@cassiomc1/forgeloop 1.2.4 → 1.5.0

package/src/core/events.js

@@ -1,5 +1,5 @@
 
-import { appendFile, mkdir, readFile } from "node:fs/promises";
+import { appendFile, mkdir, open, readFile, stat } from "node:fs/promises";
 import path from "node:path";
 
 import { assertSafePath, ensureWithin, fileExists } from "./filesystem.js";
@@ -11,9 +11,17 @@ import { PROTOCOL_VERSION } from "./protocol.js";
 import { isRecoverableCompletionEvidenceCode } from "./completion-recovery.js";
 
 import { taskArtifactPath } from "./task-paths.js";
+import { getActiveTaskTransaction, withTaskTransaction } from "./transaction.js";
 
 import { assertDiagnosisDetails } from "./diagnosis-model.js";
 import { assertDecisionCriterionDetails } from "./settlement-model.js";
+import {
+  LEGACY_RECOVERY_MIGRATION_EVENT,
+  assertLegacyMigrationDetails,
+  isLegacyRecoveryDetailsShape,
+  isLegacyRecoveryEventShape,
+  legacyRecoveryMigrationId,
+} from "./task-recovery-migration.js";
 
 const EVENT_SCHEMA_VERSION = 1;
 export const LIFECYCLE_MILESTONES = Object.freeze([
@@ -40,6 +48,50 @@ const REPEATABLE_MILESTONES = new Set([
   "TERMINAL_RESULT_RECORDED",
 ]);
 
+function eventIndexPath(eventsPath) {
+  return `${eventsPath}.index.json`;
+}
+
+function parseEventIndex(text, relativePath) {
+  if (typeof text !== "string") return null;
+  try {
+    const value = JSON.parse(text);
+    if (!value || value.schemaVersion !== 1 || !Number.isInteger(value.seq) || value.seq < 0
+      || (value.lastHash !== null && !/^[a-f0-9]{64}$/.test(value.lastHash))) return null;
+    return value;
+  } catch {
+    return null;
+  }
+}
+
+function checkpointFromEvents(events) {
+  const last = events.at(-1) ?? null;
+  return {
+    schemaVersion: 1,
+    seq: last?.seq ?? 0,
+    lastHash: last?.hash ?? null,
+  };
+}
+
+async function readEventCheckpoint(target, packageRoot, relPath, options, transaction) {
+  if (!transaction.eventCheckpoints) transaction.eventCheckpoints = new Map();
+  const cached = transaction.eventCheckpoints.get(relPath);
+  if (cached) return cached;
+
+  const indexPath = eventIndexPath(relPath);
+  const indexed = parseEventIndex(await transaction.readText(indexPath), indexPath);
+  const tail = await readEventTail(target, packageRoot, { ...options, eventsPath: relPath, limit: 1 });
+  const last = tail.at(-1) ?? null;
+  let checkpoint;
+  if (indexed && indexed.seq === (last?.seq ?? 0) && indexed.lastHash === (last?.hash ?? null)) {
+    checkpoint = indexed;
+  } else {
+    checkpoint = checkpointFromEvents(await readEvents(target, packageRoot, { ...options, eventsPath: relPath }));
+  }
+  transaction.eventCheckpoints.set(relPath, checkpoint);
+  return checkpoint;
+}
+
 export function validateKnownEventDetails(event) {
   if (!event || typeof event !== "object") return;
   switch (event.event) {
@@ -52,11 +104,63 @@ export function validateKnownEventDetails(event) {
     case "CHECKPOINT_RECONCILED":
       assertReconcileClosureDetails(event.details);
       return;
+    case "TASK_RECOVERY_RECORDED":
+      assertRecoveryRecordedDetails(event.details);
+      return;
+    case "OPERATOR_RECOVERY_RECORDED":
+      // The exact known legacy defect signature is tolerated here so the
+      // ledger can be parsed and classified. It only becomes valid through an
+      // official migration event (enforced by validateEventLedger).
+      if (!event.details?.recoveryId && isLegacyRecoveryDetailsShape(event.details)) return;
+      assertRecoveryRecordedDetails(event.details);
+      return;
+    case "LEGACY_RECOVERY_MIGRATION_RECORDED":
+      assertLegacyMigrationDetails(event.details);
+      return;
+    case "TASK_RECOVERY_RESUMED":
+      assertRecoveryResumedDetails(event.details);
+      return;
     default:
       return;
   }
 }
 
+function assertStringList(value, label) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || !item)) {
+    throw protocolError("E_EVENT_INVALID", `${label} must be an array of non-empty strings`);
+  }
+}
+
+function assertRecoveryRecordedDetails(details) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
+    throw protocolError("E_EVENT_INVALID", "recovery event requires structured details");
+  }
+  for (const key of ["recoveryId", "classification", "previousPhase", "authorityKind"]) {
+    if (typeof details[key] !== "string" || !details[key]) {
+      throw protocolError("E_EVENT_INVALID", `recovery event details.${key} must be a non-empty string`);
+    }
+  }
+  if (!Number.isInteger(details.previousRevision) || details.previousRevision < 0) {
+    throw protocolError("E_EVENT_INVALID", "recovery event details.previousRevision must be a non-negative integer");
+  }
+  if (!["STALE", "ABANDONED"].includes(details.classification)) {
+    throw protocolError("E_EVENT_INVALID", "recovery event details.classification must be STALE or ABANDONED");
+  }
+  if (!["CALLER_ACKNOWLEDGED", "HOST_ATTESTED"].includes(details.authorityKind)) {
+    throw protocolError("E_EVENT_INVALID", "recovery event details.authorityKind is invalid");
+  }
+  assertStringList(details.reasonCodes, "recovery event details.reasonCodes");
+  assertStringList(details.releasedClaims, "recovery event details.releasedClaims");
+}
+
+function assertRecoveryResumedDetails(details) {
+  if (!details || typeof details !== "object" || Array.isArray(details)
+    || typeof details.recoveryId !== "string" || !details.recoveryId) {
+    throw protocolError("E_EVENT_INVALID", "TASK_RECOVERY_RESUMED requires details.recoveryId");
+  }
+  assertStringList(details.reacquiredClaims, "TASK_RECOVERY_RESUMED details.reacquiredClaims");
+}
+
 function assertReconcileClosureDetails(details) {
   if (!details || typeof details !== "object" || Array.isArray(details)) {
     throw protocolError("E_EVENT_INVALID", "CHECKPOINT_RECONCILED requires structured details");
@@ -76,7 +180,7 @@ function assertReconcileClosureDetails(details) {
   }
 }
 
-function eventHash(event) {
+export function eventHash(event) {
   const { hash, ...body } = event;
   return canonicalFingerprint(body);
 }
@@ -94,6 +198,47 @@ export async function readEvents(target, packageRoot, options = {}) {
   const eventsPath = ensureWithin(target, relPath);
   if (!(await fileExists(eventsPath))) return [];
   const text = await readFile(eventsPath, "utf8");
+  return parseEventsText(text, relPath, packageRoot);
+}
+
+export async function readEventTail(target, packageRoot, options = {}) {
+  const limit = options.limit ?? 50;
+  if (!Number.isInteger(limit) || limit < 1) {
+    throw protocolError("E_EVENT_INVALID", "ledger tail limit must be a positive integer");
+  }
+  const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
+  await assertSafePath(target, relPath);
+  const eventsPath = ensureWithin(target, relPath);
+  if (!(await fileExists(eventsPath))) return [];
+  const size = (await stat(eventsPath)).size;
+  let window = Math.min(size, 64 * 1024);
+  while (true) {
+    const position = size - window;
+    const handle = await open(eventsPath, "r");
+    const bytes = Buffer.alloc(window);
+    try {
+      await handle.read(bytes, 0, window, position);
+    } finally {
+      await handle.close();
+    }
+    let text = bytes.toString("utf8");
+    if (position > 0) {
+      const firstLineEnd = text.indexOf("\n");
+      if (firstLineEnd < 0) {
+        window = Math.min(size, window * 2);
+        continue;
+      }
+      text = text.slice(firstLineEnd + 1);
+    }
+    const lines = text.split(/\r?\n/).filter((line) => line.trim() !== "");
+    if (lines.length >= limit || position === 0) {
+      return parseEventsText(lines.slice(-limit).join("\n"), relPath, packageRoot);
+    }
+    window = Math.min(size, window * 2);
+  }
+}
+
+async function parseEventsText(text, relPath, packageRoot) {
   assertJsonBytes(text, relPath);
   const schema = await readSchema("event", packageRoot);
   const lines = text.split(/\r?\n/).filter((line) => line.trim() !== "");
@@ -112,20 +257,28 @@ export async function readEvents(target, packageRoot, options = {}) {
 }
 
 export async function appendProtocolEvent(target, input, packageRoot, options = {}) {
+  const activeTransaction = getActiveTaskTransaction();
   if (typeof input?.taskId !== "string" || !input.taskId) throw protocolError("E_EVENT_INVALID", "event taskId is required");
   if (typeof input?.event !== "string" || !input.event) throw protocolError("E_EVENT_INVALID", "event type is required");
   const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
-  const events = await readEvents(target, packageRoot, { ...options, eventsPath: relPath });
-  const previous = events.at(-1) ?? null;
+  if (!activeTransaction) {
+    return withTaskTransaction({
+      target,
+      taskId: options.taskId ?? input.taskId,
+      lockTaskId: relPath === ARTIFACT_PATHS.events ? "__legacy-events__" : (options.taskId ?? input.taskId),
+      operation: "append-event",
+    }, async () => appendProtocolEvent(target, input, packageRoot, options));
+  }
+  const checkpoint = await readEventCheckpoint(target, packageRoot, relPath, options, activeTransaction);
   const event = {
-    seq: events.length + 1,
+    seq: checkpoint.seq + 1,
     schemaVersion: EVENT_SCHEMA_VERSION,
     protocolVersion: PROTOCOL_VERSION,
     taskId: input.taskId,
     event: input.event,
     at: input.at ?? new Date().toISOString(),
     ...(input.fingerprint ? { fingerprint: input.fingerprint } : {}),
-    previousHash: previous?.hash ?? null,
+    previousHash: checkpoint.lastHash,
     ...(input.details ? { details: structuredClone(input.details) } : {}),
   };
   validateKnownEventDetails(event);
@@ -133,14 +286,88 @@ export async function appendProtocolEvent(target, input, packageRoot, options =
   const schema = await readSchema("event", packageRoot);
   assertSchema(event, schema, relPath);
   event.hash = eventHash(event);
-  const eventsPath = ensureWithin(target, relPath);
   if (!options.dryRun) {
-    await mkdir(path.dirname(eventsPath), { recursive: true });
-    await appendFile(eventsPath, `${JSON.stringify(event)}\n`, { encoding: "utf8" });
+    if (activeTransaction) {
+      await activeTransaction.appendText(relPath, `${JSON.stringify(event)}\n`);
+      const nextCheckpoint = { schemaVersion: 1, seq: event.seq, lastHash: event.hash };
+      await activeTransaction.stageText(eventIndexPath(relPath), `${JSON.stringify(nextCheckpoint)}\n`);
+      activeTransaction.eventCheckpoints.set(relPath, nextCheckpoint);
+    } else {
+      const eventsPath = ensureWithin(target, relPath);
+      await mkdir(path.dirname(eventsPath), { recursive: true });
+      await appendFile(eventsPath, `${JSON.stringify(event)}\n`, { encoding: "utf8" });
+    }
   }
   return event;
 }
 
+/**
+ * Validates the append-only pairing between unmigrated legacy recovery events
+ * and their official migration events. Strict by default; the official repair
+ * command validates intermediate state with `allowUnmigratedLegacyRecoveryEvents`
+ * before appending the migration events.
+ */
+function validateLegacyRecoveryMigrations(events, errors, { allowUnmigratedLegacyRecoveryEvents = false } = {}) {
+  const migrationBySeq = new Map();
+  for (const event of events) {
+    if (event.event !== LEGACY_RECOVERY_MIGRATION_EVENT) continue;
+    try {
+      assertLegacyMigrationDetails(event.details);
+    } catch (err) {
+      errors.push({ code: err.code ?? "E_EVENT_INVALID", message: `event ${event.seq} (${event.event}): ${err.message}` });
+      continue;
+    }
+    if (migrationBySeq.has(event.details.legacyEventSeq)) {
+      errors.push({
+        code: "E_EVENT_INVALID",
+        message: `event ${event.seq} (${event.event}): duplicate migration for legacy recovery event seq ${event.details.legacyEventSeq}`,
+      });
+      continue;
+    }
+    migrationBySeq.set(event.details.legacyEventSeq, event);
+  }
+  for (const event of events) {
+    if (!isLegacyRecoveryEventShape(event)) continue;
+    const migration = migrationBySeq.get(event.seq);
+    if (!migration) {
+      if (!allowUnmigratedLegacyRecoveryEvents) {
+        errors.push({
+          code: "E_EVENT_INVALID",
+          message: `legacy recovery event ${event.seq} is not officially migrated (run forgeloop task-repair-legacy-recovery)`,
+        });
+      }
+      continue;
+    }
+    migrationBySeq.delete(event.seq);
+    const expectedRecoveryId = legacyRecoveryMigrationId({ taskId: event.taskId, seq: event.seq, hash: event.hash });
+    // Tail-binding: the migration event is appended at the ledger tail and may
+    // sit anywhere after its historical source. It binds by reference only.
+    if (migration.seq <= event.seq) {
+      errors.push({
+        code: "E_EVENT_INVALID",
+        message: `migration event ${migration.seq} must follow legacy recovery event ${event.seq}`,
+      });
+    }
+    if (migration.taskId !== event.taskId
+      || migration.details.legacyTaskId !== event.taskId
+      || migration.details.recoveryId !== expectedRecoveryId
+      || migration.details.legacyEventHash !== event.hash
+      || migration.details.legacyEventAt !== event.at
+      || migration.details.legacyEventType !== event.event) {
+      errors.push({
+        code: "E_LEDGER_HASH_INVALID",
+        message: `migration event ${migration.seq} does not bind legacy recovery event ${event.seq}`,
+      });
+    }
+  }
+  for (const [legacySeq, migration] of migrationBySeq) {
+    errors.push({
+      code: "E_EVENT_INVALID",
+      message: `migration event ${migration.seq} references unknown legacy recovery event seq ${legacySeq}`,
+    });
+  }
+}
+
 export async function validateEventLedger(target, packageRoot, options = {}) {
   const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
   let events;
@@ -222,6 +449,9 @@ export async function validateEventLedger(target, packageRoot, options = {}) {
       errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: "completion rejected before verification started" });
     }
   }
+  validateLegacyRecoveryMigrations(events, errors, {
+    allowUnmigratedLegacyRecoveryEvents: options?.allowUnmigratedLegacyRecoveryEvents === true,
+  });
   return { valid: errors.length === 0, events, errors };
 }
 

package/src/core/execution.js

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import { readdir } from "node:fs/promises";
 import path from "node:path";
@@ -54,25 +54,79 @@ function validateAuthorityBeforeLaunch({ target, taskId, argv, resolution, detai
   }
 }
 
-function executeProcess(argv, cwd) {
+const MAX_CAPTURED_OUTPUT_BYTES = 64 * 1024;
+export const TERMINATION_GRACE_MS = 1_000;
+
+function digest(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+function executeProcess(argv, cwd, { timeoutMs = null } = {}) {
   return new Promise((resolve) => {
     let spawnError = null;
+    let timedOut = false;
+    let settled = false;
+    let timeout = null;
+    let forceTermination = null;
+    const stdout = [];
+    const stderr = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let outputTruncated = false;
+    const capture = (chunks, chunk, total) => {
+      const available = MAX_CAPTURED_OUTPUT_BYTES - total;
+      if (available <= 0) {
+        outputTruncated = true;
+        return total;
+      }
+      if (chunk.length > available) {
+        chunks.push(chunk.subarray(0, available));
+        outputTruncated = true;
+        return total + available;
+      }
+      chunks.push(chunk);
+      return total + chunk.length;
+    };
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      if (timeout) clearTimeout(timeout);
+      if (forceTermination) clearTimeout(forceTermination);
+      resolve({
+        ...result,
+        timedOut,
+        stdout: Buffer.concat(stdout),
+        stderr: Buffer.concat(stderr),
+        stdoutBytes,
+        stderrBytes,
+        outputTruncated,
+      });
+    };
     try {
       const child = spawn(argv[0], argv.slice(1), {
         cwd,
         shell: false,
         stdio: ["ignore", "pipe", "pipe"],
       });
-      child.stdout?.resume();
-      child.stderr?.resume();
+      child.stdout?.on("data", (chunk) => { stdoutBytes = capture(stdout, chunk, stdoutBytes); });
+      child.stderr?.on("data", (chunk) => { stderrBytes = capture(stderr, chunk, stderrBytes); });
       child.once("error", (error) => {
         spawnError = error;
       });
-      child.once("close", (exitCode) => {
-        resolve({ exitCode, spawnError });
+      child.once("close", (exitCode, signal) => {
+        finish({ exitCode, signal, spawnError });
       });
+      if (Number.isInteger(timeoutMs) && timeoutMs > 0) {
+        timeout = setTimeout(() => {
+          timedOut = true;
+          child.kill("SIGTERM");
+          forceTermination = setTimeout(() => {
+            child.kill("SIGKILL");
+          }, TERMINATION_GRACE_MS);
+        }, timeoutMs);
+      }
     } catch (error) {
-      resolve({ exitCode: null, spawnError: error });
+      finish({ exitCode: null, signal: null, spawnError: error });
     }
   });
 }
@@ -106,6 +160,7 @@ export async function runCommandExecution({
   authorityContext,
   runtimeContext,
   executionPath,
+  timeoutMs = null,
 } = {}) {
   const commandArgv = normalizeArgv(argv);
   const resolution = await resolveExecutionResolution({
@@ -145,7 +200,7 @@ export async function runCommandExecution({
 
   const executionId = `exec-${randomUUID()}`;
   const startedAt = new Date().toISOString();
-  const processResult = await executeProcess(commandArgv, target);
+  const processResult = await executeProcess(commandArgv, target, { timeoutMs });
   const finishedAt = new Date().toISOString();
   const execution = {
     schemaVersion: 1,
@@ -167,8 +222,17 @@ export async function runCommandExecution({
     ...(resolution.dispatch ? { dispatch: resolution.dispatch } : {}),
     startedAt,
     finishedAt,
-    status: processResult.exitCode === 0 && !processResult.spawnError ? "passed" : "failed",
+    status: processResult.exitCode === 0 && !processResult.spawnError && !processResult.timedOut ? "passed" : "failed",
     exitCode: processResult.exitCode,
+    durationMs: Math.max(0, Date.parse(finishedAt) - Date.parse(startedAt)),
+    termination: processResult.spawnError ? "spawn-error" : processResult.timedOut ? "timeout" : processResult.signal ? "signal" : "exit",
+    signal: processResult.signal ?? null,
+    stdoutSha256: digest(processResult.stdout),
+    stderrSha256: digest(processResult.stderr),
+    stdoutBytes: processResult.stdoutBytes,
+    stderrBytes: processResult.stderrBytes,
+    outputTruncated: processResult.outputTruncated,
+    ...(Number.isInteger(timeoutMs) && timeoutMs > 0 ? { timeoutMs, terminationGraceMs: TERMINATION_GRACE_MS } : {}),
   };
   const execPath = executionPath ?? await resolveExecutionArtifactPath(target, taskId, executionId);
   const written = await writeJsonArtifact(target, execPath, execution, "execution", packageRoot);

package/src/core/filesystem.js

@@ -3,13 +3,62 @@ import {
   access,
   lstat,
   mkdir,
+  open,
   readFile,
   realpath,
   rename,
   unlink,
-  writeFile,
 } from "node:fs/promises";
 import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+
+const WINDOWS_TRANSIENT_RETRY_DELAYS_MS = Object.freeze([5, 10, 20, 40]);
+
+async function fsCallWithTransientWindowsRetry(fsImpl, filePath, {
+  platform = process.platform,
+  retryDelaysMs = WINDOWS_TRANSIENT_RETRY_DELAYS_MS,
+  delayImpl = delay,
+} = {}) {
+  let retryIndex = 0;
+  while (true) {
+    try {
+      return await fsImpl(filePath);
+    } catch (error) {
+      const retryable = platform === "win32"
+        && (error?.code === "EPERM" || error?.code === "EACCES")
+        && retryIndex < retryDelaysMs.length;
+      if (!retryable) throw error;
+      await delayImpl(retryDelaysMs[retryIndex]);
+      retryIndex += 1;
+    }
+  }
+}
+
+export async function realpathWithTransientWindowsRetry(filePath, {
+  platform = process.platform,
+  retryDelaysMs = WINDOWS_TRANSIENT_RETRY_DELAYS_MS,
+  realpathImpl = realpath,
+  delayImpl = delay,
+} = {}) {
+  return fsCallWithTransientWindowsRetry(realpathImpl, filePath, {
+    platform,
+    retryDelaysMs,
+    delayImpl,
+  });
+}
+
+export function lstatWithTransientWindowsRetry(filePath, {
+  platform = process.platform,
+  retryDelaysMs = WINDOWS_TRANSIENT_RETRY_DELAYS_MS,
+  lstatImpl = lstat,
+  delayImpl = delay,
+} = {}) {
+  return fsCallWithTransientWindowsRetry(lstatImpl, filePath, {
+    platform,
+    retryDelaysMs,
+    delayImpl,
+  });
+}
 
 export function ensureWithin(root, relativePath) {
   if (path.isAbsolute(relativePath)) {
@@ -27,7 +76,7 @@ export function ensureWithin(root, relativePath) {
 export async function assertSafePath(root, relativePath) {
   const destination = ensureWithin(root, relativePath);
   const absoluteRoot = path.resolve(root);
-  const rootInfo = await lstat(absoluteRoot);
+  const rootInfo = await lstatWithTransientWindowsRetry(absoluteRoot);
   if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) {
     throw new Error(`Target directory must not be a symlink: ${absoluteRoot}`);
   }
@@ -37,7 +86,7 @@ export async function assertSafePath(root, relativePath) {
   for (const segment of segments) {
     current = path.join(current, segment);
     try {
-      const info = await lstat(current);
+      const info = await lstatWithTransientWindowsRetry(current);
       if (info.isSymbolicLink()) {
         throw new Error(`Path uses a symlink inside target directory: ${relativePath}`);
       }
@@ -50,12 +99,12 @@ export async function assertSafePath(root, relativePath) {
   let existing = destination;
   while (true) {
     try {
-      const info = await lstat(existing);
+      const info = await lstatWithTransientWindowsRetry(existing);
       if (info.isSymbolicLink()) {
         throw new Error(`Path uses a symlink inside target directory: ${relativePath}`);
       }
-      const resolvedRoot = await realpath(absoluteRoot);
-      const resolvedExisting = await realpath(existing);
+      const resolvedRoot = await realpathWithTransientWindowsRetry(absoluteRoot);
+      const resolvedExisting = await realpathWithTransientWindowsRetry(existing);
       const relativeResolved = path.relative(resolvedRoot, resolvedExisting);
       if (relativeResolved === ".." || relativeResolved.startsWith(`..${path.sep}`) || path.isAbsolute(relativeResolved)) {
         throw new Error(`Path escapes target directory: ${relativePath}`);
@@ -108,10 +157,28 @@ export async function writeFileAtomic(filePath, bytes, { dryRun = false } = {})
 
   await mkdir(path.dirname(filePath), { recursive: true });
   const temporaryPath = `${filePath}.${randomUUID()}.tmp`;
+  let temporaryHandle;
   try {
-    await writeFile(temporaryPath, bytes, { mode: 0o644 });
+    // A rename alone is atomic but does not guarantee that staged bytes have
+    // reached stable storage. Sync the temporary file before publishing it;
+    // directory sync is best-effort because Windows and some filesystems do
+    // not permit opening a directory for fsync.
+    temporaryHandle = await open(temporaryPath, "w", 0o644);
+    await temporaryHandle.writeFile(bytes);
+    await temporaryHandle.sync();
+    await temporaryHandle.close();
+    temporaryHandle = null;
     await rename(temporaryPath, filePath);
+    try {
+      const directoryHandle = await open(path.dirname(filePath), "r");
+      try { await directoryHandle.sync(); } finally { await directoryHandle.close(); }
+    } catch (error) {
+      if (!["EINVAL", "EPERM", "EISDIR", "ENOTSUP", "UNKNOWN"].includes(error.code)) throw error;
+    }
   } catch (error) {
+    if (temporaryHandle) {
+      try { await temporaryHandle.close(); } catch { /* preserve original error */ }
+    }
     try {
       await unlink(temporaryPath);
     } catch {
@@ -119,4 +186,4 @@ export async function writeFileAtomic(filePath, bytes, { dryRun = false } = {})
     }
     throw error;
   }
-}
+}

package/src/core/inspect.js

@@ -11,6 +11,7 @@ import { FORGELOOP_KIT_DIR } from "./target-layout.js";
 import { trustedAuthorityConfiguration } from "./trusted-authority.js";
 import { reconcileContinuity } from "./continuity-reconciliation.js";
 import { continuityFinding, continuityIsHealthy } from "./continuity-observability.js";
+import { findTaskById } from "./task-discovery.js";
 
 function profileMetadata(bytes) {
   const text = bytes.toString("utf8");
@@ -40,6 +41,7 @@ export async function inspectTarget({ target, packageRoot, contractFile = null,
   const statePath = ensureWithin(target, effectiveStateRel);
   const statePresent = await fileExists(statePath);
   const state = await readAndClassifyWorkState({ target, packageRoot, contractFile, taskId, stateFile: effectiveStateRel });
+  const taskInfo = taskId ? await findTaskById(target, taskId, packageRoot) : null;
   const continuity = await reconcileContinuity({ target, packageRoot, taskId });
   const schemaRoot = manifest?.layoutVersion >= 2
     ? ensureWithin(target, FORGELOOP_KIT_DIR)
@@ -78,6 +80,21 @@ export async function inspectTarget({ target, packageRoot, contractFile = null,
   const continuityIssue = continuityFinding(continuity);
   if (continuityIssue) findings.push(continuityIssue);
 
+  if (taskInfo?.ownershipValid === false) {
+    findings.push({
+      code: "task-claim-ownership-inconsistent",
+      severity: "error",
+      path: taskArtifactPath(taskId, "recovery"),
+      message: "Task claim ownership cannot be validated from recovery state and ledger history.",
+      remediation: `Run forgeloop validate-protocol --task ${taskId} --json and repair the reported protocol-owned artifact.`,
+      evidence: createEvidence({
+        kind: "BLOCKED",
+        source: taskArtifactPath(taskId, "events"),
+        result: "E_TASK_CLAIM_OWNERSHIP_INCONSISTENT",
+      }),
+    });
+  }
+
   if (state.status === "INVALID") {
     findings.push({
       code: "state-invalid",
@@ -132,6 +149,15 @@ export async function inspectTarget({ target, packageRoot, contractFile = null,
       evidence: protocolEvidence,
     },
     state: { ...state, path: WORK_STATE_PATH, present: statePresent },
+    recovery: taskInfo?.recovery ?? null,
+    claims: taskInfo ? {
+      state: taskInfo.claimState,
+      historical: taskInfo.historicalWriteClaims,
+      effective: taskInfo.effectiveWriteClaims,
+      mutationAllowed: taskInfo.mutationAllowed,
+      ownershipValid: taskInfo.ownershipValid,
+      ownershipErrors: taskInfo.ownershipErrors ?? taskInfo.errors ?? [],
+    } : null,
     continuity,
     compatibility: {
       deprecated: true,
@@ -142,6 +168,7 @@ export async function inspectTarget({ target, packageRoot, contractFile = null,
     ok: doctor.ok
       && !manifestError
       && schemaHealth.status === "valid"
+      && taskInfo?.ownershipValid !== false
       && !["INVALID", "REVALIDATION_REQUIRED"].includes(state.status)
       && continuityIsHealthy(continuity),
   };