@amalgm/shell 0.1.164-main.34246520761 → 0.1.164-preview.34182506414

package/PURPOSE.md

@@ -6,9 +6,6 @@ while its host can execute, recover without opening a UI, contain a failing
 workload, and leave the machine's resources available for useful work. Shell
 owns composition, process boot, and native host effects; Core and the product
 SDKs own the decisions those effects execute.
-At the completed brick/mortar boundary, compatible bricks advance through independently selected artifacts while Shell
-remains the mortar; publishing a brick must not require publishing unchanged
-Shell code.
 
 ## Operating axioms
 
@@ -18,9 +15,6 @@ defines the terms and examinations; the [September 2026 audit](docs/operating-au
 records implementation gaps and historical evidence.
 The [release environments plan](docs/release-environments-plan.md) records the
 agreed CI/CD and update evolution; its target behavior is not yet delivered.
-The owner permits temporary bundled Shell releases for brick changes during
-boundary cleanup. Independent brick adoption remains the target, and Engine
-migration is out of scope because no existing Engine users need it.
 
 - **O1 — Lifetime follows installation intent.** One installation owner keeps
   the enabled runtime available independently of its launching UI or terminal
@@ -64,26 +58,6 @@ Release tooling remains available inside each owner repository so a developer
 or CI job never needs access to another private product repository.
 Registry credentials are available only to the final protected publication job,
 after every native examination proves the exact candidate bytes.
-Native examination fixtures own their process pipes and test servers independently
-of the installed service, and release those resources even when service removal fails.
-Fixture cleanup preserves the original failure and every cleanup failure; installed
-state remains available when its native owner cannot be removed.
-A fixture's process lease covers its final writes, and its native release fences
-cleanup after either cooperative or forced exit.
-Fixture termination is proved by releasing its owned native resources; an HTTP
-stop acknowledgement or transport failure cannot substitute for that proof.
-A fixture publishes file-based readiness only after its complete evidence is
-atomically visible to the observing process.
-Native certification runs independent fixture files serially on its shared host,
-while each fixture retains the concurrent load required by its examination.
-The certifying producer owns fixture orchestration and loads production adapters
-from the exact installed archive, without modifying that archive's bytes.
-An outer fixture owner removes a temporary package only after the process loading
-its native libraries has closed and the package's native service owners have stopped.
-The final examination proof includes process completion and temporary-file cleanup.
-Public package selection is complete only when the ordinary registry endpoint
-observes the authorized version and integrity within one fixed deadline; cached
-predecessors do not authorize another tag write or extend that deadline.
 
 Shell owns both the internal `@amalgm/shell` package and the public `amalgm`
 distribution. One tested build supplies both archives; only package identity,
@@ -92,12 +66,12 @@ native examinations before either becomes a managed public candidate. Public
 metadata records the exact internal archive it was derived from; no wrapper,
 copied Engine implementation or second dependency graph supplies runtime behavior.
 
-At the target boundary, release assembly selects exact registry artifacts from the same managed branch
-into a signed installation recipe. Compatible brick changes reuse the existing
-Shell artifact without a Shell dependency-update PR or lockfile edit. A product
-owns changes to libraries embedded in its own artifact. Reconciliation preserves
-human edits, coalesces candidates, and never republishes unchanged components
-because a notification or check was repeated.
+Consumer assembly reads dependencies from each declared package manifest and
+selects only registry candidates from the same managed branch. It changes exact
+pins and their locks in one reproducible composition change; the consumer's
+complete checks gate merging that exact tree against its unchanged base. Reconciliation keeps one
+pending change per branch, preserves human edits, and never republishes an
+unchanged consumer merely because a notification or check was repeated.
 
 1. **The shell implements host effects; SDKs own domain decisions.** Shell
    assembles published capabilities, implements their native effect ports,
@@ -136,40 +110,16 @@ uses another data home. Windows Task Scheduler owns a hidden action in that
 account's logged-in session; the action owns controller exit recovery using
 Core's restart policy. Scheduler launch retries alone cannot recover a program
 that started successfully and then exited.
-The stable bootstrap retains a bounded result for each controller launch role,
-including failures before the controller can open its own log.
-Before launching any controller, the Windows action joins its own unnamed,
-non-inheritable, kill-on-close Job Object; every descendant remains inside that
-lifetime boundary, and only action termination releases its owning handle.
-Failed job admission refuses launch, and stopping one action releases its parked
-bootstrap and descendants without discovering or signalling remembered PIDs.
 Native service descriptions preserve literal arguments, environment values and
 working directories through the owning OS parser. Each directive uses its own
 grammar; unrepresentable input is refused before replacing a service description.
-Windows Scheduler requests travel as structured stdin, and both encoded
-PowerShell invocations are admitted within the native command-line length bound.
 Native Watch opens the OS-resolved physical directory; portable or short-name
 aliases cannot become a second path grammar inside a kernel handle.
 Persistent SQLite handles use the OS namespace for the selected file, including
 Windows extended paths; a host API's legacy path limit cannot select another file.
-Durability acknowledgements require the native flush to succeed through a handle
-with the access it requires; a failed flush cannot become a successful install
-or materialization. Each writer owns the durability of the files it creates.
-Content equality alone cannot acknowledge durable materialization; Verify
-re-establishes the affected file and directory flushes before completion.
-The staging barrier composes a writer's acknowledgement only while its exact
-physical file remains unchanged, and a retry obtains fresh writer evidence.
-Git materialization requires Git 2.36 or newer to establish its declared writer
-durability before immutable object files are closed.
-An active Shell installation from before the ownership protocol must exit once
-before its saved account can move to this controller; a remembered PID is
-neither a stop capability nor permission to start a second writer beside it.
-Engine's root-level device control file identifies an earlier installation
-format. Shell refuses that format before installing or starting an owner, or
-initializing machine or user ground; status and removal remain available.
-Stopping its process does not convert its credentials, journals or control files
-into current state or portable content. An owner-certified conversion must
-retire that layout before Shell can open it.
+An active installation from before the ownership protocol must exit once before
+its saved account can move to this controller; a remembered PID is neither a
+stop capability nor permission to start a second writer beside it.
 
 Every UI enters one finite setup operation. It serializes installation setup,
 selects the server-approved account, and either proves adoption without changing
@@ -185,8 +135,6 @@ changes it. Examinations inject their credential store explicitly.
    Upgrading the runtime means bumping a version, not merging code. Registry
    proof runs under the supported Node executable that launched the gate;
    ambient package-manager shims are not runtime evidence.
-   The selected Node executable also owns dependency install scripts; an OS
-   service's ambient search path cannot substitute another Node version.
 
 3. **Parity gates each released service.** The target begins with
    `amalgm-engine`'s runtime surface, then subtracts only owner-approved
@@ -203,25 +151,17 @@ changes it. Examinations inject their credential store explicitly.
    decisions receive effects explicitly and never discover ambient process
    state or disk on their own.
 
-5. **Bricks release independently; one installation owner adopts the graph.**
-   Shell carries allowed component identities and supported host contracts,
-   without bundling brick implementations or pinning their runtime versions.
-   A separately signed recipe selects exact compatible artifacts and dependency
-   graphs; compatible brick changes reuse unchanged Shell and UI artifacts.
-   Registry tags locate candidates; fresh TUF metadata authorizes adoption.
-   Bricks never update themselves, and one coherent tested graph governs each
-   activation and its recovery. Artifact identity is separate from process
-   lifetime: a changed in-process implementation requires draining its actual
-   process cohort even when Shell's bytes stay unchanged. Release proof checks
-   actual dependency resolutions and public contracts; it never forces all
-   consumers onto one untested Core version.
-
-   Accepted transition: current Shell packages still bundle a pinned SDK graph,
-   and the current updater stages one Shell archive. A brick change may therefore
-   temporarily require a checked Shell release while the boundary is completed;
-   this does not block initial delivery. The
-   [release contract](docs/release-environments-plan.md#current-release-contract--2026-09-08)
-   defines the required transition and distinguishes it from existing evidence.
+5. **Bricks never update themselves; the shell updates.** Every direct `@amalgm/*`
+   dependency is pinned to an exact version — no ranges. Publishing a brick
+   changes nothing on any user machine until the shell bumps its pin and ships
+   a new release through its lane's signed runtime authority. Registry tags
+   locate published artifacts; fresh TUF metadata selects installed adoption.
+   One version number, one atomic update, one combination that was
+   actually tested together — never a per-brick drift of versions in the wild.
+   The shrinkwrap fixes the transitive graph as well; direct pins do not
+   imply that every consumer resolves the same Core version. Release proof
+   checks those actual resolutions and their public contracts, and upgrades
+   affected consumers deliberately instead of forcing an untested override.
 
 The installed runtime follows the [update axioms](src/updates/README.md).
 Each public managed package declares its controller, process and state-format
@@ -523,8 +463,7 @@ Local profiles retain their selected sources and do not follow managed targets.
     or corrupt chunk, and proves the ordered whole-artifact hash. Durability
     is one explicit barrier over the whole staged tree — every file,
     duplicate, and repository — that must succeed before entity rows are
-    committed or ground is revealed; ordinary streamed files defer their flush
-    to that barrier. A
+    committed or ground is revealed; no staged file is fsynced on its own. A
     failed barrier leaves the intent retained, no rows committed, no visible
     destination, and staging re-proven as untrusted on retry. Links and
     repository transports keep their type-specific cache and adapter rails.
@@ -1052,7 +991,7 @@ Local profiles retain their selected sources and do not follow managed targets.
 
 65. **A Shell release is tested as the artifact users install.** The release
     gate packs Shell, installs that tarball with the exact public Amalgm
-    artifacts selected by the installation recipe, and exercises authorization
+    dependency versions declared by its manifest, and exercises authorization
     through Chat using package exports only. Sibling repositories and source
     paths are never an integration-test dependency.
 

package/dist/durability-barrier.d.ts

@@ -17,22 +17,6 @@
  * libuv's fsync is F_FULLFSYNC on macOS and FlushFileBuffers on Windows,
  * where NTFS's own log carries the directory entries with their files. A
  * directory-only fsync never guarantees file contents and is never used.
- *
- * A writer may instead acknowledge a file it durably flushed before closing
- * its write handle. The barrier accepts that evidence only while the exact
- * physical file, size, timestamps, and mode remain unchanged. Git owns the
- * flush of its immutable objects; neither their names nor their read-only
- * permissions exempt them from this law. Evidence is invocation-local and
- * must be re-established when retained staging is materialized again.
- * Writer and barrier use the OS-native physical path, so filesystem aliases
- * cannot introduce a second identity for the same writer output.
  */
-/** An acknowledgement from the file's writer, never persisted as authority. */
-export interface DurableFile {
-    readonly path: string;
-    readonly identity: string;
-}
-/** Call only after the producer has successfully flushed this file. */
-export declare function recordFileDurability(path: string): DurableFile;
-export type DurabilityBarrier = (root: string, durableFiles?: readonly DurableFile[]) => Promise<void>;
+export type DurabilityBarrier = (root: string) => Promise<void>;
 export declare const durabilityBarrier: DurabilityBarrier;

package/dist/durability-barrier.js

@@ -17,57 +17,21 @@
  * libuv's fsync is F_FULLFSYNC on macOS and FlushFileBuffers on Windows,
  * where NTFS's own log carries the directory entries with their files. A
  * directory-only fsync never guarantees file contents and is never used.
- *
- * A writer may instead acknowledge a file it durably flushed before closing
- * its write handle. The barrier accepts that evidence only while the exact
- * physical file, size, timestamps, and mode remain unchanged. Git owns the
- * flush of its immutable objects; neither their names nor their read-only
- * permissions exempt them from this law. Evidence is invocation-local and
- * must be re-established when retained staging is materialized again.
- * Writer and barrier use the OS-native physical path, so filesystem aliases
- * cannot introduce a second identity for the same writer output.
  */
 import { execFile } from "node:child_process";
-import { constants, lstatSync, realpathSync } from "node:fs";
-import { lstat, open, readdir, realpath } from "node:fs/promises";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { constants } from "node:fs";
+import { lstat, open, readdir } from "node:fs/promises";
+import { join } from "node:path";
 import { promisify } from "node:util";
 import { boundedForEach } from "./bounded-for-each.js";
 const execFileAsync = promisify(execFile);
 /** Handles in flight while a tree is flushed entry by entry. */
 const FLUSH_CONCURRENCY = 16;
-function fileIdentity(stats) {
-    return [stats.dev, stats.ino, stats.size, stats.mtimeNs, stats.ctimeNs, stats.mode].join(":");
-}
-/** Call only after the producer has successfully flushed this file. */
-export function recordFileDurability(path) {
-    const stats = lstatSync(path, { bigint: true });
-    if (!stats.isFile())
-        throw new Error(`durable writer output is not a regular file: ${path}`);
-    const physical = realpathSync.native(path);
-    return { path: physical, identity: fileIdentity(stats) };
-}
-async function validateDurableFiles(root, files) {
-    const paths = new Set();
-    for (const file of files) {
-        const local = relative(root, file.path);
-        if (resolve(file.path) !== file.path || !local || isAbsolute(local)
-            || local === ".." || local.startsWith(`..${sep}`) || paths.has(file.path)) {
-            throw new Error(`durable writer output is not a unique file within staging: ${file.path}`);
-        }
-        const stats = await lstat(file.path, { bigint: true });
-        if (!stats.isFile() || fileIdentity(stats) !== file.identity || await realpath(file.path) !== file.path) {
-            throw new Error(`durable writer output changed before the barrier: ${file.path}`);
-        }
-        paths.add(file.path);
-    }
-    return paths;
-}
 async function syncFilesystem(root) {
     await execFileAsync("sync", ["-f", root]);
 }
-async function flushEntry(path, writable) {
-    const handle = await open(path, (writable ? constants.O_RDWR : constants.O_RDONLY) | constants.O_NOFOLLOW);
+async function flushEntry(path) {
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
     try {
         await handle.sync();
     }
@@ -75,7 +39,7 @@ async function flushEntry(path, writable) {
         await handle.close();
     }
 }
-async function syncTree(root, durableFiles) {
+async function syncTree(root) {
     const files = [];
     const directories = [root];
     for (let index = 0; index < directories.length; index += 1) {
@@ -84,30 +48,21 @@ async function syncTree(root, durableFiles) {
             const path = join(directory, entry.name);
             if (entry.isDirectory())
                 directories.push(path);
-            else if (entry.isFile() && !durableFiles.has(path))
+            else if (entry.isFile())
                 files.push(path);
         }
     }
-    // FlushFileBuffers requires a write-capable regular-file handle. Directory
-    // handles retain their separate POSIX contract; Windows does not open them.
-    await boundedForEach(files, FLUSH_CONCURRENCY, (path) => flushEntry(path, process.platform === "win32"));
-    if (process.platform !== "win32") {
-        await boundedForEach(directories, FLUSH_CONCURRENCY, (path) => flushEntry(path, false));
-    }
+    const flushed = process.platform === "win32" ? files : [...files, ...directories];
+    await boundedForEach(flushed, FLUSH_CONCURRENCY, flushEntry);
 }
-export const durabilityBarrier = async (root, durableFiles = []) => {
+const platformBarrier = process.platform === "linux" ? syncFilesystem : syncTree;
+export const durabilityBarrier = async (root) => {
     try {
         const stats = await lstat(root);
         if (!stats.isDirectory() || stats.isSymbolicLink()) {
             throw new Error("staging root is not a physical directory");
         }
-        const physical = await realpath(root);
-        const acknowledged = await validateDurableFiles(physical, durableFiles);
-        if (process.platform === "linux")
-            await syncFilesystem(physical);
-        else
-            await syncTree(physical, acknowledged);
-        await validateDurableFiles(physical, durableFiles);
+        await platformBarrier(root);
     }
     catch (error) {
         const detail = error instanceof Error ? error.message : String(error);

package/dist/durability-barrier.js.map

@@ -1 +1 @@
-{"version":3,"file":"durability-barrier.js","sourceRoot":"","sources":["../src/durability-barrier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAoB,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAQ7B,SAAS,YAAY,CAAC,KAAkB;IACtC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChG,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAID,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,KAA6B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;eAC9D,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,8DAA8D,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACxG,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,QAAiB;IACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3G,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,YAAiC;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAW,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC3C,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,cAAc,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAsB,KAAK,EAAE,IAAI,EAAE,YAAY,GAAG,EAAE,EAAE,EAAE;IACpF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;;YAC5D,MAAM,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"durability-barrier.js","sourceRoot":"","sources":["../src/durability-barrier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAI7B,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAW,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC3C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,WAAW,CAAC,CAAC;IAClF,MAAM,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;AAEjF,MAAM,CAAC,MAAM,iBAAiB,GAAsB,KAAK,EAAE,IAAI,EAAE,EAAE;IACjE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC,CAAC"}

package/dist/entity-apply-host.js

@@ -45,8 +45,7 @@ const portable = (row) => ({
     fileMode: portableFileMode(row.type, row.filesystemMode),
 });
 function fsyncFile(path) {
-    // Windows FlushFileBuffers requires write access to a regular file.
-    const fd = openSync(path, process.platform === "win32" ? "r+" : "r");
+    const fd = openSync(path, "r");
     try {
         fsyncSync(fd);
     }
@@ -54,48 +53,26 @@ function fsyncFile(path) {
         closeSync(fd);
     }
 }
-/** POSIX directory fsync makes the rename durable. Windows carries directory
- * entries through its file flush contract and does not open directory handles. */
+/** Directory fsync makes the rename itself durable; platforms that refuse
+ * opening or syncing a directory (Windows) already order it themselves. */
 function fsyncDirectory(path) {
-    if (process.platform === "win32")
+    let fd;
+    try {
+        fd = openSync(path, "r");
+    }
+    catch {
         return;
-    const fd = openSync(path, "r");
+    }
     try {
         fsyncSync(fd);
     }
+    catch {
+        // EINVAL on filesystems without directory sync; the data fsync stands.
+    }
     finally {
         closeSync(fd);
     }
 }
-/** Presence and absence both belong to directory entries. A removed parent
- * cone is owned by its first surviving ancestor; only ENOENT allows climbing
- * to that owner. Moves settle the old parent as well as the new parent. */
-function fsyncAddressParents(addresses) {
-    if (process.platform === "win32")
-        return;
-    const directories = new Set();
-    for (const address of addresses) {
-        let directory = dirname(address);
-        while (true) {
-            try {
-                const stats = lstatSync(directory);
-                if (!stats.isDirectory() || stats.isSymbolicLink()) {
-                    throw new Error(`Apply directory entry owner is not a physical directory: ${directory}`);
-                }
-                break;
-            }
-            catch (error) {
-                const parent = dirname(directory);
-                if (error.code !== "ENOENT" || parent === directory)
-                    throw error;
-                directory = parent;
-            }
-        }
-        directories.add(directory);
-    }
-    for (const directory of directories)
-        fsyncDirectory(directory);
-}
 const tryLstat = (path) => {
     try {
         return lstatSync(path);
@@ -639,15 +616,6 @@ export class EntityApplyHost {
                 this.#releaseGround(intent);
                 return { kind: "local-change" };
             }
-            // Matching visible bytes prove content, not durable completion. A
-            // recovered already-target guard may have skipped reveal after its
-            // rename became visible but its directory flush failed. Verify owns the
-            // final acknowledgement, including pre-existing targets and retries.
-            if (plan.target.status === "active"
-                && (plan.target.type === "file.text" || plan.target.type === "file.binary")) {
-                fsyncFile(context.targetPath);
-            }
-            fsyncAddressParents(this.applyAddresses(intent, plan));
             if (plan.target.type === "repo.git" && plan.target.status === "active") {
                 const repository = await this.#repositoryRows(intent, plan, context);
                 this.store.stageVerification(intent, repository.rows, repository.removals);