRDT is custom (Repository-Semantics §1–§4, implemented). Text content CRDT is specified in #48 and plugs in at Online-First 6.6. (The older line "CRDT engine undecided" is superseded for the tree.)