@blamejs/blamejs-shop 0.2.15 → 0.2.18

package/lib/vendor/blamejs/lib/cert.js

@@ -54,6 +54,7 @@ var atomicFile    = require("./atomic-file");
 var safeJson      = require("./safe-json");
 var { defineClass } = require("./framework-error");
 var C             = require("./constants");
+var { boot }      = require("./log");
 
 var acme          = lazyRequire(function () { return require("./acme"); });
 var vault         = lazyRequire(function () { return require("./vault"); });
@@ -62,6 +63,7 @@ var networkTls    = lazyRequire(function () { return require("./network-tls"); }
 var bCrypto       = lazyRequire(function () { return require("./crypto"); });
 
 var CertError = defineClass("CertError");
+var log = boot("cert");
 
 var DEFAULT_RENEW_INTERVAL_MS    = C.TIME.hours(6);
 var DEFAULT_MIN_DAYS_BEFORE_EXPIRY = 14;
@@ -140,8 +142,13 @@ function _createSealedDiskStorage(opts) {
       if (!nodeFs.existsSync(p)) return null;
       try { return safeJson.parse(nodeFs.readFileSync(p, "utf8"), { maxBytes: C.BYTES.kib(16) }); }
       catch (e) {
-        throw new CertError("cert/bad-meta",
-          "cert: meta.json for '" + certName + "' is corrupt: " + e.message);
+        // meta.json is a derived index (expiry + fingerprint), not a
+        // source of truth — the sealed cert is. A corrupt meta must not
+        // block renewal: treat it as absent so _ensureCert re-derives it
+        // from a fresh issue rather than throwing out of start().
+        log.warn("cert: meta.json for '" + certName + "' unreadable (" +
+          e.message + ") — treating as absent, will re-derive");
+        return null;
       }
     },
 
@@ -413,8 +420,21 @@ function create(opts) {
       ? nodeFs.readFileSync(nodePath.join(storage.rootDir, "account/jwk.json.sealed"))
       : null;
     if (sealedBuf) {
-      var plain = (opts.storage.vault || vault().getDefaultStore()).unseal(sealedBuf);
-      var jwk = safeJson.parse(plain.toString("utf8"), { maxBytes: C.BYTES.kib(64) });
+      var jwk;
+      try {
+        var plain = (opts.storage.vault || vault().getDefaultStore()).unseal(sealedBuf);
+        jwk = safeJson.parse(plain.toString("utf8"), { maxBytes: C.BYTES.kib(64) });
+      } catch (e) {
+        // The ACME account key binds existing order + authorization
+        // history, so it is NOT auto-regenerated on corruption (unlike a
+        // re-issuable cert) — that would silently abandon the account.
+        // Fail with an actionable error naming the file + recovery instead
+        // of letting a raw decrypt/parse error escape out of start().
+        throw new CertError("cert/account-key-unreadable",
+          "cert: ACME account key 'account/jwk.json.sealed' is unreadable (" +
+          e.message + "). Restore it from backup, or delete it to register " +
+          "a fresh ACME account (this abandons prior order history).");
+      }
       return _accountKeyFromJwk(jwk);
     }
     var pair = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
@@ -555,18 +575,55 @@ function create(opts) {
   // for emergency reissue / key rollover when the existing cert is
   // structurally fine but operationally compromised (suspected key
   // disclosure, CA misissuance investigation, posture-driven rotation).
+  // A corrupt sealed cert/key is RECOVERABLE state — the CA re-issues on
+  // demand. Treat an unreadable sealed file like a missing one (log +
+  // re-issue) rather than letting a raw unseal/decrypt error escape out of
+  // start(): on a managed restart the same corrupt file is read on every
+  // boot, so throwing here is an unrecoverable crash loop, and a corrupt
+  // file must never be handled worse than an absent one (which already
+  // falls through to issue). The ACME account key is the one piece NOT
+  // auto-recovered this way — see _loadOrGenerateAccountKey.
+  async function _readSealedOrReissue(relPath, certName) {
+    try {
+      return await storage.readSealed(relPath);
+    } catch (e) {
+      log.warn("cert: sealed '" + relPath + "' unreadable (" + e.message +
+        ") — re-issuing as if absent");
+      _emitAudit("cert.sealed.corrupt", "recovered", { path: relPath, name: certName });
+      return null;
+    }
+  }
+
   async function _ensureCert(certManifest, forceIssue) {
     var meta = await storage.readMeta(certManifest.name);
-    var certBuf = await storage.readSealed(certManifest.name + "/cert.pem");
-    var keyBuf  = await storage.readSealed(certManifest.name + "/key.pem");
-    if (!forceIssue && meta && certBuf && keyBuf &&
-        meta.expiresAt > Date.now() + minDaysBeforeExpiry * C.TIME.days(1)) {
-      // Cached, not due for renewal yet.
+    var certBuf = await _readSealedOrReissue(certManifest.name + "/cert.pem", certManifest.name);
+    var keyBuf  = await _readSealedOrReissue(certManifest.name + "/key.pem", certManifest.name);
+    // Base the renewal decision on the SEALED cert's OWN notAfter, not the
+    // plaintext meta.json index. meta is a derived convenience copy; if it
+    // drifts from — or is tampered relative to — the actual cert (a far-
+    // future meta.expiresAt over an actually-expiring cert), trusting it
+    // would skip renewal and serve an expired cert. Re-derive expiry +
+    // fingerprint from the cert itself; if it won't parse, treat it as a
+    // corrupt sealed cert and re-issue (same recovery as an unreadable one).
+    var actual = null;
+    if (certBuf) {
+      try { actual = _certMeta(certBuf.toString("utf8")); }
+      catch (e) {
+        log.warn("cert: sealed cert for '" + certManifest.name + "' will not parse (" +
+          e.message + ") — re-issuing");
+        _emitAudit("cert.sealed.corrupt", "recovered",
+          { path: certManifest.name + "/cert.pem", name: certManifest.name });
+        certBuf = null;
+      }
+    }
+    if (!forceIssue && actual && certBuf && keyBuf &&
+        actual.expiresAt > Date.now() + minDaysBeforeExpiry * C.TIME.days(1)) {
+      // Cached, and the cert's own notAfter is comfortably in the future.
       loadedContexts[certManifest.name] = {
         cert:               certBuf.toString("utf8"),
         key:                keyBuf.toString("utf8"),
-        expiresAt:          meta.expiresAt,
-        fingerprintSha256:  meta.fingerprintSha256,
+        expiresAt:          actual.expiresAt,
+        fingerprintSha256:  actual.fingerprintSha256,
         sniNames:           certManifest.domains.slice(),
       };
       return loadedContexts[certManifest.name];

package/lib/vendor/blamejs/lib/cluster-storage.js

@@ -261,6 +261,33 @@ function placeholderize(sql, dialect) {
  *   );
  *   // → { rows: [ { counter: 43, row_hash: "..." } ], rowCount: 1 }
  */
+// Single-node transaction serialization. node:sqlite is synchronous and
+// the framework shares ONE local connection, so a SQLite transaction is
+// connection-global: any statement that runs between this connection's
+// BEGIN and COMMIT lands INSIDE the transaction. `_activeTx` is a promise
+// held for the duration of a single-node transaction(); execute() waits it
+// out before running so a concurrent statement can't interleave into the
+// open transaction on the shared connection. It is null in cluster mode
+// (the pool gives each transaction its own connection, so the DB enforces
+// isolation and no global lock is needed).
+var _activeTx = null;
+
+// Raw local exec — synchronous, no transaction-lock wait. Used by execute()
+// AFTER the lock wait and by transaction() for its own statements (which
+// must NOT wait on the lock they themselves hold). Because node:sqlite is
+// synchronous this runs atomically to completion with no interleaving.
+function _localExec(sql, params) {
+  var stmt = _localDb().prepare(sql);
+  // Heuristic: if the statement returns rows (SELECT or has RETURNING),
+  // use .all(); otherwise .run() and report changes as rowCount.
+  if (/^\s*SELECT\b/i.test(sql) || /\bRETURNING\b/i.test(sql)) {
+    var rows = stmt.all.apply(stmt, params || []);
+    return { rows: rows, rowCount: rows.length };
+  }
+  var info = stmt.run.apply(stmt, params || []);
+  return { rows: [], rowCount: info.changes };
+}
+
 async function execute(sql, params) {
   if (typeof sql !== "string") {
     throw new ClusterStorageError("sql must be a string", "cluster-storage/bad-arg");
@@ -275,17 +302,93 @@ async function execute(sql, params) {
     return result;
   }
 
-  // Local SQLite path. node:sqlite is sync — wrap in a resolved Promise
-  // so callers always see the same shape regardless of mode.
-  var stmt = _localDb().prepare(sql);
-  // Heuristic: if the statement returns rows (SELECT or has RETURNING),
-  // use .all(); otherwise .run() and report changes as rowCount.
-  if (/^\s*SELECT\b/i.test(sql) || /\bRETURNING\b/i.test(sql)) {
-    var rows = stmt.all.apply(stmt, params);
-    return { rows: rows, rowCount: rows.length };
+  // Local SQLite path. Wait out any open single-node transaction so this
+  // statement can't interleave into it on the shared connection. The loop
+  // re-checks after each wait (a new transaction may have started while we
+  // waited); once it exits, `_localExec` runs synchronously to completion,
+  // so no transaction can begin between the check and the statement.
+  while (_activeTx) { try { await _activeTx; } catch (_e) { /* tx failed — proceed */ } }
+  return _localExec(sql, params);
+}
+
+/**
+ * @primitive b.clusterStorage.transaction
+ * @signature b.clusterStorage.transaction(fn)
+ * @since     0.13.38
+ * @status    stable
+ * @related   b.clusterStorage.execute
+ *
+ * Run `fn` inside an atomic transaction against the active backend, so a
+ * multi-statement read-modify-write commits all-or-nothing. `fn` receives a
+ * transaction handle exposing the same `execute` / `executeOne` /
+ * `executeAll` surface as the module — but scoped to the open transaction.
+ * Use the handle's methods inside `fn`; calling the module-level
+ * `b.clusterStorage.execute` from within `fn` would deadlock single-node
+ * (it waits for the very transaction `fn` is running).
+ *
+ * Cluster mode dispatches to the external DB's transaction (its own pooled
+ * connection + deadlock retry). Single-node serializes against other
+ * transactions and against `execute` on the shared SQLite connection.
+ *
+ * @example
+ *   await b.clusterStorage.transaction(async function (tx) {
+ *     var row = await tx.executeOne("SELECT v FROM t WHERE k = ?", ["x"]);
+ *     await tx.execute("UPDATE t SET v = ? WHERE k = ?", [row.v + 1, "x"]);
+ *   });
+ */
+async function transaction(fn) {
+  if (typeof fn !== "function") {
+    throw new ClusterStorageError("transaction requires a function", "cluster-storage/bad-arg");
+  }
+
+  if (cluster.isClusterMode()) {
+    var dialect = cluster.dialect();
+    return await externalDb.transaction(async function (txClient) {
+      function txExec(sql, params) {
+        var translated = placeholderize(resolveTables(sql), dialect);
+        return txClient.query(translated, params || []);
+      }
+      var txHandle = {
+        execute:    txExec,
+        executeOne: async function (sql, params) {
+          var r = await txExec(sql, params); return r.rows.length > 0 ? r.rows[0] : null;
+        },
+        executeAll: async function (sql, params) {
+          var r = await txExec(sql, params); return r.rows;
+        },
+      };
+      return await fn(txHandle);
+    }, { backend: cluster.externalDbBackend() });
+  }
+
+  // Single-node: serialize this transaction behind any other open one, then
+  // hold `_activeTx` so concurrent execute()/transaction() calls wait.
+  while (_activeTx) { try { await _activeTx; } catch (_e) { /* prior tx failed */ } }
+  var releaseTx;
+  _activeTx = new Promise(function (resolve) { releaseTx = resolve; });
+  function txExecLocal(sql, params) { return Promise.resolve(_localExec(sql, params)); }
+  var localHandle = {
+    execute:    txExecLocal,
+    executeOne: async function (sql, params) {
+      var r = await txExecLocal(sql, params); return r.rows.length > 0 ? r.rows[0] : null;
+    },
+    executeAll: async function (sql, params) {
+      var r = await txExecLocal(sql, params); return r.rows;
+    },
+  };
+  try {
+    _localExec("BEGIN", []);
+    try {
+      var result = await fn(localHandle);
+      _localExec("COMMIT", []);
+      return result;
+    } catch (e) {
+      try { _localExec("ROLLBACK", []); } catch (_e) { /* already errored */ }
+      throw e;
+    }
+  } finally {
+    var r = releaseTx; _activeTx = null; r();
   }
-  var info = stmt.run.apply(stmt, params);
-  return { rows: [], rowCount: info.changes };
 }
 
 // Convenience wrappers for the two common patterns.
@@ -344,6 +447,7 @@ module.exports = {
   execute:               execute,
   executeOne:            executeOne,
   executeAll:            executeAll,
+  transaction:           transaction,
   tableName:             tableName,
   resolveTables:         resolveTables,
   placeholderize:        placeholderize,

package/lib/vendor/blamejs/lib/db.js

@@ -132,6 +132,22 @@ var encPath   = null;       // encrypted-at-rest path (null in plain mode)
 var encKey    = null;       // DB encryption key buffer (null in plain mode)
 var encTimer  = null;       // periodic encrypt interval handle
 var atRest    = null;       // 'encrypted' or 'plain'
+// Tmpfs free-space guard (encrypted mode). The working copy lives on a
+// bounded tmpfs (Docker /dev/shm defaults to 64 MiB); if it fills, SQLite
+// hits ENOSPC and corrupts the working copy. A periodic probe refuses
+// growth writes (INSERT/UPDATE/REPLACE) before that happens — fail-clear
+// instead of corrupt-then-recover. DELETE + reads stay available so
+// retention can reclaim space and the app can keep serving.
+var storageProbeTimer = null;  // periodic free-space probe handle
+var writesRefused = false;     // true when free space < minFreeBytes
+var minFreeBytes  = 0;         // refuse growth writes below this (0 = guard off)
+var statfsProbe   = null;      // free-space reader (fs.statfsSync; injectable for tests)
+// The process-exit final-flush handler is registered ONCE at first
+// encrypted init. Re-registering per init() leaked an 'exit' listener on
+// every init/close cycle (MaxListenersExceeded in long test runs / hot
+// reload); the flag makes it idempotent. The handler reads live module
+// state at exit time, so a later re-init is still covered.
+var _exitHandlerRegistered = false;
 var dataDir   = null;
 var initialized = false;
 var dataResidency = null;   // operator's declared region config (validated by storage backends)
@@ -672,13 +688,30 @@ function loadOrCreateDbKey(dataDirPath, keyPathOverride) {
 function decryptToTmp() {
   if (!encPath || !nodeFs.existsSync(encPath)) return;
   // If a plaintext file already exists in tmpfs from a prior process, prefer
-  // the newer mtime (crash recovery — operator's most recent state wins).
+  // the newer mtime (crash recovery — operator's most recent state wins) —
+  // but ONLY if it is a readable SQLite file. A working copy corrupted by
+  // an unclean shutdown or a full tmpfs (e.g. Docker's 64 MiB /dev/shm
+  // default overflowing) would otherwise be kept on every boot, and
+  // db.init's integrity gate would fail identically forever — an
+  // unrecoverable crash loop. When the newer plaintext fails a fast
+  // integrity probe, discard it and fall through to re-decrypt the
+  // last-good db.enc snapshot. db.enc itself is never modified here, so
+  // this only ever rolls back to the persistent encrypted copy; if THAT
+  // is also corrupt, db.init still fails loudly (no silent data loss).
   if (nodeFs.existsSync(dbPath)) {
     var plainStat = nodeFs.statSync(dbPath);
     var encStat = nodeFs.statSync(encPath);
     if (plainStat.mtimeMs > encStat.mtimeMs && plainStat.size > 0) {
-      log("plaintext is newer than encrypted — keeping plaintext (crash recovery)");
-      return;
+      if (_tmpWorkingCopyIsHealthy(dbPath)) {
+        log("plaintext is newer than encrypted — keeping plaintext (crash recovery)");
+        return;
+      }
+      log("newer tmpfs working copy failed its integrity probe (corrupt — likely an " +
+          "unclean shutdown or a full /dev/shm); discarding it and re-decrypting from " +
+          "db.enc (auto-recovery to the last-good encrypted snapshot)");
+      try { nodeFs.unlinkSync(dbPath); }          catch (_e) { /* fall through to overwrite */ }
+      try { nodeFs.unlinkSync(dbPath + "-wal"); } catch (_e) { /* may not exist */ }
+      try { nodeFs.unlinkSync(dbPath + "-shm"); } catch (_e) { /* may not exist */ }
     }
   }
   var packed = nodeFs.readFileSync(encPath);
@@ -696,10 +729,90 @@ function decryptToTmp() {
   }
 }
 
+// Fast "is this a usable SQLite file" probe for the crash-recovery path.
+// Opens the candidate working copy and runs PRAGMA quick_check(1) (far
+// cheaper than full integrity_check — header + page-structure sanity,
+// enough to catch a "database disk image is malformed" / truncated /
+// non-DB file). Any throw (malformed image, not-a-DB) or non-"ok" result
+// is unhealthy. The probe handle is always closed so it never holds the
+// tmpfs file open against the subsequent real open.
+function _tmpWorkingCopyIsHealthy(p) {
+  var probe = null;
+  try {
+    probe = new DatabaseSync(p);
+    var rows = probe.prepare("PRAGMA quick_check(1)").all();
+    return rows.length >= 1 && rows[0] && rows[0].quick_check === "ok";
+  } catch (_e) {
+    return false;
+  } finally {
+    if (probe) { try { probe.close(); } catch (_e2) { /* already gone */ } }
+  }
+}
+
 function _dbEncAad(dir) {
   return Buffer.from("blamejs.db-enc.v1\0" + (dir || ""), "utf8");
 }
 
+// Probe free space on the tmpfs holding the working copy and flip the
+// write-refusal flag. Encrypted mode only (the bounded-tmpfs surface);
+// guard disabled when minFreeBytes is 0. A probe failure leaves the flag
+// unchanged — we never refuse writes on a stat error (that would be a
+// self-inflicted outage). Growth writes (INSERT/UPDATE/REPLACE) are gated
+// by the prepare() wrapper installed in init(); DELETE + reads always pass
+// so retention can reclaim space and the app keeps serving.
+function _probeStorageHeadroom() {
+  if (atRest !== "encrypted" || !minFreeBytes || !dbPath || !statfsProbe) return;
+  var free;
+  try {
+    var st = statfsProbe(nodePath.dirname(dbPath));
+    free = st.bavail * st.bsize;
+    if (!isFinite(free)) return;
+  } catch (_e) { return; }
+  if (free < minFreeBytes && !writesRefused) {
+    writesRefused = true;
+    log.error("storage low: " + free + " bytes free on the tmpfs working-copy mount (< " +
+      minFreeBytes + ") — refusing growth writes (INSERT/UPDATE/REPLACE) until space " +
+      "recovers. Raise shm_size / --shm-size, or let retention prune. DELETE + reads still serve.");
+    try {
+      audit.safeEmit({ action: "db.storage.low", outcome: "failure",
+        metadata: { freeBytes: free, minFreeBytes: minFreeBytes } });
+    } catch (_e2) { /* drop-silent — observability */ }
+  } else if (free >= minFreeBytes && writesRefused) {
+    writesRefused = false;
+    log("storage recovered: " + free + " bytes free — growth writes re-enabled");
+    try {
+      audit.safeEmit({ action: "db.storage.recovered", outcome: "success",
+        metadata: { freeBytes: free } });
+    } catch (_e3) { /* drop-silent */ }
+  }
+}
+
+// Install the growth-write gate on the SQLite handle: shadow prepare() so
+// INSERT/UPDATE/REPLACE statements throw db/storage-low when the tmpfs is
+// critically low, instead of proceeding into an ENOSPC corruption. Reads,
+// DELETE, PRAGMA, and DDL pass through ungated. Called once in init() after
+// schema setup so init's own writes are never gated (writesRefused is false
+// until the first probe anyway).
+function _installWriteGate() {
+  var rawPrepare = database.prepare.bind(database);
+  database.prepare = function (sql) {
+    var stmt = rawPrepare(sql);
+    if (/^\s*(?:INSERT|UPDATE|REPLACE)\b/i.test(sql)) {
+      var rawRun = stmt.run.bind(stmt);
+      stmt.run = function () {
+        if (writesRefused) {
+          throw _dbErr("db/storage-low",
+            "db: refusing write — the encrypted-mode working copy is on a tmpfs with less than " +
+            minFreeBytes + " bytes free (Docker /dev/shm defaults to 64 MiB). Raise shm_size / " +
+            "--shm-size, or let retention prune expired rows. DELETE and reads remain available.");
+        }
+        return rawRun.apply(stmt, arguments);
+      };
+    }
+    return stmt;
+  };
+}
+
 function encryptToDisk() {
   if (!encPath) return;
   // Force WAL checkpoint so the .db file holds all committed transactions.
@@ -878,11 +991,11 @@ async function init(opts) {
     if (!nodeFs.existsSync(tmpDir)) nodeFs.mkdirSync(tmpDir, { recursive: true });
 
     // D-H7 — if the resolved tmpDir is NOT actually tmpfs, the
-    // plaintext DB file lives on persistent storage. statvfs/statfs
-    // isn't in stable Node, but on Linux we can check that tmpDir
-    // resolves under /dev/shm or /run/shm as a heuristic. On other
+    // plaintext DB file lives on persistent storage. We check that tmpDir
+    // resolves under /dev/shm or /run/shm on Linux as a heuristic; on other
     // platforms we warn that the operator must verify tmpfs binding
-    // out-of-band.
+    // out-of-band. (Free-space headroom is enforced separately via
+    // fs.statfsSync in the storage guard below.)
     if (process.platform === "linux") {
       var realTmp = "";
       try { realTmp = nodeFs.realpathSync(tmpDir); } catch (_e) { /* stat best-effort */ }
@@ -904,6 +1017,21 @@ async function init(opts) {
     dbPath  = nodePath.join(tmpDir, "blamejs-" + generateToken(C.BYTES.bytes(16)) + ".db");
     encKey  = loadOrCreateDbKey(dataDir, opts.dbKeyPath);
 
+    // Tmpfs free-space guard. Default headroom is 16 MiB below which growth
+    // writes are refused (fail-clear) before the working copy fills its
+    // bounded tmpfs and corrupts. opts.minFreeBytes tunes it; 0 disables.
+    // opts._statfsForTest injects a free-space reader for tests.
+    if (opts.minFreeBytes !== undefined) {
+      require("./numeric-bounds").requireNonNegativeFiniteIntIfPresent(
+        opts.minFreeBytes, "db.init: opts.minFreeBytes", DbError, "db/bad-min-free-bytes");
+      minFreeBytes = opts.minFreeBytes;
+    } else {
+      minFreeBytes = C.BYTES.mib(16);
+    }
+    statfsProbe = typeof opts._statfsForTest === "function"
+      ? opts._statfsForTest
+      : (typeof nodeFs.statfsSync === "function" ? nodeFs.statfsSync : null);
+
     cleanStaleTmpDbs(tmpDir);
     decryptToTmp();
   } else {
@@ -961,7 +1089,25 @@ async function init(opts) {
   // the freshly-decrypted-into-tmpfs file (<1 second on a typical
   // multi-MB DB) and the result is "ok" or a list of issues.
   if (opts.skipBootIntegrityCheck !== true) {
-    var ic = database.prepare("PRAGMA integrity_check").all();
+    var ic;
+    try {
+      ic = database.prepare("PRAGMA integrity_check").all();
+    } catch (corruptErr) {
+      // SQLite throws "database disk image is malformed" / "file is not a
+      // database" when the file is too corrupt to even run the check.
+      // Translate the raw native error into an actionable one — the most
+      // common operational cause in encrypted mode is a too-small tmpfs.
+      throw new DbError("db/integrity-check-failed",
+        "database is corrupt at boot — SQLite: " +
+        ((corruptErr && corruptErr.message) || String(corruptErr)) + ". " +
+        (atRest === "encrypted"
+          ? "Encrypted mode runs the live DB as a tmpfs working copy (" + dbPath +
+            "); a recurring failure here usually means the tmpfs is too small " +
+            "(Docker's /dev/shm defaults to 64 MiB — raise it via shm_size / " +
+            "--shm-size), or db.enc itself is corrupt (restore <dataDir>/db.enc " +
+            "from backup)."
+          : "Restore the database file (" + dbPath + ") from backup."));
+    }
     var icIssues = ic.map(function (r) { return r && r.integrity_check; })
                      .filter(function (s) { return s && s !== "ok"; });
     if (icIssues.length > 0) {
@@ -1282,12 +1428,30 @@ async function init(opts) {
       }
     }, C.TIME.minutes(5), { name: "db-periodic-encrypt" });
 
+    // Tmpfs free-space guard. Install the growth-write gate now (after all
+    // of init's own writes), then probe on a short interval so the
+    // refuse-writes flag tracks a fast-filling tmpfs (the 5-minute encrypt
+    // cadence is far too coarse to catch a fill in time). The guard is a
+    // no-op when minFreeBytes is 0 or no statfs reader is available.
+    if (minFreeBytes && statfsProbe) {
+      _installWriteGate();
+      _probeStorageHeadroom();   // seed the flag from current free space
+      storageProbeTimer = safeAsync.repeating(_probeStorageHeadroom,
+        C.TIME.seconds(10), { name: "db-storage-probe" });
+    }
+
     // Final encrypt on process exit. We don't try to unlink the plaintext
     // here — the SQLite handle may still be open, and the OS reclaims tmpfs
-    // on reboot anyway. close() does the orderly shutdown.
-    process.on("exit", function () {
-      try { encryptToDisk(); } catch (_e) { /* exit handler — silent */ }
-    });
+    // on reboot anyway. close() does the orderly shutdown. Registered ONCE
+    // (guarded by the module flag) — re-registering per init() leaked an
+    // 'exit' listener on every init/close cycle. The handler reads live
+    // module state, so it still flushes whatever DB is open at exit.
+    if (!_exitHandlerRegistered) {
+      _exitHandlerRegistered = true;
+      process.on("exit", function () {
+        try { if (atRest === "encrypted") encryptToDisk(); } catch (_e) { /* exit handler — silent */ }
+      });
+    }
   }
 
   log("ready (mode: " + atRest + ", path: " + dbPath + ")");
@@ -1924,6 +2088,11 @@ function close() {
     encTimer.stop();
     encTimer = null;
   }
+  if (storageProbeTimer) {
+    storageProbeTimer.stop();
+    storageProbeTimer = null;
+  }
+  writesRefused = false;
   // Drop prepared-statement cache so the underlying Statement handles
   // release ahead of database.close().
   _prepareCache.clear();
@@ -1942,11 +2111,19 @@ function close() {
   // Order: encrypt while the DB is still open (so the file is consistent),
   // then close the SQLite handle (releases the file lock on Windows),
   // THEN unlink the plaintext sidecar files.
-  try { encryptToDisk(); } catch (e) {
-    log.error("close: final encrypt failed: " + e.message);
+  var encryptOk = false;
+  try { encryptToDisk(); encryptOk = true; } catch (e) {
+    log.error("close: final encrypt failed: " + e.message +
+      " — keeping the plaintext working copy so the next boot can recover " +
+      "the latest writes (db.enc still holds the prior snapshot)");
   }
   try { database.close(); } catch (_e) { /* already closed */ }
-  if (atRest === "encrypted") removePlaintextFiles();
+  // Only discard the plaintext working copy once it has been safely
+  // re-encrypted. If the final encrypt failed (full /dev/shm, disk-full),
+  // the working copy is the ONLY carrier of writes since the last periodic
+  // flush — keep it so decryptToTmp's newer-mtime recovery picks it up next
+  // boot (integrity-probed, falling back to db.enc if it is itself corrupt).
+  if (atRest === "encrypted" && encryptOk) removePlaintextFiles();
   database = null;
   initialized = false;
 }
@@ -2440,6 +2617,7 @@ function _cascadeStep(name, ref) {
 // Test helpers — not part of public contract
 function _resetForTest() {
   if (encTimer) { encTimer.stop(); encTimer = null; }
+  if (storageProbeTimer) { storageProbeTimer.stop(); storageProbeTimer = null; }
   try { if (database) database.close(); }
   catch (e) { log.debug("test-reset close failed", { error: e.message }); }
   database = null;
@@ -2448,10 +2626,20 @@ function _resetForTest() {
   encKey = null;
   atRest = null;
   dataDir = null;
+  minFreeBytes = 0;
+  statfsProbe = null;
+  writesRefused = false;
   initialized = false;
   cryptoField.clearForTest();
 }
 
+// Test seam — force a storage-headroom probe synchronously (the production
+// path runs it on a 10s timer) and read the resulting refuse-writes flag.
+function _probeStorageForTest() {
+  _probeStorageHeadroom();
+  return { writesRefused: writesRefused, minFreeBytes: minFreeBytes };
+}
+
 
 /**
  * @primitive b.db.vacuumAfterErase
@@ -3102,6 +3290,8 @@ module.exports = {
     _cascadeStep("redact",      _resetRedact);
     _cascadeStep("external-db", _resetExternalDb);
   },
+  // Test seam for the tmpfs free-space guard — force a probe + read the flag.
+  _probeStorageForTest: _probeStorageForTest,
   // Helper for audit.checkpoint to write the rollback-detection sidecar
   _writeAuditTip: function (tip) {
     if (!dataDir) return;