@amalgm/shell 0.1.164-preview.36072132286 → 0.1.164-preview.36809057014

package/dist/service/recovery.d.ts

@@ -1,27 +1,28 @@
-import { type ChildRestartPolicy } from '@amalgm/core/supervision';
+import { type RestartPolicy } from './policy.js';
 import type { ServiceIdentity } from './registration.js';
 export interface RecoveryState {
     readonly attempts: number;
-    readonly maxAttempts: number;
     readonly generation: string | null;
     readonly lastFailure: string | null;
+    readonly lastFailureAt: string | null;
     readonly lastHealthyGeneration: string | null;
     readonly lastHealthyAt: string | null;
-    readonly parked: boolean;
 }
 /** Only the controller holding the installation lease opens this journal.
- * Charge Core's allowance before the host effect: even death during spawn
- * cannot turn controller replacement into a fresh recovery budget. */
+ * Charge each start before the host effect so controller replacement cannot
+ * reset the backoff; a sustained healthy run is the only thing that does. */
 export declare class RuntimeRecovery {
-    readonly policy: ChildRestartPolicy;
+    readonly policy: RestartPolicy;
     private readonly database;
-    readonly maxAttempts: number;
-    constructor(identity: ServiceIdentity, policy?: ChildRestartPolicy);
+    constructor(identity: ServiceIdentity, policy?: RestartPolicy);
     get state(): RecoveryState;
+    /** The backoff counts from the last failure, so time already spent down —
+     * a reboot, a controller replacement — is never waited again. */
     get delayMs(): number;
     begin(generation: string): void;
     healthy(generation: string): void;
     exited(generation: string, failure: string | null): void;
-    retry(): void;
+    /** Operator retry and an authorized update both start without waiting. */
+    reset(): void;
     close(): void;
 }

package/dist/service/recovery.js

@@ -1,16 +1,15 @@
-import { CHILD_RESTART_POLICY } from '@amalgm/core/supervision';
 import { join } from 'node:path';
 import { openFileDatabase } from '../sqlite.js';
+import { backoffMs } from '../updates/bootstrap.js';
+import { ALWAYS_ON_POLICY } from './policy.js';
 /** Only the controller holding the installation lease opens this journal.
- * Charge Core's allowance before the host effect: even death during spawn
- * cannot turn controller replacement into a fresh recovery budget. */
+ * Charge each start before the host effect so controller replacement cannot
+ * reset the backoff; a sustained healthy run is the only thing that does. */
 export class RuntimeRecovery {
     policy;
     database;
-    maxAttempts;
-    constructor(identity, policy = CHILD_RESTART_POLICY) {
+    constructor(identity, policy = ALWAYS_ON_POLICY.restart) {
         this.policy = policy;
-        this.maxAttempts = policy.maxRestarts + 1;
         this.database = openFileDatabase(join(identity.serviceDir, 'recovery.sqlite'));
         try {
             this.database.pragma('synchronous = FULL');
@@ -19,8 +18,13 @@ export class RuntimeRecovery {
         attempts INTEGER NOT NULL CHECK (attempts >= 0),
         generation TEXT, lastFailure TEXT, lastHealthyGeneration TEXT, lastHealthyAt TEXT
       );
-      INSERT OR IGNORE INTO recovery (id, attempts) VALUES (1, 0);
-      UPDATE recovery SET generation = NULL,
+      INSERT OR IGNORE INTO recovery (id, attempts) VALUES (1, 0);`);
+            const columns = this.database.pragma('table_info(recovery)');
+            if (!columns.some(column => column.name === 'lastFailureAt'))
+                this.database.exec('ALTER TABLE recovery ADD COLUMN lastFailureAt TEXT');
+            // The failure time stays the runtime's own: a controller that died
+            // around a healthy runtime is no reason to delay its next start.
+            this.database.exec(`UPDATE recovery SET generation = NULL,
         lastFailure = 'Controller exited before its runtime drained'
         WHERE generation IS NOT NULL;`);
         }
@@ -30,28 +34,34 @@ export class RuntimeRecovery {
         }
     }
     get state() {
-        const row = this.database.prepare('SELECT attempts, generation, lastFailure, lastHealthyGeneration, lastHealthyAt FROM recovery WHERE id = 1').get();
-        return { ...row, maxAttempts: this.maxAttempts, parked: row.generation === null && row.attempts >= this.maxAttempts };
+        return this.database.prepare('SELECT attempts, generation, lastFailure, lastFailureAt, lastHealthyGeneration, lastHealthyAt FROM recovery WHERE id = 1').get();
     }
+    /** The backoff counts from the last failure, so time already spent down —
+     * a reboot, a controller replacement — is never waited again. */
     get delayMs() {
-        const { attempts } = this.state;
-        return attempts === 0 ? 0 : Math.min(this.policy.initialDelayMs * 2 ** (attempts - 1), this.policy.maxDelayMs);
+        const { attempts, lastFailureAt } = this.state;
+        const delay = backoffMs(this.policy, attempts);
+        if (!delay || !lastFailureAt)
+            return 0;
+        return Math.min(delay, Math.max(0, delay - (Date.now() - Date.parse(lastFailureAt))));
     }
     begin(generation) {
-        const result = this.database.prepare('UPDATE recovery SET attempts = attempts + 1, generation = ? WHERE id = 1 AND generation IS NULL AND attempts < ?').run(generation, this.maxAttempts);
+        const result = this.database.prepare('UPDATE recovery SET attempts = attempts + 1, generation = ? WHERE id = 1 AND generation IS NULL').run(generation);
         if (result.changes !== 1)
-            throw new Error('The runtime recovery allowance is exhausted or a generation is still owned.');
+            throw new Error('A runtime generation is still owned.');
     }
     healthy(generation) {
-        this.database.prepare('UPDATE recovery SET attempts = 0, lastFailure = NULL, lastHealthyGeneration = ?, lastHealthyAt = ? WHERE id = 1 AND generation = ?')
+        this.database.prepare('UPDATE recovery SET attempts = 0, lastFailure = NULL, lastFailureAt = NULL, lastHealthyGeneration = ?, lastHealthyAt = ? WHERE id = 1 AND generation = ?')
             .run(generation, new Date().toISOString(), generation);
     }
     exited(generation, failure) {
-        this.database.prepare('UPDATE recovery SET generation = NULL, lastFailure = COALESCE(?, lastFailure) WHERE id = 1 AND generation = ?')
-            .run(failure?.slice(0, 1_024) ?? null, generation);
+        this.database.prepare(`UPDATE recovery SET generation = NULL, lastFailure = COALESCE(@failure, lastFailure),
+      lastFailureAt = CASE WHEN @failure IS NULL THEN lastFailureAt ELSE @at END WHERE id = 1 AND generation = @generation`)
+            .run({ failure: failure?.slice(0, 1_024) ?? null, at: new Date().toISOString(), generation });
     }
-    retry() {
-        this.database.prepare('UPDATE recovery SET attempts = 0, lastFailure = NULL WHERE id = 1 AND generation IS NULL AND attempts >= ?').run(this.maxAttempts);
+    /** Operator retry and an authorized update both start without waiting. */
+    reset() {
+        this.database.prepare('UPDATE recovery SET attempts = 0 WHERE id = 1').run();
     }
     close() { this.database.close(); }
 }

package/dist/service/recovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../src/service/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAA2B,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAahD;;sEAEsE;AACtE,MAAM,OAAO,eAAe;IAIsB;IAH/B,QAAQ,CAAC;IACjB,WAAW,CAAS;IAE7B,YAAY,QAAyB,EAAW,SAA6B,oBAAoB;QAAjD,WAAM,GAAN,MAAM,CAA2C;QAC/F,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;;;;;;;;sCAQa,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACzD,CAAC;IAED,IAAI,KAAK;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,2GAA2G,CAAC,CAAC,GAAG,EAAmD,CAAC;QACtM,OAAO,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;IACxH,CAAC;IAED,IAAI,OAAO;QACT,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAChC,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjH,CAAC;IAED,KAAK,CAAC,UAAkB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,kHAAkH,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3L,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC3H,CAAC;IAED,OAAO,CAAC,UAAkB;QACxB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,oIAAoI,CAAC;aACxJ,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,UAAkB,EAAE,OAAsB;QAC/C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,+GAA+G,CAAC;aACnI,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,4GAA4G,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5J,CAAC;IAED,KAAK,KAAW,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CACzC"}
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../src/service/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAsB,MAAM,aAAa,CAAC;AAYnE;;6EAE6E;AAC7E,MAAM,OAAO,eAAe;IAGsB;IAF/B,QAAQ,CAAC;IAE1B,YAAY,QAAyB,EAAW,SAAwB,gBAAgB,CAAC,OAAO;QAAhD,WAAM,GAAN,MAAM,CAA0C;QAC9F,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;;;;;mEAK0C,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAuB,CAAC;YACnF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACvI,mEAAmE;YACnE,iEAAiE;YACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;;sCAEa,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACzD,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,0HAA0H,CAAC,CAAC,GAAG,EAAmB,CAAC;IAClL,CAAC;IAED;qEACiE;IACjE,IAAI,OAAO;QACT,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa;YAAE,OAAO,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,UAAkB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iGAAiG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxJ,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,CAAC,UAAkB;QACxB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,0JAA0J,CAAC;aAC9K,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,UAAkB,EAAE,OAAsB;QAC/C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;2HACiG,CAAC;aACrH,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,0EAA0E;IAC1E,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,KAAW,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CACzC"}

package/dist/service/windows-action.d.ts

@@ -1,4 +1,4 @@
-import { type ChildRestartPolicy } from '@amalgm/core/supervision';
+import { type RestartPolicy } from './policy.js';
 export declare const encodePowerShell: (source: string) => string;
 export declare function jsonExpression(value: unknown): string;
 export declare function powershellExecutable(env?: NodeJS.ProcessEnv): string;
@@ -9,8 +9,10 @@ export declare function quoteWindowsArgument(value: string): string;
  * https://learn.microsoft.com/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw */
 export declare function powershellArguments(encoded: string, hidden?: boolean): string[];
 /** Scheduler owns this action's logged-in lifetime. Its launch-retry setting
- * cannot observe controller exits, so this native port applies Core's policy.
+ * cannot observe controller exits, so this action restarts the controller
+ * itself: every exit except an operator stop (0) is retried after a doubling
+ * delay capped at the policy's maximum, for as long as the user is logged in.
  * Self-assignment before launch avoids a spawn/assign race. The action alone
  * owns the non-inheritable job handle, which the OS closes on action death.
  * https://learn.microsoft.com/windows/win32/procthread/job-objects */
-export declare function windowsControllerAction(command: readonly string[], workingDirectory: string, restartPolicy?: ChildRestartPolicy): string;
+export declare function windowsControllerAction(command: readonly string[], workingDirectory: string, restartPolicy?: RestartPolicy): string;

package/dist/service/windows-action.js

@@ -1,5 +1,5 @@
 import { win32 } from 'node:path';
-import { CHILD_RESTART_POLICY } from '@amalgm/core/supervision';
+import { ALWAYS_ON_POLICY } from './policy.js';
 export const encodePowerShell = (source) => Buffer.from(source, 'utf16le').toString('base64');
 export function jsonExpression(value) {
     return `ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${Buffer.from(JSON.stringify(value), 'utf8').toString('base64')}')))`;
@@ -24,11 +24,13 @@ export function powershellArguments(encoded, hidden = false) {
     return args;
 }
 /** Scheduler owns this action's logged-in lifetime. Its launch-retry setting
- * cannot observe controller exits, so this native port applies Core's policy.
+ * cannot observe controller exits, so this action restarts the controller
+ * itself: every exit except an operator stop (0) is retried after a doubling
+ * delay capped at the policy's maximum, for as long as the user is logged in.
  * Self-assignment before launch avoids a spawn/assign race. The action alone
  * owns the non-inheritable job handle, which the OS closes on action death.
  * https://learn.microsoft.com/windows/win32/procthread/job-objects */
-export function windowsControllerAction(command, workingDirectory, restartPolicy = CHILD_RESTART_POLICY) {
+export function windowsControllerAction(command, workingDirectory, restartPolicy = ALWAYS_ON_POLICY.restart) {
     if (!command.length || !command[0])
         throw new Error('The controller needs an executable.');
     const action = encodePowerShell(`
@@ -106,7 +108,6 @@ $start.WorkingDirectory = $launch.workingDirectory
 $start.UseShellExecute = $false
 $start.CreateNoWindow = $true
 $clock = [Diagnostics.Stopwatch]::StartNew()
-$history = @()
 $delay = $policy.initialDelayMs
 while ($true) {
   $started = $clock.ElapsedMilliseconds
@@ -119,11 +120,7 @@ while ($true) {
   } catch { [Console]::Error.WriteLine($_.Exception.Message) }
   finally { if ($runtimeProcess) { $runtimeProcess.Dispose() } }
   if ($result -eq 0) { exit 0 }
-  $now = $clock.ElapsedMilliseconds
-  if ($now - $started -ge $policy.stableAfterMs) { $delay = $policy.initialDelayMs; $history = @() }
-  $history = @($history | Where-Object { $now - $_ -le $policy.windowMs })
-  if ($history.Count -ge $policy.maxRestarts) { exit $result }
-  $history += $now
+  if ($clock.ElapsedMilliseconds - $started -ge $policy.stableAfterMs) { $delay = $policy.initialDelayMs }
   Start-Sleep -Milliseconds $delay
   $delay = [Math]::Min($delay * 2, $policy.maxDelayMs)
 }

package/dist/service/windows-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"windows-action.js","sourceRoot":"","sources":["../../src/service/windows-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAA2B,MAAM,0BAA0B,CAAC;AAEzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9G,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,kFAAkF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;AAC/J,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAChH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED;;yGAEyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAM,GAAG,KAAK;IACjE,MAAM,IAAI,GAAG,CAAC,YAAY,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC1H,IAAI,CAAC,oBAAoB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;QAC9F,MAAM,IAAI,UAAU,CAAC,wFAAwF,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;sEAIsE;AACtE,MAAM,UAAU,uBAAuB,CAAC,OAA0B,EAAE,gBAAwB,EAC1F,gBAAoC,oBAAoB;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAkEtB,cAAc,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,CAAC;YAC7H,cAAc,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BxC,CAAC,CAAC;IACD,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"windows-action.js","sourceRoot":"","sources":["../../src/service/windows-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAsB,MAAM,aAAa,CAAC;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9G,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,kFAAkF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;AAC/J,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAChH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED;;yGAEyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAM,GAAG,KAAK;IACjE,MAAM,IAAI,GAAG,CAAC,YAAY,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC1H,IAAI,CAAC,oBAAoB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;QAC9F,MAAM,IAAI,UAAU,CAAC,wFAAwF,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;sEAMsE;AACtE,MAAM,UAAU,uBAAuB,CAAC,OAA0B,EAAE,gBAAwB,EAC1F,gBAA+B,gBAAgB,CAAC,OAAO;IACvD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAkEtB,cAAc,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,CAAC;YAC7H,cAAc,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;CAwBxC,CAAC,CAAC;IACD,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/service/windows-task.js

@@ -1,4 +1,3 @@
-import { CHILD_RESTART_POLICY } from '@amalgm/core/supervision';
 import { encodePowerShell, powershellArguments, powershellExecutable, quoteWindowsArgument } from './windows-action.js';
 export { encodePowerShell, powershellExecutable, quoteWindowsArgument, windowsControllerAction } from './windows-action.js';
 /** All input is structured JSON transported as ASCII stdin and decoded as UTF-8.
@@ -9,12 +8,13 @@ export function windowsTaskOperation(input) {
     const executable = powershellExecutable();
     const request = { operation: input.operation, name: input.name, executable,
         ...(input.action ? { arguments: powershellArguments(input.action, true).map(quoteWindowsArgument).join(' ') } : {}),
-        restartCount: CHILD_RESTART_POLICY.maxRestarts,
-        // MS-TSCH 2.5.4.2: these retries cover failure to start an action, not its exit.
+        // MS-TSCH 2.5.4.2: these retries cover failure to start an action, not its
+        // exit, which the action itself retries. Both values are the schema's
+        // bounds: the most retries, one minute apart.
         // https://learn.microsoft.com/openspecs/windows_protocols/ms-tsch/2ff4aa5a-7bc4-449f-bbb1-27475645867f
-        // Task Scheduler's supported minimum is one minute.
         // https://learn.microsoft.com/windows/win32/taskschd/taskschedulerschema-restarttype-complextype
-        restartIntervalMs: Math.max(60_000, CHILD_RESTART_POLICY.initialDelayMs) };
+        restartCount: 999,
+        restartIntervalMs: 60_000 };
     const command = encodePowerShell(`
 $ErrorActionPreference = 'Stop'
 $request = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([Console]::In.ReadToEnd())))

package/dist/service/windows-task.js.map

@@ -1 +1 @@
-{"version":3,"file":"windows-task.js","sourceRoot":"","sources":["../../src/service/windows-task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAI5H;;;+EAG+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU;QACxE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,YAAY,EAAE,oBAAoB,CAAC,WAAW;QAC9C,iFAAiF;QACjF,uGAAuG;QACvG,oDAAoD;QACpD,iGAAiG;QACjG,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BlC,CAAC,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACpI,CAAC"}
+{"version":3,"file":"windows-task.js","sourceRoot":"","sources":["../../src/service/windows-task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAI5H;;;+EAG+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU;QACxE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,2EAA2E;QAC3E,sEAAsE;QACtE,8CAA8C;QAC9C,uGAAuG;QACvG,iGAAiG;QACjG,YAAY,EAAE,GAAG;QACjB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BlC,CAAC,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACpI,CAAC"}

package/dist/sharing-admission.d.ts

@@ -0,0 +1,17 @@
+/** Transaction-local provenance for the sharing baseline. The only durable
+ * value is its originating mutation ID on the existing notebook row. */
+import { type LocalEntityRecord } from "@amalgm/live";
+import type Database from "better-sqlite3";
+import { type GroundRow } from "./ground-row.js";
+import type { GroundTransition } from "./ground-basis.js";
+export type SharingWrite = "replace" | "retain-equivalent";
+export declare function sameSharingResult(before: GroundRow, after: GroundRow): boolean;
+export declare class SharingAdmission {
+    #private;
+    constructor(database: Database.Database);
+    batch(get: (uuid: string) => GroundRow | undefined): {
+        changed(before: GroundRow | undefined, after: GroundRow | undefined, mode: SharingWrite): void;
+        admit(record: LocalEntityRecord): string;
+        finish(transitions: Iterable<GroundTransition>): ReadonlyMap<string, string | null>;
+    };
+}

package/dist/sharing-admission.js

@@ -0,0 +1,128 @@
+/** Transaction-local provenance for the sharing baseline. The only durable
+ * value is its originating mutation ID on the existing notebook row. */
+import { assertRecord, checkLocalEntityRecord, encodeEntityRecord } from "@amalgm/live";
+import { portableGroundRecord } from "./ground-row.js";
+export function sameSharingResult(before, after) {
+    return before.resourceId === after.resourceId
+        && JSON.stringify(portableGroundRecord(before)) === JSON.stringify(portableGroundRecord(after));
+}
+/** A nested repository contributes its placement, never its independent head. */
+function sameRepositoryPlacement(before, after) {
+    return before?.type === "repo.git" && after?.type === "repo.git"
+        && before.resourceId === after.resourceId && before.rootUUID === after.rootUUID
+        && before.parentUUID === after.parentUUID && before.name === after.name
+        && before.status === after.status;
+}
+export class SharingAdmission {
+    #database;
+    #append;
+    constructor(database) {
+        this.#database = database;
+        this.#append = database.prepare(`INSERT INTO record_outbox(
+      mutation_id, authority_id, entity_id, record_json, status, global_sequence, created_at, accepted_at
+      ) VALUES (?, ?, ?, ?, 'pending', NULL, ?, NULL)`);
+    }
+    batch(get) {
+        const touched = new Map();
+        const placements = new Map();
+        const admitted = new Map();
+        let sealed = false;
+        return {
+            changed(before, after, mode) {
+                if (sealed)
+                    throw new Error("sharing projection cannot change after Record admission");
+                if (mode === "retain-equivalent" && before && after && sameSharingResult(before, after)) {
+                    if (before.relativePath !== after.relativePath || before.rootUUID !== after.rootUUID) {
+                        placements.set(before.uuid, { before: placements.get(before.uuid)?.before ?? before, after });
+                    }
+                    return;
+                }
+                const uuid = (after ?? before)?.uuid;
+                if (!uuid)
+                    return;
+                const previous = touched.get(uuid);
+                touched.set(uuid, { before: previous ? previous.before : before, after });
+            },
+            // A repository's package is its territory, which the admitting unit's
+            // basis holds unchanged since the rows it was built from.
+            admit: (record) => {
+                sealed = true;
+                if (admitted.has(record.entityId))
+                    throw new Error("one sharing batch cannot admit two records for one entity");
+                const row = get(record.entityId);
+                const valid = checkLocalEntityRecord(record);
+                if (!valid.ok)
+                    throw new Error(valid.error);
+                if (!row || row.resourceId !== record.authorityId || record.change.origin !== "detected"
+                    || JSON.stringify(portableGroundRecord(row)) !== JSON.stringify(assertRecord(record.change.result))) {
+                    throw new Error("sharing admission requires its exact selected result");
+                }
+                const json = encodeEntityRecord(record);
+                this.#append.run(record.mutationId, record.authorityId, record.entityId, json, record.createdAt);
+                admitted.set(record.entityId, record);
+                return json;
+            },
+            finish: transitions => {
+                if (!this.#database.inTransaction)
+                    throw new Error("sharing admission belongs to a ground transaction");
+                const originals = new Map([...transitions].filter(change => change.inventory === "detection_notebook")
+                    .map(change => [(change.after ?? change.before).uuid, change.before]));
+                const original = (uuid) => originals.has(uuid) ? originals.get(uuid) : get(uuid);
+                const invalid = new Set(touched.keys());
+                const owner = (row, read) => {
+                    if (!row || row.uuid === row.rootUUID)
+                        return null;
+                    const seen = new Set();
+                    let uuid = row?.parentUUID;
+                    while (uuid) {
+                        if (seen.has(uuid))
+                            throw new Error("sharing ancestry contains a cycle");
+                        seen.add(uuid);
+                        const parent = read(uuid);
+                        if (!parent && uuid === row.rootUUID)
+                            return null; // An unmaterialized boundary has no local certificate.
+                        if (!parent)
+                            throw new Error("sharing owner has incomplete original ancestry");
+                        if (parent.type === "repo.git")
+                            return parent;
+                        if (parent.uuid === row.rootUUID)
+                            return null;
+                        uuid = parent.parentUUID;
+                    }
+                    return null;
+                };
+                for (const { before, after } of touched.values()) {
+                    if (sameRepositoryPlacement(before, after))
+                        continue;
+                    for (const root of [owner(before, original), owner(after, get)])
+                        if (root)
+                            invalid.add(root.uuid);
+                }
+                for (const { before, after } of placements.values()) {
+                    const priorOwner = owner(before, original), nextOwner = owner(after, get);
+                    const address = (member, root) => root
+                        ? member.relativePath.slice(root.relativePath ? root.relativePath.length + 1 : 0) : null;
+                    if (priorOwner?.uuid === nextOwner?.uuid && address(before, priorOwner) === address(after, nextOwner))
+                        continue;
+                    for (const root of [priorOwner, nextOwner])
+                        if (root)
+                            invalid.add(root.uuid);
+                }
+                const changes = new Map();
+                for (const uuid of new Set([...invalid, ...admitted.keys()])) {
+                    const row = get(uuid);
+                    if (!row)
+                        continue;
+                    const next = admitted.get(uuid)?.mutationId ?? null;
+                    // A newly inserted row starts without provenance. Cold declaration
+                    // needs no extra write to erase a certificate that never existed.
+                    if (next === null && !original(uuid))
+                        continue;
+                    changes.set(uuid, next);
+                }
+                return changes;
+            },
+        };
+    }
+}
+//# sourceMappingURL=sharing-admission.js.map

package/dist/sharing-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharing-admission.js","sourceRoot":"","sources":["../src/sharing-admission.ts"],"names":[],"mappings":"AAAA;wEACwE;AACxE,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAA0B,MAAM,cAAc,CAAC;AAEhH,OAAO,EAAE,oBAAoB,EAAkB,MAAM,iBAAiB,CAAC;AAKvE,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,KAAgB;IACnE,OAAO,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;WACxC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,MAA6B,EAAE,KAA4B;IAC1F,OAAO,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU;WAC3D,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;WAC5E,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;WACpE,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;AACtC,CAAC;AAED,MAAM,OAAO,gBAAgB;IAClB,SAAS,CAAoB;IAC7B,OAAO,CAAqB;IAErC,YAAY,QAA2B;QACrC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;;sDAEkB,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAA4C;QAKhD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2E,CAAC;QACnG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmD,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;QACtD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,OAAO;YACL,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI;gBACzB,IAAI,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBACvF,IAAI,IAAI,KAAK,mBAAmB,IAAI,MAAM,IAAI,KAAK,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;oBACxF,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;wBACrF,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChG,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,IAAI,CAAC;gBACrC,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,sEAAsE;YACtE,0DAA0D;YAC1D,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;gBAChB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAChH,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU;uBACnF,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACtG,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,WAAW,CAAC,EAAE;gBACpB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACxG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAC;qBACnG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC1E,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAyB,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,CAAC,GAA0B,EAAE,IAA6C,EAAoB,EAAE;oBAC5G,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ;wBAAE,OAAO,IAAI,CAAC;oBACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;oBAC/B,IAAI,IAAI,GAAG,GAAG,EAAE,UAAU,CAAC;oBAC3B,OAAO,IAAI,EAAE,CAAC;wBACZ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;wBACzE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACf,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC1B,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,QAAQ;4BAAE,OAAO,IAAI,CAAC,CAAC,uDAAuD;wBAC1G,IAAI,CAAC,MAAM;4BAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;wBAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;4BAAE,OAAO,MAAM,CAAC;wBAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ;4BAAE,OAAO,IAAI,CAAC;wBAC9C,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;oBAC3B,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC;gBACF,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;oBACjD,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC;wBAAE,SAAS;oBACrD,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;wBAAE,IAAI,IAAI;4BAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpG,CAAC;gBACD,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;oBACpD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC1E,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAE,IAAsB,EAAiB,EAAE,CAAC,IAAI;wBAChF,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC3F,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS,EAAE,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC;wBAAE,SAAS;oBAChH,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC;wBAAE,IAAI,IAAI;4BAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/E,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;gBACjD,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;oBACtB,IAAI,CAAC,GAAG;wBAAE,SAAS;oBACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;oBACpD,mEAAmE;oBACnE,kEAAkE;oBAClE,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC/C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/snapshot-delivery-baseline.d.ts

@@ -6,7 +6,16 @@
  * or below N are history rather than Apply work. Per-entity cursors remain
  * lazy: the first later delivery proves its predecessor from this complete
  * authority prefix.
+ *
+ * A cursor that jumps to N never received the records it skipped, so N
+ * becomes the history floor: the Inbox holds every authority record in
+ * (floor, cursor], and nothing below the floor may be read as a tail.
  */
-import Database from "better-sqlite3";
-export declare function ensureSnapshotDeliveryBaselineTable(database: Database.Database): void;
-export declare function adoptSnapshotDeliveryBaseline(database: Database.Database, authorityId: string, deliverySequence: number, now?: number): number;
+import type Database from "better-sqlite3";
+/** `record.adoptSnapshotBaseline`, run only by the ground file's saver thread
+ * (ground-saver.ts): how many retained Inbox rows N resolves. */
+export declare function adoptSnapshotDeliveryBaseline(database: Database.Database, input: {
+    readonly authorityId: string;
+    readonly deliverySequence: number;
+    readonly now: number;
+}): number;

package/dist/snapshot-delivery-baseline.js

@@ -6,53 +6,52 @@
  * or below N are history rather than Apply work. Per-entity cursors remain
  * lazy: the first later delivery proves its predecessor from this complete
  * authority prefix.
+ *
+ * A cursor that jumps to N never received the records it skipped, so N
+ * becomes the history floor: the Inbox holds every authority record in
+ * (floor, cursor], and nothing below the floor may be read as a tail.
  */
-export function ensureSnapshotDeliveryBaselineTable(database) {
-    database.exec(`
-    CREATE TABLE IF NOT EXISTS authority_snapshot_baselines (
-      authority_id TEXT PRIMARY KEY,
-      delivery_sequence INTEGER NOT NULL CHECK(delivery_sequence >= 0)
-    )
-  `);
-}
-export function adoptSnapshotDeliveryBaseline(database, authorityId, deliverySequence, now = Date.now()) {
+import { cachedStatement } from "./sqlite.js";
+/** `record.adoptSnapshotBaseline`, run only by the ground file's saver thread
+ * (ground-saver.ts): how many retained Inbox rows N resolves. */
+export function adoptSnapshotDeliveryBaseline(database, input) {
+    const { authorityId, deliverySequence, now } = input;
     if (!authorityId)
         throw new Error("snapshot delivery authority is required");
     if (!Number.isSafeInteger(deliverySequence) || deliverySequence < 0) {
         throw new Error("snapshot delivery watermark must be a non-negative integer");
     }
-    ensureSnapshotDeliveryBaselineTable(database);
-    return database.transaction(() => {
-        database.prepare(`
-      INSERT INTO authority_snapshot_baselines(authority_id, delivery_sequence)
-      VALUES (?, ?)
-      ON CONFLICT(authority_id) DO UPDATE SET
-        delivery_sequence = MAX(delivery_sequence, excluded.delivery_sequence)
-    `).run(authorityId, deliverySequence);
-        database.prepare(`
-      INSERT INTO authority_delivery_cursors(authority_id, received_through)
-      VALUES (?, ?)
-      ON CONFLICT(authority_id) DO UPDATE SET
-        received_through = MAX(received_through, excluded.received_through)
-    `).run(authorityId, deliverySequence);
-        // The snapshot replaces per-entity receive history through N. Retain a
-        // cursor only when this machine already holds a genuinely later delivery;
-        // otherwise the first post-snapshot record establishes its immediate
-        // predecessor from the complete authority prefix.
-        database.prepare(`
-      DELETE FROM entity_receive_cursors AS cursor
-       WHERE cursor.authority_id = ?
-         AND NOT EXISTS (
-           SELECT 1 FROM record_inbox AS inbox
-            WHERE inbox.authority_id = cursor.authority_id
-              AND inbox.entity_id = cursor.entity_id
-              AND inbox.delivery_sequence > ?
-         )
-    `).run(authorityId, deliverySequence);
-        return database.prepare(`
-      UPDATE record_inbox SET resolved_at = ?
-       WHERE authority_id = ? AND delivery_sequence <= ? AND resolved_at IS NULL
-    `).run(now, authorityId, deliverySequence).changes;
-    })();
+    cachedStatement(database, `
+    INSERT INTO authority_snapshot_baselines(authority_id, delivery_sequence)
+    VALUES (?, ?)
+    ON CONFLICT(authority_id) DO UPDATE SET
+      delivery_sequence = MAX(delivery_sequence, excluded.delivery_sequence)
+  `).run(authorityId, deliverySequence);
+    cachedStatement(database, `
+    INSERT INTO authority_delivery_cursors(authority_id, received_through, history_floor)
+    VALUES (?, ?, ?)
+    ON CONFLICT(authority_id) DO UPDATE SET
+      history_floor = CASE WHEN received_through < excluded.received_through
+        THEN MAX(history_floor, excluded.received_through) ELSE history_floor END,
+      received_through = MAX(received_through, excluded.received_through)
+  `).run(authorityId, deliverySequence, deliverySequence);
+    // The snapshot replaces per-entity receive history through N. Retain a
+    // cursor only when this machine already holds a genuinely later delivery;
+    // otherwise the first post-snapshot record establishes its immediate
+    // predecessor from the complete authority prefix.
+    cachedStatement(database, `
+    DELETE FROM entity_receive_cursors AS cursor
+     WHERE cursor.authority_id = ?
+       AND NOT EXISTS (
+         SELECT 1 FROM record_inbox AS inbox
+          WHERE inbox.authority_id = cursor.authority_id
+            AND inbox.entity_id = cursor.entity_id
+            AND inbox.delivery_sequence > ?
+       )
+  `).run(authorityId, deliverySequence);
+    return cachedStatement(database, `
+    UPDATE record_inbox SET resolved_at = ?
+     WHERE authority_id = ? AND delivery_sequence <= ? AND resolved_at IS NULL
+  `).run(now, authorityId, deliverySequence).changes;
 }
 //# sourceMappingURL=snapshot-delivery-baseline.js.map

package/dist/snapshot-delivery-baseline.js.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot-delivery-baseline.js","sourceRoot":"","sources":["../src/snapshot-delivery-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,UAAU,mCAAmC,CAAC,QAA2B;IAC7E,QAAQ,CAAC,IAAI,CAAC;;;;;GAKb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAA2B,EAC3B,WAAmB,EACnB,gBAAwB,EACxB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE;QAC/B,QAAQ,CAAC,OAAO,CAAC;;;;;KAKhB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACtC,QAAQ,CAAC,OAAO,CAAC;;;;;KAKhB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACtC,uEAAuE;QACvE,0EAA0E;QAC1E,qEAAqE;QACrE,kDAAkD;QAClD,QAAQ,CAAC,OAAO,CAAC;;;;;;;;;KAShB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC,OAAO,CAAC;;;KAGvB,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC;IACrD,CAAC,CAAC,EAAE,CAAC;AACP,CAAC"}
+{"version":3,"file":"snapshot-delivery-baseline.js","sourceRoot":"","sources":["../src/snapshot-delivery-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;iEACiE;AACjE,MAAM,UAAU,6BAA6B,CAAC,QAA2B,EAAE,KAI1E;IACC,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACrD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,eAAe,CAAC,QAAQ,EAAE;;;;;GAKzB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACtC,eAAe,CAAC,QAAQ,EAAE;;;;;;;GAOzB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IACxD,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,kDAAkD;IAClD,eAAe,CAAC,QAAQ,EAAE;;;;;;;;;GASzB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACtC,OAAO,eAAe,CAAC,QAAQ,EAAE;;;GAGhC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC;AACrD,CAAC"}

package/dist/source-proof.d.ts

@@ -0,0 +1,36 @@
+/** A retained observation closes in two phases. The semantic phase re-asks a
+ * slower owner such as Git and may await. The physical phase compares the
+ * original native witnesses and never awaits. Neither renews its baseline;
+ * together they belong to one observation, and neither alone admits it.
+ * Admission awaits every semantic phase first, then closes every physical
+ * phase with its commit, so final closure checks the original observation
+ * against its retained dependencies after all intervening semantic work. A
+ * change no witness holds belongs to a later Watch generation.
+ *
+ * The physical phase is data where it can be: witnesses any thread samples
+ * and judges. What only the admitting thread can answer — host authority
+ * such as the content clock, or a check over live objects — is an admission
+ * that runs there, synchronously, after the witnesses are judged. */
+import { type SourceWitness } from "./source-witness.js";
+export interface SourceProof {
+    semantic(): Promise<void>;
+    readonly witnesses: readonly SourceWitness[];
+    readonly admission?: () => void;
+}
+export declare const witnessProof: (witnesses: readonly SourceWitness[]) => SourceProof;
+export declare const admissionProof: (admission: () => void) => SourceProof;
+export declare const semanticProof: (semantic: () => Promise<void>) => SourceProof;
+/** The admission half alone, for a caller whose witnesses were judged elsewhere.
+ * A void-typed boundary accepts a value-returning function; a Promise that
+ * slipped through must fail here rather than pass as a completed check. */
+export declare function admitPhysically(proof: SourceProof): void;
+export declare function closePhysically(proof: SourceProof): void;
+export declare const proofLeaves: (proof: SourceProof) => readonly SourceProof[];
+/** Each original proof closes once, at its last requested position, so no
+ * duplicate can close before a later dependency's work. Identity is
+ * ownership: equal paths or answers never merge proofs. Semantic phases run
+ * one at a time, so several repositories never multiply concurrent Git
+ * processes. */
+export declare function sourceProofs(proofs: readonly SourceProof[]): SourceProof;
+/** A standalone close: the semantic answer, then the original witnesses. */
+export declare function closeSource(proof: SourceProof): Promise<void>;