@claudexor/daemon 3.24.0 → 4.0.0

package/dist/store/mutation.js

@@ -0,0 +1,85 @@
+import { deleteUnownedInlineInTx } from "./blob-files.js";
+import { mapStoreError } from "./errors.js";
+/** SQL committed even when a later projection/notification failed. Never retry
+ * the mutation as though this were a rollback. All owner generations are set. */
+export class MutationPostCommitError extends AggregateError {
+    committed = true;
+    constructor(errors) {
+        super(errors, "engine store mutation committed; post-commit notification failed");
+        this.name = "MutationPostCommitError";
+    }
+}
+/** Changes are collected during SQL writes, then published synchronously after
+ * COMMIT. Record both old and new references when a row changes its owner key. */
+export class MutationDelta {
+    owners = new Set();
+    callbacks = [];
+    blobChanged(...digests) {
+        for (const digest of digests)
+            if (digest != null)
+                this.owners.add(`blob:${digest}`);
+    }
+    uploadChanged(...ids) {
+        for (const id of ids)
+            if (id != null)
+                this.owners.add(`upload:${id}`);
+    }
+    afterCommit(callback) {
+        this.callbacks.push(callback);
+    }
+    /** Run once after all row writers, before COMMIT. A later writer in the same
+     * mutation may still acquire a reference, so cleanup must not run earlier. */
+    clearUnownedInline(sql) {
+        for (const key of this.owners)
+            if (key.startsWith("blob:"))
+                deleteUnownedInlineInTx(sql, key.slice(5));
+    }
+    /** Used by runMutation only, after EngineStore.transaction returned. */
+    publish(store) {
+        for (const key of this.owners)
+            store.owners.noteChange(key);
+        const errors = [];
+        for (const callback of this.callbacks) {
+            try {
+                callback();
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+        if (errors.length > 0)
+            throw new MutationPostCommitError(errors);
+    }
+}
+/** Prepare file-backed bodies before calling this function, without an await
+ * between preparation and commit. No nested transaction or async body. Failed
+ * SQL discards the delta; successful SQL publishes every owner before callbacks. */
+export function runMutation(store, body) {
+    const changes = new MutationDelta();
+    const tx = {
+        prepare: (sql) => store.prepare(sql),
+        get inTransaction() {
+            return store.inTransaction;
+        },
+        changes,
+        now: store.now,
+    };
+    let result;
+    try {
+        result = store.transaction(() => {
+            const value = body(tx);
+            changes.clearUnownedInline(tx);
+            return value;
+        });
+    }
+    catch (error) {
+        throw mapStoreError(error, "mutating engine rows");
+    }
+    changes.publish(store);
+    return result;
+}
+export function requireTransaction(sql) {
+    if (!sql.inTransaction)
+        throw new Error("row writes require the owner's transaction");
+}
+//# sourceMappingURL=mutation.js.map

package/dist/store/mutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutation.js","sourceRoot":"","sources":["../../src/store/mutation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAW5C;iFACiF;AACjF,MAAM,OAAO,uBAAwB,SAAQ,cAAc;IAChD,SAAS,GAAG,IAAI,CAAC;IAE1B,YAAY,MAAiB;QAC3B,KAAK,CAAC,MAAM,EAAE,kEAAkE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;kFACkF;AAClF,MAAM,OAAO,aAAa;IACP,MAAM,GAAG,IAAI,GAAG,EAAY,CAAC;IAC7B,SAAS,GAAsB,EAAE,CAAC;IAEnD,WAAW,CAAC,GAAG,OAAyC;QACtD,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,MAAM,IAAI,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,aAAa,CAAC,GAAG,GAAqC;QACpD,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,IAAI,EAAE,IAAI,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,WAAW,CAAC,QAAoB;QAC9B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED;kFAC8E;IAC9E,kBAAkB,CAAC,GAAoB;QACrC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM;YAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,wEAAwE;IACxE,OAAO,CAAC,KAAkB;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;CACF;AAED;;oFAEoF;AACpF,MAAM,UAAU,WAAW,CAAI,KAAkB,EAAE,IAAgC;IACjF,MAAM,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;IACpC,MAAM,EAAE,GAAoB;QAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACpC,IAAI,aAAa;YACf,OAAO,KAAK,CAAC,aAAa,CAAC;QAC7B,CAAC;QACD,OAAO;QACP,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC;IACF,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;AACxF,CAAC"}

package/dist/store/obligations.d.ts

@@ -0,0 +1,101 @@
+import type { EngineStore } from "./store.js";
+import { type MutationContext } from "./mutation.js";
+/** `effect_obligation.kind` values (SYNTHESIS_R5 §4.6). Data, not enum-in-logic:
+ * stores register a completion handler per kind at startup. */
+export declare const OBLIGATION_KINDS: readonly ["terminal_files", "publish_blob", "archive_fs", "purge_fs", "quarantine_fs"];
+export type ObligationKind = (typeof OBLIGATION_KINDS)[number];
+export type ObligationState = "pending" | "materialized";
+export interface ObligationRow {
+    kind: ObligationKind;
+    key: string;
+    pid: number;
+    createdAt: string;
+    payload: unknown;
+    state: ObligationState;
+    materializedGeneration: number | null;
+}
+/** What a completion handler may do: redo the effect and bind its directories. */
+export interface ObligationEffects {
+    register(dir: string): number;
+}
+export type ObligationHandler = (obligation: ObligationRow, effects: ObligationEffects) => void | Promise<void>;
+export interface ObligationCompletionReceipt {
+    completed: Array<{
+        kind: ObligationKind;
+        key: string;
+    }>;
+    failed: Array<{
+        kind: ObligationKind;
+        key: string;
+        error: string;
+    }>;
+    unhandled: Array<{
+        kind: ObligationKind;
+        key: string;
+    }>;
+}
+/**
+ * Obligations (SYNTHESIS_R5 §4.6 as amended by R5_AMENDMENTS A2): the row is
+ * created `pending` in the SAME transaction as the decision it protects; the
+ * effect runs (files, links, renames) and registers its directories; once
+ * EVERY effect succeeded the owner materializes the row in one
+ * micro-transaction, recording the generation of the last registration; only
+ * `synced(G >= materialized_g)` deletes it. A `pending` row is never touched
+ * by `synced`, however many registrations it has. Startup replays every open
+ * row through idempotent handlers — their count is unfinished work, never
+ * history.
+ */
+export declare class Obligations {
+    private readonly store;
+    private readonly options;
+    private readonly tracked;
+    private readonly handlers;
+    private readonly unsubscribe;
+    /**
+     * Uses the store's owner-generation map (A3/C10): an open
+     * `publish_blob` row is an owner of its digest, so clearing it is an owner
+     * change the blob GC must observe. `log` receives a failed clear (ENOSPC,
+     * SQLite error); the rows stay tracked and the clear retries on the next
+     * `synced` instead of becoming an uncaught exception on the request thread.
+     */
+    constructor(store: EngineStore, options?: {
+        log?: (line: string) => void;
+        /** Already deleted and committed. Shared blob owner generations are
+         * updated before this notification; consumers must not repeat them. */
+        onCleared?: (rows: readonly ObligationRow[]) => void;
+    });
+    /** Pure row write inside the caller's transaction. A duplicate (kind, key)
+     * is a constraint violation. The enclosing mutation records any publish_blob
+     * reference with changes.blobChanged alongside its upload/resource changes. */
+    create(kind: ObligationKind, key: string, pid: number, payload: unknown): void;
+    /** Bind a directory the effect touched; returns the registration generation. */
+    registerEffect(kind: ObligationKind, key: string, dir: string): number;
+    /**
+     * Every effect succeeded: `pending → materialized` with `materialized_g` =
+     * the last registration (or a fresh mark when the effect registered
+     * nothing). Runs as its own micro-transaction. A composed decision uses
+     * materializeInTx with its MutationContext instead, so rollback cannot
+     * publish materialized state in memory.
+     */
+    materialize(kind: ObligationKind, key: string): number;
+    /** `generation` is the last file registration (or an empty-effect mark)
+     * prepared outside this transaction. Row state and the enclosing decision
+     * commit together; only their successful commit enables synced to clear it. */
+    materializeInTx(tx: MutationContext, kind: ObligationKind, key: string, generation: number): number;
+    open(): ObligationRow[];
+    get(kind: ObligationKind, key: string): ObligationRow | undefined;
+    /** Stores register one idempotent completion handler per kind at startup. */
+    registerHandler(kind: ObligationKind, handler: ObligationHandler): void;
+    /**
+     * Startup hook: redo every open row through its handler and materialize it
+     * with a fresh generation (a row left `materialized` by a crashed process
+     * names generations nobody can prove any more). A handler failure leaves
+     * the row `pending` (the fact `obligations_open` discloses it); a kind
+     * without a handler is reported, never silently dropped.
+     */
+    completeOpen(): Promise<ObligationCompletionReceipt>;
+    close(): void;
+    private entry;
+    private clearSynced;
+}
+//# sourceMappingURL=obligations.d.ts.map

package/dist/store/obligations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligations.d.ts","sourceRoot":"","sources":["../../src/store/obligations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAmC,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAGtF;+DAC+D;AAC/D,eAAO,MAAM,gBAAgB,YAC3B,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,UAAU,EACV,eAAe,CACP,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,cAAc,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,iBAAiB,KACvB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAiCD;;;;;;;;;;GAUG;AACH,qBAAa,WAAW;IAapB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAb1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgD;IACzE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IAEzC;;;;;;OAMG;IACH,YACmB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE;QACxB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC7B;+EACuE;QACvE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,KAAK,IAAI,CAAC;KACjD,EAGP;IAED;;mFAE+E;IAC/E,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAS7E;IAED,gFAAgF;IAChF,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAKrE;IAED;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAMrD;IAED;;mFAE+E;IAC/E,eAAe,CACb,EAAE,EAAE,eAAe,EACnB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,GACjB,MAAM,CAYR;IAED,IAAI,IAAI,aAAa,EAAE,CAQtB;IAED,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAOhE;IAED,6EAA6E;IAC7E,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAItE;IAED;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAgCzD;IAED,KAAK,IAAI,IAAI,CAGZ;IAED,OAAO,CAAC,KAAK;IAUb,OAAO,CAAC,WAAW;CAoDpB"}

package/dist/store/obligations.js

@@ -0,0 +1,226 @@
+import { requireTransaction, runMutation } from "./mutation.js";
+import { deleteUnownedInlineInTx } from "./blob-files.js";
+/** `effect_obligation.kind` values (SYNTHESIS_R5 §4.6). Data, not enum-in-logic:
+ * stores register a completion handler per kind at startup. */
+export const OBLIGATION_KINDS = [
+    "terminal_files",
+    "publish_blob",
+    "archive_fs",
+    "purge_fs",
+    "quarantine_fs",
+];
+function fromRow(row) {
+    return {
+        kind: row.kind,
+        key: row.key,
+        pid: Number(row.pid),
+        createdAt: row.created_at,
+        payload: JSON.parse(Buffer.from(row.payload).toString("utf8")),
+        state: row.state,
+        materializedGeneration: row.materialized_g === null ? null : Number(row.materialized_g),
+    };
+}
+function trackKey(kind, key) {
+    return `${kind}\0${key}`;
+}
+/**
+ * Obligations (SYNTHESIS_R5 §4.6 as amended by R5_AMENDMENTS A2): the row is
+ * created `pending` in the SAME transaction as the decision it protects; the
+ * effect runs (files, links, renames) and registers its directories; once
+ * EVERY effect succeeded the owner materializes the row in one
+ * micro-transaction, recording the generation of the last registration; only
+ * `synced(G >= materialized_g)` deletes it. A `pending` row is never touched
+ * by `synced`, however many registrations it has. Startup replays every open
+ * row through idempotent handlers — their count is unfinished work, never
+ * history.
+ */
+export class Obligations {
+    store;
+    options;
+    tracked = new Map();
+    handlers = new Map();
+    unsubscribe;
+    /**
+     * Uses the store's owner-generation map (A3/C10): an open
+     * `publish_blob` row is an owner of its digest, so clearing it is an owner
+     * change the blob GC must observe. `log` receives a failed clear (ENOSPC,
+     * SQLite error); the rows stay tracked and the clear retries on the next
+     * `synced` instead of becoming an uncaught exception on the request thread.
+     */
+    constructor(store, options = {}) {
+        this.store = store;
+        this.options = options;
+        this.unsubscribe = store.onSynced((generation) => this.clearSynced(generation));
+    }
+    /** Pure row write inside the caller's transaction. A duplicate (kind, key)
+     * is a constraint violation. The enclosing mutation records any publish_blob
+     * reference with changes.blobChanged alongside its upload/resource changes. */
+    create(kind, key, pid, payload) {
+        if (!this.store.inTransaction) {
+            throw new Error("an obligation is created inside the transaction of its decision");
+        }
+        this.store
+            .prepare("INSERT INTO effect_obligation(kind, key, pid, created_at, payload, state) VALUES(?, ?, ?, ?, ?, 'pending')")
+            .run(kind, key, pid, this.store.now().toISOString(), Buffer.from(JSON.stringify(payload)));
+    }
+    /** Bind a directory the effect touched; returns the registration generation. */
+    registerEffect(kind, key, dir) {
+        if (this.store.inTransaction)
+            throw new Error("file effects run outside SQL transactions");
+        const g = this.store.registerExternal(dir);
+        this.entry(kind, key).lastRegistration = g;
+        return g;
+    }
+    /**
+     * Every effect succeeded: `pending → materialized` with `materialized_g` =
+     * the last registration (or a fresh mark when the effect registered
+     * nothing). Runs as its own micro-transaction. A composed decision uses
+     * materializeInTx with its MutationContext instead, so rollback cannot
+     * publish materialized state in memory.
+     */
+    materialize(kind, key) {
+        if (this.store.inTransaction) {
+            throw new Error("use materializeInTx with the owner's MutationContext");
+        }
+        const generation = this.tracked.get(trackKey(kind, key))?.lastRegistration ?? this.store.mark();
+        return runMutation(this.store, (tx) => this.materializeInTx(tx, kind, key, generation));
+    }
+    /** `generation` is the last file registration (or an empty-effect mark)
+     * prepared outside this transaction. Row state and the enclosing decision
+     * commit together; only their successful commit enables synced to clear it. */
+    materializeInTx(tx, kind, key, generation) {
+        requireTransaction(tx);
+        const result = tx
+            .prepare("UPDATE effect_obligation SET state = 'materialized', materialized_g = ? WHERE kind = ? AND key = ?")
+            .run(generation, kind, key);
+        if (Number(result.changes) === 0)
+            throw new Error(`no obligation ${kind}:${key}`);
+        tx.changes.afterCommit(() => {
+            this.entry(kind, key).materializedGeneration = generation;
+        });
+        return generation;
+    }
+    open() {
+        return this.store
+            .prepare("SELECT kind, key, pid, created_at, payload, state, materialized_g FROM effect_obligation ORDER BY created_at, kind, key")
+            .all().map(fromRow);
+    }
+    get(kind, key) {
+        const row = this.store
+            .prepare("SELECT kind,key,pid,created_at,payload,state,materialized_g FROM effect_obligation WHERE kind=? AND key=?")
+            .get(kind, key);
+        return row ? fromRow(row) : undefined;
+    }
+    /** Stores register one idempotent completion handler per kind at startup. */
+    registerHandler(kind, handler) {
+        if (this.handlers.has(kind))
+            throw new Error(`obligation handler for '${kind}' already registered`);
+        this.handlers.set(kind, handler);
+    }
+    /**
+     * Startup hook: redo every open row through its handler and materialize it
+     * with a fresh generation (a row left `materialized` by a crashed process
+     * names generations nobody can prove any more). A handler failure leaves
+     * the row `pending` (the fact `obligations_open` discloses it); a kind
+     * without a handler is reported, never silently dropped.
+     */
+    async completeOpen() {
+        const open = this.open();
+        // A generation persisted by another process is not durability evidence.
+        // Reset every open row before the first await, including unhandled kinds.
+        runMutation(this.store, (tx) => {
+            tx.prepare("UPDATE effect_obligation SET state = 'pending', materialized_g = NULL WHERE state = 'materialized' OR materialized_g IS NOT NULL").run();
+            tx.changes.afterCommit(() => this.tracked.clear());
+        });
+        const receipt = { completed: [], failed: [], unhandled: [] };
+        for (const obligation of open) {
+            const handler = this.handlers.get(obligation.kind);
+            if (!handler) {
+                receipt.unhandled.push({ kind: obligation.kind, key: obligation.key });
+                continue;
+            }
+            try {
+                await handler(obligation, {
+                    register: (dir) => this.registerEffect(obligation.kind, obligation.key, dir),
+                });
+                this.materialize(obligation.kind, obligation.key);
+                receipt.completed.push({ kind: obligation.kind, key: obligation.key });
+            }
+            catch (error) {
+                receipt.failed.push({
+                    kind: obligation.kind,
+                    key: obligation.key,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        return receipt;
+    }
+    close() {
+        this.unsubscribe();
+        this.tracked.clear();
+    }
+    entry(kind, key) {
+        const id = trackKey(kind, key);
+        let entry = this.tracked.get(id);
+        if (!entry) {
+            entry = { lastRegistration: null, materializedGeneration: null };
+            this.tracked.set(id, entry);
+        }
+        return entry;
+    }
+    clearSynced(generation) {
+        if (this.store.isClosed)
+            return;
+        const clearable = [];
+        for (const [id, entry] of this.tracked) {
+            if (entry.materializedGeneration === null || entry.materializedGeneration > generation)
+                continue;
+            const [kind, key] = id.split("\0");
+            clearable.push([kind, key]);
+        }
+        if (clearable.length === 0)
+            return;
+        let cleared;
+        try {
+            const remove = this.store.prepare("DELETE FROM effect_obligation WHERE kind = ? AND key = ? AND state = 'materialized' AND materialized_g <= ? RETURNING kind, key, pid, created_at, payload, state, materialized_g");
+            cleared = this.store.transaction(() => {
+                const removed = [];
+                for (const [kind, key] of clearable) {
+                    removed.push(...remove.all(kind, key, generation).map(fromRow));
+                }
+                for (const row of removed) {
+                    const sha = row.kind === "publish_blob" ? row.payload?.sha : null;
+                    if (typeof sha === "string")
+                        deleteUnownedInlineInTx(this.store, sha);
+                }
+                return removed;
+            });
+        }
+        catch (error) {
+            // The rows stay tracked and materialized; the next synced retries.
+            this.options.log?.(`obligation clear deferred: ${error instanceof Error ? error.message : String(error)}`);
+            return;
+        }
+        for (const [kind, key] of clearable)
+            this.tracked.delete(trackKey(kind, key));
+        // The deleted publish_blob rows were owners of their digests (A3): the GC
+        // waiting on this very barrier must see the owner change and wait again.
+        for (const row of cleared) {
+            if (row.kind !== "publish_blob")
+                continue;
+            const digest = row.payload?.sha;
+            if (typeof digest === "string")
+                this.store.owners.noteChange(`blob:${digest}`);
+        }
+        if (cleared.length > 0) {
+            try {
+                this.options.onCleared?.(cleared);
+            }
+            catch (error) {
+                this.options.log?.(`obligation rows cleared and committed; notification failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=obligations.js.map

package/dist/store/obligations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligations.js","sourceRoot":"","sources":["../../src/store/obligations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAwB,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D;+DAC+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,UAAU;IACV,eAAe;CACP,CAAC;AA8CX,SAAS,OAAO,CAAC,GAAqB;IACpC,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QACpB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY;QACzE,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,sBAAsB,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IACzC,OAAO,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,WAAW;IAaH,KAAK;IACL,OAAO;IAbT,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IACrC,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;IACxD,WAAW,CAAa;IAEzC;;;;;;OAMG;IACH,YACmB,KAAkB,EAClB,OAAO,GAKpB,EAAE;qBANW,KAAK;uBACL,OAAO;QAOxB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;mFAE+E;IAC/E,MAAM,CAAC,IAAoB,EAAE,GAAW,EAAE,GAAW,EAAE,OAAgB;QACrE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,KAAK;aACP,OAAO,CACN,4GAA4G,CAC7G;aACA,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,gFAAgF;IAChF,cAAc,CAAC,IAAoB,EAAE,GAAW,EAAE,GAAW;QAC3D,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,IAAoB,EAAE,GAAW;QAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChG,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED;;mFAE+E;IAC/E,eAAe,CACb,EAAmB,EACnB,IAAoB,EACpB,GAAW,EACX,UAAkB;QAElB,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,EAAE;aACd,OAAO,CACN,oGAAoG,CACrG;aACA,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QAClF,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,sBAAsB,GAAG,UAAU,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI;QACF,OACE,IAAI,CAAC,KAAK;aACP,OAAO,CACN,yHAAyH,CAC1H;aACA,GAAG,EACP,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,IAAoB,EAAE,GAAW;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK;aACnB,OAAO,CACN,2GAA2G,CAC5G;aACA,GAAG,CAAC,IAAI,EAAE,GAAG,CAAiC,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,eAAe,CAAC,IAAoB,EAAE,OAA0B;QAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,sBAAsB,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,wEAAwE;QACxE,0EAA0E;QAC1E,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE;YAC7B,EAAE,CAAC,OAAO,CACR,kIAAkI,CACnI,CAAC,GAAG,EAAE,CAAC;YACR,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAgC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC1F,KAAK,MAAM,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;gBACvE,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,UAAU,EAAE;oBACxB,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;iBAC7E,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;gBAClD,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;oBAClB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,GAAG,EAAE,UAAU,CAAC,GAAG;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,IAAoB,EAAE,GAAW;QAC7C,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,WAAW,CAAC,UAAkB;QACpC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO;QAChC,MAAM,SAAS,GAAoC,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,IAAI,KAAK,CAAC,sBAAsB,GAAG,UAAU;gBACpF,SAAS;YACX,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC;YAC/D,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnC,IAAI,OAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAC/B,kLAAkL,CACnL,CAAC;YACF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;gBACpC,MAAM,OAAO,GAAoB,EAAE,CAAC;gBACpC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,GAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC1F,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;oBAC1B,MAAM,GAAG,GACP,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAE,GAAG,CAAC,OAAoC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBACtF,IAAI,OAAO,GAAG,KAAK,QAAQ;wBAAE,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mEAAmE;YACnE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAChB,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvF,CAAC;YACF,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,SAAS;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9E,0EAA0E;QAC1E,yEAAyE;QACzE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YAC1C,MAAM,MAAM,GAAI,GAAG,CAAC,OAAoC,EAAE,GAAG,CAAC;YAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAChB,+DAA+D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/store/operator-decisions.d.ts

@@ -0,0 +1,23 @@
+import { type DecisionMutation, type OperatorDecisionRecord, type RecordedOperatorDecision } from "../operator-decisions.js";
+import type { SqlEventLedger } from "./event-store.js";
+import { type SqlWriteContext } from "./mutation.js";
+import type { EngineStore } from "./store.js";
+/** Latest decision and every original request binding share the row transaction. */
+export declare function applyDecisionInTx(sql: SqlWriteContext, pid: number, input: DecisionMutation): void;
+export declare class SqlOperatorDecisionStore {
+    private readonly store;
+    private readonly events;
+    constructor(store: EngineStore, events: SqlEventLedger);
+    get(runId: string): OperatorDecisionRecord | null;
+    findByIdempotency(runId: string, idempotency: {
+        key: string;
+        client: string;
+        request: unknown;
+    }): OperatorDecisionRecord | null;
+    record(input: OperatorDecisionRecord, idempotency?: {
+        key: string;
+        client: string;
+        request: unknown;
+    }): RecordedOperatorDecision;
+}
+//# sourceMappingURL=operator-decisions.d.ts.map

package/dist/store/operator-decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-decisions.d.ts","sourceRoot":"","sources":["../../src/store/operator-decisions.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAmC,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,oFAAoF;AACpF,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,gBAAgB,GACtB,IAAI,CAwBN;AAED,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFzB,YACmB,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,cAAc,EACrC;IAEJ,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAKhD;IAED,iBAAiB,CACf,KAAK,EAAE,MAAM,EACb,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAC7D,sBAAsB,GAAG,IAAI,CAW/B;IAED,MAAM,CACJ,KAAK,EAAE,sBAAsB,EAC7B,WAAW,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAC9D,wBAAwB,CAkB1B;CACF"}

package/dist/store/operator-decisions.js

@@ -0,0 +1,68 @@
+import { operatorDecisionBinding, parseDecisionMutation, parseOperatorDecision, } from "../operator-decisions.js";
+import { bindIdempotencyInTx, lookupIdempotency } from "./idempotency.js";
+import { requireTransaction, runMutation } from "./mutation.js";
+/** Latest decision and every original request binding share the row transaction. */
+export function applyDecisionInTx(sql, pid, input) {
+    requireTransaction(sql);
+    const mutation = parseDecisionMutation(input);
+    const result = sql
+        .prepare("INSERT INTO operator_decision(run_id,pid,body) VALUES(?,?,?) ON CONFLICT(run_id) DO UPDATE SET body=excluded.body WHERE operator_decision.pid=excluded.pid")
+        .run(mutation.decision.runId, pid, Buffer.from(JSON.stringify(mutation.decision)));
+    if (Number(result.changes) !== 1)
+        throw new Error("operator decision belongs to a different partition");
+    if (mutation.idempotency) {
+        const { keyDigest, requestDigest, runId } = mutation.idempotency;
+        const binding = bindIdempotencyInTx(sql, {
+            owner: "decision",
+            pid,
+            keyDigest,
+            requestDigest,
+            targetId: runId,
+            operation: "run.decision",
+            createdAt: mutation.decision.decidedAt,
+        });
+        if (binding.targetId !== runId)
+            throw new Error("conflicting operator decision idempotency history");
+    }
+}
+export class SqlOperatorDecisionStore {
+    store;
+    events;
+    constructor(store, events) {
+        this.store = store;
+        this.events = events;
+    }
+    get(runId) {
+        const row = this.store
+            .prepare("SELECT body FROM operator_decision WHERE run_id=? AND pid=?")
+            .get(runId, this.events.generation.pid);
+        return row ? parseOperatorDecision(JSON.parse(Buffer.from(row.body).toString("utf8"))) : null;
+    }
+    findByIdempotency(runId, idempotency) {
+        const key = operatorDecisionBinding(this.events.generation.name, runId, idempotency);
+        const binding = lookupIdempotency(this.store, { owner: "decision", pid: this.events.generation.pid, keyDigest: key.keyDigest }, key.requestDigest);
+        if (!binding)
+            return null;
+        const decision = this.get(binding.targetId);
+        if (!decision)
+            throw new Error("operator decision idempotency index is dangling");
+        return decision;
+    }
+    record(input, idempotency) {
+        const decision = parseOperatorDecision(input);
+        const binding = operatorDecisionBinding(this.events.generation.name, decision.runId, idempotency);
+        if (idempotency) {
+            const prior = this.findByIdempotency(decision.runId, idempotency);
+            if (prior)
+                return { record: prior, reused: true };
+        }
+        const mutation = { decision, ...(binding ? { idempotency: binding } : {}) };
+        const event = this.events.prepare("operator.decision_recorded", mutation);
+        runMutation(this.store, (tx) => {
+            applyDecisionInTx(tx, this.events.generation.pid, mutation);
+            this.events.appendInTx(tx, event);
+        });
+        return { record: decision, reused: false };
+    }
+}
+//# sourceMappingURL=operator-decisions.js.map

package/dist/store/operator-decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-decisions.js","sourceRoot":"","sources":["../../src/store/operator-decisions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GAItB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAwB,MAAM,eAAe,CAAC;AAGtF,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAC/B,GAAoB,EACpB,GAAW,EACX,KAAuB;IAEvB,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CACN,4JAA4J,CAC7J;SACA,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC;QACjE,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE;YACvC,KAAK,EAAE,UAAU;YACjB,GAAG;YACH,SAAS;YACT,aAAa;YACb,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS;SACvC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;YAC5B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,OAAO,wBAAwB;IAEhB,KAAK;IACL,MAAM;IAFzB,YACmB,KAAkB,EAClB,MAAsB;qBADtB,KAAK;sBACL,MAAM;IACtB,CAAC;IAEJ,GAAG,CAAC,KAAa;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK;aACnB,OAAO,CAAC,6DAA6D,CAAC;aACtE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAqC,CAAC;QAC9E,OAAO,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,CAAC;IAED,iBAAiB,CACf,KAAa,EACb,WAA8D;QAE9D,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAE,CAAC;QACtF,MAAM,OAAO,GAAG,iBAAiB,CAC/B,IAAI,CAAC,KAAK,EACV,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAChF,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAClF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CACJ,KAA6B,EAC7B,WAA+D;QAE/D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,uBAAuB,CACrC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAC3B,QAAQ,CAAC,KAAK,EACd,WAAW,CACZ,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClE,IAAI,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,4BAA4B,EAAE,QAAQ,CAAC,CAAC;QAC1E,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE;YAC7B,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;CACF"}

package/dist/store/owner-generations.d.ts

@@ -0,0 +1,33 @@
+import type { EngineStore } from "./store.js";
+/** `blob:<sha256>` or `upload:<uploadId>`: the file families the sweep/GC may unlink by "no owner". */
+export type OwnerKey = `blob:${string}` | `upload:${string}`;
+export type UnlinkOutcome = "removed" | "owned";
+export interface UnlinkRequest {
+    path: string;
+    /** Synchronous owner check in the recheck section (reverse indexes / the `upload` row). */
+    owners: () => boolean;
+    /** Runs in the same synchronous section right after the unlink (e.g. the `blob` row delete). */
+    afterUnlink?: () => void;
+}
+/**
+ * The one rule for every unlink by "no owner" (R5_AMENDMENTS C10, generalizing
+ * A3/C3 and replacing the C9 mechanism). The main thread records, after every
+ * COMMIT that inserts, deletes or changes an owner row of a key, the
+ * generation of that change; the unlink waits for the barrier covering the
+ * latest such generation and then, in ONE synchronous section, retries when
+ * the owner moved during the wait, keeps when an owner exists, else unlinks
+ * (ENOENT is success). One flight per key; concurrent callers join it.
+ */
+export declare class OwnerGenerations {
+    private readonly store;
+    private readonly generations;
+    private readonly inflight;
+    constructor(store: EngineStore);
+    /** Right after the COMMIT of a transaction that touched the key's owner row(s). */
+    noteChange(key: OwnerKey): number;
+    /** Test seam: the generation currently bound to a key. */
+    generationOf(key: OwnerKey): number | undefined;
+    unlinkWhenUnowned(key: OwnerKey, request: UnlinkRequest): Promise<UnlinkOutcome>;
+    private loop;
+}
+//# sourceMappingURL=owner-generations.d.ts.map

package/dist/store/owner-generations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-generations.d.ts","sourceRoot":"","sources":["../../src/store/owner-generations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,uGAAuG;AACvG,MAAM,MAAM,QAAQ,GAAG,QAAQ,MAAM,EAAE,GAAG,UAAU,MAAM,EAAE,CAAC;AAE7D,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAIf,OAAO,CAAC,QAAQ,CAAC,KAAK;IAHlC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+C;IAExE,YAA6B,KAAK,EAAE,WAAW,EAAI;IAEnD,mFAAmF;IACnF,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAIhC;IAED,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAE9C;IAED,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAQ/E;YAEa,IAAI;CAoBnB"}

package/dist/store/owner-generations.js

@@ -0,0 +1,63 @@
+import { unlinkSync } from "node:fs";
+/**
+ * The one rule for every unlink by "no owner" (R5_AMENDMENTS C10, generalizing
+ * A3/C3 and replacing the C9 mechanism). The main thread records, after every
+ * COMMIT that inserts, deletes or changes an owner row of a key, the
+ * generation of that change; the unlink waits for the barrier covering the
+ * latest such generation and then, in ONE synchronous section, retries when
+ * the owner moved during the wait, keeps when an owner exists, else unlinks
+ * (ENOENT is success). One flight per key; concurrent callers join it.
+ */
+export class OwnerGenerations {
+    store;
+    generations = new Map();
+    inflight = new Map();
+    constructor(store) {
+        this.store = store;
+    }
+    /** Right after the COMMIT of a transaction that touched the key's owner row(s). */
+    noteChange(key) {
+        const g = this.store.mark();
+        this.generations.set(key, g);
+        return g;
+    }
+    /** Test seam: the generation currently bound to a key. */
+    generationOf(key) {
+        return this.generations.get(key);
+    }
+    unlinkWhenUnowned(key, request) {
+        const running = this.inflight.get(key);
+        if (running)
+            return running;
+        const flight = this.loop(key, request).finally(() => {
+            if (this.inflight.get(key) === flight)
+                this.inflight.delete(key);
+        });
+        this.inflight.set(key, flight);
+        return flight;
+    }
+    async loop(key, request) {
+        for (;;) {
+            const gWait = this.generations.get(key) ?? this.store.mark();
+            await this.store.synced(gWait);
+            // One synchronous section: no await below this line.
+            if ((this.generations.get(key) ?? gWait) > gWait)
+                continue;
+            if (request.owners()) {
+                this.generations.delete(key);
+                return "owned";
+            }
+            try {
+                unlinkSync(request.path);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            request.afterUnlink?.();
+            this.generations.delete(key);
+            return "removed";
+        }
+    }
+}
+//# sourceMappingURL=owner-generations.js.map

package/dist/store/owner-generations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-generations.js","sourceRoot":"","sources":["../../src/store/owner-generations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAgBrC;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IAIE,KAAK;IAHjB,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IAExE,YAA6B,KAAkB;qBAAlB,KAAK;IAAgB,CAAC;IAEnD,mFAAmF;IACnF,UAAU,CAAC,GAAa;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0DAA0D;IAC1D,YAAY,CAAC,GAAa;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,iBAAiB,CAAC,GAAa,EAAE,OAAsB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAa,EAAE,OAAsB;QACtD,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK;gBAAE,SAAS;YAC3D,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7B,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,CAAC;gBACH,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YACtE,CAAC;YACD,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}