@khoavu882/doflow 2.0.0-beta.4 → 2.0.0

package/src/runtime/source-version.js

@@ -0,0 +1,290 @@
+'use strict';
+
+// TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { execFileSync } = require('node:child_process');
+
+                     
+                           
+                            
+                        
+                             
+ 
+
+                                                                 
+
+                         
+                           
+                          
+                          
+ 
+
+const treeStateMemo = new Map                   ();
+
+function clearTreeStateCache()       {
+  treeStateMemo.clear();
+}
+
+/**
+ * Finds the top of the git work tree and root's relative prefix below it using filesystem reads only.
+ */
+function findWorkTreeTop(root        )                                                {
+  let current = path.resolve(root);
+  while (true) {
+    try {
+      if (fs.existsSync(path.join(current, '.git'))) {
+        const rel = path.relative(current, path.resolve(root));
+        const prefix = rel && rel !== '.' ? (rel.split(path.sep).join('/') + '/') : '';
+        return { top: current, prefix };
+      }
+    } catch {
+      break;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return { top: null, prefix: null };
+}
+
+function defaultGitRunner(args          , cwd        )                {
+  try {
+    return execFileSync('git', args, {
+      cwd,
+      encoding: 'utf8',
+      timeout: 2000,
+      maxBuffer: 256 * 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Measures the repository's HEAD commit, dirty paths and tree fingerprint with one git status call.
+ */
+function measureTreeState(root        , runner            )            {
+  const absRoot = path.resolve(root);
+  if (!runner && treeStateMemo.has(absRoot)) {
+    return treeStateMemo.get(absRoot) ;
+  }
+
+  const { top: workTreeTop, prefix } = findWorkTreeTop(absRoot);
+  if (!workTreeTop) {
+    const unmeasured            = {
+      gitCommit: null,
+      dirty: null,
+      prefix: null,
+      fingerprint: null,
+    };
+    if (!runner) treeStateMemo.set(absRoot, unmeasured);
+    return unmeasured;
+  }
+
+  const args = ['-C', absRoot, 'status', '--porcelain=v2', '--branch', '-z', '--untracked-files=all', '--ignored=matching'];
+  const raw = runner ? runner(args, absRoot) : defaultGitRunner(args, absRoot);
+
+  if (raw === null || raw === undefined) {
+    const commit = runner
+      ? runner(['-C', absRoot, 'rev-parse', 'HEAD'], absRoot)
+      : defaultGitRunner(['-C', absRoot, 'rev-parse', 'HEAD'], absRoot);
+    const failed            = {
+      gitCommit: commit?.trim() || null,
+      dirty: null,
+      prefix,
+      fingerprint: null,
+    };
+    if (!runner) treeStateMemo.set(absRoot, failed);
+    return failed;
+  }
+
+  const tokens = raw.split('\0');
+  let gitCommit                = null;
+  const dirty = new Set        ();
+  const entryRecords           = [];
+
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (!token) continue;
+
+    if (token.startsWith('# branch.oid ')) {
+      const oid = token.slice('# branch.oid '.length).trim();
+      if (oid && oid !== '(initial)') {
+        gitCommit = oid;
+      }
+      continue;
+    }
+    if (token.startsWith('# ')) {
+      continue;
+    }
+
+    if (token.startsWith('! ')) {
+      const ignoredPath = token.slice(2);
+      if (prefix && (ignoredPath === prefix.slice(0, -1) || ignoredPath === `${prefix.slice(0, -1)}/`)) {
+        const ignored            = { gitCommit, dirty: null, prefix, fingerprint: null };
+        if (!runner) treeStateMemo.set(absRoot, ignored);
+        return ignored;
+      }
+      continue;
+    }
+
+    let dirtyPath                = null;
+    let entryText = token;
+
+    if (token.startsWith('1 ')) {
+      const parts = token.split(' ');
+      dirtyPath = parts.slice(8).join(' ');
+      dirty.add(dirtyPath);
+    } else if (token.startsWith('2 ')) {
+      const parts = token.split(' ');
+      dirtyPath = parts.slice(9).join(' ');
+      dirty.add(dirtyPath);
+      if (i + 1 < tokens.length && tokens[i + 1]) {
+        const origPath = tokens[i + 1];
+        dirty.add(origPath);
+        entryText = `${token}\0${origPath}`;
+        i++;
+      }
+    } else if (token.startsWith('u ')) {
+      const parts = token.split(' ');
+      dirtyPath = parts.slice(10).join(' ');
+      dirty.add(dirtyPath);
+    } else if (token.startsWith('? ')) {
+      dirtyPath = token.slice(2);
+      dirty.add(dirtyPath);
+    }
+
+    if (dirtyPath !== null) {
+      const statePath = `${prefix}.doflow/state/`;
+      const normalizedDirtyPath = dirtyPath.split(path.sep).join('/');
+      const shouldFingerprint = !normalizedDirtyPath.startsWith(statePath);
+      if (shouldFingerprint && /^(?:1|2|u) \S+ S\.M /.test(token)) {
+        const nestedRoot = path.resolve(workTreeTop, dirtyPath);
+        const nested = measureNestedRepository(nestedRoot);
+        if (nested === null) {
+          const unknown            = { gitCommit, dirty: null, prefix, fingerprint: null };
+          if (!runner) treeStateMemo.set(absRoot, unknown);
+          return unknown;
+        }
+        entryRecords.push(`${entryText}:nested:${nested}`);
+        continue;
+      }
+      if (shouldFingerprint && token.startsWith('? ')) {
+        const nestedRoot = path.resolve(workTreeTop, dirtyPath.replace(/\/$/, ''));
+        if (fs.existsSync(path.join(nestedRoot, '.git'))) {
+          const nested = measureNestedRepository(nestedRoot);
+          if (nested === null) {
+            const unknown            = { gitCommit, dirty: null, prefix, fingerprint: null };
+            if (!runner) treeStateMemo.set(absRoot, unknown);
+            return unknown;
+          }
+          entryRecords.push(`${entryText}:nested:${nested}`);
+          continue;
+        }
+      }
+      if (!shouldFingerprint) continue;
+      let statTerm = 'absent';
+      try {
+        const absPath = path.resolve(workTreeTop, dirtyPath);
+        const st = fs.statSync(absPath);
+        statTerm = `${st.size}:${st.mtimeMs}`;
+      } catch {
+        statTerm = 'absent';
+      }
+      entryRecords.push(`${entryText}:${statTerm}`);
+    }
+  }
+
+  if (!gitCommit) {
+    const uncommitted            = {
+      gitCommit: null,
+      dirty: null,
+      prefix,
+      fingerprint: null,
+    };
+    if (!runner) treeStateMemo.set(absRoot, uncommitted);
+    return uncommitted;
+  }
+
+  const hash = crypto.createHash('sha256');
+  hash.update(gitCommit);
+  hash.update('\0');
+  hash.update(entryRecords.sort().join('\0'));
+  const fingerprint = `sha256:${hash.digest('hex')}`;
+
+  const state            = {
+    gitCommit,
+    dirty,
+    prefix,
+    fingerprint,
+  };
+  if (!runner) treeStateMemo.set(absRoot, state);
+  return state;
+}
+
+function measureNestedRepository(root        )                {
+  try {
+    const gitEntry = path.join(root, '.git');
+    const gitStat = fs.statSync(gitEntry);
+    const gitDir = gitStat.isFile()
+      ? path.resolve(root, fs.readFileSync(gitEntry, 'utf8').trim().replace(/^gitdir:\s*/, ''))
+      : gitEntry;
+    const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim();
+    const headRef = head.startsWith('ref: ')
+      ? fs.readFileSync(path.join(gitDir, head.slice('ref: '.length)), 'utf8').trim()
+      : head;
+    const index = fs.statSync(path.join(gitDir, 'index'));
+    return `${head}:${headRef}:${index.mtimeMs}:${index.size}`;
+  } catch {
+    return null;
+  }
+}
+
+function fileHash(root        , locator     )                {
+  if (!locator?.file) return null;
+  try {
+    const absolute = path.resolve(root, locator.file);
+    if (!fs.statSync(absolute).isFile()) return null;
+    return `sha256:${crypto.createHash('sha256').update(fs.readFileSync(absolute)).digest('hex')}`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Derives source version { gitCommit, fileHash, isDirty } for a given locator and tree state.
+ */
+function sourceVersionFor(root        , locator     , state           )                {
+  const hash = fileHash(root, locator);
+  if (!locator?.file || !state || !state.dirty) {
+    return {
+      gitCommit: state?.gitCommit ?? null,
+      fileHash: hash,
+      isDirty: null,
+    };
+  }
+
+  const prefix = state.prefix || '';
+  if (path.isAbsolute(locator.file)) {
+    return { gitCommit: state.gitCommit ?? null, fileHash: hash, isDirty: null };
+  }
+  const candidate = path.posix.normalize(`${prefix}${locator.file.split(path.sep).join('/')}`).replace(/^\.\//, '');
+  const isDirty = state.dirty.has(candidate);
+
+  return {
+    gitCommit: state.gitCommit ?? null,
+    fileHash: hash,
+    isDirty,
+  };
+}
+
+module.exports = {
+  findWorkTreeTop,
+  measureTreeState,
+  sourceVersionFor,
+  clearTreeStateCache,
+};

package/src/runtime/state-root.js

@@ -0,0 +1,217 @@
+'use strict';
+
+// TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { acquireLock } = require('./task-state.js');
+const { loadStorageRegistry } = require('./storage/registry.js');
+const { REPO_ROOT } = require('../helper/repo-root.js');
+
+// Where a task's records live (115 IC-004) and how records a linked worktree wrote before that rule
+// reach the main checkout (IC-006): one locked sweep per redirected call.
+//
+// A linked, non-sandbox worktree reads and writes every per-task record under the main checkout's
+// `.doflow/state`, whatever folders the worktree holds: a conditional rule flipped mid-run when
+// do-brainstorm created the feature folder in the worktree and split one task's records across two
+// stores. A DoFlow sandbox (`.doflow-worktree-base`) keeps its own store, and `--global` is $HOME.
+
+/** This module's path as `core/registry/storage.json` names it in a store's `writers`. */
+const ADOPTER = 'src/runtime/state-root.js';
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/**
+ * IC-004: the root a task-store verb or `orchestrate` reads and writes its records in.
+ * @param {Object} o parsed CLI options (`global`, `positional`)
+ * @param {Object|null} checkouts a `listCheckouts` result, or null when none was listed
+ * @returns {{root: string, redirected: boolean}}
+ */
+function taskStateRoot(o     , checkouts     )                                        {
+  if (!o.global && checkouts?.ok && checkouts.isLinked && !checkouts.sandbox && checkouts.main) {
+    return { root: checkouts.main, redirected: true };
+  }
+  return { root: o.global ? os.homedir() : path.resolve(o.positional?.[0] || '.'), redirected: false };
+}
+
+/**
+ * The project-state stores a worktree's records are adopted from: the ones that declare this module
+ * among their `writers` in `core/registry/storage.json`, so the list is the registry's, not a copy.
+ * @param {Object} [registry] a loaded storage registry (default: the shipped one)
+ * @returns {Array<{id: string, path: string, match: RegExp}>}
+ */
+function adoptedStores(registry      = loadStorageRegistry({ repoRoot: REPO_ROOT }))                                                     {
+  return registry.stores
+    .filter((store     ) => store.root === 'project-state' && Array.isArray(store.writers) && store.writers.includes(ADOPTER))
+    .map((store     ) => ({ id: store.id, path: store.path, match: new RegExp(store.match) }));
+}
+
+/** Whether `name` is a namespace directory of a store (a feature slug), not a `<file>.lock` directory. */
+function isNamespaceDir(name        )          {
+  return SAFE_ID.test(name) && !name.includes('..') && !name.endsWith('.lock');
+}
+
+/** The record files of one store directory of the worktree, by the store's exact `match`: flat files
+ * and the files of each `<slug>/` directory, as paths relative to the store. */
+function storeFiles(dir        , match        , fsImpl     )           {
+  const out           = [];
+  let entries       ;
+  try { entries = fsImpl.readdirSync(dir, { withFileTypes: true }); } catch { return out; }
+  for (const entry of entries) {
+    // A link is listed as it stands, file or directory, so the sweep refuses it instead of skipping it.
+    if (entry.isSymbolicLink() && (match.test(entry.name) || isNamespaceDir(entry.name))) out.push(entry.name);
+    else if (entry.isFile() && match.test(entry.name)) out.push(entry.name);
+    else if (entry.isDirectory() && isNamespaceDir(entry.name)) {
+      let inner       ;
+      try { inner = fsImpl.readdirSync(path.join(dir, entry.name), { withFileTypes: true }); } catch { continue; }
+      for (const file of inner) if ((file.isFile() || file.isSymbolicLink()) && match.test(file.name)) out.push(path.join(entry.name, file.name));
+    }
+  }
+  return out.sort();
+}
+
+/** The first link among `root`'s own path components down to `file` (the root itself is the
+ * checkout and is not owned here), or null. A component that does not exist yet is not a link. */
+function linkOnTheWay(root        , file        , fsImpl     )                {
+  let at = root;
+  for (const part of path.relative(root, file).split(path.sep)) {
+    at = path.join(at, part);
+    let stat     ;
+    try { stat = fsImpl.lstatSync(at); } catch { return null; }
+    if (stat.isSymbolicLink()) return at;
+  }
+  return null;
+}
+
+/** The task id a flat record file names: `<taskId>.json` or the claims file `<taskId>_claims.json`. */
+function taskIdOf(name        )         {
+  const base = name.slice(0, -'.json'.length);
+  return base.endsWith('_claims') ? base.slice(0, -'_claims'.length) : base;
+}
+
+/** The feature a flat record names (`featureSlug` on a run, `slug` on a readiness record), or null. */
+function ownSlugOf(bytes        )                {
+  try {
+    const data = JSON.parse(bytes.toString('utf8'));
+    const named = [data?.featureSlug, data?.slug].find((v) => typeof v === 'string' && SAFE_ID.test(v) && !v.includes('..'));
+    return named || null;
+  } catch { return null; }
+}
+
+/** Writes `bytes` to `to` through a temporary file beside it and a rename, so a reader never sees a
+ * partial record. The one write path for a record copied between stores or checkouts. */
+function placeRecord(to        , bytes        , fsImpl      = fs)       {
+  const tmp = `${to}.${process.pid}.tmp`;
+  fsImpl.writeFileSync(tmp, bytes);
+  fsImpl.renameSync(tmp, to);
+}
+
+function realOrNull(p        , fsImpl     )                {
+  try { return fsImpl.realpathSync(p); } catch { return null; }
+}
+
+/**
+ * IC-006 (115 C-3, D-1, D-4): moves every record a linked worktree holds in its own `.doflow/state`
+ * to the main checkout's, before the verb reads any of them. One sweep per redirected call, over
+ * every adopted store, whatever task the call names.
+ *
+ * Nothing is swept when the two state directories are one directory (a worktree whose
+ * `.doflow/state` links to the main checkout's). Per file: a link on either side's own path, or a
+ * source and target that are one file (`dev:ino`), refuses that file; otherwise the target's lock and
+ * then the source's are taken, the source is re-read under them (gone means another sweep moved it),
+ * and it goes to the same relative path, except that a flat record of a task id other than its
+ * feature's slug goes under `<store>/<slug>/` (the slug it names, else the call's `recordSlug`, so it
+ * lands where every reader looks). Equal bytes at the target delete the source; no target means a
+ * copy to a temporary file, a rename into place, a re-read compared with the source, and only then
+ * the source's deletion; other bytes leave both and are reported. Files already moved stay moved.
+ * @param {Object} options
+ * @param {string} options.mainRoot the main checkout
+ * @param {string} options.worktreeRoot the linked worktree the verb runs in
+ * @param {string|null|(() => string|null)} [options.recordSlug] the call's feature slug, asked for only
+ *   when a flat record names no feature of its own
+ * @param {Object} [options.registry] storage registry (default: the shipped one)
+ * @param {Object} [options.fsImpl]
+ * @returns {{ok: boolean, adopted: string[], removed: string[], error?: 'store-conflict',
+ *   conflicts?: Array<{worktree: string, main: string, reason: 'differs'|'link'|'same-file'}>}}
+ */
+function sweepWorktreeRecords({ mainRoot, worktreeRoot, recordSlug = null, registry, fsImpl = fs }     )      {
+  const done = { ok: true, adopted: []            , removed: []             };
+  const conflicts                                                            = [];
+  const fromState = path.join(worktreeRoot, '.doflow', 'state');
+  const toState = path.join(mainRoot, '.doflow', 'state');
+  const fromReal = realOrNull(fromState, fsImpl);
+  if (fromReal === null || fromReal === realOrNull(toState, fsImpl)) return done;
+  let callSlug                           ;
+  const slugOfCall = ()                => {
+    if (callSlug === undefined) {
+      let value      = null;
+      try { value = typeof recordSlug === 'function' ? recordSlug() : recordSlug; } catch { /* no feature */ }
+      callSlug = typeof value === 'string' && SAFE_ID.test(value) && !value.includes('..') ? value : null;
+    }
+    return callSlug;
+  };
+
+  for (const store of adoptedStores(registry)) {
+    const fromDir = path.join(fromState, store.path);
+    let dirStat     ;
+    try { dirStat = fsImpl.lstatSync(fromDir); } catch { continue; }
+    if (dirStat.isSymbolicLink()) {
+      conflicts.push({ worktree: fromDir, main: path.join(toState, store.path), reason: 'link' });
+      continue;
+    }
+    if (!dirStat.isDirectory()) continue;
+    for (const rel of storeFiles(fromDir, store.match, fsImpl)) {
+      const from = path.join(fromDir, rel);
+      if (linkOnTheWay(worktreeRoot, from, fsImpl)) {
+        conflicts.push({ worktree: from, main: path.join(toState, store.path, rel), reason: 'link' });
+        continue;
+      }
+      let toRel = rel;
+      if (!rel.includes(path.sep)) {
+        let bytes                = null;
+        try { bytes = fsImpl.readFileSync(from); } catch { continue; }
+        const slug = ownSlugOf(bytes          ) || slugOfCall();
+        if (slug && slug !== taskIdOf(rel)) toRel = path.join(slug, rel);
+      }
+      const to = path.join(toState, store.path, toRel);
+      if (linkOnTheWay(mainRoot, to, fsImpl)) { conflicts.push({ worktree: from, main: to, reason: 'link' }); continue; }
+      try {
+        const a = fsImpl.lstatSync(from);
+        const b = fsImpl.lstatSync(to);
+        if (a.dev === b.dev && a.ino === b.ino) { conflicts.push({ worktree: from, main: to, reason: 'same-file' }); continue; }
+      } catch { /* one side is absent: not one file */ }
+
+      fsImpl.mkdirSync(path.dirname(to), { recursive: true });
+      const releaseTarget = acquireLock(fsImpl, to);
+      try {
+        const releaseSource = acquireLock(fsImpl, from);
+        try {
+          let bytes        ;
+          try { bytes = fsImpl.readFileSync(from); } catch (error     ) {
+            if (error.code === 'ENOENT') continue; // another sweep moved it
+            throw error;
+          }
+          let there                = null;
+          try { there = fsImpl.readFileSync(to); } catch (error     ) { if (error.code !== 'ENOENT') throw error; }
+          if (there !== null) {
+            if (!bytes.equals(there)) { conflicts.push({ worktree: from, main: to, reason: 'differs' }); continue; }
+            fsImpl.unlinkSync(from);
+            done.removed.push(from);
+            continue;
+          }
+          placeRecord(to, bytes, fsImpl);
+          if (!bytes.equals(fsImpl.readFileSync(to))) { conflicts.push({ worktree: from, main: to, reason: 'differs' }); continue; }
+          fsImpl.unlinkSync(from);
+          done.adopted.push(to);
+        } finally {
+          releaseSource();
+        }
+      } finally {
+        releaseTarget();
+      }
+    }
+  }
+  return conflicts.length ? { ...done, ok: false, error: 'store-conflict', conflicts } : done;
+}
+
+module.exports = { taskStateRoot, sweepWorktreeRecords, placeRecord, adoptedStores, ADOPTER };

package/src/runtime/storage/cli.js

@@ -5,7 +5,7 @@
 const path = require('node:path');
 const fs = require('node:fs');
 const { loadStorageRegistry } = require('./registry.js');
-const { resolveRoots, readPruneSetting } = require('./roots.js');
+const { resolveRoots, createPruneSettingsResolver } = require('./roots.js');
 const { runPass } = require('./engine.js');
 const { upkeepAfterVerb } = require('./upkeep.js');
 const { REPO_ROOT } = require('../../helper/repo-root.js');
@@ -29,10 +29,15 @@ function handleStorageCommand({ action = 'report', json = false, global = false,
     return;
   }
   const roots = resolveRoots({ registry, projectRoot: global ? null : path.resolve(projectRoot), global, env });
-  const projectSetting = readPruneSetting({ registry, roots, rootId: 'project-state', fsImpl });
-  const userSetting = readPruneSetting({ registry, roots, rootId: 'user-state', fsImpl });
-  const setting = Object.fromEntries(Object.keys(roots).map(rootId => [rootId,
-    readPruneSetting({ registry, roots, rootId, fsImpl })]));
+  let settingsView      = null;
+  const resolvePruneSetting = createPruneSettingsResolver({ roots, fsImpl, onView: (view     ) => { settingsView = view; } });
+  const projectSetting = resolvePruneSetting('project-state');
+  const userSetting = resolvePruneSetting('user-state');
+  let deprecationNotes        = [];
+  try {
+    if (settingsView) deprecationNotes = settingsView.notes.filter((note     ) => note.code === 'deprecated' && note.key === 'storage.prune');
+  } catch { /* a settings fault does not change storage's fail-closed report */ }
+  const setting = Object.fromEntries(Object.keys(roots).map(rootId => [rootId, resolvePruneSetting(rootId)]));
   const mode = action === 'prune' ? 'prune' : 'report';
   const result = runPass({ registry, roots, mode, setting, now: Date.now(), env, fsImpl });
   const removed = result.stores.reduce((sum     , row     ) => sum + row.removed, 0);
@@ -42,6 +47,7 @@ function handleStorageCommand({ action = 'report', json = false, global = false,
     // IC-013: an explicitly set DOFLOW_RETENTION_HOURS still removes settled lifecycle events.
     console.log(removed === 0 ? `storage: pruning is off (${decision}); nothing removed`
       : `storage: pruning is off (${decision}); DOFLOW_RETENTION_HOURS still applied to lifecycle events: removed ${removed} ${entries}`);
+    for (const note of deprecationNotes) console.log(`note: ${note.text}`);
     return;
   }
   if (json) {
@@ -53,6 +59,7 @@ function handleStorageCommand({ action = 'report', json = false, global = false,
     return;
   }
   console.log(`Settings: project ${projectSetting.setting}${projectSetting.decidedBy ? ` (${projectSetting.decidedBy})` : ' (default)'}; user ${userSetting.setting}${userSetting.decidedBy ? ` (${userSetting.decidedBy})` : ' (default)'}`);
+  for (const note of deprecationNotes) console.log(`note: ${note.text}`);
   for (const row of result.stores) {
     const names = row.selected.slice(0, 20).map((entry     ) => entry.name);
     const more = row.selected.length > 20 ? `\n    ... and ${row.selected.length - 20} more` : '';

package/src/runtime/storage/engine.js

@@ -7,7 +7,7 @@ const path = require('node:path');
 const { randomBytes } = require('node:crypto');
 const { formatBound } = require('./registry.js');
 const { resolveStorePath } = require('./roots.js');
-const { selectCandidates, recordStillCandidate, protectedLogs, removableRules, ruleOrder, projectRoot } = require('./rules.js');
+const { selectCandidates, recordStillCandidate, protectedLogs, unfinishedRuns, removableRules, ruleOrder, projectRoot } = require('./rules.js');
 const { retainLocked } = require('../lifecycle/store-upkeep.js');
 const { parseWindow, selectExpired } = require('../lifecycle/retention.js');
 const { readEvents } = require('../lifecycle/event-store.js');
@@ -192,7 +192,7 @@ function runPass({registry,roots,stores,mode,setting={},now=Date.now(),budgetMs,
           row.selected=selection.files.map((name     )=>({name,reason:'settled',bytes:stat(fsImpl,path.join(location,name))?.size || 0}));
         } else {
           let output;
-          try { output=retainLocked(project,{fsImpl,now:new Date(now),window,maxFiles:Math.max(0,cap-removals),shouldStop}); }
+          try { output=retainLocked(project,{fsImpl,now:new Date(now),window,maxFiles:Math.max(0,cap-removals),shouldStop,staleTmpMs:registry.settings.staleTmpHours*3600000}); }
           catch(error     ) { row.failed.push({name:store.id,code:error.code || 'EIO'}); continue; }
           row.selected=output.selected.map(({name,bytes}     )=>({name,reason:'settled',bytes}));
           row.removed=output.removed; removals+=row.removed;
@@ -222,6 +222,13 @@ function runPass({registry,roots,stores,mode,setting={},now=Date.now(),budgetMs,
       row.protected=candidates.filter((c     )=>protectedSet.has(c.name)).length;
       candidates=candidates.filter((c     )=>!protectedSet.has(c.name));
     }
+    if (store.protect==='unfinished-run' && candidates.length) {
+      // Fails closed: a file whose run cannot be shown terminal is kept, never reported as a failure.
+      const kept=unfinishedRuns({roots,fsImpl,names:candidates.map((c     )=>c.name),shouldStop});
+      if (kept.incomplete) { result.partial=true; break; }
+      row.protected=candidates.filter((c     )=>kept.names.has(c.name)).length;
+      candidates=candidates.filter((c     )=>!kept.names.has(c.name));
+    }
     const orderedCandidates=store.entry==='record' ? removalOrder(candidates)
       : [...candidates].sort((a,b)=>a.mtimeMs-b.mtimeMs || a.name.localeCompare(b.name));
     if (shouldStop()) { result.partial=true; break; }

package/src/runtime/storage/registry.js

@@ -18,6 +18,9 @@ const RULES                        = new Map([
   ['existing', []],
   ['control', []],
 ]);
+// open-work keeps logs an unfinished task's record names; unfinished-run keeps a worker-model file
+// while its worker run or dispatch is not terminal or cannot be resolved (row 120 IC-005).
+const PROTECTS = new Set(['open-work', 'unfinished-run']);
 const MOMENTS = new Set(['verb', 'session', 'verify', 'install', 'lifecycle-verb', 'uninstall']);
 const STORE_ID = /^[a-z][a-z0-9-]*$/;
 
@@ -70,8 +73,18 @@ function validateStorageRegistry(registry     )
         for (const field of RULES.get(store.rule) || []) if (!positiveInteger(store.bound[field])) error(errors, `${where}.bound.${field}`, 'must be a positive integer');
         if (['existing', 'control'].includes(store.rule) && (typeof store.bound.text !== 'string' || !store.bound.text)) error(errors, `${where}.bound.text`, 'must be a non-empty string');
         if (store.rule === 'existing' && store.bound.value !== undefined && !positiveInteger(store.bound.value)) error(errors, `${where}.bound.value`, 'must be a positive integer when present');
+        if (store.rule === 'count-and-age' && store.bound.either !== undefined && typeof store.bound.either !== 'boolean') error(errors, `${where}.bound.either`, 'must be a boolean when present');
+        const allowed = new Set([
+          ...(RULES.get(store.rule) || []),
+          ...(['existing', 'control'].includes(store.rule) ? ['text'] : []),
+          ...(store.rule === 'existing' ? ['value'] : []),
+          ...(store.rule === 'count-and-age' ? ['either'] : []),
+        ]);
+        for (const key of Object.keys(store.bound)) {
+          if (!allowed.has(key)) error(errors, `${where}.bound`, `unknown key '${key}'`);
+        }
       }
-      if (store.protect !== null && store.protect !== 'open-work') error(errors, `${where}.protect`, 'must be open-work or null');
+      if (store.protect !== null && !PROTECTS.has(store.protect)) error(errors, `${where}.protect`, 'must be open-work, unfinished-run or null');
       if (!Array.isArray(store.moments) || store.moments.some((moment     ) => !MOMENTS.has(moment)) || new Set(store.moments).size !== store.moments.length) error(errors, `${where}.moments`, 'must be a unique subset of known moments');
       if (store.rule === 'existing' && store.moments?.length) error(errors, `${where}.moments`, 'must be empty for existing stores');
       if (!Array.isArray(store.writers) || store.writers.some((writer     ) => typeof writer !== 'string' || !writer)) error(errors, `${where}.writers`, 'must be an array of repository-relative paths');