@dsh-electron/dsh-plugin-multi-root-workspace 0.1.13 → 0.1.15

package/lib/{registry-Bv431TfO.js → registry-DyDNDSJZ.js}

@@ -1,8 +1,8 @@
 import { a as runPrimaryOperation, n as freezeOperationScope, o as runRegistryOperation } from "./registry-operation-C2ZV3Jhw.js";
 import { i as isWindowsNetworkOrDevicePath } from "./windows-runner-contract-B5R2K3mM.js";
-import { a as classifyStoredRoots, d as reservedRootBoundary, f as resolveRootIndex, i as canonicalRoot, m as validateRootCandidate, n as additionalRootId, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-Ca_W1S9n.js";
-import { r as validateAliasId, t as migrateRootSkills } from "./metadata-DgqSdVX_.js";
-import { a as snapshotSchema, i as parseArguments, r as AuthorityServer, s as storeIdentity, t as AuthorityClient } from "./protocol-CJOvAvOS.js";
+import { _ as samePath, a as classifyStoredRoots, d as primaryKey, f as protectedOverlap, h as resolveRootIndex, i as canonicalRoot, m as reservedRootBoundary, n as additionalRootId, p as removeStatusAt, s as expandRootInput, t as RootValidationError, u as markProtectedPaths, v as singleGrantOf, y as validateRootCandidate } from "./roots-CmaWxRVy.js";
+import { r as validateAliasId, t as migrateRootSkills } from "./metadata-99jgViHQ.js";
+import { a as snapshotSchema, i as parseArguments, r as AuthorityServer, s as storeIdentity, t as AuthorityClient } from "./protocol-CwDnFEyK.js";
 import { createRequire } from "node:module";
 import { closeSync, fstatSync, mkdirSync, openSync, statSync } from "node:fs";
 import { randomUUID } from "node:crypto";
@@ -265,7 +265,7 @@ var RegistryAuthorityLease = class RegistryAuthorityLease {
 			mode: 448
 		});
 		if (process.platform === "win32") {
-			const { acquireLockHandleWin32 } = await import("./registry-lease-win32-DVTq9d4D.js");
+			const { acquireLockHandleWin32 } = await import("./registry-lease-win32-r4puac9m.js");
 			let handle;
 			try {
 				handle = await acquireLockHandleWin32(leasePath);
@@ -317,7 +317,7 @@ var RegistryAuthorityLease = class RegistryAuthorityLease {
 		if (this.released) return;
 		this.released = true;
 		if (this.held.kind === "win32") {
-			const { releaseLockHandleWin32 } = await import("./registry-lease-win32-DVTq9d4D.js");
+			const { releaseLockHandleWin32 } = await import("./registry-lease-win32-r4puac9m.js");
 			await releaseLockHandleWin32(this.held.handle);
 			return;
 		}
@@ -430,11 +430,11 @@ const multiRootDomainSpec = defineDomain({
 	tables: { roots: domainTable(persistedPrimaryRoot) }
 });
 /** The registry service: `ctx.multiRootRegistry`. */
-var MultiRootRegistry = class extends Service {
+var MultiRootRegistry = class MultiRootRegistry extends Service {
 	static inject = [
 		"multiRootCompat",
 		"multiRootProviders",
-		"storageDomain",
+		"storage",
 		"multiRootScope"
 	];
 	/** Absolute lock path; absent means the row was composed without `leasePath`. */
@@ -492,8 +492,15 @@ var MultiRootRegistry = class extends Service {
 	/** Keys already warned about a historical over-limit store (one warning each). */
 	warnedOverLimit = /* @__PURE__ */ new Set();
 	/**
-	* @param ctx - the host context; `storageDomain` and `multiRootScope` are injected.
-	* @param config - the patch row's `leasePath` and `maxAdditionalRoots`.
+	* The canonical value each protected boundary resolved to the FIRST time it
+	* could be computed, keyed by boundary kind. Never re-pinned: a later
+	* rename or symlink swap of the DSH home (or of the lease directory) must
+	* not drop the boundary the registration rules were enforced under.
+	*/
+	pinnedProtectedPaths = /* @__PURE__ */ new Map();
+	/**
+	* @param ctx - the host context; `storage` and `multiRootScope` are injected.
+	* @param config - the patch row's `sharedStorageRoot`, `leasePath`, and `maxAdditionalRoots`.
 	*/
 	constructor(ctx, config = {}) {
 		super(ctx, "multiRootRegistry");
@@ -515,6 +522,10 @@ var MultiRootRegistry = class extends Service {
 		});
 		if (config.sharedStorageRoot !== void 0) this.ctx.multiRootScope.requireAdmission(this.operationProof);
 		this.ctx.multiRootScope.setRegistryAuthority(false);
+		if (this.sharedStorageRoot === void 0 || this.sharedStorageRoot.trim() === "") this.authorityState = {
+			kind: "config-invalid",
+			reason: `${DOMAIN_NAME}: sharedStorageRoot is required; the single-process registry mode was removed (ADR-0028)`
+		};
 		const configured = config.maxAdditionalRoots === void 0 ? 16 : config.maxAdditionalRoots;
 		if (Number.isInteger(configured) && configured >= 1 && configured <= 64) this.maxRoots = configured;
 		else {
@@ -555,7 +566,7 @@ var MultiRootRegistry = class extends Service {
 		switch (this.authorityState.kind) {
 			case "active":
 			case "follower": return;
-			case "contended": return this.shared && this.connectionFailure ? `shared registry is unavailable: ${this.connectionFailure}` : REGISTRY_CONTENDED_MESSAGE;
+			case "contended": return this.connectionFailure !== void 0 ? `shared registry is unavailable: ${this.connectionFailure}` : REGISTRY_CONTENDED_MESSAGE;
 			case "storage-failed":
 			case "config-invalid": return this.authorityState.reason;
 		}
@@ -635,7 +646,7 @@ var MultiRootRegistry = class extends Service {
 	* @param primaryRoot - the session workspace root (any spelling).
 	*/
 	overLimit(primaryRoot) {
-		return this.statusesOf(canonicalRoot(primaryRoot)).length > this.maxRoots;
+		return this.statusesOf(primaryKey(primaryRoot)).length > this.maxRoots;
 	}
 	/**
 	* Every registration of one primary root, in registry order, as last
@@ -646,7 +657,7 @@ var MultiRootRegistry = class extends Service {
 	* @returns the statuses; empty when nothing is registered.
 	*/
 	list(primaryRoot) {
-		return this.statusesOf(canonicalRoot(primaryRoot));
+		return this.statusesOf(primaryKey(primaryRoot));
 	}
 	/**
 	* Re-examine every registration of one primary root WITHOUT writing storage:
@@ -680,7 +691,7 @@ var MultiRootRegistry = class extends Service {
 			if (this.client) return await this.remote("snapshot", [primaryRoot]);
 		}
 		if (this.authorityState.kind !== "active") return [];
-		const key = canonicalRoot(primaryRoot);
+		const key = primaryKey(primaryRoot);
 		return await this.serialize(key, () => this.reclassify(key));
 	}
 	/**
@@ -692,16 +703,16 @@ var MultiRootRegistry = class extends Service {
 		if (this.disposed) throw new Error("multi-root registry: cannot admit an operation after disposal");
 		const capturedPolicy = structuredClone(policy);
 		await this.ensureAuthority();
-		const key = canonicalRoot(capturedPolicy.workspaceRoot);
-		if (this.shared && this.available) {
+		const key = primaryKey(capturedPolicy.workspaceRoot);
+		if (this.available) {
 			const snapshot = this.client ? await this.remoteSnapshot("admit", [key]) : await this.captureSnapshot(key);
-			const scope = freezeOperationScope(this.ctx.multiRootScope.resolveSnapshot(capturedPolicy, this.projectRoots(snapshot.roots), snapshot.available));
+			const scope = freezeOperationScope(this.ctx.multiRootScope.resolveSnapshot(capturedPolicy, this.projectRoots(this.localSnapshotRoots(snapshot)), snapshot.available));
 			return await runRegistryOperation(scope, kind, snapshot.epoch, snapshot.revision, body, this.operationProof, capturedPolicy.mode);
 		}
 		const admission = await this.serialize(key, () => {
 			if (this.disposed) throw new Error("multi-root registry: cannot admit an operation after disposal");
 			return {
-				scope: freezeOperationScope(this.shared ? this.ctx.multiRootScope.resolveSnapshot(capturedPolicy, this.projectRoots(this.cache.get(key) ?? []), false) : this.ctx.multiRootScope.resolve(capturedPolicy)),
+				scope: freezeOperationScope(this.ctx.multiRootScope.resolveSnapshot(capturedPolicy, this.projectRoots(this.cache.get(key) ?? []), false)),
 				epoch: this.operationEpoch,
 				revision: this.operationRevision
 			};
@@ -709,10 +720,113 @@ var MultiRootRegistry = class extends Service {
 		return await runRegistryOperation(admission.scope, kind, admission.epoch, admission.revision, body, this.operationProof, capturedPolicy.mode);
 	}
 	withPrimaryOperation(policy, body) {
-		const scope = this.ctx.multiRootScope.resolveSnapshot(policy, this.projectRoots(this.cache.get(canonicalRoot(policy.workspaceRoot)) ?? []), false);
+		const scope = this.ctx.multiRootScope.resolveSnapshot(policy, this.projectRoots(this.cache.get(primaryKey(policy.workspaceRoot)) ?? []), false);
 		return runPrimaryOperation(freezeOperationScope(scope), policy.mode, this.operationProof, body);
 	}
 	/**
+	* The spellings one protected boundary contributes: the configured path,
+	* its current canonical resolution, and the canonical value pinned the
+	* first time it resolved — never re-pinned, so a later rename or symlink
+	* swap of the protected directory cannot drop the boundary the
+	* registration rules were enforced under. The list is deduplicated by
+	* {@link samePath}.
+	*/
+	boundarySpellings(kind, configured) {
+		const canonical = canonicalRoot(configured);
+		if (!this.pinnedProtectedPaths.has(kind)) this.pinnedProtectedPaths.set(kind, canonical);
+		const spellings = [];
+		for (const spelling of [
+			configured,
+			canonical,
+			this.pinnedProtectedPaths.get(kind)
+		]) if (!spellings.some((existing) => samePath(existing, spelling))) spellings.push(spelling);
+		return spellings;
+	}
+	/**
+	* The best-known protected-boundary set, plus whether it is COMPLETE.
+	*
+	* The set comes from trusted host configuration, never from a panel or
+	* shell claim: the scope row's `dshHome`, the physical medium
+	* `storeIdentity` bound, and the lease directory beside it.
+	* `complete` is false — and only NEW grants may then be refused — when a
+	* boundary cannot be proven: an invalid `dshHome` config, a configured
+	* home that is not a directory right now, or a medium that was never bound. Stored classification always consumes whatever IS known
+	* (pinned values included), so an unknown boundary never weakens the
+	* revalidation of existing records.
+	*/
+	protectedBoundarySet() {
+		const paths = [];
+		let complete = true;
+		const home = this.ctx.multiRootScope.dshHomeConfig;
+		switch (home.kind) {
+			case "absent": break;
+			case "invalid":
+				complete = false;
+				break;
+			case "configured": {
+				let isDirectory = false;
+				try {
+					isDirectory = statSync(home.path).isDirectory();
+				} catch {
+					isDirectory = false;
+				}
+				if (isDirectory) for (const spelling of this.boundarySpellings("dsh-home", home.path)) paths.push({
+					kind: "dsh-home",
+					path: spelling
+				});
+				else {
+					complete = false;
+					paths.push({
+						kind: "dsh-home",
+						path: home.path
+					});
+					const pinned = this.pinnedProtectedPaths.get("dsh-home");
+					if (pinned !== void 0 && !samePath(pinned, home.path)) paths.push({
+						kind: "dsh-home",
+						path: pinned
+					});
+				}
+				break;
+			}
+		}
+		if (this.medium === void 0) complete = false;
+		else paths.push({
+			kind: "registry-medium",
+			path: this.medium.root
+		});
+		if (this.leasePath !== void 0) for (const spelling of this.boundarySpellings("registry-lease", dirname(this.leasePath))) paths.push({
+			kind: "registry-lease",
+			path: spelling
+		});
+		return {
+			paths,
+			complete
+		};
+	}
+	/**
+	* The protected DSH directories this Host can prove right now, or
+	* `undefined` when the set cannot be proven. `undefined` blocks every NEW
+	* grant; it never weakens the classification of stored records.
+	*/
+	protectedPaths() {
+		const { paths, complete } = this.protectedBoundarySet();
+		return complete ? paths : void 0;
+	}
+	/**
+	* Every protected entry this Host can prove — used wherever a partial set
+	* must still protect stored records and received snapshots.
+	*/
+	knownProtectedPaths() {
+		return this.protectedBoundarySet().paths;
+	}
+	/**
+	* The one refusal shared by the owner mutation path and the follower
+	* pre-check: the protected set cannot be proven, so no new grant is safe.
+	*/
+	static protectedBoundaryUnknown() {
+		return new RootValidationError("protected-boundary-unknown", "the protected DSH directories cannot be resolved right now; no root can be registered until they can");
+	}
+	/**
 	* Registers one additional root.
 	* @param primaryRoot - the session workspace root the root belongs to.
 	* @param input - the directory and optional alias.
@@ -721,12 +835,28 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async add(primaryRoot, input) {
 		await this.ensureAuthority();
-		if (this.client) return await this.remote("add", [primaryRoot, input]);
+		if (this.client) {
+			const protectedPaths = this.protectedPaths();
+			if (protectedPaths === void 0) throw MultiRootRegistry.protectedBoundaryUnknown();
+			const expanded = expandRootInput(input.path);
+			if (process.platform === "win32" && isWindowsNetworkOrDevicePath(expanded)) throw new RootValidationError("unsupported-path", `Windows ACL confinement cannot cover network or device paths: ${expanded}`);
+			if (isAbsolute(expanded)) {
+				const candidate = canonicalRoot(expanded);
+				const conflict = protectedOverlap(candidate, protectedPaths);
+				if (conflict !== void 0) throw new RootValidationError("protected-path", `"${candidate}" overlaps the protected DSH directory "${conflict.path}" (${conflict.kind}) and cannot be registered`, {
+					conflict: conflict.path,
+					reference: candidate
+				});
+			}
+			return await this.remote("add", [primaryRoot, input]);
+		}
 		this.requireActive();
-		const key = canonicalRoot(primaryRoot);
+		const key = primaryKey(primaryRoot);
 		return await this.serialize(key, async () => {
+			const protectedPaths = this.protectedPaths();
+			if (protectedPaths === void 0) throw MultiRootRegistry.protectedBoundaryUnknown();
 			const earlier = this.cache.get(key);
-			const statuses = this.reclassify(key);
+			const statuses = await this.reclassify(key);
 			const alias = normalizeAlias(input.alias);
 			const expanded = expandRootInput(input.path);
 			if (process.platform === "win32" && isWindowsNetworkOrDevicePath(expanded)) throw new RootValidationError("unsupported-path", `Windows ACL confinement cannot cover network or device paths: ${expanded}`);
@@ -737,9 +867,17 @@ var MultiRootRegistry = class extends Service {
 				const before = earlier?.find((candidate) => candidate.id === status.id);
 				return status.state !== "available" || before !== void 0 && before.state !== "available";
 			});
+			if (revived !== -1) {
+				const grant = singleGrantOf(statuses[revived]);
+				if (grant === void 0 || !samePath(preliminary, grant)) throw new RootValidationError("revive-target-changed", `the registration "${statuses[revived].path}" was granted for "${grant ?? "(unknown)"}" but now resolves to "${preliminary}"; remove it and add the new directory explicitly`, {
+					...grant === void 0 ? {} : { conflict: grant },
+					reference: preliminary
+				});
+			}
 			if (revived === -1 && statuses.length >= this.maxRoots) throw new RootValidationError("root-limit-reached", `this workspace already has ${statuses.length} additional roots; the configured limit is ${this.maxRoots}. Remove one first, or raise maxAdditionalRoots.`, { reference: String(this.maxRoots) });
 			const canonical = validateRootCandidate(input.path, {
 				primaryRoot: key,
+				protectedPaths,
 				existing: statuses.flatMap((status, index) => {
 					if (index === revived) return [];
 					const boundary = reservedRootBoundary(status);
@@ -798,9 +936,9 @@ var MultiRootRegistry = class extends Service {
 			access
 		]);
 		this.requireActive();
-		const key = canonicalRoot(primaryRoot);
+		const key = primaryKey(primaryRoot);
 		return await this.serialize(key, async () => {
-			const statuses = this.reclassify(key);
+			const statuses = await this.reclassify(key);
 			const targetIndex = resolveRootIndex(statuses, ref);
 			const target = statuses[targetIndex];
 			if (target.access === access) return statuses;
@@ -840,8 +978,8 @@ var MultiRootRegistry = class extends Service {
 		await this.ensureAuthority();
 		if (this.client) return await this.remote("removeAt", [primaryRoot, ref]);
 		this.requireActive();
-		const key = canonicalRoot(primaryRoot);
-		return await this.serialize(key, async () => await this.persist(key, removeStatusAt(this.reclassify(key), ref)));
+		const key = primaryKey(primaryRoot);
+		return await this.serialize(key, async () => await this.persist(key, removeStatusAt(await this.reclassify(key), ref)));
 	}
 	/**
 	* Set or clear one registration's display alias.
@@ -859,9 +997,9 @@ var MultiRootRegistry = class extends Service {
 			alias ?? null
 		]);
 		this.requireActive();
-		const key = canonicalRoot(primaryRoot);
+		const key = primaryKey(primaryRoot);
 		return await this.serialize(key, async () => {
-			const statuses = this.reclassify(key);
+			const statuses = await this.reclassify(key);
 			const targetIndex = resolveRootIndex(statuses, ref);
 			const normalized = normalizeAlias(alias);
 			const next = statuses.map((status, index) => {
@@ -898,9 +1036,9 @@ var MultiRootRegistry = class extends Service {
 	async setSkillsMetadata(primaryRoot, ref, patch) {
 		await this.ensureAuthority();
 		this.requireActive();
-		const key = canonicalRoot(primaryRoot);
+		const key = primaryKey(primaryRoot);
 		return await this.serialize(key, async () => {
-			const statuses = this.reclassify(key);
+			const statuses = await this.reclassify(key);
 			const target = resolveRootIndex(statuses, ref);
 			if (patch.aliasId !== void 0) validateAliasId(patch.aliasId, statuses.filter((_row, index) => index !== target));
 			return await this.persist(key, statuses.map((row, index) => index === target ? {
@@ -925,9 +1063,9 @@ var MultiRootRegistry = class extends Service {
 			beforeRef ?? null
 		]);
 		this.requireActive();
-		const key = canonicalRoot(primaryRoot);
+		const key = primaryKey(primaryRoot);
 		return await this.serialize(key, async () => {
-			const statuses = this.reclassify(key);
+			const statuses = await this.reclassify(key);
 			const targetIndex = resolveRootIndex(statuses, ref);
 			const anchorIndex = beforeRef === void 0 ? void 0 : resolveRootIndex(statuses, beforeRef);
 			if (anchorIndex === targetIndex) return statuses;
@@ -954,12 +1092,12 @@ var MultiRootRegistry = class extends Service {
 		await this.ensureAuthority();
 		if (this.client) return await this.remote("recheck", [primaryRoot]);
 		this.requireActive();
-		const key = canonicalRoot(primaryRoot);
-		return await this.serialize(key, async () => await this.persist(key, this.reclassify(key)));
+		const key = primaryKey(primaryRoot);
+		return await this.serialize(key, async () => await this.persist(key, await this.reclassify(key)));
 	}
 	/**
 	* Observe registry changes.
-	* @param listener - called with the canonical primary root after each durable change.
+	* @param listener - called with the Registry key (`primaryKey()`, case-folded on Windows) after each durable change.
 	* @returns the disposer that stops observing.
 	*/
 	onChange(listener) {
@@ -974,10 +1112,10 @@ var MultiRootRegistry = class extends Service {
 	* @returns the canonical paths of every `available` root.
 	*/
 	granted(primaryRoot) {
-		return this.shared ? this.ctx.multiRootScope.snapshot({
+		return this.ctx.multiRootScope.snapshot({
 			workspaceRoot: primaryRoot,
 			mode: "workspace-write"
-		}).additionalRoots : availableRoots(this.statusesOf(canonicalRoot(primaryRoot)));
+		}).additionalRoots;
 	}
 	/**
 	* The scope the registry publishes: only usable roots, in registry order.
@@ -988,8 +1126,7 @@ var MultiRootRegistry = class extends Service {
 		return this.granted(policy.workspaceRoot);
 	}
 	/** Classify one stored record set and cache it. */
-	accept(primaryRoot, record) {
-		const key = canonicalRoot(primaryRoot);
+	accept(key, record) {
 		const statuses = this.classify(key, record);
 		this.cache.set(key, statuses);
 		this.publish(key, statuses);
@@ -1001,7 +1138,7 @@ var MultiRootRegistry = class extends Service {
 	* staging uses it so a half-opened domain cannot materialize rows.
 	*/
 	classify(key, record) {
-		const statuses = classifyStoredRoots(key, record.roots.map(toRegisteredRoot));
+		const statuses = classifyStoredRoots(canonicalRoot(key), record.roots.map(toRegisteredRoot), process.platform, this.knownProtectedPaths());
 		if (statuses.length > this.maxRoots && !this.warnedOverLimit.has(key)) {
 			this.warnedOverLimit.add(key);
 			this.ctx.logger.warn(`multi-root-workspace: ${statuses.length} roots are stored for ${key}, above the configured limit of ${this.maxRoots}; all of them stay granted, only new adds are refused`);
@@ -1017,20 +1154,38 @@ var MultiRootRegistry = class extends Service {
 	statusesOf(key) {
 		const cached = this.cache.get(key);
 		if (cached !== void 0) return cached;
-		const record = this.lookupRecords(key);
-		if (record === void 0) return [];
-		return this.accept(key, record);
+		const found = this.lookupRecords(key);
+		if (found === void 0) return [];
+		return this.accept(key, found.record);
 	}
 	/**
-	* The stored record set of one key, or `undefined` when there is none (or
-	* when the store itself could not be read: an unusable store reads as
-	* "nothing registered" so reads stay answerable and the surfaces can explain
-	* the situation, while every write fails loudly in `requireTable()`).
+	* The stored record set of one key: `{ record, migrated: false }` when the
+	* spelling key holds it; `{ record, migrated: true }` when only the legacy
+	* CANONICAL key does — stores written before the upstream primary spelling
+	* became the key (v0.1.14 and earlier). The fallback follows the CURRENT
+	* resolution ONLY for such a not-yet-migrated store; the first serialized
+	* access copies the record forward under the spelling key (see
+	* {@link reclassify}), after which resolution can never re-key a grant.
+	* `undefined` when there is no record (or when the store itself could not
+	* be read: an unusable store reads as "nothing registered" so reads stay
+	* answerable and the surfaces can explain the situation, while every write
+	* fails loudly in `requireTable()`).
 	*/
 	lookupRecords(key) {
 		if (this.authorityState.kind !== "active") return void 0;
 		try {
-			return this.table?.get(key);
+			const record = this.table?.get(key);
+			if (record !== void 0) return {
+				record,
+				migrated: false
+			};
+			const legacy = canonicalRoot(key);
+			if (legacy === key) return void 0;
+			const migrated = this.table?.get(legacy);
+			return migrated === void 0 ? void 0 : {
+				record: migrated,
+				migrated: true
+			};
 		} catch (error) {
 			if (unknownStorageState(error)) this.enterStorageFailed("registry storage state cannot be confirmed; restart and reconcile", "quarantine");
 			throw error;
@@ -1042,14 +1197,20 @@ var MultiRootRegistry = class extends Service {
 	* directory. Updates the cache, republishes the scope, and returns the new
 	* list — the shared body of the read-path re-checks.
 	*/
-	reclassify(key) {
-		const record = this.lookupRecords(key);
-		if (record === void 0) {
+	async reclassify(key) {
+		const found = this.lookupRecords(key);
+		if (found === void 0) {
 			this.cache.set(key, []);
 			this.publish(key, []);
 			return [];
 		}
-		return this.accept(key, record);
+		if (found.migrated) try {
+			await this.requireTable().put(key, found.record);
+		} catch (error) {
+			if (unknownStorageState(error)) this.enterStorageFailed("registry write result is unknown; restart and reconcile durable state", "quarantine");
+			throw error;
+		}
+		return this.accept(key, found.record);
 	}
 	/**
 	* Persist one status list, then republish it into the scope and to listeners.
@@ -1060,13 +1221,12 @@ var MultiRootRegistry = class extends Service {
 		const table = this.requireTable();
 		const durable = persistedPrimaryRoot.parse({ roots: migrateRootSkills(statuses.map(toPersistedRoot)) });
 		try {
-			if (statuses.length === 0) await table.delete(key);
-			else await table.put(key, durable);
+			await table.put(key, durable);
 		} catch (error) {
 			if (unknownStorageState(error)) this.enterStorageFailed("registry write result is unknown; restart and reconcile durable state", "quarantine");
 			throw error;
 		}
-		const classified = statuses.length === 0 ? [] : classifyStoredRoots(key, durable.roots.map(toRegisteredRoot));
+		const classified = statuses.length === 0 ? [] : classifyStoredRoots(canonicalRoot(key), durable.roots.map(toRegisteredRoot), process.platform, this.knownProtectedPaths());
 		this.cache.set(key, classified);
 		this.publish(key, classified);
 		return classified;
@@ -1112,12 +1272,7 @@ var MultiRootRegistry = class extends Service {
 		const withheld = statuses.filter((status) => status.state !== "available");
 		const signature = [...statuses.filter((status) => status.state === "available").map((status) => `available:${status.access}:${recordedGrantOf(status)}`), ...withheld.map((status) => `${status.state}:${status.invalidReason ?? ""}:${status.access}:${status.path}:${recordedGrantOf(status) ?? ""}`)].join("\n");
 		const previousMetadata = this.metadataPublished.get(key);
-		const metadata = JSON.stringify(this.shared ? statuses : statuses.map((row) => [
-			row.id,
-			row.aliasId,
-			row.skillsEnabled,
-			row.state
-		]));
+		const metadata = JSON.stringify(statuses);
 		this.metadataPublished.set(key, metadata);
 		if ((this.published.get(key) ?? "") === signature) {
 			if (previousMetadata !== metadata && (previousMetadata !== void 0 || statuses.length > 0)) {
@@ -1137,7 +1292,7 @@ var MultiRootRegistry = class extends Service {
 	projectRoots(statuses) {
 		return statuses.flatMap((status) => {
 			const recorded = recordedGrantOf(status);
-			if (status.state === "invalid" && status.invalidReason !== "membership-conflict" || recorded === void 0) return [];
+			if (status.state === "invalid" && status.invalidReason === void 0 || recorded === void 0) return [];
 			return [{
 				id: status.id,
 				path: status.path,
@@ -1160,10 +1315,10 @@ var MultiRootRegistry = class extends Service {
 		});
 	}
 	async captureSnapshot(primary) {
-		const key = canonicalRoot(primary);
-		return await this.serialize(key, () => {
+		const key = primaryKey(primary);
+		return await this.serialize(key, async () => {
 			this.requireActive();
-			this.reclassify(key);
+			await this.reclassify(key);
 			return this.snapshotOf(key);
 		});
 	}
@@ -1205,15 +1360,19 @@ var MultiRootRegistry = class extends Service {
 		this.notifyShared(key);
 		for (const listener of this.listeners) listener(key);
 	}
+	/** Narrow owner rows for this Host, identically for projection and admission. */
+	localSnapshotRoots(snapshot) {
+		return markProtectedPaths(snapshot.roots.map((row) => Object.fromEntries(Object.entries({
+			...row,
+			id: additionalRootId(row.id)
+		}).filter(([, value]) => value !== void 0))), this.knownProtectedPaths());
+	}
 	applySnapshot(snapshot) {
 		if (!this.client || snapshot.store !== this.medium?.id || snapshot.epoch !== this.client.epoch) return;
 		const previous = this.remoteRevisions.get(snapshot.primary) ?? -1;
 		if (snapshot.revision < previous) return;
 		this.remoteRevisions.set(snapshot.primary, snapshot.revision);
-		const rows = snapshot.roots.map((row) => Object.fromEntries(Object.entries({
-			...row,
-			id: additionalRootId(row.id)
-		}).filter(([, value]) => value !== void 0)));
+		const rows = this.localSnapshotRoots(snapshot);
 		this.commit(() => {
 			this.cache.set(snapshot.primary, rows);
 			this.publish(snapshot.primary, rows);
@@ -1283,7 +1442,7 @@ var MultiRootRegistry = class extends Service {
 			client.close();
 			throw error;
 		}
-		if (generation !== this.connectionGeneration || client !== this.client || snapshot.store !== this.medium?.id || snapshot.epoch !== client.epoch || snapshot.primary !== canonicalRoot(String(args[0]))) {
+		if (generation !== this.connectionGeneration || client !== this.client || snapshot.store !== this.medium?.id || snapshot.epoch !== client.epoch || snapshot.primary !== primaryKey(String(args[0]))) {
 			client.close();
 			throw new Error("stale registry connection or authority epoch");
 		}
@@ -1379,7 +1538,7 @@ var MultiRootRegistry = class extends Service {
 					this.enterStorageFailed(`${DOMAIN_NAME}: leasePath must be an absolute path`, "config");
 					return;
 				}
-				if (this.sharedStorageRoot !== void 0 && this.medium === void 0) try {
+				if (this.medium === void 0) try {
 					if (!isAbsolute(this.sharedStorageRoot)) throw new SharedConfigError("sharedStorageRoot must be absolute");
 					const medium = storeIdentity(this.sharedStorageRoot);
 					if (storeIdentity(dirname(leasePath)).id !== medium.id || basename(leasePath) !== `multi_root_workspace.lock`) throw new SharedConfigError("shared registry requires its canonical medium lock, without alternate lock names");
@@ -1454,7 +1613,7 @@ var MultiRootRegistry = class extends Service {
 	async openDomain() {
 		let domain;
 		try {
-			domain = this.medium === void 0 ? await this.ctx.storageDomain.open(multiRootDomainSpec) : await openAuthorityStorage(this.authorityStorageContext, this.medium.root, multiRootDomainSpec);
+			domain = await openAuthorityStorage(this.authorityStorageContext, this.medium.root, multiRootDomainSpec);
 		} catch (error) {
 			const reason = `${DOMAIN_NAME}: ${error instanceof Error ? error.message : String(error)}`;
 			if (this.lastOpenFailure !== reason) {
@@ -1483,7 +1642,7 @@ var MultiRootRegistry = class extends Service {
 					}
 					this.ctx.logger.warn(`multi-root skills: metadata migration failed; Skills remain withheld: ${String(error)}`);
 				}
-				const key = canonicalRoot(primaryRoot);
+				const key = primaryKey(primaryRoot);
 				staged.set(key, this.classify(key, accepted));
 			}
 		} catch (error) {
@@ -1524,8 +1683,7 @@ var MultiRootRegistry = class extends Service {
 	/** Fail closed: empty scope, no table, contended state. */
 	enterContended() {
 		this.operationEpoch = void 0;
-		if (this.shared) this.remoteUnavailable();
-		else this.withdrawPublished();
+		this.remoteUnavailable();
 		this.ctx.multiRootScope.setRegistryAuthority(false);
 		this.table = void 0;
 		this.authorityState = { kind: "contended" };
@@ -1538,11 +1696,9 @@ var MultiRootRegistry = class extends Service {
 	enterStorageFailed(reason, recovery) {
 		this.operationEpoch = void 0;
 		this.ctx.multiRootScope.setRegistryAuthority(false);
-		if (this.shared) {
-			for (const [key, rows] of this.cache) this.withholdScope(key, rows);
-			this.server?.close();
-			this.server = void 0;
-		} else this.withdrawPublished();
+		for (const [key, rows] of this.cache) this.withholdScope(key, rows);
+		this.server?.close();
+		this.server = void 0;
 		this.table = void 0;
 		this.authorityState = {
 			kind: "storage-failed",

package/lib/{registry-lease-win32-DVTq9d4D.js → registry-lease-win32-r4puac9m.js}

@@ -1,3 +1,4 @@
+import { c as loadHostKoffi } from "./protocol-CwDnFEyK.js";
 import { realpathSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { basename, dirname, join, resolve } from "node:path";
@@ -23,7 +24,7 @@ let bindings;
 /** Load kernel32 through Koffi the first time a Windows process needs it. */
 async function kernel32() {
 	if (bindings !== void 0) return bindings;
-	const library = (await import("koffi")).default.load("kernel32.dll");
+	const library = (await loadHostKoffi()).load("kernel32.dll");
 	bindings = {
 		createSemaphoreW: library.func("__stdcall", "CreateSemaphoreW", "intptr", [
 			"void*",

package/lib/registry.js

@@ -1,3 +1,3 @@
-import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, s as TABLE_NAME, t as DEFAULT_MAX_ADDITIONAL_ROOTS } from "./registry-Bv431TfO.js";
-import { o as nativeHostAvailability } from "./protocol-CJOvAvOS.js";
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, s as TABLE_NAME, t as DEFAULT_MAX_ADDITIONAL_ROOTS } from "./registry-DyDNDSJZ.js";
+import { o as nativeHostAvailability } from "./protocol-CwDnFEyK.js";
 export { DEFAULT_MAX_ADDITIONAL_ROOTS, DOMAIN_NAME, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MultiRootRegistry, MultiRootRegistry as default, REGISTRY_CONTENDED_MESSAGE, TABLE_NAME, multiRootDomainSpec, nativeHostAvailability };