@lmzhen/dsh-evolution-state-json 0.3.65 → 0.3.67

package/README.md

@@ -23,5 +23,6 @@ Independent of request-prefix construction. This package does not alter the asse
 
 
 - P2-4 (v15): the live pending map is BOUNDED — resolved (approved/rejected) records are kept to the most recent `PENDING_RESOLVED_CAP` (200, seam constant in `evolution-state-storage`); the oldest by `resolvedAt` rotate into the `pending-state-archive.json` sidecar (with `.bak` rotation), which is JSON-provider-specific. The DOMAIN provider enforces the same live cap but has no sidecar: past the cap its resolved records are deleted, not archived.
+- V25-11 (v25): the review-state table is likewise BOUNDED — `REVIEW_STATE_SESSION_CAP` (500, seam constant) rows keyed by session; on every save the least-recently-active sessions (provider-stamped `updatedAt`, stored on disk only) are pruned. The stamp is stripped on read, so the consumer-facing record shape is unchanged.
 - JSON provider serializes writers inside one process AND through the IO backend's cross-process transact lock (an internal transact wrapper — not public API, audit v10 S-03 — wraps every mutation, 0.3.20/0.3.27) — this provider is NOT limited to single-process safety. The caveat below is about the DSH storage-domain providers (`storage-json` documents no cross-process write locking) when the DOMAIN provider is used instead; multi-process deployments should route the evolution domain to a backend with cross-process semantics such as SQLite or remote storage.
 

package/lib/index.js

@@ -1,6 +1,6 @@
 import z from "@deepseek-ai/schemastery";
 import { evolutionHome, makeSerialQueue, transactIo } from "@lmzhen/dsh-evolution-core";
-import { CURATOR_STATE_FILE, CURATOR_STATE_KEY, CURATOR_STATE_TABLE, PENDING_ARCHIVE_BAK_FILE, PENDING_ARCHIVE_FILE, PENDING_LEGACY_FILE, PENDING_RESOLVED_CAP, PENDING_STATE_FILE, PENDING_TABLE, PROVIDER_JSON, REVIEW_STATE_FILE, REVIEW_STATE_TABLE, assertCloneable, canClaimPending, canResolvePending, recordIssue, releasedStatus } from "@lmzhen/dsh-evolution-state-storage";
+import { CURATOR_STATE_FILE, CURATOR_STATE_KEY, CURATOR_STATE_TABLE, PENDING_ARCHIVE_BAK_FILE, PENDING_ARCHIVE_FILE, PENDING_LEGACY_FILE, PENDING_RESOLVED_CAP, PENDING_STATE_FILE, PENDING_TABLE, PROVIDER_JSON, REVIEW_STATE_FILE, REVIEW_STATE_SESSION_CAP, REVIEW_STATE_TABLE, assertCloneable, canClaimPending, canResolvePending, recordIssue, releasedStatus } from "@lmzhen/dsh-evolution-state-storage";
 import { isAbsolute, join } from "node:path";
 //#region lib/types/index.js
 /**
@@ -226,8 +226,14 @@ function apply(ctx, rawConfig = {}) {
 				if (Array.isArray(rawBak)) {
 					for (const entry of rawBak) if (entry && typeof entry.id === "string") ids.add(entry.id);
 				}
-			} catch {}
-		} catch {}
+			} catch (bakError) {
+				if (bakError?.name === QUARANTINE_ERROR_NAME) throw bakError;
+				ctx.logger.warn(`evolution-state-json: pending archive .bak unreadable (${bakError instanceof Error ? bakError.message : String(bakError)}) — archived ids that live only in the .bak do not exclude their legacy twins until the sidecar is readable again`);
+			}
+		} catch (error) {
+			if (error?.name === QUARANTINE_ERROR_NAME) throw error;
+			ctx.logger.warn(`evolution-state-json: pending archive sidecars unreadable (${error instanceof Error ? error.message : String(error)}) — the V5-02 legacy ghost-twin filter runs WITHOUT the archived-id exclusion until the archive is readable again`);
+		}
 		return ids;
 	}
 	function filterLegacy(legacy, current, archivedIds) {
@@ -239,14 +245,21 @@ function apply(ctx, rawConfig = {}) {
 		}
 		return retired;
 	}
-	async function retireLegacyOnce(legacy, current) {
+	async function retireLegacyOnce(legacy) {
 		if (legacyMigrated) return {};
 		try {
-			const retired = filterLegacy(legacy, current, await readArchivedIds());
-			await jsonTransact(ctx, io, root, PENDING_STATE_FILE, (fresh) => ({
-				...retired,
-				...fresh ?? {}
-			}));
+			const retired = {};
+			await jsonTransact(ctx, io, root, PENDING_STATE_FILE, async (fresh) => {
+				const merged = { ...fresh ?? {} };
+				const archivedIds = await readArchivedIds();
+				for (const [id, record] of Object.entries(legacy)) {
+					if (id in merged) continue;
+					if (archivedIds.has(id)) continue;
+					merged[id] = record;
+					retired[id] = record;
+				}
+				return merged;
+			});
 			await io().rename(pathOf(PENDING_LEGACY_FILE), `${pathOf(PENDING_LEGACY_FILE)}.migrated`);
 			legacyMigrated = true;
 			return retired;
@@ -259,7 +272,7 @@ function apply(ctx, rawConfig = {}) {
 	async function loadPendingMap() {
 		const [current, legacy] = await Promise.all([readJson(PENDING_STATE_FILE), readJson(PENDING_LEGACY_FILE)]);
 		if (legacy !== null) return {
-			...await retireLegacyOnce(legacy, current),
+			...await retireLegacyOnce(legacy),
 			...current ?? {}
 		};
 		return { ...current ?? {} };
@@ -267,7 +280,8 @@ function apply(ctx, rawConfig = {}) {
 	/** V6-01 (0.3.34): single-sourced legacy merge for the four mutation paths —
 	* the SAME exclusion as the retirement read path, so a mutation that runs
 	* before any retirement cannot fixate a ghost pending twin in current
-	* (the archive id set is cached once; current-wins covers stale misses). */
+	* (the archive id set is read fresh on every merge — V11-B2; current-wins
+	* covers stale misses). */
 	async function mergedWithFilteredLegacy(legacy, current) {
 		if (legacy === null) return current;
 		return {
@@ -282,7 +296,7 @@ function apply(ctx, rawConfig = {}) {
 	* live work and are never trimmed. Returns the pruned map (rather than
 	* mutating in place) plus the evicted records. */
 	function enforceResolvedCap(map) {
-		const resolved = Object.values(map).filter((record) => record.status === "approved" || record.status === "rejected");
+		const resolved = Object.values(map).filter((record) => (record.status === "approved" || record.status === "rejected") && record.kind !== "capability");
 		if (resolved.length <= PENDING_RESOLVED_CAP$1) return {
 			map,
 			evicted: []
@@ -321,7 +335,10 @@ function apply(ctx, rawConfig = {}) {
 					const parsed = JSON.parse(current);
 					if (Array.isArray(parsed)) archive = parsed;
 				} catch {
-					await io().writeText(`${pathOf(PENDING_ARCHIVE_FILE)}.corrupt`, current).catch(() => {});
+					if (!await io().writeText(`${pathOf(PENDING_ARCHIVE_FILE)}.corrupt`, current).then(() => true, () => false)) {
+						ctx.logger.warn(`evolution-state-json: corrupt ${PENDING_ARCHIVE_FILE} could not be quarantined to .corrupt — skipping this audit append to preserve the recoverable bytes`);
+						return current;
+					}
 				}
 				const shaped = archive.filter((entry) => entry !== null && typeof entry === "object");
 				const archiveKeys = /* @__PURE__ */ new Set();
@@ -351,15 +368,29 @@ function apply(ctx, rawConfig = {}) {
 		name: PROVIDER_JSON,
 		async loadReviewState(sessionId) {
 			return await mutate(async () => {
-				return (await readJson(REVIEW_STATE_FILE))?.[sessionId] ?? null;
+				const row = (await readJson(REVIEW_STATE_FILE))?.[sessionId] ?? null;
+				if (row === null) return null;
+				const { updatedAt: _stamp, ...record } = row;
+				return record;
 			});
 		},
 		async saveReviewState(sessionId, record) {
 			await mutate(async () => {
-				await jsonTransact(ctx, io, root, REVIEW_STATE_FILE, (current) => ({
-					...current ?? {},
-					[sessionId]: record
-				}));
+				await jsonTransact(ctx, io, root, REVIEW_STATE_FILE, (current) => {
+					const stamped = { ...current ?? {} };
+					stamped[sessionId] = {
+						...record,
+						updatedAt: Date.now()
+					};
+					const others = Object.keys(stamped).filter((id) => id !== sessionId);
+					if (others.length < REVIEW_STATE_SESSION_CAP) return stamped;
+					const stampOf = (id) => stamped[id]?.updatedAt ?? 0;
+					others.sort((a, b) => stampOf(a) - stampOf(b));
+					const evict = new Set(others.slice(0, others.length - REVIEW_STATE_SESSION_CAP + 1));
+					const pruned = {};
+					for (const [id, row] of Object.entries(stamped)) if (!evict.has(id)) pruned[id] = row;
+					return pruned;
+				});
 			});
 		},
 		async loadCuratorState() {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-state-json",
   "description": "JSON-file evolution state provider over the IO seam (community build)",
-  "version": "0.3.65",
+  "version": "0.3.67",
   "publishConfig": {
     "access": "public"
   },
@@ -31,18 +31,18 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@lmzhen/dsh-evolution-core": "^0.3.65"
+    "@lmzhen/dsh-evolution-core": "^0.3.67"
   },
   "peerDependencies": {
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
     "@deepseek-ai/cordis": "^4.0.1",
-    "@lmzhen/dsh-evolution-io": "^0.3.65",
-    "@lmzhen/dsh-evolution-state-storage": "^0.3.65"
+    "@lmzhen/dsh-evolution-io": "^0.3.67",
+    "@lmzhen/dsh-evolution-state-storage": "^0.3.67"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
-    "@lmzhen/dsh-evolution-io": "^0.3.65",
-    "@lmzhen/dsh-evolution-state-storage": "^0.3.65",
-    "@lmzhen/dsh-evolution-io-node": "^0.3.65"
+    "@lmzhen/dsh-evolution-io": "^0.3.67",
+    "@lmzhen/dsh-evolution-state-storage": "^0.3.67",
+    "@lmzhen/dsh-evolution-io-node": "^0.3.67"
   }
 }