@animalabs/agent-framework 0.29.0 → 0.31.0

package/src/modules/workspace/disk-agreement.ts

@@ -42,7 +42,15 @@ import { Refusal, onlyTheHost } from './answers.js';
 const UNTIL_REOPENED = "the workspace can't check its files against disk until its store is reopened";
 const REOPEN = onlyTheHost('reopen it with a restart');
 
-export class EvidenceUnavailable extends Refusal {}
+export class EvidenceUnavailable extends Refusal {
+  constructor(readonly why: string) {
+    super(`${UNTIL_REOPENED}: ${why}. ${REOPEN}`);
+  }
+}
+
+export function rootUnreadable(err: EvidenceUnavailable): string {
+  return `the root disk last agreed with can't be read until the store is reopened: ${err.why}. ${REOPEN}`;
+}
 
 export const callGate = new AsyncLocalStorage<{ passed: boolean }>();
 
@@ -105,8 +113,8 @@ export type Physical = Agreed | Pending | Interrupted;
 
 /**
  * Which directory a mount root is: its device and inode, and its birth time
- * in nanoseconds as the runtime reports it, where that is above zero, as decimal
- * strings.
+ * in nanoseconds as the runtime reports it, where that is above zero and isn't
+ * its ctime, as decimal strings.
  */
 export interface RootIdentity {
   dev: string;
@@ -121,16 +129,32 @@ function sameRootPath(a: string, b: string): boolean {
 }
 
 /**
- * Whether two identities name the same directory: the same device and inode,
- * or the same inode and birth time on another device, since macOS can give a
- * volume another device number after a reboot. A birth time in whole seconds
- * doesn't count across devices: filesystems made in the same second can give
- * their roots one inode (2 on ext4) and one birth time.
+ * Whether the directory seen `now` is the one `recorded`: the same inode, and
+ * not born after the recorded one where `now`'s filesystem keeps a birth time
+ * fixed (`bornFixed`), since ext4 gives a directory made where one was removed
+ * its inode again, while overlayfs gives a directory copied up from a lower
+ * layer a later birth time under the same inode; and the same device, or the
+ * same birth time on another device, since macOS can give a volume another
+ * device number after a reboot. A birth time in whole seconds doesn't count
+ * across devices: filesystems made in the same second can give their roots
+ * one inode (2 on ext4) and one birth time.
  */
-export function sameRootIdentity(a: RootIdentity, b: RootIdentity): boolean {
-  if (a.ino !== b.ino) return false;
-  if (a.dev === b.dev) return true;
-  return a.born !== undefined && a.born === b.born && !a.born.endsWith('000000000');
+export function sameRootIdentity(recorded: RootIdentity, now: RootIdentity, bornFixed: boolean): boolean {
+  if (recorded.ino !== now.ino || (bornFixed && bornLater(recorded, now))) return false;
+  if (recorded.dev === now.dev) return true;
+  return fractional(recorded.born) && recorded.born === now.born;
+}
+
+export function onlyDeviceDiffers(recorded: RootIdentity, now: RootIdentity, bornFixed: boolean): boolean {
+  return !sameRootIdentity(recorded, now, bornFixed) && recorded.ino === now.ino && recorded.dev !== now.dev && !(bornFixed && bornLater(recorded, now));
+}
+
+function bornLater(recorded: RootIdentity, now: RootIdentity): boolean {
+  return recorded.born !== undefined && now.born !== undefined && BigInt(now.born) > BigInt(recorded.born);
+}
+
+function fractional(born: string | undefined): boolean {
+  return born !== undefined && !born.endsWith('000000000');
 }
 
 type JournalEntry =
@@ -242,10 +266,10 @@ export class DiskAgreement {
    */
   ensureReconciled(): void {
     if (this.journal.needsReopen) {
-      throw new EvidenceUnavailable(`${UNTIL_REOPENED}: an append to its record of what disk last agreed with failed inside the store, so that record may lack what the append held. ${REOPEN}`);
+      throw new EvidenceUnavailable('an append to its record of what disk last agreed with failed inside the store, so that record may lack what the append held');
     }
     if (!this.whole) {
-      throw new EvidenceUnavailable(`${UNTIL_REOPENED}: reading back its record of what disk last agreed with failed. ${REOPEN}`);
+      throw new EvidenceUnavailable('reading back its record of what disk last agreed with failed');
     }
     if (this.journal.needsReconcile) this.rebuild();
     const gate = callGate.getStore();
@@ -345,7 +369,7 @@ export class DiskAgreement {
   recordRootIdentity(mount: string, identity: RootIdentity): void {
     const recorded = this.rootIdentity(mount);
     if (recorded !== undefined) {
-      if (!sameRootIdentity(recorded, identity)) return;
+      if (!sameRootIdentity(recorded, identity, false)) return;
       const renumbered = recorded.dev !== identity.dev;
       const bornLearned = recorded.born === undefined && identity.born !== undefined;
       if (!renumbered && !bornLearned) return;

package/src/modules/workspace/index.ts

@@ -6,6 +6,7 @@
  */
 
 import { NOTICE_TAG } from '../../notice-tags.js';
+import { nameToTypeBack } from '../../supplied-text.js';
 import { constants as fsConstants } from 'node:fs';
 import type { BigIntStats, Stats } from 'node:fs';
 import { open, readdir, readlink, stat, lstat, realpath } from 'node:fs/promises';
@@ -39,9 +40,9 @@ import type {
 import { WORKSPACE_FS_EVENT_TYPES, opToEventType } from './types.js';
 import { MountWatcher, type FsChange } from './watcher.js';
 import { hashContent, storedBytes, DEFAULT_MAX_FILE_SIZE, type StoredBytes } from './sync.js';
-import { DiskAgreement, EvidenceUnavailable, callGate, sameRootIdentity } from './disk-agreement.js';
+import { DiskAgreement, EvidenceUnavailable, callGate, rootUnreadable, sameRootIdentity, type RootIdentity } from './disk-agreement.js';
 import { type BranchIntent, BranchIntents } from './branch-intent.js';
-import { CHANGED, type Cause, DIRECTORY, IGNORED, NONBLOCK, OTHER_MOUNT, OUTSIDE_INCLUDE, ROOT_REPLACED, ROOT_UNAVAILABLE, beneathRoot, checkDir, checkRoot, confirmAbsent, coversLanding, directoryAt, diskSpelling, filesystemTrustsCtime, foldsCase, inOtherMount, insideMount, leadsInto, linkOnTheWay, linkRefusal, linkWords, locateRoot, looksBinary, namesHolder, nestedAtReal, nestedGuess, nestedHolder, nestedStep, observePath, parsedSpelling, passedOverAt, pathSegments, patternRefusal, readBytes, readPrefix, realSegments, restBeneath, rootAbsence, sameRoot, shownLeads, sniffImageMime, surelyAtRoot, walkScope, withinIncludes, type CheckedDir, type LinkFound, type MountView, type NestedGuess, type NestedMount, type WorkspaceEntries } from './observe.js';
+import { CHANGED, type Cause, DIRECTORY, IGNORED, NONBLOCK, OTHER_MOUNT, OUTSIDE_INCLUDE, ROOT_ON_ANOTHER_DEVICE, ROOT_REPLACED, ROOT_UNAVAILABLE, beneathRoot, checkDir, checkRoot, confirmAbsent, coversLanding, directoryAt, diskSpelling, filesystemTrustsCtime, foldsCase, inOtherMount, insideMount, leadsInto, linkOnTheWay, linkRefusal, linkWords, locateRoot, looksBinary, namesHolder, nestedAtReal, nestedGuess, nestedHolder, nestedStep, observePath, parsedSpelling, passedOverAt, pathSegments, patternRefusal, readBytes, readPrefix, realSegments, restBeneath, rootAbsence, sameRoot, shownLeads, sniffImageMime, surelyAtRoot, walkScope, withinIncludes, type CheckedDir, type LinkFound, type MountView, type NestedGuess, type NestedMount, type WorkspaceEntries } from './observe.js';
 import { TOOL_BATCH_HOOK_TIMEOUT_MS, ensureStateRegistered } from '../../module-registry.js';
 import { DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS } from '../../tool-result-history.js';
 import { type EditSpec, type FilePlan, countBudget, decodeForEdit, hintBudget, planFile } from './edit-plan.js';
@@ -62,6 +63,7 @@ import {
   WALK_CAP,
   entryMode,
   explained,
+  passRoot,
   pushPaths,
   reconcilePass,
   settleAdoptionBeforeMutation,
@@ -122,6 +124,21 @@ const DIRECT_SYNC_SKIPPED = "a direct mount: its tools read disk as it is, so th
 /** Why materialize passes over a writable direct mount, as its result's `skipped` says. */
 const DIRECT_MATERIALIZE_SKIPPED = "a direct mount: its writes are on disk as they're made, so there's nothing to write";
 
+const NOTHING_RECORDED_YET = 'nothing is recorded of this root yet, so any directory at its path is taken as it';
+const NOTHING_RECORDED = `${NOTHING_RECORDED_YET}; the first sync that takes in a file, or materialize that writes one, records it`;
+const NOTHING_RECORDED_READ_ONLY = `${NOTHING_RECORDED_YET}; the first sync that takes in a file records it`;
+
+const BORN_UNRECORDED = 'no birth time is recorded of this root yet, so a directory made again in its place with the same inode can\'t be told from it; the next sync or ls of this mount records it';
+
+interface RootAsShown { dev: string; ino: string; born?: string }
+
+function asShown(identity: RootIdentity | null): RootAsShown | null {
+  if (identity?.born === undefined) return identity;
+  const ns = BigInt(identity.born);
+  const second = new Date(Number(ns / 1_000_000_000n) * 1000).toISOString().replace(/\.000Z$/, '');
+  return { ...identity, born: `${second}.${String(ns % 1_000_000_000n).padStart(9, '0')}Z` };
+}
+
 export type {
   WorkspaceConfig,
   MountConfig,
@@ -1385,6 +1402,7 @@ export class WorkspaceModule implements Module {
   /** One disk→store pass; the caller holds the mount's turn. Emits its events. */
   private async passUnlocked(mount: MountState, scope: Scope, opts: PassOptions = {}): Promise<PassResult> {
     const result = await reconcilePass(this.getStore(), this.agreementOrThrow(), await this.runtime(mount), scope, opts);
+    if (result.rootListed !== undefined) mount.lastPassRoot = { at: new Date().toISOString(), listed: result.rootListed };
     if (scope.kind === 'dir' && scope.dir === '' && scope.recursive) mount.initialSyncDone = true;
     // What a pass says is another mount's directory names that mount and
     // the path to use there, as the file operations' refusal does: a copy's
@@ -2300,13 +2318,13 @@ export class WorkspaceModule implements Module {
 
     let text: string;
     if (paths.length === 1) {
-      text = `[${NOTICE_TAG.workspaceEvent} · ${op} · ${paths[0]}]`;
+      text = `[${NOTICE_TAG.workspaceEvent} · ${op} · ${nameToTypeBack(paths[0]!)}]`;
     } else {
-      const list = paths.map(p => `- ${p}`).join('\n');
+      const list = paths.map(p => `- ${nameToTypeBack(p)}`).join('\n');
       text = `[${NOTICE_TAG.workspaceEvent} · ${op} · ${paths.length} files in ${mountName}/]\n${list}`;
     }
     if (conflicts && conflicts.length > 0) {
-      text += `\n[${NOTICE_TAG.conflictsWithDisk}: ${conflicts.join(', ')}; reading each shows how to settle it]`;
+      text += `\n[${NOTICE_TAG.conflictsWithDisk}: ${conflicts.map(nameToTypeBack).join(', ')}; reading each shows how to settle it]`;
     }
 
     return {
@@ -2375,7 +2393,7 @@ export class WorkspaceModule implements Module {
   /**
    * Write binary content (e.g. an image pulled from the agent's context) to a
    * mount, through the same Chronicle-tree + auto-materialize path as the
-   * `write` tool. Public API for the framework's synthesized `save_image`
+   * `write` tool. Public API for the framework's synthesized `save_recent_image`
    * tool and other peer callers that hold bytes rather than text.
    *
    * `branch`, when given, ties the write to that branch: the store's current
@@ -3222,8 +3240,9 @@ export class WorkspaceModule implements Module {
    * observation checks it (checkRoot), so the read and the evidence agree on
    * which directory the mount is. Once the workspace has recorded the root's
    * identity, a root that resolves to any other directory is refused, in
-   * ROOT_REPLACED's words; with none recorded yet, it need only be a
-   * directory there. A refusal where no directory is at the root's path
+   * ROOT_REPLACED's words, or ROOT_ON_ANOTHER_DEVICE's where only its device
+   * differs and birth times can't tell; with none recorded yet, it need only
+   * be a directory there. A refusal where no directory is at the root's path
    * carries the errno that gives (rootAbsence: ENOENT when nothing is there
    * and ENOTDIR when something else is, which a caller can read as no file,
    * or the errno the root's stat failed with otherwise, such as EACCES). A
@@ -4077,9 +4096,7 @@ export class WorkspaceModule implements Module {
   private async diskLacks(mount: MountState, relativePath: string, path: string, err: unknown): Promise<LostContents['disk']> {
     const absent = err instanceof WorkspaceReadError && err.code !== 'mount_unavailable' && (err.errno === 'ENOENT' || err.errno === 'ENOTDIR');
     if (!absent) return { unreadable: containedRefusal(err, path) };
-    const root = resolve(mount.config.path);
-    const rootReal = await realpath(root).catch(() => root);
-    const view = this.viewOf(mount, this.agreementOrThrow().rootIdentityForRead(mount.config.name));
+    const { view, rootReal } = await this.readView(mount);
     const proof = await confirmAbsent(view, rootReal, relativePath);
     if (!('reason' in proof)) return 'none';
     return { unreadable: proof.reason === CHANGED ? containedRefusal(err, path) : proof.reason };
@@ -5838,6 +5855,8 @@ export class WorkspaceModule implements Module {
     if (input.mount !== undefined && !this.mounts.has(input.mount)) {
       return { success: false, error: didNothing('status', this.noSuchMountField(input.mount, 'covers every mount')), isError: true };
     }
+    const asked = input.mount === undefined ? [] : [...this.mounts].filter(([name, mount]) => !mount.direct && name === input.mount);
+    const roots = new Map(await Promise.all(asked.map(async ([name, mount]) => [name, await this.rootState(mount)] as const)));
 
     for (const [name, mount] of this.mounts) {
       if (input.mount !== undefined && name !== input.mount) continue;
@@ -5857,6 +5876,8 @@ export class WorkspaceModule implements Module {
       const pending = new Set([...conflictPaths, ...deletionPaths, ...owed]);
 
       const currentBranch = store.currentBranch();
+      const root = input.mount !== undefined ? roots.get(name)!
+        : mount.lastPassRoot?.listed ? { unavailable: mount.lastPassRoot.listed, lastPassAt: mount.lastPassRoot.at } : undefined;
       status[name] = {
         path: mount.config.path,
         mode: mount.config.backend === 'direct' ? mount.config.mode ?? 'read-write' : mount.config.mode,
@@ -5874,14 +5895,44 @@ export class WorkspaceModule implements Module {
         initialSyncDone: mount.initialSyncDone,
         currentBranch: currentBranch.name,
         lastMaterializedBranch: mount.lastMaterializedBranchId,
-        canMaterialize: this.mountMaterializeBlockReason(store, mount) === null,
+        canMaterialize: this.mountMaterializeBlockReason(store, mount) === null && root?.unavailable === undefined,
         ...(mount.lastAgentActionScan ? { lastAgentActionScan: mount.lastAgentActionScan } : {}),
+        ...(root !== undefined ? { root } : {}),
       };
     }
 
     return { success: true, data: status };
   }
 
+  private async readView(mount: MountState): Promise<{ view: MountView; rootReal: string }> {
+    const root = resolve(mount.config.path);
+    const rootReal = await realpath(root).catch(() => root);
+    return { view: this.viewOf(mount, this.agreementOrThrow().rootIdentityForRead(mount.config.name)), rootReal };
+  }
+
+  private async rootState(mount: MountState): Promise<{ recorded?: RootAsShown | null; now: RootAsShown | null; unavailable?: string; note?: string }> {
+    const read = await this.readView(mount).catch((err: unknown) => {
+      if (err instanceof EvidenceUnavailable) return err;
+      throw err;
+    });
+    if (read instanceof EvidenceUnavailable) {
+      const root = resolve(mount.config.path);
+      const there = await locateRoot(this.viewOf(mount, undefined), await realpath(root).catch(() => root));
+      return { now: asShown('identity' in there ? there.identity : null), unavailable: rootUnreadable(read) };
+    }
+    const { view, rootReal } = read;
+    const recorded = view.rootIdentity ?? null;
+    const found = await passRoot({ view, rootReal });
+    if ('unavailable' in found) {
+      const there = await locateRoot({ ...view, rootIdentity: undefined }, rootReal);
+      return { recorded: asShown(recorded), now: asShown('identity' in there ? there.identity : null), unavailable: found.listed };
+    }
+    const note = this.agreementOrThrow().awaitsReopen ? undefined
+      : recorded === null ? mount.config.mode === 'read-only' ? NOTHING_RECORDED_READ_ONLY : NOTHING_RECORDED
+        : recorded.born === undefined && found.identity.born !== undefined && found.bornFixed ? BORN_UNRECORDED : undefined;
+    return { recorded: asShown(recorded), now: asShown(found.identity), ...(note !== undefined ? { note } : {}) };
+  }
+
   /**
    * What the store holds of a mount that disk lacks, on the selected branch,
    * among the mount's own paths. Status counts the first three as pending:
@@ -6401,7 +6452,7 @@ export class WorkspaceModule implements Module {
     if ('reason' in found) return false; // still missing: the pass says so
     const agreement = this.agreementOrThrow();
     const recorded = agreement.rootIdentity(mount.config.name);
-    if (recorded && sameRootIdentity(recorded, found.identity)) return false;
+    if (recorded && sameRootIdentity(recorded, found.identity, found.bornFixed)) return false;
     if (recorded) agreement.acceptRoot(mount.config.name, found.identity);
     else agreement.recordRootIdentity(mount.config.name, found.identity);
     agreement.barrier();
@@ -6868,7 +6919,7 @@ function deletedOnDisk(path: string): string {
 
 function uncheckedFile(shown: string, note: string | undefined, cause: Cause): string {
   if (note === DIRECTORY) return `${shown} is a directory, not a file; ls ${shown} lists what's in it.`;
-  const on = note === ROOT_REPLACED || cause.ownStep === true ? null
+  const on = note === ROOT_REPLACED || note === ROOT_ON_ANOTHER_DEVICE || cause.ownStep === true ? null
     : (note === undefined ? null : wayOn(note, cause, 'read')) ?? 'calling again checks disk again; if the same reason comes back, whoever runs this host can fix it on disk';
   return `${shown} isn't in the workspace, and disk couldn't be checked: ${sentence(note ?? 'not observed')}${on !== null ? ` ${on[0]!.toUpperCase()}${sentence(on.slice(1))}` : ''}`;
 }

package/src/modules/workspace/observe.ts

@@ -46,7 +46,7 @@ import type { BigIntStats } from 'node:fs';
 import { lstat, mkdir, open, readdir, readlink, realpath, stat, statfs } from 'node:fs/promises';
 import type { FileHandle } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
-import { sameRootIdentity, type Fingerprint, type RootIdentity } from './disk-agreement.js';
+import { onlyDeviceDiffers, sameRootIdentity, type Fingerprint, type RootIdentity } from './disk-agreement.js';
 import { OUTSIDE_STEP, UNFOLLOWED_STEP, errnoClause, errnoCode, systemWords } from './answers.js';
 
 export interface MountView {
@@ -164,8 +164,14 @@ export const LEAVES_MOUNT = 'a symlink that leaves the mount';
 export const NOT_A_DIRECTORY = 'a parent path is not a directory';
 export const ROOT_UNAVAILABLE = 'the mount root is unavailable';
 export const ROOT_REPLACED =
-  'the mount root is not the directory disk last agreed with (an unmounted drive, or a replaced directory): ' +
-  'reconnect it; if it was replaced on purpose, sync the mount with acceptRoot to take it as it is now';
+  'the mount root is not the directory disk last agreed with (an unmounted drive, a directory moved aside, or a replaced one); ' +
+  'whoever runs this host can say which: a drive they can reconnect, a directory moved aside they can put back, ' +
+  'and a replaced directory a sync of the mount with acceptRoot takes as it is now';
+export const ROOT_ON_ANOTHER_DEVICE =
+  'the mount root has the inode disk last agreed with, but another device number: a reboot can renumber a volume, ' +
+  'and another volume mounted at the same place can have a root with the same inode; whoever runs this host can ' +
+  'say which, and if it is the same directory, a sync of the mount with acceptRoot takes it as it is now; if not, ' +
+  'they can mount the right volume';
 export const CHANGED = 'it changed while it was observed';
 export const CHANGED_WALK = 'the directory changed while the walk ran';
 export const FILE_CHANGED = 'the file changed while it was read';
@@ -1026,6 +1032,8 @@ export class CheckedDir {
     private readonly dev: bigint,
     private readonly ino: bigint,
     private readonly born: bigint,
+    /** For the root: whether its filesystem keeps a birth time fixed (filesystemKeepsBirthTime). */
+    readonly bornFixed = false,
   ) {}
 
   /** Which directory it is. */
@@ -1094,7 +1102,12 @@ export async function rootAbsence(root: string): Promise<string | undefined> {
 async function checkedAt(view: MountView, rel: string, real: string): Promise<CheckedDir | null> {
   const info = await lstat(real, { bigint: true }).catch(() => null);
   if (!info?.isDirectory()) return null;
-  return new CheckedDir(rel, real, lexicalOf(view, rel), info.dev, info.ino, info.birthtimeNs);
+  return new CheckedDir(rel, real, lexicalOf(view, rel), info.dev, info.ino, bornOf(info), rel === '' && await filesystemKeepsBirthTime(real));
+}
+
+function bornOf(info: BigIntStats): bigint {
+  // Where statx is unavailable, libuv gives the ctime as the birth time (uv__to_stat).
+  return info.birthtimeNs === info.ctimeNs ? 0n : info.birthtimeNs;
 }
 
 /**
@@ -1141,8 +1154,8 @@ async function locateDir(view: MountView, rootReal: string, rel: string): Promis
     // A root that isn't the directory disk last agreed under proves nothing
     // about the files that agreed: an empty mountpoint where a drive was
     // would otherwise read as every file deleted.
-    if (rel === '' && view.rootIdentity && !sameRootIdentity(checked.identity(), view.rootIdentity)) {
-      return { kind: 'unobserved', reason: ROOT_REPLACED };
+    if (rel === '' && view.rootIdentity && !sameRootIdentity(view.rootIdentity, checked.identity(), checked.bornFixed)) {
+      return { kind: 'unobserved', reason: onlyDeviceDiffers(view.rootIdentity, checked.identity(), checked.bornFixed) ? ROOT_ON_ANOTHER_DEVICE : ROOT_REPLACED };
     }
     return { kind: 'checked', dir: checked };
   }
@@ -1153,9 +1166,9 @@ async function locateDir(view: MountView, rootReal: string, rel: string): Promis
  * The mount root as it is now: its identity if it is available (a directory,
  * the one the pass was given, and the one disk last agreed under), else why not.
  */
-export async function locateRoot(view: MountView, rootReal: string): Promise<{ identity: RootIdentity } | { reason: string; errno?: string }> {
+export async function locateRoot(view: MountView, rootReal: string): Promise<{ identity: RootIdentity; bornFixed: boolean } | { reason: string; errno?: string }> {
   const found = await checkRoot(view, rootReal);
-  return 'dir' in found ? { identity: found.dir.identity() } : found;
+  return 'dir' in found ? { identity: found.dir.identity(), bornFixed: found.dir.bornFixed } : found;
 }
 
 /** The mount root as locateRoot finds it, checked, so a caller can ask later whether it's still there. */
@@ -1265,7 +1278,7 @@ export async function confirmAbsent(view: MountView, rootReal: string, rel: stri
     }
     if (info.isDirectory()) {
       if (last) return { reason: CHANGED }; // present after all
-      cur = new CheckedDir(childRel, cur.at(name), lexicalOf(view, childRel), info.dev, info.ino, info.birthtimeNs);
+      cur = new CheckedDir(childRel, cur.at(name), lexicalOf(view, childRel), info.dev, info.ino, bornOf(info));
       walked.push(cur);
       continue;
     }
@@ -1360,6 +1373,34 @@ export async function filesystemTrustsCtime(root: string): Promise<boolean> {
   }
 }
 
+/**
+ * Linux filesystems that give a directory its birth time when it is made and
+ * have no call that changes it (statfs f_type). Overlayfs isn't one: copying a
+ * directory up from a lower layer gives it the copy's birth time under the
+ * same device and inode.
+ */
+const BIRTH_FIXED_FS_TYPES = new Set<number>([
+  0xef53, // ext2/ext3/ext4
+  0x58465342, // xfs
+  0x9123683e, // btrfs
+  0x01021994, // tmpfs
+  0xf2f52010, // f2fs
+  0x2fc12fc1, // zfs
+]);
+
+export function fsTypeKeepsBirthTime(type: number | bigint): boolean {
+  return BIRTH_FIXED_FS_TYPES.has(Number(type) >>> 0);
+}
+
+export async function filesystemKeepsBirthTime(dir: string): Promise<boolean> {
+  if (process.platform !== 'linux') return false;
+  try {
+    return fsTypeKeepsBirthTime((await statfs(dir)).type);
+  } catch {
+    return false;
+  }
+}
+
 // ===========================================================================
 // Paths and files
 // ===========================================================================
@@ -2106,7 +2147,7 @@ async function checkChild(view: MountView, rootReal: string, parent: CheckedDir,
     return 'reason' in proof ? { kind: 'unobserved', ...proof } : { kind: 'absent', by: proof.by };
   }
   if (!info.isDirectory()) return { kind: 'unobserved', reason: CHANGED_WALK };
-  return { kind: 'checked', dir: new CheckedDir(rel, real, lexicalOf(view, rel), info.dev, info.ino, info.birthtimeNs) };
+  return { kind: 'checked', dir: new CheckedDir(rel, real, lexicalOf(view, rel), info.dev, info.ino, bornOf(info)) };
 }
 
 /**

package/src/modules/workspace/reconcile.ts

@@ -169,6 +169,8 @@ export interface PassResult {
   branchId?: string;
   /** Why it decided nothing, where it didn't. */
   undecided?: string;
+  /** The words it listed for a root it couldn't use, or null where it used it, from its last look at the root. */
+  rootListed?: string | null;
 }
 
 export interface MountRuntime {
@@ -942,6 +944,7 @@ interface Gathered {
   branchId: string;
   /** The root the facts were gathered under, when it was available. */
   rootIdentity: RootIdentity | null;
+  rootListed: string | null;
   walk: Walk | null;
   facts: Map<string, DiskFact>;
   dirs: string[];
@@ -951,6 +954,13 @@ interface Gathered {
 /** How often a pass gathers again when the branch changes under it. */
 const GATHER_ATTEMPTS = 3;
 
+export async function passRoot(mount: Pick<MountRuntime, 'view' | 'rootReal'>): Promise<{ identity: RootIdentity; bornFixed: boolean } | { unavailable: string; cause: Cause; listed: string }> {
+  const root = await locateRoot(mount.view, mount.rootReal);
+  if ('identity' in root) return root;
+  const cause: Cause = root.errno !== undefined ? { errno: root.errno } : {};
+  return { unavailable: root.reason, cause, listed: explained(root.reason, cause, 'list') };
+}
+
 async function gather(store: JsStore, agreement: DiskAgreement, mount: MountRuntime, scope: Scope, opts: PassOptions): Promise<Gathered> {
   // A missing mount root is an unavailable mount (an unmounted drive, a root
   // being replaced), not proof that every file in it was deleted, and so is a
@@ -958,9 +968,10 @@ async function gather(store: JsStore, agreement: DiskAgreement, mount: MountRunt
   // directory a watcher makes where a drive's mountpoint was. The root is
   // the operator's choice and may itself be a symlink to a directory, so it
   // is followed, as `rootReal` is: `followSymlinks` governs links within it.
-  const root = await locateRoot(mount.view, mount.rootReal);
-  const rootUnavailable = 'reason' in root ? root.reason : null;
-  const rootCause = 'reason' in root && root.errno !== undefined ? { errno: root.errno } : {};
+  const root = await passRoot(mount);
+  const rootUnavailable = 'unavailable' in root ? root.unavailable : null;
+  const rootCause = 'unavailable' in root ? root.cause : {};
+  const rootListed = 'unavailable' in root ? root.listed : null;
 
   // The branch is labelled where the tracked candidates are read, with no
   // await between: the decision is checked against this label.
@@ -968,15 +979,16 @@ async function gather(store: JsStore, agreement: DiskAgreement, mount: MountRunt
   const gathered: Gathered = {
     branchId,
     rootIdentity: 'identity' in root ? root.identity : null,
+    rootListed,
     walk: null,
     facts: new Map(),
     dirs: [],
     incomplete: [],
   };
-  if (rootUnavailable !== null) {
+  if (rootListed !== null) {
     // Said whether or not anything is tracked: an unavailable mount must not
     // read as a verified empty directory.
-    gathered.incomplete.push({ path: scope.kind === 'dir' ? scope.dir : '', reason: explained(rootUnavailable, rootCause, 'list') });
+    gathered.incomplete.push({ path: scope.kind === 'dir' ? scope.dir : '', reason: rootListed });
   }
 
   // Which paths to decide: what disk shows, and what the store, P and intent
@@ -1082,14 +1094,15 @@ async function gather(store: JsStore, agreement: DiskAgreement, mount: MountRunt
   // now, nothing observed counts and nothing is decided from it.
   if (gathered.rootIdentity !== null) {
     const after = await locateRoot(mount.view, mount.rootReal);
-    if (!('identity' in after) || !sameRootIdentity(after.identity, gathered.rootIdentity)) {
+    if (!('identity' in after) || !sameRootIdentity(gathered.rootIdentity, after.identity, after.bornFixed)) {
       const reason = 'reason' in after ? after.reason : ROOT_REPLACED;
       const errno = 'errno' in after ? after.errno : undefined;
       for (const path of gathered.facts.keys()) gathered.facts.set(path, { kind: 'unobserved', reason, ...(errno !== undefined ? { errno } : {}) });
       gathered.rootIdentity = null;
+      gathered.rootListed = explained(reason, errno !== undefined ? { errno } : {}, 'list');
       gathered.walk = null;
       gathered.dirs = [];
-      gathered.incomplete.push({ path: scope.kind === 'dir' ? scope.dir : '', reason: explained(reason, errno !== undefined ? { errno } : {}, 'list') });
+      gathered.incomplete.push({ path: scope.kind === 'dir' ? scope.dir : '', reason: gathered.rootListed });
     }
   }
   return gathered;
@@ -1120,6 +1133,7 @@ export async function reconcilePass(
   let gathered: Gathered | null = null;
   for (let attempt = 0; attempt < GATHER_ATTEMPTS; attempt++) {
     const next = await gather(store, agreement, mount, scope, opts);
+    result.rootListed = next.rootListed;
     if (store.currentBranch().id === next.branchId) {
       gathered = next;
       break;
@@ -1469,7 +1483,7 @@ export async function pushPaths(
   // replaced meanwhile they describe the replacement, so, as a pass does,
   // nothing is decided or recorded from them.
   const after = await locateRoot(mount.view, mount.rootReal);
-  if (!('identity' in after) || !sameRootIdentity(after.identity, root.identity)) {
+  if (!('identity' in after) || !sameRootIdentity(root.identity, after.identity, after.bornFixed)) {
     const reason = 'reason' in after ? explained(after.reason, after.errno !== undefined ? { errno: after.errno } : {}, 'write') : ROOT_REPLACED;
     for (const path of paths) result.skipped.push({ path, reason });
     return result;

package/src/modules/workspace/types.ts

@@ -435,6 +435,11 @@ export interface MountState {
   initialSyncDone: boolean;
   /** Branch ID that was active when this mount last materialized */
   lastMaterializedBranchId: string | null;
+  /**
+   * What the mount's last pass found of its root, as of `at` (an ISO time):
+   * the words it listed for a root it couldn't use, or null where it used it.
+   */
+  lastPassRoot?: { at: string; listed: string | null };
   /**
    * The last on-agent-action scan, as of `at`: `complete` when it has
    * finished at all, `withinDeadline` when it finished before the deadline

package/src/modules/workspace/watcher.ts

@@ -38,13 +38,13 @@ export interface WatcherLifecycle {
   onReattach?: () => void;
 }
 
-interface RootIdentity {
+export interface RootIdentity {
   dev: number;
   ino: number;
   birthtimeMs: number;
 }
 
-const identityOf = (stat: Stats): RootIdentity => ({ dev: stat.dev, ino: stat.ino, birthtimeMs: stat.birthtimeMs });
+export const identityOf = (stat: Stats): RootIdentity => ({ dev: stat.dev, ino: stat.ino, birthtimeMs: stat.birthtimeMs === stat.ctimeMs ? 0 : stat.birthtimeMs });
 
 /**
  * Manages filesystem watching for a single mount.
@@ -481,10 +481,12 @@ export class MountWatcher {
   private sameIdentity(a: RootIdentity, b: RootIdentity): boolean {
     // birthtimeMs tells a root made again from a removed one whose inode
     // number it took, unless both were made within one tick of the clock or
-    // the file system keeps no birth time. A held root's removal shows in its
-    // link count instead, and where the root isn't held the rename's force
-    // covers those.
-    return a.dev === b.dev && a.ino === b.ino && a.birthtimeMs === b.birthtimeMs;
+    // either side's birth time can't be read (0: none kept, or one equal to
+    // the ctime, as where statx is unavailable or nothing has changed in the
+    // root since it was made). A held root's removal shows in its link count
+    // instead, and where the root isn't held the rename's force covers those.
+    return a.dev === b.dev && a.ino === b.ino
+      && (a.birthtimeMs === 0 || b.birthtimeMs === 0 || a.birthtimeMs === b.birthtimeMs);
   }
 
   private isErrno(err: unknown, code: string): boolean {

package/src/notice-tags.ts

@@ -33,6 +33,8 @@ export const NOTICE_TAG = {
   tuneOutWake: 'Tune-out wake',
   tuneOutCadence: 'Tune-out cadence',
   tuneOutCancelled: 'Tune-out cancelled',
+  focus: 'Focus',
+  agentLifecycle: 'Agent lifecycle',
   standingDispositions: 'Standing dispositions',
   channelInvitation: 'Channel invitation',
   system: 'system',

package/src/recovery/discord-awareness-outbox.ts

@@ -1285,7 +1285,7 @@ function leftPrepared(batch?: DiscordAwarenessBatch): string {
  * Read and check the ledger file: a missing file is an empty ledger. A file
  * this build can't read for its meaning is refused, never guessed at: one
  * it can't read or parse, one that isn't the shape its version promises,
- * and any version but 2 and 3, version 1 with its own reason.
+ * and any version but 2 and 3.
  */
 function readLedger(path: string):
   | { version: 3; state: LedgerState }
@@ -1318,16 +1318,6 @@ function readLedger(path: string):
     if (!isLegacyLedger(parsed)) throw new Error(`Invalid Discord awareness ledger ${path}`);
     return { version: 2, document: parsed as { version: 2; batches: unknown[] } };
   }
-  if (version === 1) {
-    throw new Error(
-      `Discord awareness ledger ${path} is version 1, which only agent-framework commit b16731b2 wrote ` +
-        '(2026-07-15, before any release). Every release rewrites it as version 2 at its next write, and this ' +
-        'build reads versions 2 and 3. Nothing is read from it until the file is moved away. Moving it gives up ' +
-        'only work it still had to send, which this build would retire unsent anyway, since that commit took each ' +
-        'mark out of the file once Discord confirmed it. A mark added just before that process ended, before its ' +
-        'confirmation was written, stays on Discord, and retract can\'t find it',
-    );
-  }
   throw new Error(
     `Discord awareness ledger ${path} is ${version === undefined ? 'of no version' : `version ${JSON.stringify(version)}`}, ` +
       'which this build can\'t read: it reads versions 2 and 3',

package/src/silent-heartbeat.ts

@@ -190,14 +190,17 @@ export interface RequestOnlyRowIndex {
 /** Index the agent's own rows that follow request-only turns: the rows of its
  * silent ticks, and the rows of each reply to a `[Continue]`. The two are
  * independent, so a row can be both. Only stamped rows are keyed, so an
- * agent's history walk costs a metadata read per row. */
-export function indexRequestOnlyRows(stored: readonly StoredRowLike[], agentName: string): RequestOnlyRowIndex {
+ * agent's history walk costs a metadata read per row. `own` is the agent's
+ * name, or every participant that is its own voice, as a derived agent's
+ * inherited rows are. */
+export function indexRequestOnlyRows(stored: readonly StoredRowLike[], own: string | ReadonlySet<string>): RequestOnlyRowIndex {
+  const ownNames = typeof own === 'string' ? new Set([own]) : own;
   const ticks = new Map<string, { tick: string; text: string }>();
   const prompts = new Map<string, RequestOnlyPrompt>();
   for (const row of stored) {
-    if (row.participant !== agentName) continue;
+    if (!ownNames.has(row.participant)) continue;
     const stamp = silentHeartbeatOf(row.metadata);
-    const ownTick = stamp !== undefined && stamp.agentName === agentName;
+    const ownTick = stamp !== undefined && stamp.agentName === row.participant;
     const prompt = promptedByOf(row.metadata);
     if (!ownTick && !prompt) continue;
     const keys = identityKeys(row.content);

package/src/stored-injections.ts

@@ -84,6 +84,13 @@ export function isAnotherAgentsInjection(metadata: unknown, agentName: string):
   return mark !== undefined && mark.agent !== agentName;
 }
 
+/** Whether a row is `agentName`'s own stored injection: its context, which
+ *  its view keeps however the rest is read, as a shared fork's does, whose
+ *  view is otherwise its source's (AgentFramework's deriveSharedContext). */
+export function isOwnInjection(metadata: unknown, agentName: string): boolean {
+  return storedInjectionMarkOf(metadata)?.agent === agentName;
+}
+
 /**
  * Whether an injection is stored, rather than placed by `compile()` each
  * time: an `afterUser` one, unless it opts out