@latysh-development/monolith 0.1.0-alpha.0 → 0.1.0-alpha.1

package/dist/discovery/traverse.js

@@ -0,0 +1,510 @@
+/**
+ * Bounded, safe project traversal (DISCOVERY-001B-1, ADR-021).
+ *
+ * Lists the directory tree of a project and nothing else: it never reads file
+ * content, never writes, never runs project code and never touches the network.
+ * It is the only code in Discovery that lists directories.
+ *
+ * What it does:
+ *  - lists each directory through `opendir` + `Dir#readSync` (never `readdirSync`),
+ *    one open handle at a time, so a hostile directory cannot be loaded whole before
+ *    a cap applies; the handle is always closed (`finally`);
+ *  - never follows a symlink (it is listed as kind `symlink` and counted; its target is
+ *    never looked at); FIFOs, sockets and devices are listed as `other`, never opened;
+ *  - excludes the real `<monolithRoot>` (resolved with `resolveMonolithRoot`, not by
+ *    the literal name `.monolith`), a fixed list of dependency/build directories, nested
+ *    repositories (a directory holding `.git`) and directories on another file system;
+ *  - bounds the work and the retained result: directory entries READ (every listing counts,
+ *    including the one of a directory later found to be unreadable, replaced or opaque),
+ *    entries per directory, depth, wall-clock time and the UTF-8 bytes of the retained
+ *    paths; every bound that fires yields `PARTIAL` with a typed diagnostic, never a
+ *    silent cut. A nested repository is recognised by one `lstat` of `<dir>/.git` BEFORE
+ *    the directory is listed, so its content is neither read nor counted;
+ *  - is deterministic for an unchanged tree: names are ordered by UTF-16 code units
+ *    (never `localeCompare`), breadth-first, and the result is sorted before it is
+ *    returned. No clock value, absolute path or `readdir` order reaches the result.
+ *
+ * What it does NOT do (ADR-013, SEC-001B.3 open; TM-C unsupported): it does not prevent
+ * and does not reliably detect a process that replaces a directory (e.g. with a symlink)
+ * while the walk runs. The window runs from the `lstat` that queues a directory until
+ * the walk has listed it, i.e. the breadth-first distance in between. Comparing the
+ * identity (`dev`/`ino`) of a directory before and after listing it (`DIR_CHANGED`) may
+ * notice SOME replacements; a replacement that is put back before the second `lstat`
+ * goes unnoticed, and names read from the substitute can then appear as COMPLETE.
+ * Do not run it on a tree an untrusted process is modifying.
+ *
+ * Root: `projectRoot` must be absolute and is the caller's explicit choice. A symlink as
+ * root is accepted and its target is walked (nothing below the root is ever followed, so
+ * the boundary is the directory the caller named). A missing, non-directory, unreadable
+ * or otherwise unresolvable root throws `ROOT_UNSAFE` (from `resolveMonolithRoot`, before
+ * any listing); `ROOT_NOT_DIRECTORY` is the defensive second check. Errors other than a
+ * root-containment error from `resolveMonolithRoot` propagate unchanged.
+ *
+ * Nested MONOLITH instances: only the actual `<monolithRoot>` is excluded. A sub-project
+ * that has its own `.monolith` stays part of the inventory (its sources belong to this
+ * project); that directory is not recognised by name. Excluding the confirmed internals
+ * of nested instances is a decision for DISCOVERY-001B-2.
+ *
+ * The time budget is checked between entries; a synchronous syscall that hangs in the
+ * kernel (e.g. a dead network mount) is not interrupted.
+ */
+import { lstatSync, opendirSync, statSync, constants } from 'fs';
+import { join } from 'path';
+import { RootContainmentError, resolveMonolithRoot } from '../root/index.js';
+/** Starting values (ADR-021 Q-10); validated by the 001B-1 benchmark, see the story report. */
+export const DEFAULT_TRAVERSAL_LIMITS = Object.freeze({
+    maxEntries: 50_000,
+    maxEntriesPerDir: 10_000,
+    maxDepth: 32,
+    deadlineMs: 30_000,
+    // Measured (DISCOVERY-001B-1-F): 50 000 paths of 3.6 KB each retained ~188 MiB of heap;
+    // real trees average well under 100 B per path (a few MiB at 50 000 entries).
+    maxPathBytes: 16 * 1024 * 1024,
+});
+/** Directories never entered, matched by name at any depth. */
+export const EXCLUDED_DIR_NAMES = [
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    '.next',
+    'out',
+    'coverage',
+    '.venv',
+    'venv',
+    '__pycache__',
+    'target',
+    'vendor',
+];
+/** Directories never entered, matched by project-relative path. */
+export const EXCLUDED_DIR_PATHS = ['.claude/worktrees'];
+/** Per code: how many individual paths are listed before only the total is kept. */
+const MAX_DIAGNOSTIC_PATHS = 20;
+const MAX_NAME_BYTES = 255;
+/**
+ * Closed list. `affectsCompleteness` codes make the result PARTIAL (something inside
+ * the declared scope could not be done). The others report the scope policy.
+ * An unknown code is treated as affecting completeness (fail closed).
+ */
+const DIAGNOSTIC_AFFECTS_COMPLETENESS = {
+    LIMIT_ENTRIES: true,
+    LIMIT_DEPTH: true,
+    LIMIT_DIR_ENTRIES: true,
+    LIMIT_DEADLINE: true,
+    LIMIT_PATH_BYTES: true,
+    DIR_UNREADABLE: true,
+    DIR_VANISHED: true,
+    DIR_CHANGED: true,
+    DIR_ERROR: true,
+    NAME_UNREPRESENTABLE: true,
+    ENTRY_UNCLASSIFIED: true,
+    EXCLUDED_DIR: false,
+    MONOLITH_ROOT_EXCLUDED: false,
+    SYMLINK_SKIPPED: false,
+    NESTED_REPO_SKIPPED: false,
+    MOUNT_SKIPPED: false,
+};
+/**
+ * Whether a code is a function of the tree and the parameters alone. A `false` code means a
+ * second walk of the same path may return another result (clock speed, a tree being modified,
+ * a transient I/O failure), so the result is not `reproducible`. Stable codes include the
+ * resource limits that cut a deterministic prefix and permission errors on an unchanged tree.
+ */
+const DIAGNOSTIC_IS_STABLE = {
+    LIMIT_ENTRIES: true,
+    LIMIT_DEPTH: true,
+    LIMIT_DIR_ENTRIES: true,
+    LIMIT_DEADLINE: false,
+    LIMIT_PATH_BYTES: true,
+    DIR_UNREADABLE: true,
+    DIR_VANISHED: false,
+    DIR_CHANGED: false,
+    DIR_ERROR: false,
+    NAME_UNREPRESENTABLE: true,
+    ENTRY_UNCLASSIFIED: false,
+    EXCLUDED_DIR: true,
+    MONOLITH_ROOT_EXCLUDED: true,
+    SYMLINK_SKIPPED: true,
+    NESTED_REPO_SKIPPED: true,
+    MOUNT_SKIPPED: true,
+};
+/** The traversal cannot start or cannot be trusted; no result exists (FAILED). */
+export class TraversalError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = 'TraversalError';
+        this.code = code;
+    }
+}
+const realFs = {
+    opendir: (path) => opendirSync(path),
+    lstat: (path) => lstatSync(path, { bigint: true }),
+    stat: (path) => statSync(path, { bigint: true }),
+};
+// ---------------------------------------------------------------------------
+function resolveLimits(partial) {
+    const limits = { ...DEFAULT_TRAVERSAL_LIMITS, ...(partial ?? {}) };
+    for (const key of Object.keys(DEFAULT_TRAVERSAL_LIMITS)) {
+        const v = limits[key];
+        if (typeof v !== 'number' || !Number.isInteger(v) || v < 1) {
+            throw new TraversalError('INVALID_LIMITS', `limit "${key}" must be a positive integer (got ${String(v)}).`);
+        }
+    }
+    return limits;
+}
+/**
+ * Why a name cannot be represented faithfully, or `null`: U+FFFD (invalid UTF-8 was replaced),
+ * NUL, C0/C1 controls, over-long, empty. The reason is a fixed phrase; the name itself never
+ * reaches a diagnostic.
+ */
+function nameProblem(name) {
+    if (name.length === 0)
+        return 'empty';
+    if (Buffer.byteLength(name, 'utf8') > MAX_NAME_BYTES)
+        return `longer than ${MAX_NAME_BYTES} bytes`;
+    for (let i = 0; i < name.length; i++) {
+        const c = name.charCodeAt(i);
+        if (c < 0x20 || c === 0x7f || (c >= 0x80 && c <= 0x9f))
+            return 'contains a control character';
+        if (c === 0xfffd)
+            return 'contains U+FFFD (invalid UTF-8 or a literal replacement character)';
+    }
+    return null;
+}
+/** UTF-16 code-unit order (the default `<`), not locale order. */
+function compareUnits(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+class DiagnosticLog {
+    byCode = new Map();
+    add(code, message, path) {
+        let slot = this.byCode.get(code);
+        if (!slot) {
+            slot = { total: 0, items: [] };
+            this.byCode.set(code, slot);
+        }
+        slot.total++;
+        if (slot.items.length < MAX_DIAGNOSTIC_PATHS) {
+            slot.items.push(path === undefined ? { code, message } : { code, path, message });
+        }
+    }
+    has(code) {
+        return this.byCode.has(code);
+    }
+    isStable() {
+        for (const code of this.byCode.keys()) {
+            if (!DIAGNOSTIC_IS_STABLE[code])
+                return false;
+        }
+        return true;
+    }
+    affectsCompleteness() {
+        for (const code of this.byCode.keys()) {
+            if (DIAGNOSTIC_AFFECTS_COMPLETENESS[code] !== false)
+                return true;
+        }
+        return false;
+    }
+    toSortedList() {
+        const out = [];
+        for (const [code, slot] of this.byCode) {
+            out.push(...slot.items);
+            if (slot.total > slot.items.length) {
+                out.push({ code, count: slot.total, message: `${slot.total} occurrences in total; the first ${slot.items.length} are listed.` });
+            }
+        }
+        const rank = (d) => (DIAGNOSTIC_AFFECTS_COMPLETENESS[d.code] !== false ? 0 : 1);
+        return out.sort((a, b) => rank(a) - rank(b) ||
+            compareUnits(a.code, b.code) ||
+            compareUnits(a.path ?? '', b.path ?? '') ||
+            compareUnits(a.message, b.message));
+    }
+}
+/**
+ * The only way a file-system error reaches a diagnostic or a thrown message: its `code`, and
+ * only when it looks like an errno name. `message`, `stack` and any other property of an
+ * error are untrusted (a seam or exotic file system can put a path or control characters in
+ * them) and are never copied.
+ */
+const SAFE_ERRNO = /^[A-Z][A-Z0-9_]{1,31}$/;
+const UNKNOWN_ERROR = 'UNKNOWN_ERROR';
+function errno(err) {
+    let code;
+    try {
+        code = err?.code;
+    }
+    catch {
+        return UNKNOWN_ERROR;
+    }
+    return typeof code === 'string' && SAFE_ERRNO.test(code) ? code : UNKNOWN_ERROR;
+}
+/**
+ * List one directory with two hard caps and always close the handle. Reading stops at the
+ * first entry beyond `maxEntriesPerDir` ('opaque') or beyond `budgetLeft` ('budget'; the
+ * directory does not fit in what `maxEntries` leaves). Both outcomes depend only on how many
+ * entries the directory has, never on the order they are returned in. When the caps coincide
+ * the directory is reported as opaque.
+ */
+function listDirectory(fs, abs, maxEntriesPerDir, budgetLeft) {
+    let handle;
+    try {
+        handle = fs.opendir(abs);
+    }
+    catch (err) {
+        return failureOf(err, 0);
+    }
+    const dirents = [];
+    const cap = Math.min(maxEntriesPerDir, budgetLeft);
+    let outcome;
+    try {
+        for (;;) {
+            const dirent = handle.readSync();
+            if (dirent === null)
+                break;
+            if (dirents.length >= cap) {
+                // One entry more than the cap: stop reading, the directory is not enumerated.
+                const opaque = maxEntriesPerDir <= budgetLeft;
+                return opaque
+                    ? { ok: false, read: dirents.length + 1, reason: 'opaque', detail: `more than ${maxEntriesPerDir} entries` }
+                    : { ok: false, read: dirents.length + 1, reason: 'budget', detail: `more than ${budgetLeft} entries left in the budget` };
+            }
+            dirents.push({ name: dirent.name, dirent });
+        }
+        outcome = { ok: true, read: dirents.length, dirents };
+    }
+    catch (err) {
+        outcome = failureOf(err, dirents.length);
+    }
+    finally {
+        try {
+            handle.closeSync();
+        }
+        catch {
+            // A failed close of a read-only handle changes nothing we returned.
+        }
+    }
+    return outcome;
+}
+function failureOf(err, read) {
+    const code = errno(err);
+    if (code === 'EACCES' || code === 'EPERM')
+        return { ok: false, read, reason: 'unreadable', detail: `${code}` };
+    if (code === 'ENOENT' || code === 'ENOTDIR')
+        return { ok: false, read, reason: 'vanished', detail: `${code}` };
+    return { ok: false, read, reason: 'error', detail: code };
+}
+/** Whether `<abs>/.git` exists (any type, not followed). One `lstat`, no listing; any failure means "not known to exist". */
+function hasGitEntry(fs, abs) {
+    try {
+        fs.lstat(join(abs, '.git'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Throws when the type is not reported and `lstat` fails: the caller must not invent a kind. */
+function direntKind(fs, dirent, abs) {
+    if (dirent.isSymbolicLink())
+        return 'symlink';
+    if (dirent.isDirectory())
+        return 'directory';
+    if (dirent.isFile())
+        return 'file';
+    // DT_UNKNOWN: the file system does not report a type in the listing; ask, without following.
+    const st = fs.lstat(abs);
+    if (st.isSymbolicLink())
+        return 'symlink';
+    if (st.isDirectory())
+        return 'directory';
+    if (st.isFile())
+        return 'file';
+    return 'other';
+}
+/**
+ * Walk the project at `projectRoot` and return its structure.
+ *
+ * `projectRoot` is the explicit, caller-resolved project directory (for the CLI: `cwd`).
+ * The instance root is resolved with `resolveMonolithRoot` and excluded. Throws
+ * `TraversalError` when the walk cannot start or be trusted; otherwise returns a
+ * result that says whether it is `COMPLETE` or `PARTIAL`.
+ */
+export function traverseProject(projectRoot, options = {}) {
+    const flags = options.platformFlags ?? { noFollow: constants.O_NOFOLLOW, nonBlock: constants.O_NONBLOCK };
+    if (typeof flags.noFollow !== 'number' || flags.noFollow === 0 || typeof flags.nonBlock !== 'number' || flags.nonBlock === 0) {
+        throw new TraversalError('UNSUPPORTED_PLATFORM', 'this platform lacks O_NOFOLLOW/O_NONBLOCK; Discovery fails closed here (ADR-021).');
+    }
+    const limits = resolveLimits(options.limits);
+    const fs = options.fs ?? realFs;
+    const now = options.now ?? (() => Number(process.hrtime.bigint() / 1000000n));
+    let monolithRoot;
+    try {
+        monolithRoot = resolveMonolithRoot(projectRoot).monolithRoot;
+    }
+    catch (err) {
+        if (err instanceof RootContainmentError)
+            throw new TraversalError('ROOT_UNSAFE', err.message, { cause: err });
+        throw err;
+    }
+    let rootIdentity;
+    try {
+        rootIdentity = fs.stat(projectRoot);
+    }
+    catch (err) {
+        throw new TraversalError('ROOT_NOT_DIRECTORY', `project root is not accessible (${errno(err)}).`);
+    }
+    if (!rootIdentity.isDirectory())
+        throw new TraversalError('ROOT_NOT_DIRECTORY', 'project root is not a directory.');
+    const startedAt = now();
+    const diagnostics = new DiagnosticLog();
+    const entries = [];
+    const stats = { entries: 0, files: 0, directories: 0, symlinks: 0, other: 0, examined: 0, pathBytes: 0, listedDirectories: 0 };
+    let stopped = false;
+    let deadlineFired = false;
+    const overDeadline = () => {
+        if (now() - startedAt > limits.deadlineMs) {
+            if (!deadlineFired)
+                diagnostics.add('LIMIT_DEADLINE', `time budget of ${limits.deadlineMs} ms exhausted; the walk stopped.`);
+            deadlineFired = true;
+            stopped = true;
+        }
+        return stopped;
+    };
+    const queue = [{ rel: '', depth: 0, identity: rootIdentity }];
+    for (let qi = 0; qi < queue.length && !overDeadline(); qi++) {
+        const dir = queue[qi];
+        const abs = dir.rel === '' ? projectRoot : join(projectRoot, dir.rel);
+        const label = dir.rel === '' ? '.' : dir.rel;
+        // A nested repository is recognised without listing it, so its content is neither read nor counted.
+        if (dir.rel !== '' && hasGitEntry(fs, abs)) {
+            diagnostics.add('NESTED_REPO_SKIPPED', 'nested repository or worktree (contains .git); not entered.', label);
+            continue;
+        }
+        const listed = listDirectory(fs, abs, limits.maxEntriesPerDir, limits.maxEntries - stats.examined);
+        // Every listing is charged for what it read, whatever becomes of it (kept, unreadable, replaced, opaque).
+        stats.examined += listed.read;
+        if (stats.examined > limits.maxEntries) {
+            diagnostics.add('LIMIT_ENTRIES', `more than ${limits.maxEntries} entries read; the walk stopped.`);
+            stopped = true;
+        }
+        if (!listed.ok) {
+            if (listed.reason === 'opaque') {
+                diagnostics.add('LIMIT_DIR_ENTRIES', `directory has more than ${limits.maxEntriesPerDir} entries; not enumerated.`, label);
+            }
+            else if (listed.reason === 'budget') {
+                // LIMIT_ENTRIES was recorded above: this directory did not fit in the remaining budget.
+            }
+            else if (listed.reason === 'unreadable') {
+                diagnostics.add('DIR_UNREADABLE', `directory cannot be read (${listed.detail}).`, label);
+            }
+            else if (listed.reason === 'vanished') {
+                diagnostics.add('DIR_VANISHED', `directory disappeared during the walk (${listed.detail}); the tree is being modified.`, label);
+            }
+            else {
+                diagnostics.add('DIR_ERROR', `directory cannot be listed (${listed.detail}).`, label);
+            }
+            continue;
+        }
+        // Identity after listing must match the identity before (may notice a replacement; does not prevent one; see header).
+        let after;
+        try {
+            after = dir.rel === '' ? fs.stat(abs) : fs.lstat(abs);
+        }
+        catch (err) {
+            diagnostics.add('DIR_VANISHED', `directory disappeared during the walk (${errno(err)}); the tree is being modified.`, label);
+            continue;
+        }
+        if (after.dev !== dir.identity.dev || after.ino !== dir.identity.ino || (dir.rel !== '' && !after.isDirectory())) {
+            diagnostics.add('DIR_CHANGED', 'directory was replaced while it was being listed; its contents are discarded.', label);
+            continue;
+        }
+        stats.listedDirectories++;
+        // The probe above normally catches this; the listing is the second look (a .git that appeared meanwhile).
+        const hasGit = listed.dirents.some((d) => d.name === '.git');
+        if (dir.rel !== '' && hasGit) {
+            diagnostics.add('NESTED_REPO_SKIPPED', 'nested repository or worktree (contains .git); not entered.', label);
+            continue;
+        }
+        const sorted = listed.dirents.sort((a, b) => compareUnits(a.name, b.name));
+        for (const { name, dirent } of sorted) {
+            if (overDeadline())
+                break;
+            const rel = dir.rel === '' ? name : `${dir.rel}/${name}`;
+            const problem = nameProblem(name);
+            if (problem !== null) {
+                diagnostics.add('NAME_UNREPRESENTABLE', `an entry whose name ${problem} was excluded; its name is not shown.`, label);
+                continue;
+            }
+            if (rel === monolithRoot) {
+                diagnostics.add('MONOLITH_ROOT_EXCLUDED', 'the MONOLITH instance root is not part of the inventory.', rel);
+                continue;
+            }
+            let kind;
+            try {
+                kind = direntKind(fs, dirent, join(projectRoot, rel));
+            }
+            catch (err) {
+                // No type was reported and lstat failed: do not state a type, and do not hide the cause.
+                diagnostics.add('ENTRY_UNCLASSIFIED', `entry type could not be determined (${errno(err)}); not listed.`, rel);
+                continue;
+            }
+            if (kind === 'directory' && (EXCLUDED_DIR_NAMES.includes(name) || EXCLUDED_DIR_PATHS.includes(rel))) {
+                diagnostics.add('EXCLUDED_DIR', `excluded directory "${name}".`, rel);
+                continue;
+            }
+            const bytes = Buffer.byteLength(rel, 'utf8');
+            if (stats.pathBytes + bytes > limits.maxPathBytes) {
+                diagnostics.add('LIMIT_PATH_BYTES', `retained paths would exceed ${limits.maxPathBytes} bytes; the walk stopped.`);
+                stopped = true;
+                break;
+            }
+            stats.pathBytes += bytes;
+            entries.push({ path: rel, kind });
+            stats.entries++;
+            if (kind === 'file')
+                stats.files++;
+            else if (kind === 'directory')
+                stats.directories++;
+            else if (kind === 'symlink') {
+                stats.symlinks++;
+                diagnostics.add('SYMLINK_SKIPPED', 'symbolic link listed, not followed.', rel);
+            }
+            else
+                stats.other++;
+            if (kind !== 'directory')
+                continue;
+            const depth = dir.depth + 1;
+            if (depth >= limits.maxDepth) {
+                diagnostics.add('LIMIT_DEPTH', `directory is at the maximum depth of ${limits.maxDepth}; not entered.`, rel);
+                continue;
+            }
+            let identity;
+            try {
+                identity = fs.lstat(join(projectRoot, rel));
+            }
+            catch (err) {
+                diagnostics.add('DIR_VANISHED', `directory disappeared during the walk (${errno(err)}); the tree is being modified.`, rel);
+                continue;
+            }
+            if (!identity.isDirectory()) {
+                diagnostics.add('DIR_CHANGED', 'entry listed as a directory is no longer one; not entered.', rel);
+                continue;
+            }
+            if (identity.dev !== rootIdentity.dev) {
+                diagnostics.add('MOUNT_SKIPPED', 'directory is on another file system; not entered.', rel);
+                continue;
+            }
+            queue.push({ rel, depth, identity });
+        }
+    }
+    entries.sort((a, b) => compareUnits(a.path, b.path));
+    return {
+        completeness: diagnostics.affectsCompleteness() ? 'PARTIAL' : 'COMPLETE',
+        reproducible: diagnostics.isStable(),
+        limits,
+        stats,
+        entries,
+        diagnostics: diagnostics.toSortedList(),
+    };
+}

package/dist/durable/errors.d.ts

@@ -156,7 +156,7 @@ export declare class RetentionRefusedError extends DurableError {
 export type PruneCorruptReason = 'register' | 'gap' | 'unknown-artifact' | 'commit-audit' | 'multiple-commit' | 'history' | 'task-dir-missing' | 'tombstone-without-commit' | 'legacy-tombstone-unmigrated';
 /**
  * The persisted prune decision register of a task is corrupt, or the task directory is missing, or it is an
- * unmigrated legacy tombstone. Fail closed: nothing is deleted and nobody is cancelled; an operator decides.
+ * unmigrated legacy tombstone. Fail closed: the refusal deletes no task data; an operator decides.
  * Never mapped to `TaskOrphanedError`, `RetentionRefusedError` or a quarantine, and never retryable.
  * `published` is true when a write the caller made is already visible (the outcome of that write is unknown).
  */
@@ -166,8 +166,12 @@ export declare class PruneDecisionCorruptError extends DurableError {
     readonly file: string | null;
     readonly attempt: number | null;
     readonly published: boolean;
+    /** Why the register was not trusted, when the reason alone does not say (e.g. which datum contradicted a commit). */
+    readonly detail: string | null;
     readonly retryable = false;
-    constructor(taskId: string, reason: PruneCorruptReason, file?: string | null, attempt?: number | null, published?: boolean);
+    constructor(taskId: string, reason: PruneCorruptReason, file?: string | null, attempt?: number | null, published?: boolean, 
+    /** Why the register was not trusted, when the reason alone does not say (e.g. which datum contradicted a commit). */
+    detail?: string | null);
 }
 /** The attempt number would exceed `MAX_PRUNE_ATTEMPTS`. A liveness limit: numbers are never reused or reset. */
 export declare class PruneAttemptLimitError extends DurableError {

package/dist/durable/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/durable/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,gBAAgB,GAChB,aAAa,GACb,aAAa,GACb,aAAa,GACb,eAAe,GACf,uBAAuB,GACvB,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,UAAU,GACV,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,GACrB,mBAAmB,GACnB,wBAAwB,GACxB,qBAAqB,GACrB,gBAAgB,CAAC;AAErB,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;gBACpB,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM;CAKpD;AAED,qBAAa,eAAgB,SAAQ,YAAY;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,YAAY;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAIpC;AAED,gFAAgF;AAChF,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAIpC;AAED,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAIpC;AAED,4DAA4D;AAC5D,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAvC,MAAM,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAI7D;AAED,qBAAa,cAAe,SAAQ,YAAY;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAAnE,MAAM,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM,EAAW,UAAU,EAAE,MAAM;CAIzF;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM;gBAA7F,MAAM,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM,EAAW,YAAY,EAAE,MAAM;CAInH;AAED,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAzC,MAAM,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM;CAI/D;AAED,8GAA8G;AAC9G,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAApE,MAAM,EAAE,MAAM,EAAW,GAAG,EAAE,MAAM,GAAG,IAAI,EAAW,MAAM,EAAE,MAAM;CAI1F;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;gBAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI3C;AAED,gGAAgG;AAChG,qBAAa,mBAAoB,SAAQ,YAAY;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAA3D,MAAM,EAAE,MAAM,EAAW,GAAG,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CAIjF;AAED,qBAAa,gBAAiB,SAAQ,YAAY;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAAtC,MAAM,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;CAQ5D;AAED,mHAAmH;AACnH,qBAAa,kBAAmB,SAAQ,YAAY;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAA5C,OAAO,EAAE,MAAM,EAAW,UAAU,EAAE,MAAM;CAIzD;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,YAAY;IAEf,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;IADrD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;gBAC3B,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAKtD;AAYD,oGAAoG;AACpG,qBAAa,kBAAmB,SAAQ,YAAY;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM;gBAA1C,MAAM,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM;CAIhE;AAED,qBAAa,iBAAkB,SAAQ,YAAY;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAnE,MAAM,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAIzF;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,YAAY;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAAzC,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAItD;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM;gBAA1C,MAAM,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM;CAIhE;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,YAAY;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,cAAc,EAAE,MAAM;gBAA/C,MAAM,EAAE,MAAM,EAAW,cAAc,EAAE,MAAM;CAIrE;AAED;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,YAAY;IAE5C,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,cAAc,EAAE,MAAM;IADpE,QAAQ,CAAC,SAAS,QAAQ;gBACL,MAAM,EAAE,MAAM,EAAW,cAAc,EAAE,MAAM;CAIrE;AAED,qBAAa,qBAAsB,SAAQ,YAAY;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM;gBAApC,MAAM,EAAE,MAAM,EAAW,GAAG,EAAE,MAAM;CAI1D;AAED,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,KAAK,GACL,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,SAAS,GACT,kBAAkB,GAClB,0BAA0B,GAC1B,6BAA6B,CAAC;AAElC;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,YAAY;IAGvD,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,kBAAkB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAC/B,QAAQ,CAAC,SAAS;IANpB,QAAQ,CAAC,SAAS,SAAS;gBAEhB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,MAAM,GAAG,IAAW,EAC1B,OAAO,GAAE,MAAM,GAAG,IAAW,EAC7B,SAAS,UAAQ;CAQ7B;AAED,iHAAiH;AACjH,qBAAa,sBAAuB,SAAQ,YAAY;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAzC,MAAM,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM;CAI/D;AAED,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,sBAAsB,GAAG,0BAA0B,CAAC;AAEjH;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IACrB,QAAQ,CAAC,UAAU,EAAE,iBAAiB;gBAAvD,OAAO,EAAE,MAAM,EAAW,UAAU,EAAE,iBAAiB;CAIpE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/durable/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,gBAAgB,GAChB,aAAa,GACb,aAAa,GACb,aAAa,GACb,eAAe,GACf,uBAAuB,GACvB,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,UAAU,GACV,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,GACrB,mBAAmB,GACnB,wBAAwB,GACxB,qBAAqB,GACrB,gBAAgB,CAAC;AAErB,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;gBACpB,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM;CAKpD;AAED,qBAAa,eAAgB,SAAQ,YAAY;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,YAAY;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAIpC;AAED,gFAAgF;AAChF,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAIpC;AAED,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAIpC;AAED,4DAA4D;AAC5D,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAvC,MAAM,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAI7D;AAED,qBAAa,cAAe,SAAQ,YAAY;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAAnE,MAAM,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM,EAAW,UAAU,EAAE,MAAM;CAIzF;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM;gBAA7F,MAAM,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM,EAAW,YAAY,EAAE,MAAM;CAInH;AAED,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAzC,MAAM,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM;CAI/D;AAED,8GAA8G;AAC9G,qBAAa,eAAgB,SAAQ,YAAY;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAApE,MAAM,EAAE,MAAM,EAAW,GAAG,EAAE,MAAM,GAAG,IAAI,EAAW,MAAM,EAAE,MAAM;CAI1F;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;gBAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI3C;AAED,gGAAgG;AAChG,qBAAa,mBAAoB,SAAQ,YAAY;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAA3D,MAAM,EAAE,MAAM,EAAW,GAAG,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CAIjF;AAED,qBAAa,gBAAiB,SAAQ,YAAY;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAAtC,MAAM,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;CAQ5D;AAED,mHAAmH;AACnH,qBAAa,kBAAmB,SAAQ,YAAY;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAA5C,OAAO,EAAE,MAAM,EAAW,UAAU,EAAE,MAAM;CAIzD;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,YAAY;IAEf,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;IADrD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;gBAC3B,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAKtD;AAYD,oGAAoG;AACpG,qBAAa,kBAAmB,SAAQ,YAAY;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM;gBAA1C,MAAM,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM;CAIhE;AAED,qBAAa,iBAAkB,SAAQ,YAAY;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAnE,MAAM,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAIzF;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,YAAY;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAAzC,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAItD;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM;gBAA1C,MAAM,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM;CAIhE;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,YAAY;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,cAAc,EAAE,MAAM;gBAA/C,MAAM,EAAE,MAAM,EAAW,cAAc,EAAE,MAAM;CAIrE;AAED;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,YAAY;IAE5C,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,cAAc,EAAE,MAAM;IADpE,QAAQ,CAAC,SAAS,QAAQ;gBACL,MAAM,EAAE,MAAM,EAAW,cAAc,EAAE,MAAM;CAIrE;AAED,qBAAa,qBAAsB,SAAQ,YAAY;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM;gBAApC,MAAM,EAAE,MAAM,EAAW,GAAG,EAAE,MAAM;CAI1D;AAED,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,KAAK,GACL,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,SAAS,GACT,kBAAkB,GAClB,0BAA0B,GAC1B,6BAA6B,CAAC;AAElC;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,YAAY;IAGvD,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,kBAAkB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAC/B,QAAQ,CAAC,SAAS;IAClB,qHAAqH;IACrH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IARhC,QAAQ,CAAC,SAAS,SAAS;gBAEhB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,MAAM,GAAG,IAAW,EAC1B,OAAO,GAAE,MAAM,GAAG,IAAW,EAC7B,SAAS,UAAQ;IAC1B,qHAAqH;IAC5G,MAAM,GAAE,MAAM,GAAG,IAAW;CAYxC;AAED,iHAAiH;AACjH,qBAAa,sBAAuB,SAAQ,YAAY;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAzC,MAAM,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM;CAI/D;AAED,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,sBAAsB,GAAG,0BAA0B,CAAC;AAEjH;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IACrB,QAAQ,CAAC,UAAU,EAAE,iBAAiB;gBAAvD,OAAO,EAAE,MAAM,EAAW,UAAU,EAAE,iBAAiB;CAIpE"}

package/dist/durable/errors.js

@@ -270,7 +270,7 @@ export class RetentionRefusedError extends DurableError {
 }
 /**
  * The persisted prune decision register of a task is corrupt, or the task directory is missing, or it is an
- * unmigrated legacy tombstone. Fail closed: nothing is deleted and nobody is cancelled; an operator decides.
+ * unmigrated legacy tombstone. Fail closed: the refusal deletes no task data; an operator decides.
  * Never mapped to `TaskOrphanedError`, `RetentionRefusedError` or a quarantine, and never retryable.
  * `published` is true when a write the caller made is already visible (the outcome of that write is unknown).
  */
@@ -280,14 +280,20 @@ export class PruneDecisionCorruptError extends DurableError {
     file;
     attempt;
     published;
+    detail;
     retryable = false;
-    constructor(taskId, reason, file = null, attempt = null, published = false) {
-        super('PRUNE_DECISION_CORRUPT', `the prune decision register of task "${taskId}" cannot be trusted (${reason}${file ? `: ${file}` : ''}); nothing was deleted or cancelled.`);
+    constructor(taskId, reason, file = null, attempt = null, published = false, 
+    /** Why the register was not trusted, when the reason alone does not say (e.g. which datum contradicted a commit). */
+    detail = null) {
+        super('PRUNE_DECISION_CORRUPT', `the prune decision register of task "${taskId}" cannot be trusted (${reason}${file ? `: ${file}` : ''}${detail ? `; ${detail}` : ''}); ${published
+            ? 'this call had already made a write visible and does not take it back (a compaction may also have removed loose copies of the events it packed); another process may have changed the task too.'
+            : 'this call removed no task data, but it may have recorded a prune-register entry; another process may have changed the task.'}`);
         this.taskId = taskId;
         this.reason = reason;
         this.file = file;
         this.attempt = attempt;
         this.published = published;
+        this.detail = detail;
         this.name = 'PruneDecisionCorruptError';
     }
 }

package/dist/durable/fs-store.d.ts

@@ -160,6 +160,27 @@ export declare class FsEventStore implements EventStore {
     }): Promise<{
         removedFiles: number;
     }>;
+    /**
+     * The events (and covered segment lines) still on disk with `seq <= upTo`, each verified on its own; no gap is an error,
+     * because a roll-forward that was interrupted leaves gaps. A segment wins over a loose copy of the same slot (the reader's
+     * rule). Anything that cannot be read safely or does not verify throws: the audit then refuses instead of guessing.
+     */
+    private survivingEvents;
+    /**
+     * O-1: a committed register is not self-proving (its checksum is unkeyed), so the data still on disk must not contradict
+     * it before anything is unlinked. See `committedProblem` for what a partly removed log can and cannot prove. Reads only.
+     *
+     * I-1: the data is read FIRST and `tombstone.json` AFTER it. The roll-forward publishes the tombstone before its first
+     * unlink and nothing ever removes it, so a tombstone that is still absent after the data was read proves that no unlink
+     * had begun when the data was read (it was absent at every earlier moment too): a gap in the data is then not a removal
+     * but a torn observation or real damage. The loose files are read before the segments are listed (see `survivingEvents`), so a
+     * compaction that moves events into a segment meanwhile does not tear the observation. Read the
+     * other way round, a concurrent pruner that publishes the tombstone and removes events between the two reads is taken
+     * for damage. A gap seen without a tombstone is still looked at again a few times before it is refused (a defence in depth,
+     * not what F-1 relies on). No lock: a pruner that races this audit only ever turns the verdict
+     * from "the whole log must be there" into "a part may be gone", and the roll-forward still checks the tombstone it finds.
+     */
+    private auditCommitted;
     /**
      * Prune cleanup (class C, section 30.3): only for a verified, consistent `COMMITTED`. Publishes `tombstone.json` from the
      * commit, then removes the data of the task. It never touches the register, `tombstone.json` or the task directory,

package/dist/durable/fs-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-store.d.ts","sourceRoot":"","sources":["../../src/durable/fs-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,OAAO,EAKL,YAAY,EAMb,MAAM,aAAa,CAAC;AAuBrB,OAAO,EAAoC,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACnH,OAAO,EASL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAmB,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE9H,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC;IACtC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAUlD,qBAAa,yBAA0B,SAAQ,YAAY;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM;gBAApC,MAAM,EAAE,MAAM,EAAW,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI3E;AA2BD,qFAAqF;AACrF,MAAM,MAAM,cAAc;AACxB,mFAAmF;AACjF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE;AAC/B,iFAAiF;GAC/E;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE;AACxE,oHAAoH;GAClH;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,qBAAqB,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAgB/E,qBAAa,YAAa,YAAW,UAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,4IAA4I;IAC5I,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAEzB,IAAI,EAAE,cAAc;IAShC;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,WAAW;IAGnB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,UAAU;IAoBlB,OAAO,CAAC,QAAQ;IAIhB;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC;IAY/C;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,aAAa,GAAG,qBAAqB,CAAC;IAI1E,kGAAkG;IAClG,sBAAsB,IAAI,aAAa,GAAG,qBAAqB;IAiC/D,wHAAwH;IACxH,OAAO,CAAC,IAAI;IAqBZ,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,OAAO;IAYf;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAqCrB,gFAAgF;IAChF,OAAO,CAAC,WAAW;IA8BnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAwCnB,OAAO,CAAC,UAAU;IAalB,sHAAsH;IACtH,OAAO,CAAC,YAAY;IAcpB,8DAA8D;IAC9D,OAAO,CAAC,MAAM;IAgBd,wDAAwD;IACxD,OAAO,CAAC,OAAO;IAiBT,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKrD,OAAO,CAAC,aAAa;IAYrB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAShB,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAkClF,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IAoClI,UAAU,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/C,iBAAiB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtD,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,GAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAkD5G;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAwCnB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;;;OAIG;YACW,MAAM;IA+Bd,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAUhC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtG,OAAO,CAAC,WAAW;IAqHnB,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,QAAQ;IAIhB,qFAAqF;IACrF,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,YAAY;IASpB,wEAAwE;IACxE,OAAO,CAAC,gBAAgB;IAexB;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAoCjB;;;;OAIG;IACH,OAAO,CAAC,GAAG;IAwBX,qHAAqH;IACrH,OAAO,CAAC,WAAW;IAMb,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;IAuEtD,mEAAmE;IACnE,OAAO,CAAC,SAAS;IAKjB,yGAAyG;IACzG,OAAO,CAAC,kBAAkB;IAUpB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8EjG,uGAAuG;IACvG,OAAO,CAAC,sBAAsB;IAaxB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBpF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,eAAe,GAAG,gBAAgB,CAAC;IAoCnH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAoBvF,8IAA8I;IAC9I,OAAO,CAAC,UAAU;IAWlB;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAYjB"}
+{"version":3,"file":"fs-store.d.ts","sourceRoot":"","sources":["../../src/durable/fs-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,OAAO,EAKL,YAAY,EAMb,MAAM,aAAa,CAAC;AAuBrB,OAAO,EAAoC,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACnH,OAAO,EASL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAmB,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE9H,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC;IACtC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAYlD,qBAAa,yBAA0B,SAAQ,YAAY;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM;gBAApC,MAAM,EAAE,MAAM,EAAW,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI3E;AA2BD,qFAAqF;AACrF,MAAM,MAAM,cAAc;AACxB,mFAAmF;AACjF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE;AAC/B,iFAAiF;GAC/E;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE;AACxE,oHAAoH;GAClH;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,qBAAqB,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAgB/E,qBAAa,YAAa,YAAW,UAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,4IAA4I;IAC5I,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAEzB,IAAI,EAAE,cAAc;IAShC;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,WAAW;IAGnB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,UAAU;IAoBlB,OAAO,CAAC,QAAQ;IAIhB;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC;IAY/C;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,aAAa,GAAG,qBAAqB,CAAC;IAI1E,kGAAkG;IAClG,sBAAsB,IAAI,aAAa,GAAG,qBAAqB;IAiC/D,wHAAwH;IACxH,OAAO,CAAC,IAAI;IAqBZ,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,OAAO;IAYf;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAqCrB,gFAAgF;IAChF,OAAO,CAAC,WAAW;IA8BnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAwCnB,OAAO,CAAC,UAAU;IAalB,sHAAsH;IACtH,OAAO,CAAC,YAAY;IAcpB,8DAA8D;IAC9D,OAAO,CAAC,MAAM;IAgBd,wDAAwD;IACxD,OAAO,CAAC,OAAO;IAiBT,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKrD,OAAO,CAAC,aAAa;IAYrB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAShB,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAkClF,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IAoClI,UAAU,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/C,iBAAiB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtD,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,GAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAmD5G;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAsCvB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,cAAc;IA2BtB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAwCnB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAOlB;;;;OAIG;YACW,MAAM;IA+Bd,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAUhC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtG,OAAO,CAAC,WAAW;IAqHnB,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,QAAQ;IAIhB,qFAAqF;IACrF,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,YAAY;IASpB,wEAAwE;IACxE,OAAO,CAAC,gBAAgB;IAexB;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAoCjB;;;;OAIG;IACH,OAAO,CAAC,GAAG;IAwBX,qHAAqH;IACrH,OAAO,CAAC,WAAW;IAMb,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;IAuEtD,mEAAmE;IACnE,OAAO,CAAC,SAAS;IAKjB,yGAAyG;IACzG,OAAO,CAAC,kBAAkB;IAUpB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8EjG,uGAAuG;IACvG,OAAO,CAAC,sBAAsB;IAaxB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBpF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,eAAe,GAAG,gBAAgB,CAAC;IAoCnH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAoBvF,8IAA8I;IAC9I,OAAO,CAAC,UAAU;IAWlB;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAYjB"}