@davideasden/pi-undo 0.2.24 → 0.2.26

package/src/operation-context.ts

@@ -0,0 +1,266 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+export type OperationErrorCode = "operation_cancelled" | "operation_timeout";
+
+/**
+ * 一次可取消操作的共享作用域。调用方（撤回/捕获/恢复入口）创建 context，
+ * 低层只读取当前继承的 context：deadline 是硬上限，signal 是取消通道。
+ */
+export interface ProcessDiagnostic {
+	readonly command: string;
+	readonly durationMs: number;
+	readonly outcome: string;
+	readonly exitCode: number | null;
+}
+
+export interface OperationContext {
+	readonly signal: AbortSignal;
+	readonly deadline: number;
+	readonly onProgress?: (phase: string) => void;
+	readonly onProcess?: (diagnostic: ProcessDiagnostic) => void;
+}
+
+export class OperationError extends Error {
+	readonly code: OperationErrorCode;
+
+	constructor(code: OperationErrorCode, message: string, options?: ErrorOptions) {
+		super(message, options);
+		this.name = "OperationError";
+		this.code = code;
+	}
+}
+
+/** 超时与主动取消都走 AbortSignal；用固定 reason 区分两者。 */
+const OPERATION_TIMEOUT_REASON = "operation_timeout";
+
+const storage = new AsyncLocalStorage<OperationContext | undefined>();
+const unsafeContexts = new WeakSet<OperationContext>();
+
+export function markProcessExitUnconfirmed(): void {
+	const context = storage.getStore();
+	if (context !== undefined) unsafeContexts.add(context);
+}
+
+export function operationHasUnconfirmedExit(): boolean {
+	const context = storage.getStore();
+	return context !== undefined && unsafeContexts.has(context);
+}
+
+/**
+ * 在 context 下运行 body；context 为 undefined 时清除继承的 context，
+ * 保证嵌套作用域之间不会泄漏取消状态。
+ */
+export function runWithOperationContext<T>(context: OperationContext | undefined, body: () => T): T {
+	return storage.run(context, body);
+}
+
+export function currentOperationContext(): OperationContext | undefined {
+	return storage.getStore();
+}
+
+/**
+ * 取消或超时检查：可在任意 await 边界调用。没有 context 时是空操作。
+ * 已取消/超时抛 OperationError，code 区分 operation_cancelled 与 operation_timeout。
+ */
+export function checkOperation(): void {
+	const context = storage.getStore();
+	if (context === undefined) {
+		return;
+	}
+	if (unsafeContexts.has(context)) throw Object.assign(new Error("子进程未确认退出"), { code: "process_exit_unconfirmed" });
+	if (context.signal.aborted) {
+		throw operationErrorFromAbortReason(context.signal.reason);
+	}
+	if (Date.now() >= context.deadline) {
+		throw new OperationError("operation_timeout", "操作超过截止时间");
+	}
+}
+
+/** 报告可读阶段（供状态显示使用）；没有 context 或没有 onProgress 时是空操作。 */
+export function reportOperationProgress(phase: string): void {
+	storage.getStore()?.onProgress?.(phase);
+}
+
+export function reportProcessDiagnostic(diagnostic: ProcessDiagnostic): void {
+	try {
+		storage.getStore()?.onProcess?.(diagnostic);
+	} catch {
+		// 诊断失败不能改变事务结果。
+	}
+}
+
+export interface OperationProcessOptions {
+	readonly signal?: AbortSignal;
+	readonly timeoutMs: number;
+}
+
+/**
+ * 低层子进程包装器使用的预算：取「剩余 deadline」与 defaultTimeoutMs 的较小值。
+ * 已取消或已超时直接抛出，避免取消后继续启动新工作。
+ */
+export function operationProcessOptions(defaultTimeoutMs = 120_000): OperationProcessOptions {
+	if (!Number.isFinite(defaultTimeoutMs) || defaultTimeoutMs < 0) {
+		throw new RangeError("defaultTimeoutMs 必须是非负有限数字");
+	}
+	const context = storage.getStore();
+	if (context === undefined) {
+		return { timeoutMs: defaultTimeoutMs };
+	}
+	checkOperation();
+	const remaining = context.deadline - Date.now();
+	return {
+		signal: context.signal,
+		timeoutMs: Math.min(defaultTimeoutMs, remaining),
+	};
+}
+
+export interface OperationScopeOptions {
+	/** 不传表示没有 deadline（只受 signal 控制）。 */
+	readonly timeoutMs?: number;
+	/** 上层取消（例如 /undo-cancel 或父作用域）会传播到本作用域。 */
+	readonly signal?: AbortSignal;
+	readonly onProgress?: (phase: string) => void;
+	readonly onProcess?: (diagnostic: ProcessDiagnostic) => void;
+	readonly now?: () => number;
+}
+
+export interface OperationScope {
+	readonly context: OperationContext;
+	/** 请求主动取消。 */
+	cancel(): void;
+	/** 清除超时计时器与父 signal 监听。 */
+	dispose(): void;
+}
+
+/**
+ * 创建一次可取消操作的 context。超时通过计时器把 signal 置为 timeout reason，
+ * 使 checkOperation/operationProcessOptions 能区分超时与主动取消。
+ */
+export function createOperationScope(options: OperationScopeOptions = {}): OperationScope {
+	const now = options.now ?? Date.now;
+	const controller = new AbortController();
+	const deadline = options.timeoutMs === undefined
+		? Number.POSITIVE_INFINITY
+		: now() + options.timeoutMs;
+	let timeout: NodeJS.Timeout | undefined;
+	if (options.timeoutMs !== undefined) {
+		timeout = setTimeout(() => controller.abort(OPERATION_TIMEOUT_REASON), Math.max(0, options.timeoutMs));
+		timeout.unref();
+	}
+	const onParentAbort = (): void => controller.abort(options.signal?.reason ?? "operation_cancelled");
+	if (options.signal !== undefined) {
+		if (options.signal.aborted) {
+			onParentAbort();
+		} else {
+			options.signal.addEventListener("abort", onParentAbort, { once: true });
+		}
+	}
+	const context: OperationContext = {
+		signal: controller.signal,
+		deadline,
+		...(options.onProgress === undefined ? {} : { onProgress: options.onProgress }),
+		...(options.onProcess === undefined ? {} : { onProcess: options.onProcess }),
+	};
+	return {
+		context,
+		cancel: () => controller.abort("operation_cancelled"),
+		dispose: () => {
+			if (timeout !== undefined) {
+				clearTimeout(timeout);
+			}
+			options.signal?.removeEventListener("abort", onParentAbort);
+		},
+	};
+}
+
+export async function allCompleted<T extends readonly unknown[]>(tasks: T): Promise<{ -readonly [K in keyof T]: Awaited<T[K]> }> {
+	const outcomes = await Promise.allSettled(tasks);
+	const failure = outcomes.find((outcome) => outcome.status === "rejected");
+	if (failure?.status === "rejected") throw failure.reason;
+	return outcomes.map((outcome) => (outcome as PromiseFulfilledResult<unknown>).value) as { -readonly [K in keyof T]: Awaited<T[K]> };
+}
+
+export function configuredTimeout(name: string, fallback: number): number {
+	const raw = process.env[name];
+	if (raw === undefined || raw === "") return fallback;
+	const value = Number(raw);
+	if (!Number.isSafeInteger(value) || value <= 0 || value > 2_147_483_647) throw new Error(`${name} 必须是正整数毫秒`);
+	return value;
+}
+
+export async function withRecoveryBudget<T>(body: () => Promise<T>, options: OperationScopeOptions = {}): Promise<T> {
+	if (operationHasUnconfirmedExit()) checkOperation();
+	const scope = createOperationScope({
+		timeoutMs: configuredTimeout("PI_UNDO_OPERATION_TIMEOUT_MS", 300_000),
+		onProcess: currentOperationContext()?.onProcess,
+		...options,
+	});
+	try {
+		return await runWithOperationContext(scope.context, async () => {
+			try {
+				return await body();
+			} finally {
+				if (operationHasUnconfirmedExit()) checkOperation();
+			}
+		});
+	} catch (error) {
+		if (isUnconfirmedExit(error)) markProcessExitUnconfirmed();
+		throw error;
+	} finally {
+		scope.dispose();
+	}
+}
+
+export function isUnconfirmedExit(error: unknown): boolean {
+	return errorChain(error).some((value) => value.code === "git_termination_failed" || value.code === "process_exit_unconfirmed");
+}
+
+/** 包装层保留 cause 时仍能识别取消，避免被误报为普通 capture 失败。 */
+export function operationFailure(error: unknown): OperationErrorCode | undefined {
+	for (const value of errorChain(error)) {
+		if (value.code === "operation_cancelled" || value.code === "operation_timeout") return value.code;
+		const result = value.result as { timedOut?: boolean; aborted?: boolean } | undefined;
+		if (result?.timedOut) return "operation_timeout";
+		if (result?.aborted) return "operation_cancelled";
+	}
+	return undefined;
+}
+
+export function rethrowOperationFailure(error: unknown): void {
+	if (isUnconfirmedExit(error) || operationFailure(error) !== undefined) throw error;
+}
+
+function errorChain(error: unknown): Array<Record<string, unknown>> {
+	const chain: Array<Record<string, unknown>> = [];
+	const seen = new Set<unknown>();
+	while (typeof error === "object" && error !== null && !seen.has(error)) {
+		seen.add(error);
+		const value = error as Record<string, unknown>;
+		chain.push(value);
+		error = value.cause;
+	}
+	return chain;
+}
+
+function operationErrorFromAbortReason(reason: unknown): OperationError {
+	if (isTimeoutReason(reason)) {
+		return new OperationError("operation_timeout", "操作超过截止时间");
+	}
+	return new OperationError("operation_cancelled", "操作已被取消");
+}
+
+/** 判断 AbortSignal 的 reason 是否代表超时（而不是主动取消）。 */
+export function isOperationTimeoutReason(reason: unknown): boolean {
+	return isTimeoutReason(reason);
+}
+
+function isTimeoutReason(reason: unknown): boolean {
+	if (reason === OPERATION_TIMEOUT_REASON) {
+		return true;
+	}
+	if (typeof reason !== "object" || reason === null) {
+		return false;
+	}
+	const value = reason as { readonly code?: unknown; readonly name?: unknown };
+	return value.code === OPERATION_TIMEOUT_REASON || value.name === "TimeoutError";
+}

package/src/pi-runtime.ts

@@ -1,4 +1,5 @@
 import { join, resolve } from "node:path";
+import { writeJsonAtomic } from "./atomic-fs.ts";
 
 import type {
 	ExtensionAPI,
@@ -28,11 +29,17 @@ import { DurableCursorWriter, SessionState, type SessionEntrySource } from "./se
 import { SnapshotStore } from "./snapshot-store.ts";
 import { StatusReporter } from "./status-reporter.ts";
 import { WorkspaceLock } from "./workspace-lock.ts";
+import { allCompleted, checkOperation, configuredTimeout, currentOperationContext, isUnconfirmedExit, operationHasUnconfirmedExit, runWithOperationContext, withRecoveryBudget, type ProcessDiagnostic } from "./operation-context.ts";
 
 type ReadonlySessionManager = ExtensionContext["sessionManager"];
 
-export async function createPiUndoRuntime(context: ExtensionContext, pi: ExtensionAPI) {
+export function createPiUndoRuntime(context: ExtensionContext, pi: ExtensionAPI) {
+	return withRecoveryBudget(() => initializePiUndoRuntime(context, pi));
+}
+
+async function initializePiUndoRuntime(context: ExtensionContext, pi: ExtensionAPI) {
 	const manager = context.sessionManager;
+	const reporter = new StatusReporter(context);
 	const sessionState = sessionStateFor(manager);
 	const sessionIdentity = await sessionState.getSessionIdentity() ?? volatileSessionIdentity(manager, context.cwd);
 	const privateRoot = join(manager.getSessionDir(), ".pi-undo");
@@ -66,11 +73,15 @@ export async function createPiUndoRuntime(context: ExtensionContext, pi: Extensi
 		loadPending: () => journal.loadPending(),
 		assessForeignTransaction: (pending) => journal.isInertForeignPrepared(pending),
 		assessCompensatedTransaction: (pending) => journal.isFullyCompensated(pending),
-		inspectCursor: (pending) => inspectCursorMarkers(pending.descriptor.sessionIdentity.path, pending.descriptor),
+		inspectCursor: (pending) => inspectCursorMarkers(pending.descriptor.sessionIdentity.path, pending.descriptor,
+			pending.descriptor.action === "tree" && pending.state.observedLogicalLeaf !== undefined
+				? pending.state.observedLogicalLeaf : pending.descriptor.toLogicalLeaf),
 		finalizeCursor: (pending, inspection) => finalizeCursorMarker(
 			pending.descriptor.sessionIdentity.path,
 			pending.descriptor,
 			inspection,
+			pending.descriptor.action === "tree" && pending.state.observedLogicalLeaf !== undefined
+				? pending.state.observedLogicalLeaf : pending.descriptor.toLogicalLeaf,
 		),
 		recoverMutations: async (pending, decision) => {
 			const mutationJournal = journal.mutationJournal(pending.descriptor.opId);
@@ -141,7 +152,7 @@ export async function createPiUndoRuntime(context: ExtensionContext, pi: Extensi
 		if (finalizationFailure !== undefined) throw finalizationFailure;
 	};
 	const scheduleFinalization = (opId: string): void => {
-		finalizationQueue = finalizationQueue.then(async () => {
+		finalizationQueue = runWithOperationContext(undefined, () => finalizationQueue.then(() => withRecoveryBudget(async () => {
 			const lease = await workspaceLock.acquire(initialTopology.workspaceIdentity);
 			try {
 				const mutationJournal = journal.mutationJournal(opId);
@@ -161,9 +172,9 @@ export async function createPiUndoRuntime(context: ExtensionContext, pi: Extensi
 				});
 				await journal.markCommitted(opId);
 			} finally {
-				await lease.release();
+				if (!operationHasUnconfirmedExit()) await lease.release();
 			}
-		}).catch((error: unknown) => {
+		}))).catch((error: unknown) => {
 			finalizationFailure = error;
 		});
 	};
@@ -183,6 +194,9 @@ export async function createPiUndoRuntime(context: ExtensionContext, pi: Extensi
 		loadPending: () => journal.loadPending(),
 	};
 
+	const diagnostics: ProcessDiagnostic[] = [];
+	const phases: Array<{ phase: string; elapsedMs: number }> = [];
+	let operationStarted = 0;
 	const dependencies: ControllerDependencies = {
 		workspaceIdentity: initialTopology.workspaceIdentity,
 		sessionIdentity,
@@ -210,10 +224,12 @@ export async function createPiUndoRuntime(context: ExtensionContext, pi: Extensi
 			}
 		},
 		restoreSessionLeaf: async (logicalLeafId) => {
-			if (commandContext === undefined || logicalLeafId === null) return false;
+			if (commandContext === undefined) return false;
+			const targetId = sessionNavigationEntry(manager, logicalLeafId);
+			if (targetId === undefined) return false;
 			internalNavigation = true;
 			try {
-				const result = await commandContext.navigateTree(logicalLeafId, { summarize: false });
+				const result = await commandContext.navigateTree(targetId, { summarize: false });
 				return !result.cancelled && sessionStateFor(manager).getLogicalLeafId() === logicalLeafId;
 			} finally {
 				internalNavigation = false;
@@ -225,7 +241,7 @@ export async function createPiUndoRuntime(context: ExtensionContext, pi: Extensi
 		capture,
 		captureBaseline,
 		captureSafety: async (referenceManifestId, targetManifestId, scopePaths) => {
-			const [reference, target] = await Promise.all([
+			const [reference, target] = await allCompleted([
 				store.loadManifest(referenceManifestId),
 				store.loadManifest(targetManifestId),
 			]);
@@ -253,6 +269,30 @@ export async function createPiUndoRuntime(context: ExtensionContext, pi: Extensi
 		},
 		journal: transactionJournal,
 		clock: Date.now,
+		operationTimeoutMs: configuredTimeout("PI_UNDO_OPERATION_TIMEOUT_MS", 300_000),
+		onOperationStart: (opId) => {
+			operationStarted = performance.now();
+			diagnostics.length = 0;
+			phases.length = 0;
+			reporter.startOperation(opId);
+		},
+		onProgress: (phase) => {
+			reporter.setOperationPhase(phase);
+			if (phases.at(-1)?.phase === phase) return;
+			if (phases.length === 128) phases.shift();
+			phases.push({ phase, elapsedMs: Math.round(performance.now() - operationStarted) });
+		},
+		onProcess: (diagnostic) => {
+			if (diagnostics.length === 128) diagnostics.shift();
+			diagnostics.push(diagnostic);
+		},
+		onOperationEnd: async (opId, result) => {
+			const totalMs = Math.round(performance.now() - operationStarted);
+			if (totalMs < 1_000 && (result.code === "ok" || result.code === "noop")) return;
+			await writeJsonAtomic(join(privateRoot, "diagnostics", `${manager.getSessionId()}-latest.json`), {
+				schemaVersion: 1, opId, code: result.code, totalMs, phases, processes: diagnostics,
+			});
+		},
 	};
 	const startupRecovery = await workspaceLock.withLock(
 		initialTopology.workspaceIdentity,
@@ -266,17 +306,30 @@ export async function createPiUndoRuntime(context: ExtensionContext, pi: Extensi
 	});
 	return {
 		controller,
-		reporter: new StatusReporter(context),
+		reporter,
 		diffSource: store,
 		recovery: startupRecovery.kind === "locked"
 			? { reason: startupRecovery.reason, files: startupRecovery.files, opId: startupRecovery.opId }
 			: undefined,
+		async dispose(): Promise<void> {
+			await controller.dispose();
+			await finalizationQueue;
+			if (isUnconfirmedExit(finalizationFailure)) throw finalizationFailure;
+			reporter.endOperation();
+		},
 		setCommandContext(next: ExtensionCommandContext | undefined): void {
 			commandContext = next;
 		},
 		isInternalNavigation(): boolean {
 			return internalNavigation;
 		},
+		normalizeTreeEvent(event: { newLeafId: string | null; summaryEntry?: { parentId: string | null } }) {
+			return {
+				newLeafId: logicalLeafAt(manager, event.newLeafId),
+				navigationTargetLeafId: logicalLeafAt(manager,
+					event.summaryEntry === undefined ? event.newLeafId : event.summaryEntry.parentId),
+			};
+		},
 	};
 }
 
@@ -401,6 +454,21 @@ function logicalLeafAt(manager: ReadonlySessionManager, leafId: string | null):
 	return sessionStateFor(manager, leafId).getLogicalLeafId();
 }
 
+function sessionNavigationEntry(manager: ReadonlySessionManager, logicalLeafId: string | null): string | undefined {
+	if (logicalLeafId !== null) {
+		const entry = manager.getEntry(logicalLeafId) as unknown;
+		if (isRecord(entry) && entry.type !== "custom_message" &&
+			!(entry.type === "message" && isRecord(entry.message) && entry.message.role === "user")) return logicalLeafId;
+	}
+	// Pi 的公开导航 API 不接受 null；选择 parent 对应逻辑位置的用户消息。
+	for (const entry of manager.getEntries() as unknown[]) {
+		if (!isRecord(entry) || typeof entry.id !== "string" || entry.type !== "message" ||
+			!isRecord(entry.message) || entry.message.role !== "user") continue;
+		if (logicalLeafAt(manager, entryParent(manager, entry.id)) === logicalLeafId) return entry.id;
+	}
+	return undefined;
+}
+
 async function resolveTreeTarget(
 	manager: ReadonlySessionManager,
 	identity: SessionFileIdentity,
@@ -421,12 +489,42 @@ async function resolveTreeTarget(
 			undoStack: sessionStateFor(manager, physicalLeaf).getCheckpoints(identity),
 		};
 	}
-	let checkpoints = [...sessionStateFor(manager, physicalLeaf).getCheckpoints(identity)];
 	const exact = findCheckpointByEndLeaf(manager, identity, logicalLeafId);
-	if (exact !== undefined) checkpoints = checkpointFrontierById(manager, identity, exact.checkpointId);
-	const checkpoint = exact ?? checkpoints.at(-1);
-	if (checkpoint === undefined) throw new Error("tree target 缺少完整 checkpoint");
-	return { logicalLeafId, targetManifestId: checkpoint.afterManifestId, undoStack: checkpoints };
+	if (exact !== undefined) {
+		return {
+			logicalLeafId,
+			targetManifestId: exact.afterManifestId,
+			undoStack: checkpointFrontierById(manager, identity, exact.checkpointId),
+		};
+	}
+	// cursor 可以证明 summary/撤回后逻辑边界对应的文件状态；不能退回任意旧栈顶。
+	const cursor = sessionStateFor(manager, physicalLeaf).getCursor(identity);
+	if (cursor !== null && cursor.toLogicalLeaf === logicalLeafId) {
+		return {
+			logicalLeafId,
+			targetManifestId: cursor.targetManifestId,
+			undoStack: cursor.undoHead === null ? [] : checkpointFrontierById(manager, identity, cursor.undoHead),
+		};
+	}
+	// 用户输入前的控制条目/根叶可由可信 before checkpoint 证明。
+	const boundaries = new Map<string, { checkpoint: CheckpointRecord; physicalLeaf: string | null }>();
+	for (const value of manager.getEntries() as unknown[]) {
+		if (!isRecord(value) || value.type !== "custom" || value.customType !== "pi-undo:checkpoint" || typeof value.id !== "string") continue;
+		for (const checkpoint of sessionStateFor(manager, value.id).getCheckpoints(identity)) {
+			const beforeLeaf = entryParent(manager, checkpoint.userEntryId);
+			if (logicalLeafAt(manager, beforeLeaf) === logicalLeafId) boundaries.set(checkpoint.checkpointId, { checkpoint, physicalLeaf: beforeLeaf });
+		}
+	}
+	const beforeStates = [...boundaries.values()];
+	if (beforeStates.length > 0 && new Set(beforeStates.map(({ checkpoint }) => checkpoint.beforeManifestId)).size === 1) {
+		const boundary = beforeStates[0]!;
+		return {
+			logicalLeafId,
+			targetManifestId: boundary.checkpoint.beforeManifestId,
+			undoStack: sessionStateFor(manager, boundary.physicalLeaf).getCheckpoints(identity),
+		};
+	}
+	throw new Error("tree target 缺少精确的 checkpoint 边界");
 }
 
 function findCheckpointByEndLeaf(
@@ -538,17 +636,23 @@ function volatileSessionIdentity(manager: ReadonlySessionManager, cwd: string):
 
 async function waitForIdle(context: ExtensionCommandContext | undefined, deadlineMs: number): Promise<boolean> {
 	if (context === undefined) return false;
-	const remaining = Math.max(0, deadlineMs - Date.now());
+	checkOperation();
+	const operation = currentOperationContext();
+	const remaining = Math.max(0, Math.min(deadlineMs, operation?.deadline ?? Infinity) - Date.now());
 	let timeout: ReturnType<typeof setTimeout> | undefined;
+	let onAbort: (() => void) | undefined;
 	try {
 		return await Promise.race([
 			context.waitForIdle().then(() => true, () => false),
 			new Promise<boolean>((resolveTimeout) => {
 				timeout = setTimeout(() => resolveTimeout(false), remaining);
+				onAbort = () => resolveTimeout(false);
+				operation?.signal.addEventListener("abort", onAbort, { once: true });
 			}),
 		]);
 	} finally {
 		if (timeout !== undefined) clearTimeout(timeout);
+		if (onAbort !== undefined) operation?.signal.removeEventListener("abort", onAbort);
 	}
 }
 

package/src/quarantine.ts

@@ -7,6 +7,7 @@ import { fsyncDirectory, writeBytesExclusive } from "./atomic-fs.ts";
 import { canonicalJson, checksum } from "./encoding.ts";
 import type { MutationJournal } from "./mutation-journal.ts";
 import type { MutationRecord } from "./model.ts";
+import { checkOperation } from "./operation-context.ts";
 import { assertNoSymlinkEscape, relativeSafePath } from "./path-safety.ts";
 
 const BATCH_FILE_IO_CONCURRENCY = 32;
@@ -828,6 +829,7 @@ export class QuarantineManager {
 	}
 
 	private async assertWorkspaceIdentity(): Promise<void> {
+		checkOperation();
 		const identity = await realpath(this.requestedWorkspaceRoot);
 		if (identity !== this.workspaceRoot) {
 			throw new QuarantineError("unsafe_artifact", "workspace root identity 已变化");
@@ -925,6 +927,7 @@ async function mapConcurrentFailClosed<T>(
 			const index = nextIndex;
 			nextIndex += 1;
 			try {
+				checkOperation();
 				await operation(values[index]!);
 			} catch (error) {
 				if (!failed) failure = error;

package/src/recovery.ts

@@ -94,9 +94,9 @@ export class JournalRecovery {
 			if (inspection.kind === "conflict") {
 				return { kind: "locked", reason: "cursor_conflict", operations: recovered };
 			}
-			const expectedLeaf = inspection.kind === "match"
-				? journal.descriptor.toLogicalLeaf
-				: journal.descriptor.fromLogicalLeaf;
+			const committedLeaf = journal.descriptor.action === "tree" && journal.state.observedLogicalLeaf !== undefined
+				? journal.state.observedLogicalLeaf : journal.descriptor.toLogicalLeaf;
+			const expectedLeaf = inspection.kind === "match" ? committedLeaf : journal.descriptor.fromLogicalLeaf;
 			if (this.dependencies.getLogicalLeafId() !== expectedLeaf) {
 				return { kind: "locked", reason: "session_leaf_mismatch", operations: recovered };
 			}