@ccmsg/cli 0.12.0 → 0.14.0

package/src/instance/instance.ts

@@ -363,6 +363,11 @@ export class Instance {
   readonly #direct: DirectRoute;
   readonly #notify: Notify;
   readonly #translate: Translate | undefined;
+  /** Everything that writes to the state directory as it changes rather than
+   * at exit (DESIGN §2.5). A stop waits for what they have asked for before it
+   * lets go of the config home, so a successor reads what this instance last
+   * said (DESIGN §8.5 step 4). */
+  readonly #persisted: { flush(): Promise<void> }[] = [];
   /** The person's authentication: who may open a connection, and the records
    * that say so (DR-0001). */
   readonly #auth: Auth;
@@ -423,7 +428,7 @@ export class Instance {
           : { terminal_gateway: config.upstream.terminal_gateway }),
       }),
     ]);
-    // The mesh is the rest of the cluster as the topic mechanism sees it: what
+    // The mesh is the rest of the mesh as the topic mechanism sees it: what
     // the peers have stated, and where a local subscription has to travel to
     // (DESIGN §7.4). An instance without one has no other instance to hear from.
     this.#topics = new Topics(this.self, this.#capabilities, this.#mesh);
@@ -438,7 +443,19 @@ export class Instance {
       // what this instance writes travels as its own (DR-0001 §2.6).
       element: (_topic, _instance, data) => {
         const stated = (data as { records?: AuthRecord[] } | undefined)?.records;
-        if (Array.isArray(stated)) this.#auth.merge(stated);
+        // Folded in as it arrives: the element callback is not what the peer
+        // waits on, and the set is written down before the removals in it are
+        // acted on (DR-0015). A set that could not be written is said here and
+        // nowhere else — there is no caller to answer, and the records come
+        // back from the peers that also hold them.
+        if (Array.isArray(stated)) {
+          void this.#auth.merge(stated).catch((cause: unknown) => {
+            this.log.write("auth records merge failed", {
+              instance: this.self,
+              cause: String(cause),
+            });
+          });
+        }
       },
       // The mesh view is this instance's own, so the topic that carries it is
       // restated when that view moves (DESIGN §7.5).
@@ -549,6 +566,7 @@ export class Instance {
 
     const inbox = new Inbox(inboxPath(paths.stateDir));
     inbox.load();
+    this.#persisted.push(inbox);
     // Route (a) is the harness's own way in (DESIGN §6.5): Claude Code's messaging
     // socket, Codex's thread queue. Which one an instance speaks follows the
     // config home it answers for (DESIGN §4.1), and the flag turns the route off for
@@ -561,7 +579,7 @@ export class Instance {
     this.#delivery = new Delivery({
       self: this.self,
       sessions: this.#sessions,
-      ...(this.#mesh === undefined ? {} : { cluster: this.#mesh }),
+      ...(this.#mesh === undefined ? {} : { mesh: this.#mesh }),
       inbox,
       direct: this.#direct,
       publish: (topic, data, instance, to) => this.#topics.publish(topic, data, instance, to),
@@ -602,9 +620,10 @@ export class Instance {
     const kv = new KvStore(join(paths.stateDir, KV_DIR), this.self, (topic, data) => {
       this.#topics.publish(topic, data);
     });
+    this.#persisted.push(kv);
     this.#topics.attach("kv", kv);
 
-    // The credentials, tokens and removals the cluster shares (DR-0001 §2.6).
+    // The credentials, tokens and removals the mesh shares (DR-0001 §2.6).
     // Written down beside the store and for the same reason: none of it is
     // derived from anything else this instance holds (DESIGN §2.5).
     const records = new AuthRecords({
@@ -615,6 +634,7 @@ export class Instance {
         this.#topics.publish("auth.records", { records: written });
       },
     });
+    this.#persisted.push(records);
     this.#auth = new Auth({
       self: this.self,
       records,
@@ -714,11 +734,9 @@ export class Instance {
         handle: (frame, conn) => {
           const admin = adminRequestOf(frame);
           if (admin !== undefined) {
-            return Promise.resolve(
-              handleAdmin(
-                { auth: this.#auth, ...(this.#mesh === undefined ? {} : { mesh: this.#mesh }) },
-                admin,
-              ),
+            return handleAdmin(
+              { auth: this.#auth, ...(this.#mesh === undefined ? {} : { mesh: this.#mesh }) },
+              admin,
             );
           }
           return this.handle(frame, conn);
@@ -860,7 +878,7 @@ export class Instance {
 
   /** A link came up or went down. Told to every client when it changes what
    * the instance would answer about the host link, and to nobody when the set
-   * of reachable peers moved without changing that — a five-peer cluster
+   * of reachable peers moved without changing that — a five-peer mesh
    * losing one is not this host going offline. */
   #linkMoved(): void {
     const network = this.network;
@@ -945,11 +963,11 @@ export class Instance {
       : await this.#mesh.forward(decided.to, decided.frame, stated ?? callerOfIdentity(identity));
   }
 
-  /** Which instance owns the subject of an instance-local op.
+  /** Which instance owns the subject of an owner_instance op.
    *
    * The subject is the session an op names, and an op that names none is about
    * this instance and stays here. A session this instance holds is its own
-   * whatever the cluster last said; one it does not hold is looked for in the
+   * whatever the mesh last said; one it does not hold is looked for in the
    * routing table the `peers` topic is (DESIGN §7.3). */
   #owner(fields: Record<string, unknown>): InstanceId | undefined {
     const sid = fields["sid"];
@@ -997,10 +1015,16 @@ export class Instance {
     // 3. tell the connections, while they can still be told
     const restarting: RestartingEvent = { ev: "restarting", instance: this.self };
     for (const conn of this.#conns) conn.send(restarting);
-    // 4. settle what is persisted. `last_live` and the inbox are written as
-    // they change rather than at exit, so there is nothing held back to flush;
-    // the log's writer is synchronous for the same reason (DESIGN §2.5).
+    // 4. settle what is persisted. `last_live`, the inbox, the store and the
+    // records are written as they change rather than at exit (DESIGN §2.5), so
+    // what is held back is only what has been asked for and has not landed —
+    // and it has to land before the lock goes, since a successor reads these
+    // files as it starts.
     this.log.write("stopping", { instance: this.self });
+    await Promise.allSettled([
+      this.#sessions.flush(),
+      ...this.#persisted.map((held) => held.flush()),
+    ]);
     // 5. let the resources go, the unix socket last. Closing takes the path
     // this process bound, and only that one: the stable address is a symlink
     // nothing here touches, because a successor may have already pointed it at
@@ -1016,8 +1040,11 @@ export class Instance {
     } finally {
       // The pid and lock are the observable proof that this process is still
       // leaving. Released only after every listener has finished closing, so a
-      // client cannot mistake an unreachable socket for a completed stop.
+      // client cannot mistake an unreachable socket for a completed stop — and
+      // after the log's own last lines, this one included, are on disk: what a
+      // reader wants from the log of a stopped instance is how it ended.
       remove(this.paths.pidFile);
+      await this.log.flush();
       this.lock.release();
     }
   }

package/src/instance/log.ts

@@ -1,15 +1,24 @@
-import { appendFileSync, mkdirSync } from "node:fs";
+import { mkdirSync } from "node:fs";
+import { appendFile } from "node:fs/promises";
 import { dirname } from "node:path";
 
-/** The instance's log: one writer, and every line on disk before the call
- * returns (DESIGN §2.5).
+/** The instance's log: one writer, and the file in the order the calls were
+ * made (DESIGN §2.5).
  *
- * The reason to read a log is to find out why a process stopped, so the line
- * that matters most is the last one written before it did. A buffered writer
- * is the one that loses exactly that line, so this one appends synchronously
- * and holds nothing — the cost is a write per line, on a file that takes a
- * line per lifecycle event rather than per request. */
+ * A line is written where anything at all is happening — a lifecycle step, a
+ * mesh callback, a session appearing — so the write cannot be the one thing
+ * that stops the instance while it lands (DR-0015). Each append is chained onto
+ * the one before it, which is what keeps the order the calls stated; what a
+ * kill can cost is the last line or two that had not reached the file yet, and
+ * for a log that is a cheaper loss than holding the process still for every
+ * line.
+ *
+ * `flush` is for the one moment that loss is avoidable: a stop that is being
+ * waited on can wait for its own last line. */
 export class Log {
+  /** The appends already asked for, as one chain. */
+  #written: Promise<void> = Promise.resolve();
+
   constructor(
     private readonly file: string,
     /** Mirrored to stderr so a foreground run shows what it is doing. */
@@ -21,10 +30,17 @@ export class Log {
   write(message: string, fields: Record<string, unknown> = {}): void {
     const line = JSON.stringify({ at: new Date().toISOString(), message, ...fields });
     if (this.echo) process.stderr.write(`${line}\n`);
-    try {
-      appendFileSync(this.file, `${line}\n`);
-    } catch {
-      // A log that cannot be written is not a reason to stop serving.
-    }
+    this.#written = this.#written.then(async () => {
+      try {
+        await appendFile(this.file, `${line}\n`);
+      } catch {
+        // A log that cannot be written is not a reason to stop serving.
+      }
+    });
+  }
+
+  /** Settle once every line asked for so far is on disk. */
+  async flush(): Promise<void> {
+    await this.#written;
   }
 }

package/src/kv/store.ts

@@ -1,4 +1,5 @@
-import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { readdirSync, readFileSync } from "node:fs";
+import { mkdir, rename, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import type {
   KvDeleteArgs,
@@ -28,15 +29,38 @@ export const KV_DIR = "kv";
  * One file per namespace, whole-file: a namespace holds a handful of small
  * values, and the whole of it is what both a snapshot and a reload state. The
  * write lands through a temporary and a rename, so a kill leaves either the
- * previous namespace or the new one. */
+ * previous namespace or the new one.
+ *
+ * The files are read here, as the store is built — before this instance is
+ * accepting anything, so nobody is waiting on the read (DR-0015). Reading them
+ * when a namespace was first asked about would put the read inside the turn
+ * that answers a `kv.read` or opens a `kv:<ns>` subscription, and a snapshot is
+ * answered from what is held rather than from a promise. A namespace with no
+ * file starts empty, which is the same thing a namespace written for the first
+ * time after this starts from. */
 export class KvStore implements UpstreamResource {
   readonly #namespaces = new Map<string, Map<string, Held>>();
 
+  /** Per namespace, the writes already asked for, as one chain. */
+  readonly #writing = new Map<string, Promise<void>>();
+
   constructor(
     private readonly dir: string,
     private readonly self: InstanceId,
     private readonly publish: (topic: string, data: unknown) => void,
-  ) {}
+  ) {
+    let names: string[];
+    try {
+      names = readdirSync(this.dir);
+    } catch {
+      // No directory yet, which is an instance nobody has written a value to.
+      return;
+    }
+    for (const name of names) {
+      if (!name.endsWith(".json")) continue;
+      this.#namespaces.set(name.slice(0, -".json".length), read(join(this.dir, name)));
+    }
+  }
 
   read(args: KvReadArgs): KvReadResult {
     const held = this.#load(args.ns).get(args.key);
@@ -54,7 +78,7 @@ export class KvStore implements UpstreamResource {
    * was unreachable must not displace what was written since. The answer is
    * what the key carries now — equal to what the caller stated when its write
    * stands, and later than it when an existing value did. */
-  write(args: KvWriteArgs, now: Timestamp = Date.now()): KvWriteResult {
+  async write(args: KvWriteArgs, now: Timestamp = Date.now()): Promise<KvWriteResult> {
     const entries = this.#load(args.ns);
     const updatedAt = args.updated_at ?? now;
     const held = entries.get(args.key);
@@ -65,7 +89,9 @@ export class KvStore implements UpstreamResource {
       return { updated_at: held.updated_at };
     }
     entries.set(args.key, { value: args.value, updated_at: updatedAt });
-    this.#persist(args.ns, entries);
+    // Told to the subscribers once it is written down, so nobody is holding a
+    // value this instance would not have after a restart.
+    await this.#persist(args.ns, entries);
     this.publish(`kv:${args.ns}`, {
       entries: [{ key: args.key, value: args.value, updated_at: updatedAt }],
     });
@@ -75,14 +101,14 @@ export class KvStore implements UpstreamResource {
   /** A key that was not there is no error: the caller wanted the namespace
    * without it, and it is. The removal is still announced, because a subscriber
    * that has the entry has to be told it is gone. */
-  delete(args: KvDeleteArgs, now: Timestamp = Date.now()): KvDeleteResult {
+  async delete(args: KvDeleteArgs, now: Timestamp = Date.now()): Promise<KvDeleteResult> {
     const entries = this.#load(args.ns);
     const before = entries.get(args.key);
     // A removal older than what the key holds undoes nothing, which is the
     // same rule a write is held to.
     if (before !== undefined && before.updated_at > now) return {};
     entries.set(args.key, { updated_at: now, deleted: true });
-    this.#persist(args.ns, entries);
+    await this.#persist(args.ns, entries);
     // A removal is announced only when something was there to remove: a
     // subscriber holding no entry has nothing to be told is gone.
     if (before !== undefined && before.deleted !== true) {
@@ -94,8 +120,7 @@ export class KvStore implements UpstreamResource {
   }
 
   /** Nothing to start or stop: the values are here whether anyone is watching
-   * or not, and the file they live in is read the first time the namespace is
-   * touched. */
+   * or not, and the files they live in were read as this was built. */
   start(): void {}
   stop(): void {}
 
@@ -110,57 +135,51 @@ export class KvStore implements UpstreamResource {
     return [{ instance: this.self, data: { entries } }];
   }
 
+  /** Settle once every write asked for so far has landed. What a stop waits on
+   * before it lets go of the config home (DESIGN §8.5 step 4). */
+  async flush(): Promise<void> {
+    await Promise.allSettled(this.#writing.values());
+  }
+
+  /** What the namespace holds, dropping the removals nothing can still be
+   * carrying an older write for. A name this store read no file for is a
+   * namespace with nothing in it. */
   #load(ns: string, now: Timestamp = Date.now()): Map<string, Held> {
-    const known = this.#namespaces.get(ns);
-    if (known !== undefined) return forget(known, now);
-    const entries = new Map<string, Held>();
-    let text: string;
-    try {
-      text = readFileSync(this.#file(ns), "utf8");
-    } catch {
-      this.#namespaces.set(ns, entries);
-      return entries;
-    }
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(text);
-    } catch {
-      // A file a kill damaged states nothing this instance can act on, and
-      // refusing every read of the namespace would be worse than starting it
-      // empty: the next write replaces the file.
-      parsed = undefined;
-    }
-    if (typeof parsed === "object" && parsed !== null) {
-      for (const [key, held] of Object.entries(parsed as Record<string, unknown>)) {
-        if (typeof held !== "object" || held === null) continue;
-        const fields = held as Record<string, unknown>;
-        const updatedAt = fields["updated_at"];
-        if (typeof updatedAt !== "number") continue;
-        entries.set(
-          key,
-          fields["deleted"] === true
-            ? { updated_at: updatedAt, deleted: true }
-            : { value: fields["value"], updated_at: updatedAt },
-        );
-      }
-    }
-    this.#namespaces.set(ns, entries);
-    return forget(entries, now);
+    const known = this.#namespaces.get(ns) ?? new Map<string, Held>();
+    this.#namespaces.set(ns, known);
+    return forget(known, now);
   }
 
-  #persist(ns: string, entries: Map<string, Held>): void {
-    mkdirSync(this.dir, { recursive: true });
+  /** The namespace as it stands, written whole.
+   *
+   * The body is taken here, before anything is awaited, so what is written is
+   * the namespace as it was when the write was answered. Writes to one
+   * namespace are chained rather than started side by side: two of them would
+   * otherwise be racing for one file, and the older could land last (DR-0015).
+   * Namespaces do not wait on each other, having nothing in common but this
+   * directory. */
+  #persist(ns: string, entries: Map<string, Held>): Promise<void> {
     const file = this.#file(ns);
     const body: Record<string, Held> = {};
     for (const [key, held] of entries) body[key] = held;
-    const temporary = `${file}.ccmsg-${process.pid}-${Date.now()}`;
-    writeFileSync(temporary, JSON.stringify(body));
-    try {
-      renameSync(temporary, file);
-    } catch (cause) {
-      unlinkSync(temporary);
-      throw cause;
-    }
+    const written = (this.#writing.get(ns) ?? Promise.resolve()).then(async () => {
+      await mkdir(this.dir, { recursive: true });
+      const temporary = `${file}.ccmsg-${process.pid}-${Date.now()}`;
+      await writeFile(temporary, JSON.stringify(body));
+      try {
+        await rename(temporary, file);
+      } catch (cause) {
+        await unlink(temporary);
+        throw cause;
+      }
+    });
+    // The chain carries the order, not the outcome: a write that failed is
+    // answered to its own caller, and the ones behind it still go.
+    this.#writing.set(
+      ns,
+      written.catch(() => {}),
+    );
+    return written;
   }
 
   /** The namespace's file. A namespace is an identifier, so its name is a file
@@ -170,6 +189,35 @@ export class KvStore implements UpstreamResource {
   }
 }
 
+/** One namespace's file, as the entries it states.
+ *
+ * A file a kill damaged states nothing this instance can act on, and refusing
+ * every read of the namespace would be worse than starting it empty: the next
+ * write replaces the file. */
+function read(file: string): Map<string, Held> {
+  const entries = new Map<string, Held>();
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return entries;
+  }
+  if (typeof parsed !== "object" || parsed === null) return entries;
+  for (const [key, held] of Object.entries(parsed as Record<string, unknown>)) {
+    if (typeof held !== "object" || held === null) continue;
+    const fields = held as Record<string, unknown>;
+    const updatedAt = fields["updated_at"];
+    if (typeof updatedAt !== "number") continue;
+    entries.set(
+      key,
+      fields["deleted"] === true
+        ? { updated_at: updatedAt, deleted: true }
+        : { value: fields["value"], updated_at: updatedAt },
+    );
+  }
+  return entries;
+}
+
 /** Drop the removals nothing can still be carrying an older write for.
  *
  * Done where the namespace is read rather than on a clock of its own: a timer
@@ -188,9 +236,9 @@ export function kvHandlers(store: KvStore) {
   return {
     "kv.read": (input: HandlerInput): KvReadResult =>
       store.read(input.args as unknown as KvReadArgs),
-    "kv.write": (input: HandlerInput): KvWriteResult =>
+    "kv.write": (input: HandlerInput): Promise<KvWriteResult> =>
       store.write(input.args as unknown as KvWriteArgs),
-    "kv.delete": (input: HandlerInput): KvDeleteResult =>
+    "kv.delete": (input: HandlerInput): Promise<KvDeleteResult> =>
       store.delete(input.args as unknown as KvDeleteArgs),
   };
 }

package/src/launcher/launcher.ts

@@ -67,17 +67,20 @@ export class Launcher {
       templates: this.config.templates.map((template) => ({
         name: template.name,
         command: template.command,
-        params: template.params.map((param) => ({ name: param.name, default: param.default })),
+        params: template.params.map((param) => ({
+          name: param.name,
+          default: param.default,
+        })),
       })),
     };
   }
 
-  tree(args: DirTreeArgs): DirTreeResult {
+  tree(args: DirTreeArgs): Promise<DirTreeResult> {
     return dirTree(this.config, args);
   }
 
-  run(args: LauncherRunArgs): Promise<LauncherRunResult> {
-    const cwd = insideRoots(this.config, args.cwd);
+  async run(args: LauncherRunArgs): Promise<LauncherRunResult> {
+    const cwd = await insideRoots(this.config, args.cwd);
     if (cwd === undefined) {
       // The op states no refusal for a path, so a directory outside the roots
       // is answered as what it is from here: an argument this launcher cannot
@@ -129,7 +132,7 @@ export function launcherHandlers(launcher: Launcher) {
     "launcher.config.read": (): LauncherConfigReadResult => launcher.configRead(),
     "launcher.run": (input: HandlerInput): Promise<LauncherRunResult> =>
       launcher.run(input.args as unknown as LauncherRunArgs),
-    "dir.tree": (input: HandlerInput): DirTreeResult =>
+    "dir.tree": (input: HandlerInput): Promise<DirTreeResult> =>
       launcher.tree(input.args as unknown as DirTreeArgs),
   };
 }

package/src/launcher/roots.ts

@@ -1,4 +1,4 @@
-import { statSync } from "node:fs";
+import { stat } from "node:fs/promises";
 import { isAbsolute } from "node:path";
 import type { LauncherConfig } from "../instance/config.ts";
 import { canonical, within } from "../files/index.ts";
@@ -13,19 +13,22 @@ import { canonical, within } from "../files/index.ts";
  *
  * A root that no longer resolves grants nothing and stops nothing: another
  * configured root may still hold the candidate. */
-export function insideRoots(config: LauncherConfig, path: string): string | undefined {
+export async function insideRoots(
+  config: LauncherConfig,
+  path: string,
+): Promise<string | undefined> {
   if (!isAbsolute(path)) return undefined;
-  const real = canonical(path);
-  if (!isDirectory(real)) return undefined;
+  const real = await canonical(path);
+  if (!(await isDirectory(real))) return undefined;
   for (const root of config.root_dirs) {
-    if (within(real, canonical(root))) return real;
+    if (within(real, await canonical(root))) return real;
   }
   return undefined;
 }
 
-export function isDirectory(path: string): boolean {
+export async function isDirectory(path: string): Promise<boolean> {
   try {
-    return statSync(path).isDirectory();
+    return (await stat(path)).isDirectory();
   } catch {
     return false;
   }

package/src/launcher/tree.ts

@@ -1,4 +1,4 @@
-import { readdirSync } from "node:fs";
+import { readdir } from "node:fs/promises";
 import { join, relative } from "node:path";
 import type { DirTreeArgs, DirTreeEntry, DirTreeResult } from "@ccmsg/protocol";
 import type { LauncherConfig } from "../instance/config.ts";
@@ -18,29 +18,29 @@ const MAX_DEPTH = 5;
  * not hold contributes nothing rather than failing the request: the op states no
  * refusal for a path, and a tree assembled from several roots would otherwise be
  * lost whole because one of them went away. */
-export function dirTree(config: LauncherConfig, args: DirTreeArgs): DirTreeResult {
+export async function dirTree(config: LauncherConfig, args: DirTreeArgs): Promise<DirTreeResult> {
   const depth = Math.min(MAX_DEPTH, args.depth ?? config.depth);
   // A filter of nothing is not a filter: an emptied search box shows the tree
   // rather than hiding all of it.
   const filter = args.filter === undefined || args.filter === "" ? undefined : args.filter;
   const entries: DirTreeEntry[] = [];
   for (const root of args.roots) {
-    const real = insideRoots(config, root);
+    const real = await insideRoots(config, root);
     if (real === undefined) continue;
-    entries.push(...walk(config, real, real, depth, filter));
+    entries.push(...(await walk(config, real, real, depth, filter)));
   }
   return { entries: sorted(entries) };
 }
 
-function walk(
+async function walk(
   config: LauncherConfig,
   root: string,
   at: string,
   depth: number,
   filter: string | undefined,
-): DirTreeEntry[] {
+): Promise<DirTreeEntry[]> {
   const entries: DirTreeEntry[] = [];
-  for (const dirent of read(at)) {
+  for (const dirent of await read(at)) {
     // Design rationale: dot-directories are left out. This answers "where could
     // a session run", and a repository's `.git` is not one of those places —
     // browsing a session's own files is a different op with different rules.
@@ -49,24 +49,27 @@ function walk(
     if (dirent.isSymbolicLink()) {
       // A link is a place to run only if what it points at is one, so it goes
       // through the same containment its target would.
-      if (insideRoots(config, path) === undefined) continue;
+      if ((await insideRoots(config, path)) === undefined) continue;
     } else if (!dirent.isDirectory()) continue;
 
-    const children = depth > 1 ? walk(config, root, path, depth - 1, filter) : undefined;
+    const children = depth > 1 ? await walk(config, root, path, depth - 1, filter) : undefined;
     if (filter !== undefined) {
       const matches = relative(root, path).includes(filter);
       // An ancestor of a match survives the filter: without it a match several
       // levels down would have nothing to hang from.
       if (!matches && (children === undefined || children.length === 0)) continue;
     }
-    entries.push({ path, ...(children === undefined ? {} : { children: sorted(children) }) });
+    entries.push({
+      path,
+      ...(children === undefined ? {} : { children: sorted(children) }),
+    });
   }
   return entries;
 }
 
-function read(dir: string) {
+async function read(dir: string) {
   try {
-    return readdirSync(dir, { withFileTypes: true });
+    return await readdir(dir, { withFileTypes: true });
   } catch {
     // A directory that cannot be read is still a place to run; what it holds is
     // simply not known, which is the same answer as holding nothing.

package/src/mesh/instances.ts

@@ -8,16 +8,16 @@ export interface MeshView {
   instances(): InstanceInfo[];
 }
 
-/** The cluster as one instance sees it, itself included.
+/** The mesh as one instance sees it, itself included.
  *
- * An instance with no mesh is a cluster of one and says so: it is reached at
+ * An instance with no mesh is a mesh of one and says so: it is reached at
  * whatever it serves, which is a row without an endpoint when that is the unix
  * socket alone rather than no row at all (contract, `InstanceInfo`).
  *
  * The same answer feeds `hello` and the topic, from here rather than from two
  * places: a greeting and a subscription that disagreed about who is in the
- * cluster would be one instance stating two views of itself. */
-export function clusterView(
+ * mesh would be one instance stating two views of itself. */
+export function meshView(
   self: InstanceId,
   endpoint: Endpoint | undefined,
   mesh: MeshView | undefined,
@@ -56,7 +56,7 @@ export class Instances implements UpstreamResource {
   ) {}
 
   view(): InstanceInfo[] {
-    return clusterView(this.deps.self, this.deps.endpoint, this.deps.mesh);
+    return meshView(this.deps.self, this.deps.endpoint, this.deps.mesh);
   }
 
   /** State the view, which the mesh asks for whenever a link moves. A frame