@dsh-electron/dsh-plugin-multi-root-workspace 0.1.11 → 0.1.12

package/lib/{registry-KSsmU393.js → registry-YTUOjmVu.js}

@@ -1,13 +1,53 @@
+import { a as runPrimaryOperation, n as freezeOperationScope, o as runRegistryOperation } from "./registry-operation-C2ZV3Jhw.js";
 import { i as isWindowsNetworkOrDevicePath } from "./windows-runner-contract-B5R2K3mM.js";
 import { a as classifyStoredRoots, d as reservedRootBoundary, f as resolveRootIndex, i as canonicalRoot, m as validateRootCandidate, n as additionalRootId, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-Ca_W1S9n.js";
 import { r as validateAliasId, t as migrateRootSkills } from "./metadata-DgqSdVX_.js";
+import { a as snapshotSchema, i as parseArguments, r as AuthorityServer, s as storeIdentity, t as AuthorityClient } from "./protocol-4zdwV7u4.js";
 import { createRequire } from "node:module";
 import { closeSync, fstatSync, mkdirSync, openSync, statSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { dirname, isAbsolute } from "node:path";
+import { basename, dirname, isAbsolute } from "node:path";
 import { Service } from "@deepseek-ai/cordis";
-import { defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
+import { DomainFacility, defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
 import { tryLockExclusive } from "@deepseek-ai/node-addon-system/flock";
+//#region src/compat/authority-storage.ts
+/** Open an explicitly bound medium through public storage APIs only. */
+async function openAuthorityStorage(ctx, root, spec) {
+	const { JsonStorageBackend } = await import("@deepseek-ai/dsh-storage-json");
+	const backend = new JsonStorageBackend(root);
+	const name = `multi-root-${randomUUID()}`;
+	const unmount = ctx.get("storage").backend.register(name, backend);
+	let facility;
+	const fiber = ctx.inject(["storage"], (scope) => {
+		facility = new DomainFacility(scope, {
+			backend: name,
+			routes: {}
+		});
+	});
+	try {
+		await fiber;
+		if (!facility) throw new Error("shared registry requires the storage hub");
+		const domain = await facility.open(spec);
+		return {
+			table: domain.table.bind(domain),
+			async close() {
+				try {
+					await domain.close();
+				} finally {
+					unmount();
+					await backend.close();
+					await fiber.dispose();
+				}
+			}
+		};
+	} catch (error) {
+		unmount();
+		await backend.close();
+		await fiber.dispose();
+		throw error;
+	}
+}
+//#endregion
 //#region src/compat/storage-zod.ts
 /**
 * Build the domain record schemas with the zod module the installed
@@ -209,8 +249,8 @@ var RegistryAuthorityLease = class RegistryAuthorityLease {
 *   only when the operator removes it (or when the store is repaired). Storage
 *   that cannot be parsed at all is backed up and skipped by the domain layer,
 *   with a warning.
-* - **Mutations are serialized per primary root.** Every mutation runs its
-*   whole read → validate → persist sequence inside one queue per key. The
+* - **Mutations and fs admissions are serialized store-wide.** Every mutation
+*   runs its whole read → validate → persist sequence inside the store queue. The
 *   storage domain serializes individual `put()`/`delete()` calls, which is not
 *   enough: two concurrent `add()` calls would both read the same snapshot and
 *   the later write would drop the earlier one, and a removal racing an add
@@ -296,6 +336,16 @@ var MultiRootRegistry = class extends Service {
 	];
 	/** Absolute lock path; absent means the row was composed without `leasePath`. */
 	leasePath;
+	sharedStorageRoot;
+	authorityStorageContext;
+	medium;
+	server;
+	client;
+	connectionFailure;
+	connectionGeneration = 0;
+	remoteProjectionReady = false;
+	remoteRevisions = /* @__PURE__ */ new Map();
+	operationProof = Object.freeze({});
 	/** Whether this process currently owns the store. */
 	authorityState = { kind: "contended" };
 	/** Held kernel lease; present once acquire succeeded, including after a failed open. */
@@ -308,8 +358,12 @@ var MultiRootRegistry = class extends Service {
 	cache = /* @__PURE__ */ new Map();
 	/** Signature of the last published grant per key, so a no-op refresh stays a no-op. */
 	published = /* @__PURE__ */ new Map();
-	/** One promise chain per canonical primary root: mutations never interleave. */
+	/** Pending store-ordered work, grouped by primary for teardown accounting. */
 	chains = /* @__PURE__ */ new Map();
+	/** Admissions and mutations share one order, including across primary roots. */
+	operationChain = Promise.resolve();
+	operationEpoch;
+	operationRevision = 0;
 	/** Store-wide queue for lease acquire / open / release. */
 	authorityChain = Promise.resolve();
 	/** Change listeners, keyed by their own disposer identity. */
@@ -328,7 +382,10 @@ var MultiRootRegistry = class extends Service {
 	*/
 	constructor(ctx, config = {}) {
 		super(ctx, "multiRootRegistry");
+		this.authorityStorageContext = ctx;
 		this.leasePath = config.leasePath;
+		this.sharedStorageRoot = config.sharedStorageRoot;
+		if (config.sharedStorageRoot !== void 0) this.ctx.multiRootScope.requireAdmission(this.operationProof);
 		this.ctx.multiRootScope.setRegistryAuthority(false);
 		const configured = config.maxAdditionalRoots === void 0 ? 16 : config.maxAdditionalRoots;
 		if (Number.isInteger(configured) && configured >= 1 && configured <= 64) this.maxRoots = configured;
@@ -367,8 +424,9 @@ var MultiRootRegistry = class extends Service {
 	*/
 	get unavailable() {
 		switch (this.authorityState.kind) {
-			case "active": return;
-			case "contended": return REGISTRY_CONTENDED_MESSAGE;
+			case "active":
+			case "follower": return;
+			case "contended": return this.shared && this.connectionFailure ? `shared registry is unavailable: ${this.connectionFailure}` : REGISTRY_CONTENDED_MESSAGE;
 			case "storage-failed":
 			case "config-invalid": return this.authorityState.reason;
 		}
@@ -377,6 +435,15 @@ var MultiRootRegistry = class extends Service {
 	* Whether this process is the Registry Authority for the store-wide medium.
 	* Tests and diagnostics read this; surfaces use {@link unavailable}.
 	*/
+	get epoch() {
+		return this.authorityState.kind === "active" ? this.operationEpoch : this.client?.epoch;
+	}
+	get shared() {
+		return this.sharedStorageRoot !== void 0;
+	}
+	get available() {
+		return this.authorityState.kind === "active" || this.authorityState.kind === "follower";
+	}
 	get authority() {
 		return this.authorityState;
 	}
@@ -430,11 +497,47 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async refresh(primaryRoot) {
 		await this.ensureAuthority();
+		if (this.client) try {
+			return await this.remote("snapshot", [primaryRoot]);
+		} catch (error) {
+			if (this.client) throw error;
+			await this.ensureAuthority();
+			if (this.client) return await this.remote("snapshot", [primaryRoot]);
+		}
 		if (this.authorityState.kind !== "active") return [];
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, () => this.reclassify(key));
 	}
 	/**
+	* Admit one fs invocation in the same order as mutations, then run its I/O
+	* OUTSIDE the queue. Revocation does not wait for already-admitted work.
+	* Shared followers obtain the same ordered snapshot through attested IPC.
+	*/
+	async withOperation(policy, kind, body) {
+		if (this.disposed) throw new Error("multi-root registry: cannot admit an operation after disposal");
+		const capturedPolicy = structuredClone(policy);
+		await this.ensureAuthority();
+		const key = canonicalRoot(capturedPolicy.workspaceRoot);
+		if (this.shared && this.available) {
+			const snapshot = this.client ? await this.remoteSnapshot("admit", [key]) : await this.captureSnapshot(key);
+			const scope = freezeOperationScope(this.ctx.multiRootScope.resolveSnapshot(capturedPolicy, this.projectRoots(snapshot.roots), snapshot.available));
+			return await runRegistryOperation(scope, kind, snapshot.epoch, snapshot.revision, body, this.operationProof, capturedPolicy.mode);
+		}
+		const admission = await this.serialize(key, () => {
+			if (this.disposed) throw new Error("multi-root registry: cannot admit an operation after disposal");
+			return {
+				scope: freezeOperationScope(this.shared ? this.ctx.multiRootScope.resolveSnapshot(capturedPolicy, this.projectRoots(this.cache.get(key) ?? []), false) : this.ctx.multiRootScope.resolve(capturedPolicy)),
+				epoch: this.operationEpoch,
+				revision: this.operationRevision
+			};
+		});
+		return await runRegistryOperation(admission.scope, kind, admission.epoch, admission.revision, body, this.operationProof, capturedPolicy.mode);
+	}
+	withPrimaryOperation(policy, body) {
+		const scope = this.ctx.multiRootScope.resolveSnapshot(policy, this.projectRoots(this.cache.get(canonicalRoot(policy.workspaceRoot)) ?? []), false);
+		return runPrimaryOperation(freezeOperationScope(scope), policy.mode, this.operationProof, body);
+	}
+	/**
 	* Registers one additional root.
 	* @param primaryRoot - the session workspace root the root belongs to.
 	* @param input - the directory and optional alias.
@@ -443,6 +546,7 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async add(primaryRoot, input) {
 		await this.ensureAuthority();
+		if (this.client) return await this.remote("add", [primaryRoot, input]);
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, async () => {
@@ -513,6 +617,11 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async setAccess(primaryRoot, ref, access) {
 		await this.ensureAuthority();
+		if (this.client) return await this.remote("setAccess", [
+			primaryRoot,
+			ref,
+			access
+		]);
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, async () => {
@@ -554,6 +663,7 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async removeAt(primaryRoot, ref) {
 		await this.ensureAuthority();
+		if (this.client) return await this.remote("removeAt", [primaryRoot, ref]);
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, async () => await this.persist(key, removeStatusAt(this.reclassify(key), ref)));
@@ -568,6 +678,11 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async setAlias(primaryRoot, ref, alias) {
 		await this.ensureAuthority();
+		if (this.client) return await this.remote("setAlias", [
+			primaryRoot,
+			ref,
+			alias ?? null
+		]);
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, async () => {
@@ -587,10 +702,22 @@ var MultiRootRegistry = class extends Service {
 	}
 	/** Change a Skill switch without changing any grant field. */
 	async setSkillsEnabled(primaryRoot, ref, skillsEnabled) {
+		await this.ensureAuthority();
+		if (this.client) return await this.remote("setSkillsEnabled", [
+			primaryRoot,
+			ref,
+			skillsEnabled
+		]);
 		if (typeof skillsEnabled !== "boolean") throw new RootValidationError("invalid-ref", "skillsEnabled must be a boolean");
 		return await this.setSkillsMetadata(primaryRoot, ref, { skillsEnabled });
 	}
 	async setAliasId(primaryRoot, ref, aliasId) {
+		await this.ensureAuthority();
+		if (this.client) return await this.remote("setAliasId", [
+			primaryRoot,
+			ref,
+			aliasId
+		]);
 		return await this.setSkillsMetadata(primaryRoot, ref, { aliasId });
 	}
 	async setSkillsMetadata(primaryRoot, ref, patch) {
@@ -617,6 +744,11 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async move(primaryRoot, ref, beforeRef) {
 		await this.ensureAuthority();
+		if (this.client) return await this.remote("move", [
+			primaryRoot,
+			ref,
+			beforeRef ?? null
+		]);
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, async () => {
@@ -645,6 +777,7 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async recheck(primaryRoot) {
 		await this.ensureAuthority();
+		if (this.client) return await this.remote("recheck", [primaryRoot]);
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, async () => await this.persist(key, this.reclassify(key)));
@@ -666,7 +799,10 @@ var MultiRootRegistry = class extends Service {
 	* @returns the canonical paths of every `available` root.
 	*/
 	granted(primaryRoot) {
-		return availableRoots(this.statusesOf(canonicalRoot(primaryRoot)));
+		return this.shared ? this.ctx.multiRootScope.snapshot({
+			workspaceRoot: primaryRoot,
+			mode: "workspace-write"
+		}).additionalRoots : availableRoots(this.statusesOf(canonicalRoot(primaryRoot)));
 	}
 	/**
 	* The scope the registry publishes: only usable roots, in registry order.
@@ -709,7 +845,12 @@ var MultiRootRegistry = class extends Service {
 	*/
 	lookupRecords(key) {
 		if (this.authorityState.kind !== "active") return void 0;
-		return this.table?.get(key);
+		try {
+			return this.table?.get(key);
+		} catch (error) {
+			if (unknownStorageState(error)) this.enterStorageFailed("registry storage state cannot be confirmed; restart and reconcile");
+			throw error;
+		}
 	}
 	/**
 	* Re-classify one key from its stored records: every directory is `stat`ed
@@ -734,22 +875,28 @@ var MultiRootRegistry = class extends Service {
 	async persist(key, statuses) {
 		const table = this.requireTable();
 		const durable = persistedPrimaryRoot.parse({ roots: migrateRootSkills(statuses.map(toPersistedRoot)) });
-		if (statuses.length === 0) await table.delete(key);
-		else await table.put(key, durable);
+		try {
+			if (statuses.length === 0) await table.delete(key);
+			else await table.put(key, durable);
+		} catch (error) {
+			if (unknownStorageState(error)) this.enterStorageFailed("registry write result is unknown; restart and reconcile durable state");
+			throw error;
+		}
 		const classified = statuses.length === 0 ? [] : classifyStoredRoots(key, durable.roots.map(toRegisteredRoot));
 		this.cache.set(key, classified);
 		this.publish(key, classified);
 		return classified;
 	}
 	/**
-	* Run one job for one primary root after every job already queued for that
-	* root. The whole read → validate → write sequence belongs inside the job:
+	* Run one job after every store job already queued. The whole
+	* read → validate → write sequence belongs inside the job:
 	* the storage domain serializes individual writes, so without this the loser
 	* of a race reads a snapshot that is already stale and writes it back.
 	*/
 	async serialize(key, job) {
-		const run = (this.chains.get(key) ?? Promise.resolve()).then(job);
+		const run = this.operationChain.then(job);
 		const tail = run.then(() => void 0, () => void 0);
+		this.operationChain = tail;
 		this.chains.set(key, tail);
 		try {
 			return await run;
@@ -781,7 +928,7 @@ var MultiRootRegistry = class extends Service {
 		const withheld = statuses.filter((status) => status.state !== "available");
 		const signature = [...statuses.filter((status) => status.state === "available").map((status) => `available:${status.access}:${recordedGrantOf(status)}`), ...withheld.map((status) => `${status.state}:${status.invalidReason ?? ""}:${status.access}:${status.path}:${recordedGrantOf(status) ?? ""}`)].join("\n");
 		const previousMetadata = this.metadataPublished.get(key);
-		const metadata = JSON.stringify(statuses.map((row) => [
+		const metadata = JSON.stringify(this.shared ? statuses : statuses.map((row) => [
 			row.id,
 			row.aliasId,
 			row.skillsEnabled,
@@ -789,11 +936,23 @@ var MultiRootRegistry = class extends Service {
 		]));
 		this.metadataPublished.set(key, metadata);
 		if ((this.published.get(key) ?? "") === signature) {
-			if (previousMetadata !== metadata && (previousMetadata !== void 0 || statuses.length > 0)) for (const listener of this.listeners) listener(key);
+			if (previousMetadata !== metadata && (previousMetadata !== void 0 || statuses.length > 0)) {
+				this.operationRevision++;
+				this.notifyShared(key);
+				for (const listener of this.listeners) listener(key);
+			}
 			return;
 		}
 		this.published.set(key, signature);
-		const effective = statuses.flatMap((status) => {
+		this.operationRevision++;
+		const effective = this.projectRoots(statuses);
+		this.ctx.multiRootScope.setAdditionalRoots(key, effective);
+		if (withheld.length > 0) this.ctx.logger.warn(`multi-root-workspace: ${withheld.length} registered root(s) of ${key} are not writable right now (${withheld.map((status) => `${status.path}: ${status.state}`).join(", ")}); they stay registered and are reported by /workspace-folders`);
+		this.notifyShared(key);
+		for (const listener of this.listeners) listener(key);
+	}
+	projectRoots(statuses) {
+		return statuses.flatMap((status) => {
 			const recorded = recordedGrantOf(status);
 			if (status.state === "invalid" && status.invalidReason !== "membership-conflict" || recorded === void 0) return [];
 			return [{
@@ -805,9 +964,113 @@ var MultiRootRegistry = class extends Service {
 				...status.alias === void 0 ? {} : { alias: status.alias }
 			}];
 		});
-		this.ctx.multiRootScope.setAdditionalRoots(key, effective);
-		if (withheld.length > 0) this.ctx.logger.warn(`multi-root-workspace: ${withheld.length} registered root(s) of ${key} are not writable right now (${withheld.map((status) => `${status.path}: ${status.state}`).join(", ")}); they stay registered and are reported by /workspace-folders`);
-		for (const listener of this.listeners) listener(key);
+	}
+	snapshotOf(primary) {
+		return snapshotSchema.parse({
+			protocol: 1,
+			store: this.medium.id,
+			epoch: this.operationEpoch,
+			revision: this.operationRevision,
+			primary,
+			roots: this.cache.get(primary) ?? [],
+			available: this.authorityState.kind === "active"
+		});
+	}
+	async captureSnapshot(primary) {
+		const key = canonicalRoot(primary);
+		return await this.serialize(key, () => {
+			this.requireActive();
+			this.reclassify(key);
+			return this.snapshotOf(key);
+		});
+	}
+	notifyShared(key) {
+		if (this.server && this.authorityState.kind === "active") this.server.changed(this.snapshotOf(key));
+	}
+	applySnapshot(snapshot) {
+		if (!this.client || snapshot.store !== this.medium?.id || snapshot.epoch !== this.client.epoch) return;
+		const previous = this.remoteRevisions.get(snapshot.primary) ?? -1;
+		if (snapshot.revision < previous) return;
+		this.remoteRevisions.set(snapshot.primary, snapshot.revision);
+		const rows = snapshot.roots.map((row) => Object.fromEntries(Object.entries({
+			...row,
+			id: additionalRootId(row.id)
+		}).filter(([, value]) => value !== void 0)));
+		this.cache.set(snapshot.primary, rows);
+		this.publish(snapshot.primary, rows);
+		this.ctx.multiRootScope.setRegistryAuthority(snapshot.available);
+		this.remoteProjectionReady = snapshot.available;
+	}
+	remoteUnavailable() {
+		this.connectionGeneration++;
+		this.client = void 0;
+		this.remoteRevisions.clear();
+		this.authorityState = { kind: "contended" };
+		this.ctx.multiRootScope.setRegistryAuthority(false);
+		if (!this.remoteProjectionReady) return;
+		this.remoteProjectionReady = false;
+		for (const [primary, rows] of this.cache) this.ctx.multiRootScope.setAdditionalRoots(primary, this.projectRoots(rows).map((root) => ({
+			...root,
+			withheld: true
+		})));
+		this.published.clear();
+	}
+	async remoteSnapshot(method, args) {
+		const client = this.client, generation = this.connectionGeneration;
+		if (!client) throw new Error("registry authority is unavailable");
+		const value = await client.request(method, args);
+		let snapshot;
+		try {
+			snapshot = snapshotSchema.parse(value);
+		} catch (error) {
+			client.close();
+			throw error;
+		}
+		if (generation !== this.connectionGeneration || client !== this.client || snapshot.store !== this.medium?.id || snapshot.epoch !== client.epoch || snapshot.primary !== canonicalRoot(String(args[0]))) {
+			client.close();
+			throw new Error("stale registry connection or authority epoch");
+		}
+		this.applySnapshot(snapshot);
+		return snapshot;
+	}
+	async remote(method, args) {
+		await this.remoteSnapshot(method, args);
+		return this.list(String(args[0]));
+	}
+	async dispatchShared(method, values) {
+		const args = parseArguments(method, values);
+		const primary = String(args[0]);
+		if (!isAbsolute(primary)) throw new Error("registry primary must be absolute");
+		if (method === "snapshot" || method === "admit") return this.captureSnapshot(primary);
+		const ref = args[1];
+		switch (method) {
+			case "add":
+				await this.add(primary, args[1]);
+				break;
+			case "removeAt":
+				await this.removeAt(primary, ref);
+				break;
+			case "setAccess":
+				await this.setAccess(primary, ref, args[2]);
+				break;
+			case "setAlias":
+				await this.setAlias(primary, ref, args[2] === null ? void 0 : args[2]);
+				break;
+			case "setSkillsEnabled":
+				await this.setSkillsEnabled(primary, ref, args[2]);
+				break;
+			case "setAliasId":
+				await this.setAliasId(primary, ref, args[2]);
+				break;
+			case "move":
+				await this.move(primary, ref, args[2] === null ? void 0 : args[2]);
+				break;
+			case "recheck":
+				await this.recheck(primary);
+				break;
+			default: throw new Error("unsupported registry method");
+		}
+		return this.captureSnapshot(primary);
 	}
 	/**
 	* The open table.
@@ -817,6 +1080,7 @@ var MultiRootRegistry = class extends Service {
 	*   or an error when the service has not started.
 	*/
 	requireTable() {
+		if (this.authorityState.kind === "follower") throw new Error("a follower never opens registry storage");
 		if (this.authorityState.kind === "contended") throw new RootValidationError("registry-contended", REGISTRY_CONTENDED_MESSAGE);
 		if (this.authorityState.kind === "config-invalid") throw new RootValidationError("config-invalid", `the root registry configuration is invalid (${this.authorityState.reason}); no additional root is granted`);
 		if (this.authorityState.kind === "storage-failed") throw new RootValidationError("storage-unavailable", `the root registry store is unavailable (${this.authorityState.reason}); remove or repair \$DSH_HOME/storages/multi_root_workspace.json and restart dsh`);
@@ -840,9 +1104,10 @@ var MultiRootRegistry = class extends Service {
 	async ensureAuthority() {
 		await this.serializeAuthority(async () => {
 			if (this.disposed) return;
-			if (this.authorityState.kind === "active") return;
+			if (this.authorityState.kind === "active" || this.client !== void 0) return;
 			if (this.authorityState.kind === "config-invalid") return;
 			if (this.lease !== void 0) {
+				if (this.domain !== void 0) return;
 				await this.openDomain();
 				return;
 			}
@@ -855,11 +1120,50 @@ var MultiRootRegistry = class extends Service {
 				this.enterStorageFailed(`${DOMAIN_NAME}: leasePath must be an absolute path`);
 				return;
 			}
+			if (this.sharedStorageRoot !== void 0 && this.medium === void 0) try {
+				if (!isAbsolute(this.sharedStorageRoot)) throw new Error("sharedStorageRoot must be absolute");
+				this.medium = storeIdentity(this.sharedStorageRoot);
+				if (storeIdentity(dirname(leasePath)).id !== this.medium.id || basename(leasePath) !== `multi_root_workspace.lock`) throw new Error("shared registry requires its canonical medium lock, without alternate lock names");
+			} catch (error) {
+				this.enterStorageFailed(String(error));
+				return;
+			}
 			try {
 				this.lease = await RegistryAuthorityLease.acquire(leasePath);
 			} catch (error) {
 				if (error instanceof RegistryLeaseContendedError) {
 					this.enterContended();
+					if (this.medium !== void 0) for (const delay of [
+						0,
+						50,
+						150
+					]) {
+						if (delay) await new Promise((resolve) => setTimeout(resolve, delay));
+						if (this.disposed) return;
+						const generation = ++this.connectionGeneration;
+						let adopted = false;
+						try {
+							const client = await AuthorityClient.connect(this.medium.endpoint, this.medium.id, this.maxRoots, (snapshot) => {
+								if (adopted && generation === this.connectionGeneration) this.applySnapshot(snapshot);
+							}, () => {
+								if (adopted && generation === this.connectionGeneration) this.remoteUnavailable();
+							});
+							if (this.disposed || generation !== this.connectionGeneration) {
+								client.close();
+								return;
+							}
+							this.client = client;
+							adopted = true;
+							this.connectionFailure = void 0;
+							this.authorityState = {
+								kind: "follower",
+								epoch: client.epoch
+							};
+							break;
+						} catch (error) {
+							this.connectionFailure = String(error);
+						}
+					}
 					return;
 				}
 				this.enterStorageFailed(`${DOMAIN_NAME}: cannot acquire the registry lease: ${error instanceof Error ? error.message : String(error)}`);
@@ -876,7 +1180,7 @@ var MultiRootRegistry = class extends Service {
 	async openDomain() {
 		let domain;
 		try {
-			domain = await this.ctx.storageDomain.open(multiRootDomainSpec);
+			domain = this.medium === void 0 ? await this.ctx.storageDomain.open(multiRootDomainSpec) : await openAuthorityStorage(this.authorityStorageContext, this.medium.root, multiRootDomainSpec);
 		} catch (error) {
 			const reason = `${DOMAIN_NAME}: ${error instanceof Error ? error.message : String(error)}`;
 			this.ctx.logger.error(`multi-root-workspace: cannot open the root registry store (${DOMAIN_NAME}); no additional root is granted until it is repaired or removed: ${reason}`);
@@ -885,6 +1189,8 @@ var MultiRootRegistry = class extends Service {
 		}
 		this.domain = domain;
 		this.table = domain.table(TABLE_NAME);
+		this.operationEpoch = randomUUID();
+		this.operationRevision = 0;
 		this.authorityState = { kind: "active" };
 		this.loggedContended = false;
 		this.cache.clear();
@@ -896,15 +1202,30 @@ var MultiRootRegistry = class extends Service {
 				await this.table.put(primaryRoot, migrated);
 				accepted = migrated;
 			} catch (error) {
+				if (unknownStorageState(error)) {
+					this.enterStorageFailed("Skills migration result is unknown; restart and reconcile");
+					return;
+				}
 				this.ctx.logger.warn(`multi-root skills: metadata migration failed; Skills remain withheld: ${String(error)}`);
 			}
 			this.accept(primaryRoot, accepted);
 		});
+		if (this.authorityState.kind !== "active") return;
+		if (this.medium !== void 0) try {
+			this.server = await AuthorityServer.listen(this.medium.endpoint, this.medium.id, this.operationEpoch, this.maxRoots, (method, args) => this.dispatchShared(method, args));
+		} catch (error) {
+			await domain.close();
+			this.domain = void 0;
+			this.enterStorageFailed(`cannot start shared registry: ${String(error)}`);
+			return;
+		}
 		this.ctx.multiRootScope.setRegistryAuthority(true);
 	}
 	/** Fail closed: empty scope, no table, contended state. */
 	enterContended() {
-		this.withdrawPublished();
+		this.operationEpoch = void 0;
+		if (this.shared) this.remoteUnavailable();
+		else this.withdrawPublished();
 		this.ctx.multiRootScope.setRegistryAuthority(false);
 		this.table = void 0;
 		this.authorityState = { kind: "contended" };
@@ -915,8 +1236,17 @@ var MultiRootRegistry = class extends Service {
 	}
 	/** Fail closed: empty scope, no table, storage-failed state. The lease, if held, stays. */
 	enterStorageFailed(reason) {
-		this.withdrawPublished();
+		this.operationEpoch = void 0;
 		this.ctx.multiRootScope.setRegistryAuthority(false);
+		if (this.shared) {
+			for (const [key, rows] of this.cache) this.ctx.multiRootScope.setAdditionalRoots(key, this.projectRoots(rows).map((root) => ({
+				...root,
+				withheld: true
+			})));
+			this.published.clear();
+			this.server?.close();
+			this.server = void 0;
+		} else this.withdrawPublished();
 		this.table = void 0;
 		this.authorityState = {
 			kind: "storage-failed",
@@ -945,8 +1275,14 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async releaseAuthority() {
 		this.disposed = true;
+		this.connectionGeneration++;
+		this.client?.close();
+		this.client = void 0;
 		await this.serializeAuthority(async () => {
+			this.server?.close();
+			this.server = void 0;
 			this.table = void 0;
+			this.operationEpoch = void 0;
 			this.authorityState = { kind: "contended" };
 			this.ctx.multiRootScope.setRegistryAuthority(false);
 			await this.drainMutations();
@@ -964,7 +1300,7 @@ var MultiRootRegistry = class extends Service {
 		});
 	}
 	/**
-	* Wait until no per-primary-root mutation is queued or running.
+	* Wait until no store work is queued or running (operation I/O is outside).
 	*
 	* One pass is enough, and only because the authority state has already been
 	* flipped: no further mutation can be admitted (it would fail in
@@ -1063,5 +1399,12 @@ function normalizeAlias(alias) {
 	if (trimmed.length > 120) throw new RootValidationError("invalid-alias", `an alias must be at most 120 characters`);
 	return trimmed;
 }
+/** Structural across storage releases; older versions do not expose this code. */
+function unknownStorageState(error, seen = /* @__PURE__ */ new Set()) {
+	if (error === null || typeof error !== "object" || seen.has(error)) return false;
+	seen.add(error);
+	const value = error;
+	return value.code === "unknown-state" || unknownStorageState(value.cause, seen) || Array.isArray(value.errors) && value.errors.some((item) => unknownStorageState(item, seen));
+}
 //#endregion
 export { MultiRootRegistry as a, multiRootDomainSpec as c, MAX_ALIAS_LENGTH as i, RegistryAuthorityLease as l, DOMAIN_NAME as n, REGISTRY_CONTENDED_MESSAGE as o, MAX_ADDITIONAL_ROOTS_CEILING as r, TABLE_NAME as s, DEFAULT_MAX_ADDITIONAL_ROOTS as t, RegistryLeaseContendedError as u };