@davesheffer/hunch 1.45.1 → 1.45.2

package/dist/store/jsonStore.js

@@ -11,7 +11,7 @@ import { ENTITY_KINDS, SCHEMAS } from "../core/types.js";
 import { BASELINE_VERSION, migrateRaw, SCHEMA_VERSION } from "../core/migrate.js";
 import { writeFileAtomic } from "../core/io.js";
 import { readStoreArtifact } from "../core/storeArtifact.js";
-import { heldLockNonces, judgeSameHostOwner, selfStartToken, startTokenOf } from "../core/procstart.js";
+import { createdAfterLock, heldLockNonces, judgeSameHostOwner, processStartedAt, selfStartToken, startTokenOf } from "../core/procstart.js";
 /** High-cardinality collections (symbols, edges) are stored as a single
  *  index.json array — there can be thousands, and one file per edge would create
  *  enormous git noise. Curated, low-volume entities (components, decisions, bugs,
@@ -118,6 +118,7 @@ function readRmwOwnerOnce(lock) {
             host: parsed.host,
             ...(typeof parsed.nonce === "string" ? { nonce: parsed.nonce } : {}),
             ...(typeof parsed.start === "string" ? { start: parsed.start } : {}),
+            ...(typeof parsed.at === "string" ? { at: parsed.at } : {}),
         };
     }
     catch {
@@ -143,9 +144,14 @@ const RMW_CLAIM_STALE_MS = 10_000;
  *  The owner's recorded process-instance token settles that by string equality
  *  (core/procstart.ts); no clock is compared, because a lock's mtime and a start
  *  time come from different clocks and any skew would "prove" a live owner
- *  recycled. `readRmwOwner` stays FIRST: it throws on unsafe/hardlinked or
- *  oversized ownership metadata, and unsafe ownership never licenses removal. */
-function rmwLockIsStale(lock) {
+ *  recycled. Where no token exists (macOS, Windows) a live pid is "unproven",
+ *  and an AGED lock is still taken over once the OS proves the process now
+ *  holding that pid was created after the lock's recorded `at` (issue #457) —
+ *  the same `createdAfterLock` rule as the write lock. `startedAt` is
+ *  memoized per acquisition by the caller, because the OS probe spawns.
+ *  `readRmwOwner` stays FIRST: it throws on unsafe/hardlinked or oversized
+ *  ownership metadata, and unsafe ownership never licenses removal. */
+function rmwLockIsStale(lock, startedAt) {
     let stat;
     try {
         stat = lstatSync(lock);
@@ -157,9 +163,10 @@ function rmwLockIsStale(lock) {
     }
     const owner = readRmwOwner(lock);
     if (owner && owner.host === hostname()) {
-        // One shared table with src/serve/writelock.ts (core/procstart.ts), so the
-        // two locks can never drift apart; "age" means nothing was proven and the
-        // fallback below governs, exactly as for a foreign host.
+        // One shared table with src/serve/writelock.ts (core/procstart.ts), and one
+        // shared creation-time check for an "unproven" pid, so the two locks apply
+        // the same rule; "age" means nothing was proven and the fallback below
+        // governs, exactly as for a foreign host.
         const verdict = judgeSameHostOwner(owner, {
             alive: rmwPidAlive,
             self: selfStartToken(),
@@ -168,6 +175,8 @@ function rmwLockIsStale(lock) {
             selfPid: process.pid,
             heldNonces: heldLockNonces,
         });
+        if (verdict === "unproven")
+            return Date.now() - stat.mtimeMs > 10_000 && createdAfterLock(owner, startedAt);
         if (verdict !== "age")
             return verdict === "stale";
     }
@@ -210,7 +219,7 @@ function rmwLockIsStale(lock) {
  * so the race persists until every writer on the store is upgraded. Returns true
  * when the path may now be free.
  */
-function takeOverRmwLock(lock) {
+function takeOverRmwLock(lock, startedAt) {
     const claim = `${lock}.reclaim`;
     try {
         mkdirSync(claim);
@@ -229,7 +238,7 @@ function takeOverRmwLock(lock) {
         return false;
     }
     try {
-        if (!rmwLockIsStale(lock))
+        if (!rmwLockIsStale(lock, startedAt))
             return false; // re-judged from scratch under the claim
         rmSync(lock, { recursive: true, force: true });
         return true;
@@ -253,6 +262,7 @@ function unsafePath(path, reason) {
 }
 export class JsonStore {
     paths;
+    lockOpts;
     _warnedForward = false;
     /** Memoized validated records per kind. loadAll() is on every read-path method
      *  (why/checkConstraints/fragility/assembleContext…), each of which previously
@@ -265,8 +275,13 @@ export class JsonStore {
     lexicalRoot;
     canonicalRoot;
     lexicalHunch;
-    constructor(paths) {
+    /** `lockOpts.startedAt` is an INTERNAL TEST SEAM, not API: it replaces the OS
+     *  creation-time probe of the `.rmw-lock` "unproven" rule so the suite can
+     *  drive it on linux, where the real probe reports nothing. Callers outside
+     *  this repo must leave it unset — `processStartedAt` is the only sound probe. */
+    constructor(paths, lockOpts = {}) {
         this.paths = paths;
+        this.lockOpts = lockOpts;
         this.lexicalRoot = resolve(paths.root);
         this.canonicalRoot = realpathSync(this.lexicalRoot);
         this.lexicalHunch = resolve(paths.hunch);
@@ -666,6 +681,15 @@ export class JsonStore {
         const lock = join(directory.lexical, ".rmw-lock");
         const deadline = Date.now() + 2_000;
         const nonce = randomBytes(8).toString("hex");
+        // The creation-time probe spawns; ask it once per pid for this acquisition,
+        // not on every poll nor again under the takeover claim (as writelock.ts).
+        const createdAt = new Map();
+        const probe = this.lockOpts.startedAt ?? processStartedAt;
+        const startedAt = (pid) => {
+            if (!createdAt.has(pid))
+                createdAt.set(pid, probe(pid));
+            return createdAt.get(pid);
+        };
         for (;;) {
             try {
                 mkdirSync(lock);
@@ -676,10 +700,11 @@ export class JsonStore {
                 // writer may exceed the stale-age heuristic while serializing a large
                 // index; its PID must prevent a second writer from taking over. The
                 // process-instance token (when this platform has one) is what lets a
-                // successor tell that PID apart from a recycled one.
+                // successor tell that PID apart from a recycled one; without one, `at`
+                // lets it prove the pid's current process was created after this lock.
                 try {
                     const start = selfStartToken();
-                    writeFileAtomic(join(lock, "owner.tmp.json"), JSON.stringify({ pid: process.pid, host: hostname(), nonce, ...(start !== null ? { start } : {}) }));
+                    writeFileAtomic(join(lock, "owner.tmp.json"), JSON.stringify({ pid: process.pid, host: hostname(), nonce, at: new Date().toISOString(), ...(start !== null ? { start } : {}) }));
                 }
                 catch (error) {
                     try {
@@ -694,7 +719,7 @@ export class JsonStore {
             catch (error) {
                 if (error.code !== "EEXIST")
                     throw error;
-                if (rmwLockIsStale(lock) && takeOverRmwLock(lock))
+                if (rmwLockIsStale(lock, startedAt) && takeOverRmwLock(lock, startedAt))
                     continue;
                 // The deadline is checked only AFTER an acquire has been attempted: with
                 // the check at the top of the loop, a successful takeover could still be

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.45.1",
+  "version": "1.45.2",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.45.1",
+  "version": "1.45.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.45.1",
+      "version": "1.45.2",
       "runtimeHint": "npx",
       "packageArguments": [
         {