@latysh-development/monolith 0.1.0-alpha.3 → 0.1.0-alpha.4

package/dist/root/safe-write.js

@@ -18,7 +18,11 @@
  *    temp name, never from an error code. UNKNOWN is never retried and never
  *    silently downgraded;
  *  - identity-checked cleanup: only a temp file THIS call created, and only if
- *    the name still shows the `dev/ino` recorded from the descriptor.
+ *    the name still shows the inode of a separate read-only IDENTITY descriptor,
+ *    which stays open until publication and cleanup are finished (an open
+ *    descriptor pins the inode, so it cannot be recycled for a foreign file: no
+ *    ABA). The WRITING descriptor is closed before publication (ADR-012). The
+ *    `lstat` -> `unlink` step itself remains non-atomic (residual race, ADR-012).
  *
  * Not routed through here: lock release and stale-lock recovery (`lock.ts`)
  * unlink the lock path directly, and `trusted-directory` scope creates its
@@ -484,13 +488,25 @@ function safeClose(ctx, fd) {
     }
 }
 /**
- * Remove `token`'s file iff the name still shows the recorded identity. Never
- * removes anything else. The unlink itself is not conditional (no `unlinkat`):
- * a name swapped between the check and the unlink is a residual race.
+ * Does `st` (an `lstat` of the temp name) show the file this call created?
+ * Throws if the proof itself cannot be obtained (fstat failed, or the
+ * descriptor no longer shows the recorded identity): callers treat a throw as
+ * "ownership NOT shown".
  */
-export function disposeOwned(parent, token, opts = {}) {
-    const ctx = ctxOf(opts);
-    const path = join(pdata(parent).path, token.name);
+function showsOwned(ctx, held, st) {
+    if (!st.isFile())
+        return false;
+    if (held.fd === null)
+        return sameId(st, held.token.dev, held.token.ino);
+    if (held.closed)
+        throw new Error('descriptor already released; ownership cannot be proven');
+    const live = ctx.ops.fstatSync(held.fd, { bigint: true });
+    if (!live.isFile() || !sameId(live, held.token.dev, held.token.ino))
+        throw new Error('descriptor identity changed');
+    return sameId(st, live.dev, live.ino);
+}
+function disposeHeld(parent, held, ctx) {
+    const path = join(pdata(parent).path, held.token.name);
     let st;
     try {
         st = bigLstatOrNull(ctx, path);
@@ -500,7 +516,14 @@ export function disposeOwned(parent, token, opts = {}) {
     }
     if (st === null)
         return 'absent';
-    if (!st.isFile() || !sameId(st, token.dev, token.ino))
+    let ours;
+    try {
+        ours = showsOwned(ctx, held, st);
+    }
+    catch {
+        return 'failed'; // ownership could not be established: do NOT unlink
+    }
+    if (!ours)
         return 'not-owned';
     try {
         ctx.ops.unlinkSync(path);
@@ -510,6 +533,42 @@ export function disposeOwned(parent, token, opts = {}) {
         return errnoOf(err) === 'ENOENT' ? 'absent' : 'failed';
     }
 }
+/**
+ * Remove `token`'s file iff the name still shows the recorded identity. Never
+ * removes anything else. This token-only form has no live descriptor and so
+ * cannot exclude inode reuse after the caller closed its own; the writes in
+ * this module use `disposeHeld`. The unlink itself is not conditional (no
+ * `unlinkat`): a name swapped between the check and the unlink is a residual race.
+ */
+export function disposeOwned(parent, token, opts = {}) {
+    return disposeHeld(parent, { token, fd: null, closed: true }, ctxOf(opts));
+}
+/** Close the held descriptor exactly once. Never throws; returns the close error, if any. */
+function releaseHeld(ctx, held) {
+    if (held.fd === null || held.closed)
+        return undefined;
+    held.closed = true;
+    try {
+        ctx.ops.closeSync(held.fd);
+    }
+    catch (err) {
+        return err;
+    }
+    return undefined;
+}
+/** Keep the original failure; mention a failed release of the descriptor. */
+function withCloseNote(err, closeErr) {
+    if (closeErr === undefined || !(err instanceof SafeWriteError))
+        return err;
+    return new SafeWriteError(`${err.message} The identity descriptor also failed to close: ${errMsg(closeErr)}.`, {
+        code: err.code,
+        phase: err.phase,
+        publication: err.publication,
+        path: err.path,
+        tmp: err.tmp,
+        cause: err.cause,
+    });
+}
 function tmpInfo(res, name) {
     switch (res) {
         case 'removed':
@@ -587,22 +646,70 @@ function inspectTarget(parent, name, ctx, mode) {
     return { existing: st };
 }
 /**
- * Steps 1-5b of the durability order: create, write, fchmod, verify the
- * descriptor, fsync the file, close. Any failure leaves the destination
- * untouched and removes the temp file only if ownership still verifies.
+ * Flags of the identity descriptor: `O_RDONLY|O_NOFOLLOW|O_NONBLOCK`. Without
+ * `O_NOFOLLOW` (Windows, best-effort per ADR-012) the flag is simply absent and
+ * `stage` compensates with an `lstat` check; that is NOT equivalent protection.
+ * `O_NONBLOCK` keeps a swapped-in FIFO from blocking the open.
+ */
+function identityFlags(ctx) {
+    const c = fs.constants;
+    const nonBlock = typeof c.O_NONBLOCK === 'number' ? c.O_NONBLOCK : 0;
+    // On POSIX a missing O_NONBLOCK would allow a blocking open of a swapped FIFO: refuse.
+    if (nonBlock === 0 && ctx.caps.posix)
+        return null;
+    return c.O_RDONLY | (ctx.caps.noFollow ? c.O_NOFOLLOW : 0) | nonBlock;
+}
+/**
+ * Steps of the durability order (ADR-012) with TWO descriptors:
+ *
+ *  - WRITING fd (from `createExclusive`): write, fchmod, verify, fsync, then
+ *    CLOSED before publication (a deferred write error surfaces at `close` and
+ *    must make the write NOT_PUBLISHED);
+ *  - IDENTITY fd (separate read-only `open`, not `dup`): opened right after the
+ *    create while the writing fd is open, proven to be the same inode, and
+ *    returned STILL OPEN. Its owner from here on is the caller, which releases
+ *    it with `releaseHeld` after publication and cleanup. It pins the inode
+ *    (no ABA) for verification and cleanup.
+ *
+ * Any failure leaves the destination untouched, removes the temp file only if
+ * ownership still verifies against a live descriptor, and closes every
+ * descriptor still owned here exactly once (`releaseHeld` marks before closing,
+ * so a failed close is never repeated).
  */
 function stage(parent, finalName, data, finalMode, createMode, fsyncFile, ctx) {
     const dir = pdata(parent).path;
     const owned = createExclusive(parent, tempName(finalName), createMode, { ops: ctx.ops, caps: ctx.caps });
     const { fd, token } = owned;
     const tmpPath = join(dir, token.name);
-    let closed = false;
+    const writing = { token, fd, closed: false };
+    let identity = null;
+    let identityProven = false; // until proven, only the writing descriptor vouches for ownership
+    // Owner-read elevation (ALPHA4-SEC-SAFEWRITE-008): the mode the file really had
+    // after creation, set ONLY while `0o400` was temporarily added so the read-only
+    // identity descriptor can be opened. `null` = no elevation outstanding.
+    let restoreMode = null;
     const abort = (code, phase, what, cause) => {
-        if (!closed)
-            safeClose(ctx, fd);
-        closed = true;
-        const info = tmpInfo(disposeOwned(parent, token, { ops: ctx.ops, caps: ctx.caps }), token.name);
-        throw new SafeWriteError(`${what}: ${errMsg(cause)}.${residueNote(info, dir)}`, {
+        // Put the mode back first, while the writing descriptor is still open. A
+        // failure here never replaces the original error; it is reported in the message.
+        let modeNote = '';
+        let modeRestoreFailed = false;
+        if (restoreMode !== null && !writing.closed) {
+            try {
+                ctx.ops.fchmodSync(fd, restoreMode);
+                restoreMode = null;
+            }
+            catch (restoreErr) {
+                modeRestoreFailed = true;
+                modeNote = ` The original mode of the temporary file could not be restored after the temporary owner-read elevation: ${errMsg(restoreErr)}.`;
+            }
+        }
+        // Cleanup next, while a live descriptor still proves what the name must show.
+        const info = tmpInfo(disposeHeld(parent, identityProven && identity ? identity : writing, ctx), token.name);
+        if (modeRestoreFailed && info.owned && !info.removed)
+            modeNote += ' The temporary file was left with the owner-read permission added.';
+        const closeErrs = [releaseHeld(ctx, writing), identity ? releaseHeld(ctx, identity) : undefined].filter((e) => e !== undefined);
+        const note = closeErrs.length === 0 ? '' : ` A descriptor also failed to close: ${closeErrs.map(errMsg).join('; ')}.`;
+        throw new SafeWriteError(`${what}: ${errMsg(cause)}.${residueNote(info, dir)}${modeNote}${note}`, {
             code,
             phase,
             publication: 'NOT_PUBLISHED',
@@ -611,6 +718,55 @@ function stage(parent, finalName, data, finalMode, createMode, fsyncFile, ctx) {
             cause,
         });
     };
+    // Owner-read elevation: the identity descriptor is read-only, so a staging
+    // file created without owner-read (e.g. `exactMode:false` with 0o200/0o000)
+    // could not be opened. Only the mode bit is added, only on the file THIS call
+    // created, and only when `0o400` is missing; the mode is restored at the
+    // `fchmod` step below, before fsync and close.
+    let createdMode;
+    try {
+        const st = ctx.ops.fstatSync(fd, { bigint: true });
+        if (!st.isFile())
+            throw new Error('not a regular file');
+        createdMode = Number(st.mode) & 0o7777;
+    }
+    catch (err) {
+        return abort('WRITE_VERIFY_FAILED', 'identity', `cannot inspect the mode of "${tmpPath}"`, err);
+    }
+    if ((createdMode & 0o400) === 0) {
+        try {
+            ctx.ops.fchmodSync(fd, createdMode | 0o400);
+        }
+        catch (err) {
+            return abort(codeForErrno(err), 'chmod', `cannot add owner-read to "${tmpPath}" for the identity descriptor`, err);
+        }
+        restoreMode = createdMode;
+    }
+    // Identity descriptor: opened before fchmod, while the writing one is open.
+    let idFd;
+    try {
+        const flags = identityFlags(ctx);
+        if (flags === null)
+            throw new Error('O_NONBLOCK is unavailable, so a swapped-in FIFO could block the open');
+        idFd = ctx.ops.openSync(tmpPath, flags);
+        identity = { token, fd: idFd, closed: false };
+        const w = ctx.ops.fstatSync(fd, { bigint: true });
+        const i = ctx.ops.fstatSync(idFd, { bigint: true });
+        if (!w.isFile() || !i.isFile())
+            throw new Error('not a regular file');
+        if (!sameId(i, w.dev, w.ino) || !sameId(i, token.dev, token.ino))
+            throw new Error('identity descriptor shows a different file');
+        if (!ctx.caps.noFollow) {
+            // No O_NOFOLLOW: the name must still be the very file both descriptors show.
+            const at = bigLstat(ctx, tmpPath);
+            if (at.isSymbolicLink() || !sameId(at, w.dev, w.ino))
+                throw new Error('path no longer names the created file');
+        }
+        identityProven = true;
+    }
+    catch (err) {
+        return abort('WRITE_VERIFY_FAILED', 'identity', `cannot establish the identity descriptor of "${tmpPath}"`, err);
+    }
     try {
         let off = 0;
         while (off < data.length) {
@@ -623,9 +779,13 @@ function stage(parent, finalName, data, finalMode, createMode, fsyncFile, ctx) {
     catch (err) {
         return abort(codeForErrno(err), 'write', `cannot write "${tmpPath}"`, err);
     }
-    if (finalMode !== null) {
+    // The final mode, or (after an elevation) the original mode. Without either
+    // there is no `fchmod` at all: ordinary modes are never touched.
+    const targetMode = finalMode ?? restoreMode;
+    if (targetMode !== null) {
         try {
-            ctx.ops.fchmodSync(fd, finalMode);
+            ctx.ops.fchmodSync(fd, targetMode);
+            restoreMode = null;
         }
         catch (err) {
             return abort(codeForErrno(err), 'chmod', `cannot set the mode of "${tmpPath}"`, err);
@@ -641,7 +801,7 @@ function stage(parent, finalName, data, finalMode, createMode, fsyncFile, ctx) {
             throw new Error(`size is ${st.size}, expected ${data.length}`);
         if (!sameId(st, token.dev, token.ino))
             throw new Error('identity changed');
-        if (finalMode !== null && (Number(st.mode) & 0o777) !== finalMode)
+        if (targetMode !== null && (Number(st.mode) & 0o777) !== (finalMode !== null ? finalMode : targetMode & 0o777))
             throw new Error('mode does not match');
         if (ctx.caps.ownerCheck && Number(st.uid) !== process.geteuid())
             throw new Error('not owned by the effective user');
@@ -658,17 +818,35 @@ function stage(parent, finalName, data, finalMode, createMode, fsyncFile, ctx) {
             return abort('WRITE_FSYNC_FAILED', 'fsync', `cannot fsync "${tmpPath}"`, err);
         }
     }
+    // The writing descriptor is closed BEFORE publication (ADR-012): a close error
+    // forbids publishing. Whatever close reports, the fd number is spent and is
+    // never closed again.
+    const closeErr = releaseHeld(ctx, writing);
+    if (closeErr !== undefined) {
+        return abort(codeForErrno(closeErr), 'close', `cannot close "${tmpPath}"`, closeErr);
+    }
+    // The identity descriptor must still show the same, complete file.
     try {
-        closed = true;
-        ctx.ops.closeSync(fd);
+        const st = ctx.ops.fstatSync(idFd, { bigint: true });
+        if (!st.isFile() || !sameId(st, token.dev, token.ino))
+            throw new Error('identity changed after close');
+        if (st.nlink !== 1n)
+            throw new Error(`link count is ${st.nlink}`);
+        if (st.size !== BigInt(data.length))
+            throw new Error(`size is ${st.size}, expected ${data.length}`);
     }
     catch (err) {
-        return abort(codeForErrno(err), 'close', `cannot close "${tmpPath}"`, err);
+        return abort('WRITE_VERIFY_FAILED', 'verify', `temporary file "${tmpPath}" failed verification after close`, err);
     }
-    return { token, tmpPath };
+    return { token, fd: idFd, closed: false, tmpPath };
 }
-function isOurs(st, staged) {
-    return st !== null && st.isFile() && sameId(st, staged.token.dev, staged.token.ino);
+/**
+ * Is `st` the file this call created? Decided against the LIVE descriptor
+ * (`fstat(fd)`), not a remembered `dev/ino`. A throw means the proof could not
+ * be obtained and must be read as "unknown" by the caller.
+ */
+function isOurs(st, staged, ctx) {
+    return st !== null && showsOwned(ctx, staged, st);
 }
 /**
  * One read-only look at the two names after a publish call failed. NO errno is
@@ -691,10 +869,10 @@ function isOurs(st, staged) {
 function verifyPublication(kind, errno, targetPath, staged, ctx) {
     try {
         const t = bigLstatOrNull(ctx, targetPath);
-        if (isOurs(t, staged))
+        if (isOurs(t, staged, ctx))
             return 'published';
         const m = bigLstatOrNull(ctx, staged.tmpPath);
-        if (isOurs(m, staged)) {
+        if (isOurs(m, staged, ctx)) {
             if (kind === 'link' && errno === 'EEXIST') {
                 // Held by another object, or it vanished again while our temp name was
                 // never linked (link count 1): either way nothing of ours was published.
@@ -714,7 +892,7 @@ function publishFailure(kind, err, parent, staged, targetPath, ctx, warnings) {
     const dir = pdata(parent).path;
     const errno = errnoOf(err);
     const notPublished = (code, what) => {
-        const info = tmpInfo(disposeOwned(parent, staged.token, { ops: ctx.ops, caps: ctx.caps }), staged.token.name);
+        const info = tmpInfo(disposeHeld(parent, staged, ctx), staged.token.name);
         throw new SafeWriteError(`${what}: ${errMsg(err)}. The destination was not modified.${residueNote(info, dir)}`, {
             code,
             phase: 'publish',
@@ -763,7 +941,8 @@ export function publishLink(parent, token, finalName, opts = {}) {
     const ctx = ctxOf(opts);
     validName(finalName, parent);
     const dir = pdata(parent).path;
-    const staged = { token, tmpPath: join(dir, token.name) };
+    // The caller already closed its descriptor: token-only (legacy) identity, see `Held`.
+    const staged = { token, fd: null, closed: true, tmpPath: join(dir, token.name) };
     const targetPath = join(dir, finalName);
     const warnings = [];
     assertParentUnchanged(parent, ctx);
@@ -858,22 +1037,46 @@ export function replaceFile(parent, name, data, opts) {
         finalMode = p.finalExact ? opts.mode : null;
     const warnings = platformWarnings(ctx);
     const staged = stage(parent, name, buf, finalMode, p.finalExact || existing ? 0o600 : opts.mode, p.fsyncFile, ctx);
-    assertParentUnchangedOrDispose(parent, staged, ctx, targetPath);
+    // The staging descriptor stays open through publication and cleanup and is
+    // closed exactly once, whatever happens (a failure keeps its own error).
     try {
-        ctx.ops.renameSync(staged.tmpPath, targetPath);
+        assertParentUnchangedOrDispose(parent, staged, ctx, targetPath);
+        try {
+            ctx.ops.renameSync(staged.tmpPath, targetPath);
+        }
+        catch (err) {
+            publishFailure('rename', err, parent, staged, targetPath, ctx, warnings);
+        }
     }
     catch (err) {
-        publishFailure('rename', err, parent, staged, targetPath, ctx, warnings);
+        throw withCloseNote(err, releaseHeld(ctx, staged));
     }
+    noteIdentityCloseFailure(releaseHeld(ctx, staged), warnings, staged.tmpPath);
     const dirReached = p.fsyncDir ? syncDirectory(parent, ctx, warnings) : 'file';
     return { publication: 'PUBLISHED', durability: reached(p.requested, dirReached), warnings };
 }
+/**
+ * The write is already published: a failed release of the IDENTITY descriptor
+ * never changes the result. It is reported as `STAGING_DESCRIPTOR_CLOSE_FAILED`
+ * (appended to the existing warnings), NOT as `STAGING_RESIDUE`, which means "a
+ * temporary file is left behind". The close is never retried. Only the errno
+ * code is reported, not the raw message.
+ */
+function noteIdentityCloseFailure(closeErr, warnings, tmpPath) {
+    if (closeErr === undefined)
+        return;
+    warnings.push({
+        code: 'STAGING_DESCRIPTOR_CLOSE_FAILED',
+        message: `the staging descriptor failed to close after publication (${errnoOf(closeErr) ?? 'unknown error'}); the write is published and unaffected.`,
+        path: tmpPath,
+    });
+}
 function assertParentUnchangedOrDispose(parent, staged, ctx, targetPath) {
     try {
         assertParentUnchanged(parent, ctx);
     }
     catch (err) {
-        const info = tmpInfo(disposeOwned(parent, staged.token, { ops: ctx.ops, caps: ctx.caps }), staged.token.name);
+        const info = tmpInfo(disposeHeld(parent, staged, ctx), staged.token.name);
         if (err instanceof SafeWriteError) {
             throw new SafeWriteError(`${err.message}${residueNote(info, pdata(parent).path)}`, {
                 code: err.code,
@@ -906,26 +1109,37 @@ export function createFile(parent, name, data, opts) {
     inspectTarget(parent, name, ctx, 'create');
     const warnings = platformWarnings(ctx);
     const staged = stage(parent, name, buf, p.finalExact ? opts.mode : null, p.finalExact ? 0o600 : opts.mode, p.fsyncFile, ctx);
-    assertParentUnchangedOrDispose(parent, staged, ctx, targetPath);
-    let outcome;
+    // One owner for the staging descriptor: it is held until the second name has
+    // been disposed (the identity check needs it) and closed exactly once.
+    let removed;
     try {
-        ctx.ops.linkSync(staged.tmpPath, targetPath);
-        outcome = 'published';
+        assertParentUnchangedOrDispose(parent, staged, ctx, targetPath);
+        let outcome;
+        try {
+            ctx.ops.linkSync(staged.tmpPath, targetPath);
+            outcome = 'published';
+        }
+        catch (err) {
+            outcome = publishFailure('link', err, parent, staged, targetPath, ctx, warnings);
+        }
+        if (outcome === 'lost-race') {
+            const info = tmpInfo(disposeHeld(parent, staged, ctx), staged.token.name);
+            throw new SafeWriteError(`"${targetPath}" appeared while it was being created; it is never overwritten.${residueNote(info, dir)}`, {
+                code: 'WRITE_TARGET_EXISTS',
+                phase: 'publish',
+                publication: 'NOT_PUBLISHED',
+                path: targetPath,
+                tmp: info,
+            });
+        }
+        // Published: the temp name is now a second link (nlink 2) to OUR inode; the
+        // live descriptor still identifies it, so only that name is removed.
+        removed = disposeHeld(parent, staged, ctx);
     }
     catch (err) {
-        outcome = publishFailure('link', err, parent, staged, targetPath, ctx, warnings);
-    }
-    if (outcome === 'lost-race') {
-        const info = tmpInfo(disposeOwned(parent, staged.token, { ops: ctx.ops, caps: ctx.caps }), staged.token.name);
-        throw new SafeWriteError(`"${targetPath}" appeared while it was being created; it is never overwritten.${residueNote(info, dir)}`, {
-            code: 'WRITE_TARGET_EXISTS',
-            phase: 'publish',
-            publication: 'NOT_PUBLISHED',
-            path: targetPath,
-            tmp: info,
-        });
+        throw withCloseNote(err, releaseHeld(ctx, staged));
     }
-    const removed = disposeOwned(parent, staged.token, { ops: ctx.ops, caps: ctx.caps });
+    noteIdentityCloseFailure(releaseHeld(ctx, staged), warnings, staged.tmpPath);
     if (removed !== 'removed' && removed !== 'absent') {
         warnings.push({
             code: 'STAGING_RESIDUE',

package/dist/ui/assets/index-BJKxUDPD.css

@@ -0,0 +1 @@
+.skin-switcher[data-v-570e4117]{color:var(--muted);font-size:var(--fs-secondary);display:flex;flex-direction:column;gap:4px}.skin-switcher select[data-v-570e4117]{background:var(--surface-2);color:var(--text);border:1px solid var(--control-border);border-radius:4px;padding:4px 6px;font:inherit}:root{--bg: #0e1116;--surface: #161b22;--surface-2: #1d242d;--border: #2b3440;--control-border: #627185;--text: #e6edf3;--muted: #a3afc0;--accent: #58a6ff;--ok: #3fb950;--warn: #d29922;--err: #f85149;--demo: #f0b429;color-scheme:dark;--fs-body: 16px;--fs-nav: 15px;--fs-project: 18px;--fs-h2: 16px;--fs-h3: 15px;--fs-secondary: 14px;--fs-meta: 13px;--fs-label: 12px;--fs-mono: 14px;--lh-body: 1.55;--lh-heading: 1.3}*{box-sizing:border-box}html{scrollbar-gutter:stable}body{margin:0;background:var(--bg);color:var(--text);font:var(--fs-body)/var(--lh-body) system-ui,-apple-system,"Segoe UI",Roboto,sans-serif}code,pre{font-family:ui-monospace,SF Mono,Menlo,Consolas,monospace;font-size:var(--fs-mono);line-height:1.55}.shell{display:flex;align-items:flex-start;min-height:100vh}.shell-main{flex:1 1 auto;min-width:0}.sidebar{position:sticky;top:0;align-self:flex-start;flex:0 0 240px;width:240px;height:100vh;display:flex;flex-direction:column;background:var(--surface);border-right:1px solid var(--border)}.sidebar-head{padding:14px 16px}.sidebar-panel{flex:1 1 auto;min-height:0;display:flex;flex-direction:column;gap:16px;padding:4px 12px 16px;overflow-y:auto}.sidebar-panel .skin-switcher{padding:0 4px 12px;border-bottom:1px solid var(--border)}.nav-toggle{display:none}.topbar{display:flex;flex-wrap:wrap;align-items:center;gap:12px 24px;padding:10px 20px;min-height:52px;background:var(--surface);border-bottom:1px solid var(--border)}.brand{display:flex;gap:10px;align-items:center;min-width:0}.brand-logo{flex:none;width:40px;height:40px;display:block}.brand-text{display:flex;flex-direction:column;min-width:0;line-height:1.25}.brand .muted{white-space:nowrap;font-size:var(--fs-meta)}.brand strong{letter-spacing:.12em;font-size:var(--fs-h2)}.project{font-weight:600;font-size:var(--fs-project);line-height:var(--lh-heading);min-width:0;overflow-wrap:anywhere}.topbar-right{margin-left:auto;display:flex;align-items:center;gap:14px}.scenario{color:var(--muted);font-size:var(--fs-secondary);display:flex;gap:6px;align-items:center}.scenario select{background:var(--surface-2);color:var(--text);border:1px solid var(--control-border);border-radius:4px;padding:4px 8px;font:inherit;min-height:32px}.demo-badge{background:var(--demo);color:#1a1300;font-weight:800;letter-spacing:.1em;padding:4px 12px;border-radius:4px}.nav{display:flex;flex-direction:column;gap:2px}.nav a{color:var(--muted);text-decoration:none;overflow-wrap:anywhere;padding:8px 12px;border-radius:4px;font-size:var(--fs-nav);line-height:1.35}.nav a:hover{color:var(--text);background:var(--surface-2)}.nav a[aria-current=location]{color:var(--text);background:var(--surface-2);font-weight:600;box-shadow:inset 3px 0 0 var(--accent)}.nav a:focus-visible,button:focus-visible,select:focus-visible{outline:2px solid var(--accent);outline-offset:2px}.content{max-width:1100px;margin:0 auto;padding:20px;display:grid;grid-template-columns:minmax(0,1fr);gap:16px}.panel{min-width:0;overflow-wrap:anywhere;background:var(--surface);border:1px solid var(--border);border-radius:6px;padding:16px 20px;scroll-margin-top:16px}.panel h2{margin:0 0 12px;font-size:var(--fs-h2);line-height:var(--lh-heading);text-transform:uppercase;letter-spacing:.06em;color:var(--accent)}.panel h3{margin:16px 0 6px;font-size:var(--fs-h3);line-height:var(--lh-heading)}.panel h4{margin:10px 0 4px;font-size:var(--fs-secondary);line-height:var(--lh-heading);color:var(--muted)}.facts{display:grid;grid-template-columns:max-content minmax(0,1fr);gap:4px 16px;margin:0}.facts dt{color:var(--muted)}.facts dt,.facts dd{min-width:0}.facts dd{margin:0;overflow-wrap:anywhere}.facts.compact{font-size:var(--fs-secondary);margin-top:8px}.cards{list-style:none;margin:0;padding:0;display:grid;grid-template-columns:minmax(0,1fr);gap:10px}.card{min-width:0;overflow-wrap:anywhere;background:var(--surface-2);border:1px solid var(--border);border-radius:4px;padding:10px 14px}.card h3{margin:6px 0 2px;font-size:var(--fs-h3);line-height:var(--lh-heading)}.card p{margin:4px 0}.card-head{display:flex;justify-content:space-between;gap:12px;flex-wrap:wrap}.status{font-size:var(--fs-meta);padding:1px 8px;border-radius:10px;border:1px solid var(--ok);color:var(--ok)}.tag.tag-neutral{color:var(--muted);border-color:var(--muted)}.steps ul{margin:0;padding-left:20px}.tag{font-weight:400;font-size:var(--fs-label);color:var(--warn);border:1px solid var(--warn);border-radius:3px;padding:0 6px;margin-left:6px}.roadmap{margin:0;padding:12px;background:var(--surface-2);border-radius:4px;white-space:pre-wrap;overflow-wrap:anywhere;font-size:var(--fs-mono);line-height:1.55}.phases{list-style:none;margin:12px 0;padding:0;display:grid;gap:10px}.phase{min-width:0;overflow-wrap:anywhere;background:var(--surface-2);border:1px solid var(--border);border-radius:4px;padding:10px 14px}.phase-active{border-color:var(--accent);border-left-width:4px}.panel .phase-title{margin:0 0 4px;font-size:var(--fs-h3);line-height:var(--lh-heading)}.phase-meta{margin:0 0 6px;display:flex;flex-wrap:wrap;gap:8px;align-items:center}.status-badge{font-size:var(--fs-meta);padding:1px 8px;border-radius:10px;border:1px solid var(--control-border);color:var(--text)}.status-badge.status-unrecognized{border-color:var(--warn);color:var(--warn)}.phase-meta .tag{margin-left:0;border-color:var(--accent);color:var(--accent)}.phase-goal{margin:4px 0}.phase-details,.raw{margin-top:8px}.phase-details summary,.raw summary{cursor:pointer;color:var(--accent)}.phase-details summary:focus-visible,.raw summary:focus-visible{outline:2px solid var(--accent);outline-offset:2px}.phase-details .roadmap,.raw .roadmap{margin-top:8px;overflow-x:auto}.roadmap-diag{margin-top:12px}.diag li{min-width:0}.diag{list-style:none;margin:0;padding:0;display:grid;gap:4px}.sev{font-size:var(--fs-label);text-transform:uppercase;font-weight:700;margin-right:6px}.sev-info .sev{color:var(--accent)}.sev-warning .sev{color:var(--warn)}.sev-error .sev{color:var(--err)}.muted{color:var(--muted)}.empty{color:var(--muted);font-style:italic;margin:0}.unknown{color:var(--warn);font-weight:600;font-style:normal;letter-spacing:.04em}@media(max-width:899px){.shell{display:block}.sidebar{position:sticky;top:0;z-index:2;width:auto;height:auto;max-height:100vh;border-right:0;border-bottom:1px solid var(--border)}.sidebar-head{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:8px 12px}.brand-logo{width:36px;height:36px}.sidebar-panel{display:none;padding-top:4px;max-height:calc(100vh - 56px)}.sidebar.open .sidebar-panel{display:flex}.nav-toggle{display:inline-block}.panel{scroll-margin-top:64px}}@media(max-width:600px){.topbar{padding-left:12px;padding-right:12px}.topbar-right{margin-left:0;width:100%;flex-wrap:wrap;justify-content:space-between}.content{padding:12px}.facts{grid-template-columns:1fr}.facts dd{margin-bottom:6px}}.live-badge{background:#1f6f43;color:#eafff3;font-weight:800;letter-spacing:.1em;padding:4px 12px;border-radius:4px}.live-badge-off{background:var(--surface-2);color:var(--muted, #9aa4b2);border:1px solid var(--border)}.story{white-space:pre-wrap;margin:0;font:inherit}button{background:var(--surface-2);color:var(--text);border:1px solid var(--control-border);border-radius:4px;padding:4px 12px;font:inherit;cursor:pointer}button:disabled{opacity:.5;cursor:default}.section-fade-enter-active{transition:opacity .22s ease-out,transform .22s ease-out}.section-fade-leave-active{transition:opacity .15s ease-in,transform .15s ease-in}.section-fade-enter-from{opacity:0;transform:translateY(8px)}.section-fade-leave-to{opacity:0;transform:translateY(-8px)}@media(prefers-reduced-motion:reduce){.section-fade-enter-active,.section-fade-leave-active{transition:none}.section-fade-enter-from,.section-fade-leave-to{opacity:1;transform:none}}.ov-block+.ov-block{margin-top:16px;padding-top:4px;border-top:1px solid var(--border)}.ov-block h3{margin-top:8px;text-transform:uppercase;letter-spacing:.06em;font-size:var(--fs-secondary);color:var(--muted)}:root[data-skin=cosmic-glass]{--bg: #080a1e;--surface: rgba(12, 16, 40, .74);--surface-2: rgba(30, 34, 76, .62);--border: rgba(190, 200, 255, .2);--control-border: rgba(204, 212, 255, .52);--text: #f1f4ff;--muted: #c6d0e8;--accent: #b4a9ff;--ok: #5fd68a;--warn: #f0c040;--err: #ff8a85;--demo: #f0b429;--glass-dense: rgba(9, 12, 32, .86);--glass-edge: inset 0 1px 0 rgba(255, 255, 255, .07);--glass-shadow: 0 8px 32px rgba(2, 3, 14, .45);--glass-blur: blur(14px) saturate(1.15);background:var(--bg)}:root[data-skin=cosmic-glass] body{background:transparent;isolation:isolate}:root[data-skin=cosmic-glass] body:before{content:"";position:fixed;top:0;bottom:0;right:0;left:-14vw;z-index:-1;pointer-events:none;background:linear-gradient(180deg,#080a1e00,#080a1e33 60%,#080a1e99),url(./cosmic-glass-bg-Dwx47zPu.webp) 24% 0 / cover no-repeat,var(--bg)}:root[data-skin=cosmic-glass] .sidebar{background:#080b2080;-webkit-backdrop-filter:blur(4px) saturate(1.1);backdrop-filter:blur(4px) saturate(1.1);border-right-color:var(--border);box-shadow:1px 0 #968cff14,6px 0 28px #02030e59}:root[data-skin=cosmic-glass] .brand strong{color:var(--text);letter-spacing:.16em}:root[data-skin=cosmic-glass] .brand .muted{font-size:var(--fs-meta)}:root[data-skin=cosmic-glass] .brand-logo{border-radius:9px;box-shadow:0 0 0 1px #bec8ff47,0 2px 12px #02030e80}:root[data-skin=cosmic-glass] .nav a{color:var(--muted);border-left:2px solid transparent;border-radius:0 6px 6px 0}:root[data-skin=cosmic-glass] .nav a:hover{color:var(--text);background:#968cff29;border-left-color:var(--accent)}:root[data-skin=cosmic-glass] .nav a[aria-current=location]{color:var(--text);background:linear-gradient(90deg,#968cff42,#968cff14);border-left-color:#d3ccff;box-shadow:none}:root[data-skin=cosmic-glass] .sidebar-panel .skin-switcher{border-bottom-color:var(--border)}:root[data-skin=cosmic-glass] .topbar{background:#080b20a8;-webkit-backdrop-filter:blur(12px) saturate(1.1);backdrop-filter:blur(12px) saturate(1.1);border-bottom-color:var(--border);box-shadow:0 6px 24px #02030e4d}:root[data-skin=cosmic-glass] .project{font-size:var(--fs-project);letter-spacing:.01em}:root[data-skin=cosmic-glass] .live-badge{background:#14532f;color:#eafff3;border:1px solid #5fd68a}:root[data-skin=cosmic-glass] .live-badge-off{background:var(--glass-dense);color:var(--muted);border-color:var(--border)}:root[data-skin=cosmic-glass] .demo-badge{border:1px solid #ffd978}:root[data-skin=cosmic-glass] .panel{background:var(--surface);-webkit-backdrop-filter:var(--glass-blur);backdrop-filter:var(--glass-blur);border-radius:10px;box-shadow:var(--glass-edge),var(--glass-shadow);padding:18px 22px}:root[data-skin=cosmic-glass] .panel h2{font-size:var(--fs-h2);letter-spacing:.08em;font-weight:700;padding-bottom:8px;margin-bottom:14px;border-bottom:1px solid var(--border)}:root[data-skin=cosmic-glass] .panel h3{font-size:var(--fs-h3);font-weight:650}:root[data-skin=cosmic-glass] .card{background:var(--surface-2);border-radius:8px;box-shadow:var(--glass-edge);line-height:1.55}:root[data-skin=cosmic-glass] .phase{background:var(--surface-2);border-radius:8px;box-shadow:var(--glass-edge);line-height:1.55}:root[data-skin=cosmic-glass] .phase-active{border-color:var(--accent)}:root[data-skin=cosmic-glass] .status-badge{background:#ffffff0f}:root[data-skin=cosmic-glass] .status-badge.status-unrecognized{background:#f0c0401a}:root[data-skin=cosmic-glass] .phase-meta .tag{background:#58a6ff1f}:root[data-skin=cosmic-glass] .facts dt{font-size:var(--fs-secondary)}:root[data-skin=cosmic-glass] .roadmap,:root[data-skin=cosmic-glass] .story{background:var(--glass-dense);border-radius:8px;line-height:1.6}:root[data-skin=cosmic-glass] .roadmap{border:1px solid var(--border)}:root[data-skin=cosmic-glass] .status{background:#5fd68a1f}:root[data-skin=cosmic-glass] .tag{background:#f0c0401a}:root[data-skin=cosmic-glass] button,:root[data-skin=cosmic-glass] select{background:var(--glass-dense);border-color:var(--control-border)}:root[data-skin=cosmic-glass] button:hover:not(:disabled){border-color:var(--accent);background:#3c3882b3}:root[data-skin=cosmic-glass] button:disabled{opacity:1;color:#8f9abb;border-style:dashed;cursor:not-allowed}:root[data-skin=cosmic-glass] a:focus-visible,:root[data-skin=cosmic-glass] button:focus-visible,:root[data-skin=cosmic-glass] select:focus-visible{outline:2px solid #d3ccff;outline-offset:2px;box-shadow:0 0 0 4px #9a8cff59}@supports not ((backdrop-filter: blur(1px)) or (-webkit-backdrop-filter: blur(1px))){:root[data-skin=cosmic-glass]{--surface: rgba(12, 16, 40, .92);--surface-2: rgba(26, 30, 70, .92)}:root[data-skin=cosmic-glass] .sidebar,:root[data-skin=cosmic-glass] .topbar{background:#080b20f2}}@media(prefers-reduced-motion:no-preference){:root[data-skin=cosmic-glass] .nav a,:root[data-skin=cosmic-glass] button{transition:background-color .15s,border-color .15s,color .15s}}@media(max-width:899px){:root[data-skin=cosmic-glass] body:before{left:0;background:linear-gradient(180deg,#080a1e00,#080a1e33 55%,#080a1e8c),url(./cosmic-glass-bg-Dwx47zPu.webp) 16% 0 / cover no-repeat,var(--bg)}:root[data-skin=cosmic-glass] .sidebar{background:#080b20d1;border-bottom-color:var(--border)}:root[data-skin=cosmic-glass] .panel{padding:14px 16px;background:#0c102899}}