@amalgm/shell 0.1.75 → 0.1.76

package/dist/user-ground-host.js

@@ -333,66 +333,85 @@ export class UserGroundHost {
         return { register, add };
     }
     /** Resume the same host effect used by the SDK command before readiness.
-     * Staged ground has no binding, so recovery cannot race Watch or Detect. */
+     * Staged ground has no binding, so recovery cannot race Watch or Detect.
+     * Each intent is one workspace's durable responsibility, not the machine's:
+     * an intent that cannot be satisfied now is reported and stays durable for
+     * the next start or an explicit re-Add, while readiness proceeds. */
     async resumeWorkspaceAdds(identity) {
-        const database = this.databasePath(identity);
-        const userRoot = this.userRoot(identity);
-        const bindingDir = workspaceBindingDir(userRoot, identity.deviceId);
-        for (const intent of readWorkspaceAddIntents(database)) {
-            const release = await this.acquireGroundScope([
-                intent.destinationPath,
-                intent.stagingPath,
-                userRoot,
-            ]);
-            const visibleAcrossBlindInterval = pathExists(intent.destinationPath);
+        for (const intent of readWorkspaceAddIntents(this.databasePath(identity))) {
             try {
-                const selection = workspaceAddSelection(intent);
-                const stagedAcrossBlindInterval = pathExists(intent.stagingPath);
-                if (stagedAcrossBlindInterval && hasRootRows(database, intent.resourceId, intent.workspaceId)) {
-                    // Rows prove that staging was verified before the crash, not that its
-                    // bytes remained unchanged while no watcher existed. Return this
-                    // private install to the intent-only stage and reproduce it from the
-                    // verified immutable cache before making it visible.
-                    deleteRootRows(database, intent.resourceId, intent.workspaceId);
-                }
-                await installCloudWorkspace({
-                    identity,
-                    userRoot,
-                    database,
-                    cacheDir: this.cacheDir(identity),
-                    bindingDir,
-                    resourceId: intent.resourceId,
-                    workspace: selection.workspace,
-                    reference: selection.reference,
-                    references: intent.references,
-                    records: intent.records,
-                    destinationParent: dirname(intent.destinationPath),
-                    cloudHead: intent.cloudHead,
-                    readContent: (artifact) => this.downloadContent(intent.resourceId, this.cacheDir(identity), artifact, 10, { journey: "add", workspaceId: intent.workspaceId }),
-                    onStage: (stage) => this.options.onWorkspaceAddStage?.({
-                        workspaceId: intent.workspaceId,
-                        stage,
-                    }),
-                });
-                this.ensureWatchers(identity, visibleAcrossBlindInterval ? [] : [intent.workspaceId]);
-                assertHealthyWatch(this.watchHost.evidence(), intent.workspaceId);
+                await this.resumeWorkspaceAdd(identity, intent);
             }
-            finally {
-                release();
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                this.stage({
+                    primitive: "download",
+                    stage: "add-resume",
+                    status: "failed",
+                    workspaceId: intent.workspaceId,
+                    measurements: { error: message },
+                });
+                this.options.onApplyError?.(new Error(`workspace Add ${intent.workspaceId} could not resume and stays pending: ${message}`, { cause: error }));
             }
-            if (visibleAcrossBlindInterval) {
-                // Ground that was visible while the runtime was absent may have been
-                // edited after its verified reveal. It is an ordinary startup blind
-                // interval, so Watch must retain complete suspicion and Detect must
-                // settle it before the Add responsibility can be cleared.
-                await this.flushObservedChanges();
+        }
+    }
+    async resumeWorkspaceAdd(identity, intent) {
+        const database = this.databasePath(identity);
+        const userRoot = this.userRoot(identity);
+        const bindingDir = workspaceBindingDir(userRoot, identity.deviceId);
+        const release = await this.acquireGroundScope([
+            intent.destinationPath,
+            intent.stagingPath,
+            userRoot,
+        ]);
+        const visibleAcrossBlindInterval = pathExists(intent.destinationPath);
+        try {
+            const selection = workspaceAddSelection(intent);
+            const stagedAcrossBlindInterval = pathExists(intent.stagingPath);
+            if (stagedAcrossBlindInterval && hasRootRows(database, intent.resourceId, intent.workspaceId)) {
+                // Rows prove that staging was verified before the crash, not that its
+                // bytes remained unchanged while no watcher existed. Return this
+                // private install to the intent-only stage and reproduce it from the
+                // verified immutable cache before making it visible.
+                deleteRootRows(database, intent.resourceId, intent.workspaceId);
             }
-            await this.options.onWorkspaceAddStage?.({
-                workspaceId: intent.workspaceId,
-                stage: "watching",
+            await installCloudWorkspace({
+                identity,
+                userRoot,
+                database,
+                cacheDir: this.cacheDir(identity),
+                bindingDir,
+                resourceId: intent.resourceId,
+                workspace: selection.workspace,
+                reference: selection.reference,
+                references: intent.references,
+                records: intent.records,
+                destinationParent: dirname(intent.destinationPath),
+                cloudHead: intent.cloudHead,
+                readContent: (artifact) => this.downloadContent(intent.resourceId, this.cacheDir(identity), artifact, 10, { journey: "add", workspaceId: intent.workspaceId }),
+                onStage: (stage) => this.options.onWorkspaceAddStage?.({
+                    workspaceId: intent.workspaceId,
+                    stage,
+                }),
             });
-            deleteWorkspaceAddIntent(database, intent.workspaceId);
+            this.ensureWatchers(identity, visibleAcrossBlindInterval ? [] : [intent.workspaceId]);
+            assertHealthyWatch(this.watchHost.evidence(), intent.workspaceId);
+        }
+        finally {
+            release();
         }
+        if (visibleAcrossBlindInterval) {
+            // Ground that was visible while the runtime was absent may have been
+            // edited after its verified reveal. It is an ordinary startup blind
+            // interval, so Watch must retain complete suspicion and Detect must
+            // settle it before the Add responsibility can be cleared.
+            await this.flushObservedChanges();
+        }
+        await this.options.onWorkspaceAddStage?.({
+            workspaceId: intent.workspaceId,
+            stage: "watching",
+        });
+        deleteWorkspaceAddIntent(database, intent.workspaceId);
     }
     /** Finish the user-visible register journey inside the one persistent Files
      * owner. The declaration remains durable if any later stage fails, and a
@@ -746,7 +765,18 @@ export class UserGroundHost {
             },
             sha256Hex,
             now: Date.now,
-            onBackgroundError: (error) => this.options.onApplyError?.(error),
+            // A failed Apply lane is one entity's outcome; the rail keeps every
+            // other lane moving and retries this one. Surface it as evidence so a
+            // persistently failing entity is visible rather than silent.
+            onBackgroundError: (error) => {
+                this.options.onApplyError?.(error);
+                this.stage({
+                    primitive: "apply",
+                    stage: "lane",
+                    status: "failed",
+                    measurements: { error: error instanceof Error ? error.message : String(error) },
+                });
+            },
             // The host now coordinates by address cone, so Apply's final guard waits
             // only for effects on its own addresses. The rail itself still drains
             // one entity at a time: parallel private preparation multiplies content
@@ -2949,14 +2979,21 @@ async function reconcileGround(input) {
 }
 async function reconcileRoot(input) {
     const { identity, resourceId, rootUUID, rootName, rootPath, rootType, database, cacheDir, policy, bindingDir, suspects = null, evidence, } = input;
-    const existingRows = input.existingRows
-        ?? readRows(database).filter((row) => row.resourceId === resourceId && row.rootUUID === rootUUID);
-    const existingByPath = new Map(existingRows.flatMap((row) => {
+    // Prior rows reach this scan from every binding this root encloses. A row's
+    // stored relativePath is relative to the root that last committed it, which
+    // is a different frame when an enclosing boundary was just registered
+    // (child/README.md is stored as "README.md" under the child root). Address
+    // every prior row in this scan's frame before anything compares it with an
+    // observed entry; absolutePath is the only coordinate both frames share.
+    const existingRows = (input.existingRows
+        ?? readRows(database).filter((row) => row.resourceId === resourceId && row.rootUUID === rootUUID))
+        .flatMap((row) => {
         if (!pathWithin(rootPath, row.absolutePath))
             return [];
-        const local = slashPath(relative(rootPath, row.absolutePath));
-        return [[local, row]];
-    }));
+        const relativePath = slashPath(relative(rootPath, row.absolutePath));
+        return [relativePath === row.relativePath ? row : { ...row, relativePath }];
+    });
+    const existingByPath = new Map(existingRows.map((row) => [row.relativePath, row]));
     const registeredBoundaries = input.registeredBoundaries ?? new Map();
     if (suspects !== null
         && suspects.length === 0
@@ -4126,6 +4163,19 @@ async function installCloudWorkspace(input) {
             alreadyMaterialized: pending === null,
         };
     }
+    // One machine materializes each UUID in exactly one place. The selected
+    // closure may enclose a boundary this machine already added elsewhere; a
+    // fresh install would re-root those rows under the new destination while
+    // the old binding stayed bound and watched over ground with no rows, and
+    // the next Detect pass there would mint a second identity for every file.
+    const selectedUUIDs = new Set(records.map((record) => record.uuid));
+    const enclosedElsewhere = allLocalRows.filter((row) => row.uuid !== workspace.uuid && selectedUUIDs.has(row.uuid));
+    if (enclosedElsewhere.length > 0) {
+        const roots = [...new Set(enclosedElsewhere.map((row) => row.rootUUID))]
+            .map((rootUUID) => allLocalRows.find((row) => row.uuid === rootUUID)?.absolutePath ?? rootUUID);
+        throw new Error(`files add: workspace ${workspace.uuid} encloses ${enclosedElsewhere.length} entities already `
+            + `materialized on this machine under ${roots.join(", ")}; remove that materialization first`);
+    }
     const parent = realpathSync(resolve(destinationParent));
     if (!statSync(parent).isDirectory())
         throw new Error("destination must be a directory");