@jungjaehoon/mama-os 0.75.0 → 0.77.0

package/dist/api/member-records.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMemberRecords = createMemberRecords;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
 const mama_core_1 = require("@jungjaehoon/mama-core");
+const telegram_message_ledger_js_1 = require("../gateways/telegram-message-ledger.js");
 const member_export_js_1 = require("./member-export.js");
 const denied = () => Object.assign(new Error('Personal records require an active member own message turn and a later confirmation'), { name: 'denied' });
 function receiptText(core, product, failure, step, omittedFiles, uncertain) {
@@ -23,7 +23,7 @@ function receiptText(core, product, failure, step, omittedFiles, uncertain) {
     ];
     if (failure)
         lines.push(uncertain
-            ? 'The export delivery is uncertain. Nothing was erased. Check whether the file arrived before asking again.'
+            ? 'The export delivery is uncertain. Nothing was erased. No file was resent. Ask again for a new preview and confirm it in a later member message.'
             : ['retire', 'export', 'export_delivery', 'file_check'].includes(step)
                 ? 'Nothing was erased. Ask again for a new preview and pass its confirmationToken in a later member message.'
                 : 'Earlier steps are done. Make a new erasure request and pass its preview confirmationToken in a later member message to finish the rest.');
@@ -59,6 +59,9 @@ function createMemberRecords(options) {
             throw new Error('Member records require exactly one registered Telegram DM');
         return targets[0].id;
     };
+    const deferredInputs = (id) => options.adapter
+        .prepare("SELECT id, stimulus_id FROM mailbox_inputs WHERE principal_id=? AND kind='owner_message' AND status IN ('pending','claimed') AND json_extract(payload_json,'$.deferredMemberMessage')=1")
+        .all(id);
     const productExport = (id) => {
         const p = ports();
         const ledger = p.ledger();
@@ -89,10 +92,16 @@ function createMemberRecords(options) {
         }
         p.recordExchange(job.principalId, job.kind, `host:${job.commandId}`, text, verified);
     };
-    // Members whose erasure is scheduled or running. Only these pause claims for everyone: the
-    // member must stay unserved with its queue untouched until the export is delivered. An export
-    // deletes nothing, so it holds the chain only while its archive is built.
+    // The confirming member alone is excluded from all claims, including host inputs.
+    // Its durable erasure carrier is reconciled here, outside the mailbox claim loop.
     const erasing = new Set();
+    const release = (id) => {
+        blocked.delete(id);
+        erasing.delete(id);
+    };
+    // The checkpoint state each running erasure holds; a write deferred into it is checkpointed
+    // with the state the erasure goes on to save.
+    const runningStates = new Map();
     // Members with an export still uploading: their turns run, but no second export or erasure
     // starts until this one is delivered, so archives and uploads never pile up.
     const exporting = new Set();
@@ -102,8 +111,8 @@ function createMemberRecords(options) {
             .catch((error) => console.error('[Member records] scheduled work failed', error))
             .finally(() => jobs.delete(work));
     };
-    const enqueue = (work) => {
-        track(ports().turnChain.next(async () => {
+    const enqueue = (id, work) => {
+        const runSlot = async () => {
             let leaveChain;
             const left = new Promise((resolve) => (leaveChain = resolve));
             const run = work(leaveChain);
@@ -115,7 +124,8 @@ function createMemberRecords(options) {
                 if (!ports().isStopping())
                     ports().resumeQueued();
             }
-        }));
+        };
+        track(ports().turnChain(id).next(runSlot));
     };
     const take = (row) => {
         const job = scheduled.get(row.id);
@@ -128,11 +138,24 @@ function createMemberRecords(options) {
         const job = take(row);
         if (!job)
             return;
-        blocked.delete(job.principalId);
-        erasing.delete(job.principalId);
+        if (job.kind === 'erase' && ports().isStopping()) {
+            // Native stop can interrupt the confirming turn after the host accepted its command.
+            // The consent is durable; stopping the process is not cancellation of that consent.
+            job.release();
+            return;
+        }
+        if (job.kind === 'erase') {
+            cancelErasureConfirmation(job, outcome, reason);
+            launchErasure(job);
+            job.release();
+            return;
+        }
+        if (job.hostInputId !== undefined)
+            ports().mailbox().ack(job.hostInputId);
+        release(job.principalId);
         if (!ports().isStopping()) {
-            const label = job.kind === 'erase' ? 'Erasure' : 'Export';
-            enqueue(() => sendReceipt(job, `${label} did not run because the ${job.kind === 'erase' ? 'confirming' : 'requesting'} turn did not complete (${outcome}: ${reason}).\nYour personal records and files were kept. Make a new request in a later member message.\nYour enrollment and grants are kept.`));
+            const label = 'Export';
+            enqueue(job.principalId, () => sendReceipt(job, `${label} did not run because the ${job.kind === 'erase' ? 'confirming' : 'requesting'} turn did not complete (${outcome}: ${reason}).\nYour personal records and files were kept. Make a new request in a later member message.\nYour enrollment and grants are kept.`));
         }
         job.release();
     };
@@ -140,7 +163,7 @@ function createMemberRecords(options) {
         const p = ports(), id = job.principalId;
         let left = false;
         // An export's archive is a consistent snapshot once built: the member may run turns again
-        // and the upload continues outside the shared chain.
+        // and the upload continues outside that member's chain.
         const leave = () => {
             if (left || job.kind !== 'export')
                 return;
@@ -149,14 +172,10 @@ function createMemberRecords(options) {
             blocked.delete(id);
             leaveChain();
         };
-        const product = { cancelledMessages: 0 };
-        let core;
         let archive;
-        let failedStep = job.kind === 'erase' ? 'retire' : 'export', failure, uncertain = false;
+        let failedStep = 'export', failure, uncertain = false;
         let delivered = false;
         try {
-            if (job.kind === 'erase')
-                await p.retire(id);
             failedStep = 'export';
             archive = await (0, member_export_js_1.buildMemberExport)(p.root, id, (0, mama_core_1.exportPrincipalRecords)(options.adapter, id), productExport(id));
             leave();
@@ -178,69 +197,14 @@ function createMemberRecords(options) {
             finally {
                 (0, node_fs_1.rmSync)(archive.path, { force: true });
             }
-            if (job.kind === 'erase') {
-                // Retirement removed the writers and intake before the snapshot. Check and delete
-                // synchronously after delivery, with no await between them that could admit a write.
-                failedStep = 'file_check';
-                const inventory = (0, member_export_js_1.memberFileInventory)(p.root, id);
-                if ((0, member_export_js_1.memberInventorySnapshot)(inventory) !== archive.fileSnapshot)
-                    throw new Error('Your files changed while the export was being sent');
-                failedStep = 'files';
-                product.files = 0;
-                product.fileBytes = 0;
-                product.fileTrees = 0;
-                for (const tree of inventory.trees) {
-                    const remaining = inventory.allFiles.filter((file) => (0, node_path_1.relative)(tree, file.path) !== '..' && !(0, node_path_1.relative)(tree, file.path).startsWith('../'));
-                    (0, node_fs_1.rmSync)(tree, { recursive: true, force: true });
-                    product.files += remaining.length;
-                    product.fileBytes += remaining.reduce((n, file) => n + file.size, 0);
-                    product.fileTrees++;
-                }
-                failedStep = 'queued_inputs';
-                // Delivered in the export and never dispatched: cancelled here, they are terminal, so
-                // the core erase below removes them with their refs.
-                product.cancelledMessages = p.mailbox().cancelQueued(id, 'member_erase');
-                failedStep = 'connector_event_index';
-                product.connector_event_index = options.adapter
-                    .prepare("DELETE FROM connector_event_index WHERE source_connector='chat' AND memory_scope_kind='user' AND memory_scope_id=?")
-                    .run(id).changes;
-                failedStep = 'core';
-                core = (0, mama_core_1.erasePrincipalRecords)(options.adapter, {
-                    principalId: id,
-                    commandId: job.commandId,
-                });
-                failedStep = 'chat_raw';
-                Object.assign(product, p.rawStore.eraseScope('chat', 'user', id));
-                failedStep = 'message_ledger';
-                const ledger = p.ledger();
-                if (!ledger)
-                    throw new Error('Live message ledger is not configured');
-                product.message_ledger = ledger.eraseTelegramDm(dm(p.access(id)), [
-                    `file:${job.commandId}:export`,
-                ]);
-            }
         }
         catch (error) {
             failure = error;
         }
         try {
-            try {
-                p.serve(id);
-            }
-            catch (error) {
-                // Keep the step that stopped the job: it decides what was erased and what remains.
-                if (failure === undefined) {
-                    failedStep = 'serve';
-                    failure = error;
-                }
-                else
-                    failure = new Error(`${failure instanceof Error ? failure.message : String(failure)}; serving the member again also failed: ${error instanceof Error ? error.message : String(error)}`);
-            }
             const omittedFiles = archive?.omittedFiles ?? [];
             let text;
-            if (job.kind === 'erase')
-                text = receiptText(core, product, failure, failedStep, omittedFiles, uncertain);
-            else {
+            {
                 text = uncertain
                     ? `Export delivery is uncertain at ${failedStep}: ${failure instanceof Error ? failure.message : String(failure)}.`
                     : failure
@@ -250,7 +214,7 @@ function createMemberRecords(options) {
                         : 'Export sent: your personal records and files were sent to your registered Telegram DM.';
                 if (uncertain)
                     text +=
-                        '\nThe export delivery is uncertain. Check whether the file arrived before asking again.';
+                        '\nThe export delivery is uncertain. No file was resent. Check your DM for the export before requesting another export.';
                 text += `\nFiles: ${archive?.fileCount ?? 0} files, ${archive?.fileBytes ?? 0} bytes.\nYour enrollment and grants are kept.`;
                 for (const name of omittedFiles)
                     text += `\nLeft out of the export (a link is outside your files or in a private host directory): ${name}.`;
@@ -263,19 +227,363 @@ function createMemberRecords(options) {
                 exporting.delete(id);
             }
             else {
-                blocked.delete(id);
-                erasing.delete(id);
+                release(id);
             }
         }
     };
+    const runningErasures = new Set();
+    let recoveryTimer;
+    const checkpoint = (job, state) => {
+        // Consumer progress is opaque to core; the host stimulus identity stays immutable.
+        ports()
+            .mailbox()
+            .checkpointHostJob(job.hostInputId, JSON.parse(JSON.stringify(state)));
+    };
+    const cancelErasureConfirmation = (job, outcome, reason) => {
+        const state = ports().mailbox().hostJobCheckpoint(job.hostInputId);
+        state.phase = 'receipt';
+        state.text = `Erasure did not run because the confirming turn did not complete (${outcome}: ${reason}).\nYour personal records and files were kept. Make a new request in a later member message.\nYour enrollment and grants are kept.`;
+        checkpoint(job, state);
+    };
+    const runErasure = async (job) => {
+        const p = ports(), id = job.principalId;
+        const state = p.mailbox().hostJobCheckpoint(job.hostInputId);
+        runningStates.set(id, { job, state });
+        if (state.phase === 'done') {
+            p.serve(id);
+            p.mailbox().ack(job.hostInputId);
+            release(id);
+            return;
+        }
+        let step = 'retire';
+        let uncertainExport = false;
+        try {
+            if (state.phase === 'confirmed') {
+                if (p.isStopping())
+                    return;
+                await p.retire(id);
+                if (p.isStopping())
+                    return;
+                step = 'export';
+                const product = productExport(id);
+                const ledger = p.ledger();
+                state.exported = {
+                    ledgerKeys: ledger.listForTelegramDm(dm(p.access(id))).map((entry) => entry.key),
+                };
+                state.archive = await (0, member_export_js_1.buildMemberExport)(p.root, id, (0, mama_core_1.exportPrincipalRecords)(options.adapter, id), product);
+                state.phase = 'exporting';
+                checkpoint(job, state);
+            }
+            if (state.phase === 'exporting') {
+                if (p.isStopping())
+                    return;
+                step = 'export_delivery';
+                // A boot recreates native directories. Retire them before checking the persisted snapshot.
+                await p.retire(id);
+                if (p.isStopping())
+                    return;
+                // This principal remains reserved and excluded. Its native writers are gone and the
+                // archive touches only its known paths; other directory jobs need not wait for upload.
+                p.turnChain(id).releaseDirectoryWait();
+                const entry = p.ledger()?.get(`file:${job.commandId}:export`);
+                if (entry?.state !== 'delivered') {
+                    // The ledger has retention. A lost/expired receipt after a persisted send boundary
+                    // cannot turn an attempted upload back into a never-attempted one.
+                    if (!entry && state.exportAttempted) {
+                        uncertainExport = true;
+                        throw new Error('The export delivery is uncertain: its receipt is missing');
+                    }
+                    // A persisted attempt without a definitive receipt is never permission to delete.
+                    // In particular, a processing entry left by a crash may have reached Telegram.
+                    if (entry && (entry.deliveryUncertain || entry.state === 'processing'))
+                        throw new Error('The export delivery is uncertain');
+                    if (!state.archive)
+                        throw new Error('The export snapshot is missing');
+                    if (entry)
+                        throw new Error('The export delivery was not confirmed');
+                    state.exportAttempted = true;
+                    checkpoint(job, state);
+                    try {
+                        const telegram = p.telegram();
+                        if (!telegram)
+                            throw new Error('Member Telegram delivery is not configured');
+                        await telegram.sendFile(state.archive.path, undefined, `${job.commandId}:export`, {
+                            access: p.access(id),
+                            filesRoot: state.archive.filesRoot,
+                        });
+                    }
+                    catch (error) {
+                        // A send that failed before the transport claimed its ledger entry never reached
+                        // Telegram; clear the attempt so a resume does not report an uncertain delivery.
+                        if (!p.ledger()?.get(`file:${job.commandId}:export`)) {
+                            state.exportAttempted = false;
+                            checkpoint(job, state);
+                        }
+                        throw error;
+                    }
+                }
+                state.phase = 'delivered';
+                checkpoint(job, state);
+                if (p.isStopping())
+                    return;
+            }
+            if (state.phase === 'delivered') {
+                if (p.isStopping())
+                    return;
+                await p.retire(id);
+                if (p.isStopping())
+                    return;
+                if (state.archive)
+                    (0, node_fs_1.rmSync)(state.archive.path, { force: true });
+                step = 'file_check';
+                const inventory = (0, member_export_js_1.memberFileInventory)(p.root, id);
+                if (!state.archive || (0, member_export_js_1.memberInventorySnapshot)(inventory) !== state.archive.fileSnapshot)
+                    throw new Error('Your files changed while the export was being sent');
+                state.product.files = inventory.allFiles.length;
+                state.product.fileBytes = inventory.allFiles.reduce((n, file) => n + file.size, 0);
+                state.product.fileTrees = inventory.trees.length;
+                state.phase = 'erasing';
+                checkpoint(job, state); // Deletion may now replay each remaining store, never the upload.
+            }
+            if (state.phase === 'erasing') {
+                // Checked before any deletion: the ledger erase below keeps entries outside this snapshot.
+                if (!state.exported)
+                    throw new Error('The export ledger snapshot is missing');
+                step = 'files';
+                // No await between the delivered file check and the deletion on the first run.
+                for (const tree of (0, member_export_js_1.memberFileInventory)(p.root, id).trees)
+                    (0, node_fs_1.rmSync)(tree, { recursive: true, force: true });
+                const product = { ...state.product };
+                let core = state.core;
+                options.adapter.transaction(() => {
+                    product.cancelledMessages += p.mailbox().cancelQueued(id, 'member_erase', deferredInputs(id).map((row) => row.id));
+                    step = 'connector_event_index';
+                    // Core erases the person's scope, so its chat rows go with it; personal host receipts
+                    // written during the erasure are deferred until it ends (deferWhileErasing).
+                    product.connector_event_index =
+                        (product.connector_event_index ?? 0) +
+                            options.adapter
+                                .prepare("DELETE FROM connector_event_index WHERE source_connector='chat' AND memory_scope_kind='user' AND memory_scope_id=?")
+                                .run(id).changes;
+                    step = 'core';
+                    core = (0, mama_core_1.erasePrincipalRecords)(options.adapter, {
+                        principalId: id,
+                        commandId: job.commandId,
+                    });
+                    checkpoint(job, { ...state, product, core });
+                });
+                // A rolled-back transaction must not report its attempted deletes as completed.
+                state.product = product;
+                state.core = core;
+                step = 'chat_raw';
+                // Save intended totals before crossing the independent raw database/file-ledger boundary.
+                const rawCounts = p.rawStore.exportScope('chat', 'user', id);
+                for (const [name, rows] of Object.entries(rawCounts))
+                    state.product[name] ??= rows.length;
+                const ledger = p.ledger();
+                if (!ledger)
+                    throw new Error('Live message ledger is not configured');
+                const exportedKeys = new Set(state.exported.ledgerKeys);
+                // Entries written for this DM after the snapshot (another principal's delivery, a
+                // management receipt) were not exported, so they stay.
+                const later = ledger
+                    .listForTelegramDm(dm(p.access(id)))
+                    .filter((entry) => !exportedKeys.has(entry.key))
+                    .map((entry) => entry.key);
+                state.product.message_ledger ??= ledger
+                    .listForTelegramDm(dm(p.access(id)))
+                    .filter((entry) => exportedKeys.has(entry.key) &&
+                    entry.key !== `file:${job.commandId}:export` &&
+                    !deferredInputs(id).some((row) => row.stimulus_id === entry.key)).length;
+                checkpoint(job, state);
+                p.rawStore.eraseScope('chat', 'user', id);
+                step = 'message_ledger';
+                ledger.eraseTelegramDm(dm(p.access(id)), [
+                    `file:${job.commandId}:export`,
+                    ...deferredInputs(id).map((row) => row.stimulus_id),
+                    ...later,
+                ]);
+                state.text = receiptText(state.core, state.product, undefined, '', state.archive?.omittedFiles ?? [], false);
+                state.phase = 'receipt';
+                delete state.archive;
+                checkpoint(job, state);
+            }
+        }
+        catch (error) {
+            // Retirement races shutdown before any deletion. Keep the confirmed job resumable.
+            if (p.isStopping() && ['confirmed', 'exporting', 'delivered'].includes(state.phase))
+                return;
+            const entry = p.ledger()?.get(`file:${job.commandId}:export`);
+            const uncertain = uncertainExport ||
+                (state.phase === 'exporting' &&
+                    (entry?.deliveryUncertain === true || entry?.state === 'processing'));
+            state.text = receiptText(state.core, state.product, error, step, state.archive?.omittedFiles ?? [], uncertain);
+            state.phase = 'receipt';
+            checkpoint(job, state);
+        }
+        if (state.phase === 'receipt') {
+            if (state.archive)
+                (0, node_fs_1.rmSync)(state.archive.path, { force: true });
+            if (p.isStopping())
+                return;
+            try {
+                p.serve(id);
+            }
+            catch (error) {
+                if (!state.receiptAttempted && !state.receiptDelivered && !state.serveFailed) {
+                    state.text = `${state.text}\nserving the member again also failed: ${error instanceof Error ? error.message : String(error)}.`;
+                    state.serveFailed = true;
+                    checkpoint(job, state);
+                }
+                else {
+                    // The receipt names the first failure once (the recovery tick retries every few
+                    // seconds), and a text that crossed the send boundary never changes.
+                    console.error('[Member records] service restoration failed again', error);
+                }
+                // Keep the receipt carrier and principal exclusion until service restoration succeeds.
+                // The recovery tick retries this phase; deferred messages must not run unserved.
+                throw error;
+            }
+            const telegram = p.telegram();
+            p.turnChain(id).releaseDirectoryWait();
+            if (!telegram)
+                throw new Error('Member Telegram delivery is not configured');
+            const operation = `${job.commandId}:receipt`;
+            if (!state.receiptDelivered) {
+                state.receiptDelivered = telegram.memberTextDelivered(p.access(id), operation);
+                if (!state.receiptDelivered) {
+                    const entry = p.ledger()?.get((0, telegram_message_ledger_js_1.outboundLedgerKey)(operation));
+                    // The transport claims its ledger entry before sending, so no entry means nothing was
+                    // sent: send again (a duplicate receipt is harmless; a lost one is not). Only an
+                    // uncertain claimed send is final.
+                    if (!entry?.deliveryUncertain) {
+                        state.receiptAttempted = true;
+                        checkpoint(job, state);
+                        try {
+                            state.receiptDelivered = await telegram.sendMemberText(p.access(id), state.text, operation);
+                            if (!state.receiptDelivered)
+                                throw new Error('Erasure receipt delivery was not confirmed');
+                        }
+                        catch (error) {
+                            const attempted = p.ledger()?.get((0, telegram_message_ledger_js_1.outboundLedgerKey)(operation));
+                            // A failed pre-claim call is retryable. An uncertain send is final for this
+                            // data job: record it unverified without resending or blocking later turns.
+                            if (!attempted) {
+                                state.receiptAttempted = false;
+                                checkpoint(job, state);
+                            }
+                            if (!attempted?.deliveryUncertain)
+                                throw error;
+                        }
+                    }
+                }
+                checkpoint(job, state);
+            }
+            p.recordExchange(id, 'erase', `host:${job.commandId}`, state.text, state.receiptDelivered === true);
+            // Outside the transaction: the raw store commits apart from it, and a repeated write of a
+            // saved exchange returns the stored one, so a retry after a failure here finishes.
+            for (const exchange of state.afterErasure ?? [])
+                p.writeHostExchange(id, exchange);
+            options.adapter.transaction(() => {
+                state.phase = 'done';
+                delete state.archive;
+                delete state.exported;
+                delete state.afterErasure;
+                checkpoint(job, state);
+                p.mailbox().ack(job.hostInputId);
+            });
+            release(id);
+        }
+    };
+    const launchErasure = (job) => {
+        if (runningErasures.has(job.hostInputId))
+            return;
+        runningErasures.add(job.hostInputId);
+        enqueue(job.principalId, async () => {
+            try {
+                await runErasure(job);
+            }
+            finally {
+                runningErasures.delete(job.hostInputId);
+                runningStates.delete(job.principalId);
+            }
+        });
+    };
+    const durableRows = () => options.ports
+        ? options.adapter
+            .prepare("SELECT id, stimulus_id, principal_id, payload_json FROM mailbox_inputs WHERE kind='host_job' AND channel_key='member-erasure' AND status IN ('pending','claimed') ORDER BY id")
+            .all()
+        : [];
+    // Restore exclusion before any boot-time claim. A live confirmation still waits for settlement;
+    // after a crash its process no longer owns files, so recovery can take the same member slot.
+    for (const row of durableRows()) {
+        blocked.add(row.principal_id);
+        erasing.add(row.principal_id);
+    }
+    const recover = () => {
+        // An assembly without member_root has no personal-record host runner or delivery ports.
+        if (!options.ports)
+            return;
+        if (ports().isStopping() || !ports().isReady())
+            return;
+        for (const row of durableRows()) {
+            const payload = JSON.parse(row.payload_json);
+            if (scheduled.has(payload.inputId))
+                continue;
+            // Core reconciliation owns uncertain native intake, even after its process is gone.
+            const mailbox = ports().mailbox();
+            const status = mailbox.inputStatus(payload.inputId);
+            const confirmation = mailbox.nativeInputs.get(payload.inputId);
+            const job = {
+                principalId: row.principal_id,
+                inputId: payload.inputId,
+                commandId: row.stimulus_id,
+                kind: 'erase',
+                hostInputId: row.id,
+                release: () => { },
+            };
+            const state = mailbox.hostJobCheckpoint(row.id);
+            // A confirmed command is still waiting for native settlement. A crash before the
+            // cancellation callback cannot turn an incomplete confirming turn into permission to erase.
+            if (state.phase === 'confirmed' && (status !== 'acked' || confirmation?.state !== 'settled'))
+                cancelErasureConfirmation(job, status === 'dead' ? 'dead' : (confirmation?.state ?? 'unsettled'), confirmation?.error ??
+                    `confirmation input status=${status ?? 'missing'}, native state=${confirmation?.state ?? 'missing'}`);
+            if (status === 'acked' || status === 'dead')
+                mailbox.quarantine(payload.inputId, 'member_erasure_confirmation_recovered');
+            launchErasure(job);
+        }
+    };
     const schedule = (kind, row) => {
         const commandId = `member-${kind}:${row.principalId}:${row.id}`;
+        let hostInputId;
+        if (kind === 'erase')
+            options.adapter.transaction(() => {
+                hostInputId =
+                    ports()
+                        .mailbox()
+                        .enqueue({
+                        id: commandId,
+                        kind: 'host_job',
+                        principalId: row.principalId,
+                        channelKey: 'member-erasure',
+                        payload: { inputId: row.id },
+                        occurredAt: Date.now(),
+                    }) ?? ports().mailbox().readInput(commandId, row.principalId).id;
+                if (!ports().mailbox().hostJobCheckpoint(hostInputId))
+                    ports()
+                        .mailbox()
+                        .checkpointHostJob(hostInputId, {
+                        phase: 'confirmed',
+                        product: { cancelledMessages: 0 },
+                    });
+            });
         scheduled.set(row.id, {
             principalId: row.principalId,
             inputId: row.id,
             commandId,
             kind,
-            release: ports().turnChain.hold(),
+            ...(hostInputId === undefined ? {} : { hostInputId }),
+            release: ports().turnChain(row.principalId).hold(),
         });
         blocked.add(row.principalId);
         if (kind === 'erase')
@@ -356,17 +664,67 @@ function createMemberRecords(options) {
     return {
         registrations,
         isBusy: () => erasing.size > 0,
+        excludePrincipals: () => [...erasing],
+        /**
+         * Keep a personal write for after this member's erasure once its export snapshot is taken;
+         * false means the caller writes it now (no erasure, or one whose export will still hold it).
+         */
+        deferWhileErasing: (id, exchange) => {
+            const running = runningStates.get(id);
+            if (running) {
+                if (!running.state.exported)
+                    return false;
+                (running.state.afterErasure ??= []).push(exchange);
+                checkpoint(running.job, running.state);
+                return true;
+            }
+            // Not running here (a stop interrupted it, or recovery has not resumed it yet): its
+            // durable checkpoint carries the write to whichever run finishes the erasure.
+            const row = durableRows().find((candidate) => candidate.principal_id === id);
+            if (!row)
+                return false;
+            const mailbox = ports().mailbox();
+            const state = mailbox.hostJobCheckpoint(row.id);
+            if (!state.exported)
+                return false;
+            (state.afterErasure ??= []).push(exchange);
+            mailbox.checkpointHostJob(row.id, JSON.parse(JSON.stringify(state)));
+            return true;
+        },
+        recover,
+        startRecovery: () => {
+            if (!options.ports)
+                return;
+            recover();
+            recoveryTimer ??= setInterval(recover, 5_000);
+            recoveryTimer.unref();
+        },
+        stopRecovery: () => {
+            if (recoveryTimer)
+                clearInterval(recoveryTimer);
+            recoveryTimer = undefined;
+        },
         isBlocked: (id) => blocked.has(id),
         onSettled: (row) => {
             const job = take(row);
             if (!job)
                 return;
             if (ports().isStopping()) {
-                blocked.delete(job.principalId);
-                erasing.delete(job.principalId);
+                if (job.kind !== 'erase') {
+                    blocked.delete(job.principalId);
+                    // Exports have no durable carrier; the transports stay open through the drain, so say
+                    // so instead of dropping the request silently.
+                    enqueue(job.principalId, () => sendReceipt(job, 'Export did not run because MAMA was restarting. Ask again in a later message.'));
+                }
+            }
+            else {
+                // Export writes workspace/files; erasure recreates this member's runtime/temp paths.
+                // Other members already deny those paths, so both use only this member's chain.
+                if (job.kind === 'erase')
+                    launchErasure(job);
+                else
+                    enqueue(job.principalId, (leaveChain) => runJob(job, leaveChain));
             }
-            else
-                enqueue((leaveChain) => runJob(job, leaveChain));
             job.release();
         },
         onDead: (row, reason) => cancelConfirmation(row, 'dead', reason),