@mnstry/atelier 0.2.0-alpha.11 → 0.2.0-alpha.13

package/src/projection/obsidian/publication/transport.mjs

@@ -1,10 +1,12 @@
 import { execFile, execFileSync } from 'node:child_process'
 import { readlinkSync } from 'node:fs'
+import path from 'node:path'
 import { POLICY_SETTINGS_PATH, buildEvalCode, createInProcessHost, runInProcess, validatePayload } from './bridge-script.mjs'
+import { obsidianUserDataDir, readObsidianSettings, vaultRoute } from './vault-list.mjs'
 
 // Editor coordination adapter.
 //
-//   adapter.probe({ vaultRoot })  -> { state: 'coordinated' | 'absent' | 'uncoordinated', reason }
+//   adapter.probe({ vaultRoot })  -> { state: 'coordinated' | 'absent' | 'uncoordinated', reason, code? }
 //   adapter.inspect(payload)      -> reply          read-only, may retry
 //   adapter.collect(payload)      -> reply          read-only, may retry
 //   adapter.publish(payload)      -> reply          sent at most once
@@ -25,6 +27,16 @@ export class TransportTimeout extends Error {
   }
 }
 
+// A call that no route can take: the app's list says no call reaches only
+// this vault. `code` says why; the call is never made.
+export class RouteRefusal extends Error {
+  constructor(code, message) {
+    super(`${code}: ${message}`)
+    this.name = 'RouteRefusal'
+    this.code = code
+  }
+}
+
 const READ_RETRIES = 2
 
 // `qualification`, when given, is the app qualification this adapter was
@@ -71,7 +83,8 @@ export function createEditorAdapter({ call, processProbe, kind = 'custom', quali
     // Path selection. `absent` is returned only when the process probe says,
     // positively, that no Obsidian is running. A running or unknowable app
     // that does not answer for this exact vault is `uncoordinated`, and so is
-    // any app while this adapter's qualification checked no version.
+    // any app while this adapter's qualification checked no version. When no
+    // call could be routed to only this vault, `code` names the route's refusal.
     probe: ({ vaultRoot }) => serialized(async () => {
       let processes
       try { processes = await processProbe() } catch { processes = 'unknown' }
@@ -83,7 +96,7 @@ export function createEditorAdapter({ call, processProbe, kind = 'custom', quali
         if (['inspected', 'path-unsafe'].includes(reply.status) && reply.vaultBasePath === vaultRoot) return { state: 'coordinated', reason: 'the app answered for this vault' }
         return { state: 'uncoordinated', reason: reply.status === 'vault-mismatch' ? 'the app answered for another vault' : `the app answered ${reply.status}` }
       } catch (error) {
-        return { state: 'uncoordinated', reason: `an Obsidian process may be running and the bridge did not answer: ${String(error.message || error).slice(0, 200)}` }
+        return { state: 'uncoordinated', ...(error instanceof RouteRefusal ? { code: error.code } : {}), reason: `an Obsidian process may be running and the bridge did not answer: ${String(error.message || error).slice(0, 200)}` }
       }
     }),
   }
@@ -111,13 +124,55 @@ export function defaultCliPath(platform = process.platform) {
   return 'obsidian-cli'
 }
 
+// A directory that is no vault, for a call that must not choose one by where it runs.
+export const NEUTRAL_DIRECTORY = (() => { try { return path.parse(process.cwd()).root } catch { return path.sep } })()
+
+// The working directory and leading arguments of a call that goes where a
+// `vaultRoute` says: into the vault's folder, or naming the vault's id first
+// from a directory that is no vault (`neutral`), or, for any other route, from
+// that directory naming no vault.
+export function routedCall(route, neutral = NEUTRAL_DIRECTORY) {
+  if (route?.how === 'folder') return { cwd: route.cwd, args: [] }
+  if (route?.how === 'id') return { cwd: neutral, args: [`vault=${route.id}`] }
+  return { cwd: neutral, args: [] }
+}
+
+// Which window a publication call reaches. The app answers a command in the
+// window of the vault its list routes the call to (see vault-list.mjs),
+// opening that vault first when it is closed, and otherwise in the vault
+// window that had focus last, which may be any vault the person uses. While
+// the app lists this vault as open, a call therefore runs in its folder, or,
+// when a vault listed at a folder above it would take a call run there, names
+// its id; when neither reaches only this vault, no call is made (the error
+// says `vault-inside-another-vault`), nor when the app has the vault open in
+// more than one window, one per entry of its list that names this folder
+// (`vault-open-in-several-windows`): a call would coordinate with one of them
+// only. Otherwise a call runs in a directory
+// that is no vault and names none: a closed vault is never reopened by
+// maintenance, no other vault is reached through this one's folder, and the
+// working directory of whoever started the service never picks a vault. The
+// script still checks that it answered for exactly this vault.
+export function publicationRoute({ env = process.env, platform = process.platform } = {}) {
+  const userDataDir = obsidianUserDataDir({ platform, env })
+  return (payload) => {
+    const settings = readObsidianSettings({ userDataDir })
+    const route = settings.ok ? vaultRoute({ vaults: settings.vaults, vaultRoot: payload.vaultRoot, open: true }) : { how: 'unlisted' }
+    if (route.how === 'ambiguous') throw new RouteRefusal('vault-inside-another-vault', 'Obsidian lists a vault at a folder above this one, and no call reaches only this vault; no call was made')
+    if (route.how === 'duplicated') throw new RouteRefusal('vault-open-in-several-windows', `Obsidian has this vault open in ${route.entries.length} windows (${route.entries.map((entry) => entry.id).join(', ')}), and a call reaches one of them only; no call was made`)
+    return routedCall(route)
+  }
+}
+
 // The CLI reaches the app through a socket under $HOME, so `env` selects the
 // app instance. It is passed explicitly and never edited here. A call that
 // outlives its timeout is killed with SIGKILL: the CLI ignores SIGTERM while
-// it waits on the app.
-export function createObsidianCliCall({ cliPath = defaultCliPath(), env = process.env, timeoutMs = 20000 } = {}) {
+// it waits on the app. `route(payload)` says where a call runs and what it
+// names first ({ cwd, args }); a route that throws makes no call.
+export function createObsidianCliCall({ cliPath = defaultCliPath(), env = process.env, timeoutMs = 20000, route = () => routedCall(null) } = {}) {
   return (payload) => new Promise((resolve, reject) => {
-    execFile(cliPath, ['eval', `code=${buildEvalCode(payload)}`], { env, timeout: timeoutMs, killSignal: 'SIGKILL', maxBuffer: 16 * 1024 * 1024 }, (error, stdout, stderr) => {
+    let where
+    try { where = route(payload) } catch (error) { return reject(error) }
+    execFile(cliPath, [...where.args, 'eval', `code=${buildEvalCode(payload)}`], { env, cwd: where.cwd, timeout: timeoutMs, killSignal: 'SIGKILL', maxBuffer: 16 * 1024 * 1024 }, (error, stdout, stderr) => {
       if (error) return reject(error.killed ? new TransportTimeout(`CLI call timed out: ${payload.op}`) : new Error(`CLI call failed: ${String(error.message).slice(0, 300)}`))
       const out = stdout || stderr || ''
       const start = out.indexOf('=> ')
@@ -207,6 +262,6 @@ export function defaultObsidianProcessProbe({ platform = process.platform, run =
   }
 }
 
-export function createObsidianCliAdapter({ cliPath, env, timeoutMs, processProbe = () => defaultObsidianProcessProbe(), qualification } = {}) {
-  return createEditorAdapter({ call: createObsidianCliCall({ cliPath, env, timeoutMs }), processProbe, kind: 'obsidian-cli', qualification })
+export function createObsidianCliAdapter({ cliPath, env = process.env, timeoutMs, processProbe = () => defaultObsidianProcessProbe(), qualification, route = publicationRoute({ env }) } = {}) {
+  return createEditorAdapter({ call: createObsidianCliCall({ cliPath, env, timeoutMs, route }), processProbe, kind: 'obsidian-cli', qualification })
 }

package/src/projection/obsidian/publication/vault-list.mjs

@@ -0,0 +1,200 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { openRegularFileNoFollow, realPathAsStored } from '../../../project/private-state.mjs'
+
+// Obsidian's own list of the folders it knows as vaults, read only.
+//
+// The app keeps the list in `obsidian.json` in its user-data directory, as
+// `{ "vaults": { "<id>": { "path", "ts", "open"? } }, ...other settings }`.
+// It reads the file when it starts and rewrites the whole file whenever the
+// list changes. `open` is true while a window of that vault is open, and stays
+// true for the vaults that were open when the app quit, which it reopens on its
+// next start. `obsidian://open?path=` finds a vault only through this list.
+//
+// Nothing here writes the file. The one write Atelier makes to it is in
+// src/runtime/obsidian/app-registration.mjs, and only while no Obsidian runs.
+//
+// The list also decides which window answers a command-line call (1.13.7): a
+// first argument `vault=<value>` names the first listed vault whose id is the
+// value, or whose folder's name is the value in any letter case; without one,
+// the first listed vault whose folder is the tool's working directory or
+// contains it takes the call, the folders compared as written; failing both,
+// the vault window that had focus last. The first in list order, not the
+// deepest: a vault listed at a folder above another one takes the calls run
+// inside it. The app opens a vault that takes a call when it is closed.
+
+export const OBSIDIAN_SETTINGS_FILE = 'obsidian.json'
+// Far more than a list of vaults and a few settings; a larger file is not read.
+export const MAX_OBSIDIAN_SETTINGS_BYTES = 4 * 1024 * 1024
+
+// The user-data directory of the app for this account: Electron's, for an app
+// named `obsidian`. Null where it is not known (another platform, no HOME). A
+// Flatpak or snap build keeps its own elsewhere and is not found here (see
+// obsidianSandboxedBuild). Both known platforms have POSIX paths, whatever
+// platform asks.
+export function obsidianUserDataDir({ platform = process.platform, env = process.env } = {}) {
+  const home = env.HOME
+  if (platform !== 'darwin' && platform !== 'linux') return null
+  if (typeof home !== 'string' || !path.posix.isAbsolute(home)) return null
+  if (platform === 'darwin') return path.posix.join(home, 'Library', 'Application Support', 'obsidian')
+  const config = typeof env.XDG_CONFIG_HOME === 'string' && path.posix.isAbsolute(env.XDG_CONFIG_HOME) ? env.XDG_CONFIG_HOME : path.posix.join(home, '.config')
+  return path.posix.join(config, 'obsidian')
+}
+
+// A Flatpak or snap build of Obsidian on Linux keeps its user-data directory
+// inside its sandbox (`~/.var/app/md.obsidian.Obsidian/config/obsidian`,
+// `~/snap/obsidian/current/.config/obsidian`), where Atelier does not write,
+// and reads no file outside it. Which build this account uses: the one whose
+// vault list was written last, since every build rewrites its own whenever a
+// vault window opens or closes ('flatpak', 'snap', or null for the native
+// build); only when no build wrote one, a Flatpak or snap installation, or a
+// Flatpak or snap left by one. Null on any other platform. `exists` answers
+// whether a path exists, `modified` when a file was last written (or null).
+const modifiedAt = (file) => { try { return fs.statSync(file).mtimeMs } catch { return null } }
+export function obsidianSandboxedBuild({ platform = process.platform, env = process.env, exists = fs.existsSync, modified = modifiedAt } = {}) {
+  if (platform !== 'linux') return null
+  const home = typeof env.HOME === 'string' && path.posix.isAbsolute(env.HOME) ? env.HOME : null
+  const under = (...parts) => (home === null ? [] : [path.posix.join(home, ...parts)])
+  const native = obsidianUserDataDir({ platform, env })
+  const lists = [
+    [null, native === null ? [] : [path.posix.join(native, OBSIDIAN_SETTINGS_FILE)]],
+    ['flatpak', under('.var', 'app', 'md.obsidian.Obsidian', 'config', 'obsidian', OBSIDIAN_SETTINGS_FILE)],
+    ['snap', under('snap', 'obsidian', 'current', '.config', 'obsidian', OBSIDIAN_SETTINGS_FILE)],
+  ].flatMap(([build, files]) => files.map((file) => { let at; try { at = modified(file) } catch { at = null } return { build, at } })).filter(({ at }) => typeof at === 'number')
+  if (lists.length > 0) return lists.reduce((latest, list) => (list.at > latest.at ? list : latest)).build
+  const found = (paths) => paths.some((candidate) => { try { return exists(candidate) } catch { return false } })
+  if (found([...under('.var', 'app', 'md.obsidian.Obsidian'), ...under('.local', 'share', 'flatpak', 'app', 'md.obsidian.Obsidian'), '/var/lib/flatpak/app/md.obsidian.Obsidian'])) return 'flatpak'
+  if (found([...under('snap', 'obsidian'), '/snap/obsidian', '/var/lib/snapd/snap/obsidian'])) return 'snap'
+  return null
+}
+
+const isPlainObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value)
+// The real path as stored (realPathAsStored): what the operating system reports as a working directory.
+const realOrResolved = (target) => { try { return realPathAsStored(target) } catch { return path.resolve(target) } }
+const listedFolders = (vaults) => (isPlainObject(vaults) ? Object.entries(vaults).filter(([, entry]) => isPlainObject(entry) && typeof entry.path === 'string' && path.isAbsolute(entry.path)) : [])
+
+// A folder the list names, against a vault root spelled as given (`spelled`)
+// and as its real path (`target`). Compared as written first; the real path of
+// a listed folder is read only when its last component is the vault root's,
+// as it is for the root reached through a linked parent. So a vault on a
+// mount that does not answer is never waited on; a link to the vault root
+// under another name is not recognised.
+const namesFolder = (entryPath, { spelled, target }) => {
+  const written = path.resolve(entryPath)
+  if (written === spelled || written === target) return true
+  return path.basename(written) === path.basename(target) && realOrResolved(entryPath) === target
+}
+const rootOf = (vaultRoot) => ({ spelled: path.resolve(vaultRoot), target: realOrResolved(vaultRoot) })
+
+// The listed entries (listedFolders) whose folder is this vault root (see
+// namesFolder), in list order. One folder can be listed more than once, under
+// another letter case or through a link, say.
+const entriesOf = (listed, root) => listed.filter(([, entry]) => namesFolder(entry.path, root))
+
+// The entry of the app's vault map whose folder is this vault root (see
+// namesFolder), one the app lists open first; null when there is none. `vaults`
+// is the map as the app keeps it, from its file or from the app itself.
+export function findVaultEntry(vaults, vaultRoot) {
+  if (!isPlainObject(vaults) || typeof vaultRoot !== 'string' || !path.isAbsolute(vaultRoot)) return null
+  const entries = entriesOf(listedFolders(vaults), rootOf(vaultRoot))
+  const found = entries.find(([, entry]) => entry.open === true) ?? entries[0]
+  return found === undefined ? null : { id: found[0], path: found[1].path, open: found[1].open === true }
+}
+
+const refused = (code, message) => ({ ok: false, code, message })
+const currentUid = () => (typeof process.getuid === 'function' ? process.getuid() : null)
+
+// Reads the settings file without following a link and without writing:
+// { ok: true, file, document, vaults, bytes, mode } or a typed refusal
+// { ok: false, code, message }. The user-data directory and the file must be
+// this user's own, a real directory and a regular file; the file must be a
+// JSON object whose `vaults`, when present, is an object. A missing directory
+// or file means Obsidian has not run on this account, or has shown only its
+// starter window, which writes no list: that refusal names `userDataDir`.
+export function readObsidianSettings({ userDataDir, uid = currentUid() } = {}) {
+  if (typeof userDataDir !== 'string' || !path.isAbsolute(userDataDir)) return refused('obsidian-settings-location-unknown', 'where Obsidian keeps its settings on this system is not known')
+  const owned = (stat) => uid === null || stat.uid === uid
+  let directory
+  try { directory = fs.lstatSync(userDataDir) } catch (error) {
+    if (error.code === 'ENOENT') return { ...refused('obsidian-settings-missing', 'Obsidian has no settings directory on this account; it has not run here'), userDataDir }
+    return refused('obsidian-settings-unreadable', 'the Obsidian settings directory cannot be read')
+  }
+  if (directory.isSymbolicLink() || !directory.isDirectory()) return refused('obsidian-settings-unsafe', 'the Obsidian settings directory is a link or not a directory')
+  if (!owned(directory)) return refused('obsidian-settings-not-owned', 'the Obsidian settings directory belongs to another user')
+  const file = path.join(userDataDir, OBSIDIAN_SETTINGS_FILE)
+  let leaf
+  try { leaf = fs.lstatSync(file) } catch (error) {
+    if (error.code === 'ENOENT') return { ...refused('obsidian-settings-missing', 'Obsidian has no settings file on this account; it has not run here'), userDataDir }
+    return refused('obsidian-settings-unreadable', 'the Obsidian settings file cannot be read')
+  }
+  if (leaf.isSymbolicLink() || !leaf.isFile()) return refused('obsidian-settings-unsafe', 'the Obsidian settings file is a link or not a regular file')
+  if (!owned(leaf)) return refused('obsidian-settings-not-owned', 'the Obsidian settings file belongs to another user')
+  if (leaf.size > MAX_OBSIDIAN_SETTINGS_BYTES) return refused('obsidian-settings-unreadable', 'the Obsidian settings file is larger than a settings file can be')
+  let bytes
+  let descriptor
+  try {
+    descriptor = openRegularFileNoFollow(file)
+    const opened = fs.fstatSync(descriptor)
+    if (!owned(opened)) return refused('obsidian-settings-not-owned', 'the Obsidian settings file belongs to another user')
+    bytes = fs.readFileSync(descriptor)
+  } catch {
+    return refused('obsidian-settings-unreadable', 'the Obsidian settings file cannot be read')
+  } finally {
+    if (descriptor !== undefined) try { fs.closeSync(descriptor) } catch { /* read already, or refused */ }
+  }
+  let document
+  try { document = JSON.parse(bytes.toString('utf8')) } catch { return refused('obsidian-settings-unreadable', 'the Obsidian settings file is not JSON') }
+  if (!isPlainObject(document)) return refused('obsidian-settings-not-object', 'the Obsidian settings file is not a JSON object')
+  if (document.vaults !== undefined && !isPlainObject(document.vaults)) return refused('obsidian-settings-not-object', 'the vault list in the Obsidian settings file is not an object')
+  return { ok: true, file, document, vaults: document.vaults ?? {}, bytes, mode: leaf.mode & 0o777, links: leaf.nlink }
+}
+
+// Where a command-line call about this vault reaches the app, predicted from
+// the app's list as the app routes a call (see above):
+//
+//   { how: 'id', id }       run in a directory that is no vault, with `vault=<id>` first: the id names this vault first.
+//                           Preferred: it does not depend on how a working directory is spelled;
+//   { how: 'folder', cwd }  run in the vault's folder (its real path as stored, which the tool reports), when the id
+//                           names another vault first and the first listed vault that is or contains the folder is this one;
+//   { how: 'unlisted' }     the list has no entry for this folder (with `open`, none that the app lists open);
+//   { how: 'ambiguous' }    the id names another vault first, and a vault listed above it takes a call run in its folder;
+//   { how: 'duplicated', entries }
+//                           the list has this folder open more than once, one window per entry ({ id, path }): each
+//                           window holds the vault, and a call reaches one of them only.
+//
+// With `open`, only an entry the app lists open may take the call, so a
+// closed vault window is never reopened. Without it, so does an entry the app
+// lists open when there is one: another entry of the same folder is not opened
+// beside it.
+export function vaultRoute({ vaults, vaultRoot, open = false } = {}) {
+  if (typeof vaultRoot !== 'string' || !path.isAbsolute(vaultRoot)) return { how: 'unlisted' }
+  const root = rootOf(vaultRoot)
+  const { target } = root
+  const listed = listedFolders(vaults)
+  const entries = entriesOf(listed, root)
+  const windows = entries.filter(([, entry]) => entry.open === true)
+  if (windows.length > 1) return { how: 'duplicated', entries: windows.map(([id, entry]) => ({ id, path: entry.path })) }
+  const own = open || windows.length > 0 ? windows : entries
+  if (own.length === 0) return { how: 'unlisted' }
+  const takes = ([id]) => own.some(([ownId]) => ownId === id)
+  const byName = (value) => listed.find(([id, entry]) => id === value || path.basename(entry.path).toUpperCase() === value.toUpperCase())
+  const named = own.find(([id]) => byName(id)?.[0] === id)
+  if (named !== undefined) return { how: 'id', id: named[0] }
+  const byFolder = listed.find(([, entry]) => { const folder = path.resolve(entry.path); return target === folder || target.startsWith(folder + path.sep) })
+  return byFolder !== undefined && takes(byFolder) ? { how: 'folder', cwd: target } : { how: 'ambiguous' }
+}
+
+// The listed vaults whose folder contains this vault root, as written, against
+// the root as given and as its real path: the app would show this vault's
+// notes in their windows too, and a call run in this vault's folder may reach
+// them. No vault is added inside another one. No listed folder's real path is
+// read, so a vault above the root only through a link is not found.
+export function enclosingVaults({ vaults, vaultRoot } = {}) {
+  if (typeof vaultRoot !== 'string' || !path.isAbsolute(vaultRoot)) return []
+  const { spelled, target } = rootOf(vaultRoot)
+  const inside = (folder, root) => folder !== root && root.startsWith(folder.endsWith(path.sep) ? folder : folder + path.sep)
+  return listedFolders(vaults).filter(([, entry]) => {
+    const folder = path.resolve(entry.path)
+    return !namesFolder(entry.path, { spelled, target }) && (inside(folder, target) || inside(folder, spelled))
+  }).map(([id, entry]) => ({ id, path: entry.path }))
+}

package/src/projection/obsidian/recovery/index.mjs

@@ -1,6 +1,9 @@
 // Recovery state for Obsidian publication: the immutable store, the durable
 // journal, restart recovery and the late-writer re-check.
-export { EXCHANGE_CANDIDATE_NAME, LATE_EXCHANGE_CANDIDATE_NAME, PublicationRefusal, VAULT_LOCK_DIRECTORY, acquireVaultLock, createRecoveryStore, readFileDigest, sha256Digest } from './store.mjs'
+export {
+  EXCHANGE_CANDIDATE_NAME, LATE_EXCHANGE_CANDIDATE_NAME, PublicationRefusal, VAULT_ALLOCATION_SCHEMA, VAULT_LOCK_DIRECTORY, VAULT_ORIGINS, acquireVaultLock, allocatedFolderState, assertAllocatedFolder, allocationFile, folderIdentity,
+  createRecoveryStore, hasCommittedGeneration, legacyVaultRoot, readFileDigest, readVaultAllocation, sha256Digest, validateVaultAllocation, vaultRootFor, writeVaultAllocation,
+} from './store.mjs'
 export { JOURNAL_SCHEMA, createJournal, journalDetail, listJournals, newJournalId } from './journal.mjs'
 export { classifyCandidateFile, namedCandidates, publishedSinceCommit, reconcileUnit, recoverPublications, retireStagedFile } from './restart.mjs'
 export { recheckDisplacedFiles } from './late-writer.mjs'

package/src/projection/obsidian/recovery/restart.mjs

@@ -300,6 +300,8 @@ export function recoverPublications({ store, clock = () => new Date() }) {
 // Digests this view has published since its trusted manifest was committed,
 // by journals that did not reach a commit. They are valid bases: without them
 // a note published by an interrupted run would look like an outside edit.
+// Settings and Atelier's plugin files are planned from the disk, never from a
+// base, so they have no place here.
 export function publishedSinceCommit({ store }) {
   const pointer = store.readCurrent()
   const ledger = new Map()
@@ -308,7 +310,7 @@ export function publishedSinceCommit({ store }) {
     if (document.state === 'committed' || document.expectedGeneration !== (pointer?.generationId ?? null)) continue
     for (const entry of document.entries) {
       const detail = journalDetail(entry)
-      if (entry.step !== 'conditional-update' || entry.outcome !== 'ok' || detail.kind === 'settings') continue
+      if (entry.step !== 'conditional-update' || entry.outcome !== 'ok' || detail.kind === 'settings' || detail.kind === 'plugin') continue
       ledger.set(entry.notePath, detail.op === 'remove' ? null : entry.afterDigest)
     }
   }

package/src/projection/obsidian/recovery/store.mjs

@@ -3,11 +3,12 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { acquirePrivateLock, publishPrivateFile } from '../../../project/durable-state.mjs'
 import { checkManagedRoots } from '../../../project/file-class.mjs'
-import { atomicReplacePrivateText, ensureContainedPrivateDirectory, openRegularFileNoFollow, readRegularTextNoFollow } from '../../../project/private-state.mjs'
+import { atomicReplacePrivateText, ensureContainedPrivateDirectory, openRegularFileNoFollow, readRegularTextNoFollow, realPathAsStored } from '../../../project/private-state.mjs'
 
 // Private per-workspace state for one Obsidian view:
 //
-//   <workspaceRoot>/vaults/<scopeId>/                 the editable vault (or an explicit vaultRoot)
+//   <workspaceRoot>/vaults/<scopeId>/                 the editable vault, unless it was allocated elsewhere or a vaultRoot is named
+//   <workspaceRoot>/state/allocations/<scopeId>.json  where the view's vault was allocated, when it was (see below)
 //   <workspaceRoot>/state/manifests/<scopeId>/        trusted manifests and the current pointer
 //   <workspaceRoot>/state/journals/<scopeId>/<id>/    publication journals
 //   <workspaceRoot>/recovery/objects/<sha256>.bin     immutable content-addressed bytes
@@ -49,7 +50,15 @@ export const VAULT_LOCK_DIRECTORY = '.atelier-publication'
 // marker before its ticket, so the directory does not grow inside a person's
 // vault and an interrupted removal never leaves a marker without its ticket.
 export function acquireVaultLock(store) {
+  // Only in the vault the store was made for, reached through no link: the lock's folder is made inside whatever the
+  // vault root leads to.
+  let real = null
+  try { real = realPathAsStored(store.vaultRoot) } catch { /* not reachable: refused below */ }
+  if (real !== store.vaultRoot) refuse(store.allocation ? 'vault-allocation-moved' : 'vault-root-moved', 'the vault is no longer the folder this publication was prepared for: its path now leads somewhere else; nothing was written', { path: store.vaultRoot, leadsTo: real })
   const directory = ensureContainedPrivateDirectory({ workspaceRoot: store.vaultRoot, directory: path.dirname(store.vaultLockPath), label: 'vault publication lock' })
+  // The lock's folder resolved, again, to the one inside the vault: a link put there after the check above is refused
+  // before any ticket is written (only the empty folder may have been made through it).
+  if (directory !== path.dirname(store.vaultLockPath)) refuse(store.allocation ? 'vault-allocation-moved' : 'vault-root-moved', 'the vault is no longer the folder this publication was prepared for: its path now leads somewhere else; no lock was taken', { path: store.vaultRoot, leadsTo: path.dirname(directory) })
   const release = acquirePrivateLock(path.join(directory, path.basename(store.vaultLockPath)))
   try {
     const owners = `${store.vaultLockPath}.owners`
@@ -111,11 +120,135 @@ function publishOnce(file, bytes) {
   return true
 }
 
+// ---------------------------------------------------------------------------
+// Where a view's vault is
+// ---------------------------------------------------------------------------
+
+// A view of a workspace that decided where its vaults live gets a folder
+// there, allocated once at its first publication (by the maintenance engine)
+// and recorded, owner only, in the workspace's private state:
+//
+//   <workspaceRoot>/state/allocations/<scopeId>.json   atelier-obsidian-vault-allocation/v1
+//
+// A view without a record has its vault where every earlier release put it,
+// `<workspaceRoot>/vaults/<scopeId>`: a vault published there stays there
+// until it is moved, and a workspace that decided no place publishes there as
+// before. The record is the one thing that names another folder, and the
+// store reads it, so every reader of a view's vault (the engine, source apply,
+// the proposal adapter, `open`) finds the same one.
+
+export const VAULT_ALLOCATION_SCHEMA = 'atelier-obsidian-vault-allocation/v1'
+export const VAULT_ORIGINS = Object.freeze(['allocated', 'legacy-data-root'])
+
+const TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/
+const CONTROL = /[\u0000-\u001f\u007f]/
+// `device` and `inode` name the folder that was made, as decimal strings (a 64-bit number does not fit a JSON number):
+// a folder at the recorded path that is another one (restored, moved in, made again by someone else) is never
+// published into.
+const ALLOCATION_KEYS = Object.freeze(['schema', 'workspaceId', 'scopeId', 'path', 'name', 'parent', 'device', 'inode', 'allocatedAt'])
+const DECIMAL = /^(0|[1-9][0-9]{0,19})$/
+const isPlainPath = (value) => typeof value === 'string' && value.length <= 4096 && !CONTROL.test(value) && path.isAbsolute(value) && path.resolve(value) === value
+
+export const allocationFile = (workspaceRoot, scopeId) => path.join(workspaceRoot, 'state', 'allocations', `${segment(scopeId)}.json`)
+export const legacyVaultRoot = (workspaceRoot, scopeId) => path.join(workspaceRoot, 'vaults', segment(scopeId))
+
+export function validateVaultAllocation(document, { workspaceId, scopeId }) {
+  const code = 'invalid-vault-allocation'
+  if (document === null || typeof document !== 'object' || Array.isArray(document)) refuse(code, 'a vault allocation is an object')
+  const unknown = Object.keys(document).filter((key) => !ALLOCATION_KEYS.includes(key))
+  if (unknown.length > 0 || ALLOCATION_KEYS.some((key) => !Object.hasOwn(document, key))) refuse(code, 'a vault allocation carries exactly its own members', { unknown: unknown.sort() })
+  if (document.schema !== VAULT_ALLOCATION_SCHEMA) refuse(code, 'a vault allocation names an unknown schema')
+  if (document.workspaceId !== workspaceId || document.scopeId !== scopeId || !IDENTIFIER.test(String(scopeId))) refuse(code, 'the vault allocation belongs to another workspace or view')
+  if (!isPlainPath(document.path) || !isPlainPath(document.parent)) refuse(code, 'the vault allocation names a folder that is not an absolute, plainly written path')
+  if (path.dirname(document.path) !== document.parent || path.basename(document.path) !== document.name) refuse(code, 'the vault allocation names its folder inconsistently')
+  if (typeof document.device !== 'string' || !DECIMAL.test(document.device) || typeof document.inode !== 'string' || !DECIMAL.test(document.inode)) refuse(code, 'the vault allocation names its folder\'s device and inode as decimal strings')
+  if (typeof document.allocatedAt !== 'string' || !TIMESTAMP.test(document.allocatedAt)) refuse(code, 'the vault allocation needs a UTC time')
+  return document
+}
+
+// The record of a view, validated, or null when it has none. Reads only.
+export function readVaultAllocation({ workspaceRoot, workspaceId, scopeId }) {
+  let text
+  try { text = readRegularTextNoFollow(allocationFile(workspaceRoot, scopeId)) } catch (error) {
+    if (error.code === 'ENOENT') return null
+    return refuse('invalid-vault-allocation', 'the vault allocation cannot be read', { cause: error.code ?? String(error.message) })
+  }
+  let document
+  try { document = JSON.parse(text) } catch { return refuse('invalid-vault-allocation', 'the vault allocation is not JSON') }
+  return validateVaultAllocation(document, { workspaceId, scopeId })
+}
+
+// The device and inode of a folder, as an allocation records them; null when nothing is there.
+export function folderIdentity(folder) {
+  const stat = fs.lstatSync(folder, { bigint: true, throwIfNoEntry: false })
+  return stat === undefined ? null : { device: String(stat.dev), inode: String(stat.ino), directory: stat.isDirectory(), link: stat.isSymbolicLink() }
+}
+
+// Whether the folder at an allocation's path is the one it recorded: 'same', 'missing', or 'replaced'.
+export function allocatedFolderState(allocation) {
+  const found = folderIdentity(allocation.path)
+  if (found === null) return 'missing'
+  return found.directory && !found.link && found.device === allocation.device && found.inode === allocation.inode ? 'same' : 'replaced'
+}
+
+// Refuses, typed, unless the folder at an allocation's path is the one it recorded, at that real path: checked when a store is made, by
+// the maintenance engine before it uses a store again, and by the publisher before and after it takes the vault lock,
+// so a folder replaced while a service runs is never published into.
+export function assertAllocatedFolder(allocation) {
+  const found = allocatedFolderState(allocation)
+  if (found === 'missing') refuse('vault-allocation-missing', 'the folder allocated to this view is gone; the maintenance service makes it again at its next tick', { path: allocation.path })
+  if (found === 'replaced') refuse('vault-allocation-replaced', 'another folder is where this view\'s vault was allocated; Atelier publishes only into the folder it made', { path: allocation.path })
+  // Reached through no link: the record holds the folder's real path, so the same folder moved elsewhere (into a
+  // vault the app lists, say) and linked back, which keeps its device and inode, is not published into either.
+  let real = null
+  try { real = realPathAsStored(allocation.path) } catch { /* not reachable: refused below */ }
+  if (real !== allocation.path) refuse('vault-allocation-moved', 'this view\'s vault is now reached through a link, somewhere else than where it was allocated; Atelier publishes only into the folder at the path it recorded', { path: allocation.path, leadsTo: real })
+  return allocation
+}
+
+// Written only by the maintenance engine, under its lock, and by what moves a vault under the same lock.
+export function writeVaultAllocation({ workspaceRoot, allocation }) {
+  validateVaultAllocation(allocation, allocation)
+  const directory = ensureContainedPrivateDirectory({ workspaceRoot, directory: path.dirname(allocationFile(workspaceRoot, allocation.scopeId)), label: 'Obsidian vault allocations' })
+  atomicReplacePrivateText(path.join(directory, path.basename(allocationFile(workspaceRoot, allocation.scopeId))), `${JSON.stringify(allocation, null, 2)}\n`)
+  return allocation
+}
+
+// A view without a record that was published, and has no vault under the data root, where a view published there
+// always has its folder: its record was lost (removed, or a backup restored without it), or, for a view that was never
+// allocated a folder, its folder under the data root was removed. Refused, typed, rather than published again into a
+// new, empty vault under the data root while a vault it had elsewhere stays orphaned.
+function refuseLostAllocation({ workspaceRoot, scopeId }) {
+  const legacy = legacyVaultRoot(workspaceRoot, scopeId)
+  if (!hasCommittedGeneration({ workspaceRoot, scopeId }) || fs.lstatSync(legacy, { throwIfNoEntry: false }) !== undefined) return
+  refuse('vault-allocation-lost', `this view was published, and its vault is not where Atelier can find it: there is no record of a folder allocated for it, and no folder under the data root. If its vault was allocated elsewhere, restore ${allocationFile(workspaceRoot, scopeId)} from a backup; otherwise, or to publish the view under the data root from now on, make the folder ${legacy}: the view is published there at the next change at its sources`, { record: allocationFile(workspaceRoot, scopeId), path: legacy })
+}
+
+// Where a view's vault is, without creating anything: { path, origin, allocation }.
+export function vaultRootFor({ workspaceRoot, workspaceId, scopeId }) {
+  const allocation = readVaultAllocation({ workspaceRoot, workspaceId, scopeId })
+  if (allocation === null) refuseLostAllocation({ workspaceRoot, scopeId })
+  return allocation === null
+    ? { path: legacyVaultRoot(workspaceRoot, scopeId), origin: 'legacy-data-root', allocation: null }
+    : { path: allocation.path, origin: 'allocated', allocation }
+}
+
+// Whether a view has a committed generation, whichever folder it was published into.
+export const hasCommittedGeneration = ({ workspaceRoot, scopeId }) => fs.existsSync(path.join(workspaceRoot, 'state', 'manifests', segment(scopeId), 'current.json'))
+
 // `repositoryRoots` is required: every enrolled repository root of the loaded
 // project. Neither the workspace state nor the vault may overlap one of them,
 // in either direction, lexically or by real path; the store refuses before it
 // creates anything. A caller with no enrolled repository (a test in a
 // temporary directory) says so with an explicit empty list.
+//
+// Without `vaultRoot` the vault is where the view's allocation says, else in
+// the workspace's `vaults/` (vaultRootFor). An allocated folder must be the
+// very folder the record names (device and inode): one that has gone is made
+// again by the maintenance engine under its lock (ensureVaultAllocation), and
+// until then, like one that another folder replaced, the store refuses. A
+// published view whose record was lost is refused too, never published again
+// into a new vault under the data root.
 export function createRecoveryStore({ workspaceRoot, workspaceId, scopeId, vaultRoot, repositoryRoots } = {}) {
   if (typeof workspaceRoot !== 'string' || !path.isAbsolute(workspaceRoot)) throw new TypeError('workspaceRoot must be an absolute path')
   for (const [label, value] of [['workspaceId', workspaceId], ['scopeId', scopeId]]) {
@@ -125,17 +258,28 @@ export function createRecoveryStore({ workspaceRoot, workspaceId, scopeId, vault
     throw new TypeError('repositoryRoots must list the absolute root of every enrolled repository; pass an explicit empty list when there is none')
   }
   if (vaultRoot !== undefined && (typeof vaultRoot !== 'string' || !path.isAbsolute(vaultRoot))) throw new TypeError('vaultRoot must be an absolute path')
-  const guard = checkManagedRoots({ managedRoots: [workspaceRoot, ...(vaultRoot === undefined ? [] : [vaultRoot])], repositoryRoots })
+  const allocation = vaultRoot === undefined ? readVaultAllocation({ workspaceRoot, workspaceId, scopeId }) : null
+  const namedVault = vaultRoot ?? allocation?.path
+  // A folder that is there but is not the one allocated (a link put where it was, say) is refused as such first, with
+  // its own next step; the checks below only read. One that has gone is checked against the repositories first.
+  if (allocation !== null && allocatedFolderState(allocation) !== 'missing') assertAllocatedFolder(allocation)
+  const guard = checkManagedRoots({ managedRoots: [workspaceRoot, ...(namedVault === undefined ? [] : [namedVault])], repositoryRoots })
   if (!guard.ok) refuse(guard.refusals[0].code, guard.refusals[0].message, { refusals: guard.refusals })
+  if (allocation !== null) assertAllocatedFolder(allocation)
+  else if (vaultRoot === undefined) refuseLostAllocation({ workspaceRoot, scopeId })
   fs.mkdirSync(workspaceRoot, { recursive: true, mode: 0o700 })
-  const root = fs.realpathSync(workspaceRoot)
+  // Both as the file system stores them: the vault root is what the app is told, and what it compares its own
+  // working-directory spelling with.
+  const root = realPathAsStored(workspaceRoot)
   const privateDir = (...parts) => ensureContainedPrivateDirectory({ workspaceRoot: root, directory: path.join(root, ...parts), label: 'Obsidian publication state' })
-  const requestedVault = vaultRoot ?? path.join(root, 'vaults', segment(scopeId))
-  fs.mkdirSync(requestedVault, { recursive: true })
-  const vault = fs.realpathSync(requestedVault)
+  const requestedVault = namedVault ?? legacyVaultRoot(root, scopeId)
+  // A vault this store places itself, under the data root or where the view's vault was allocated, is private to this
+  // user from the start: it will hold the plugin's bearer.
+  fs.mkdirSync(requestedVault, { recursive: true, ...(vaultRoot === undefined ? { mode: 0o700 } : {}) })
+  const vault = realPathAsStored(requestedVault)
   const inside = (parent, child) => { const relative = path.relative(parent, child); return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative)) }
   for (const area of ['state', 'recovery', 'staging']) {
-    if (inside(path.join(root, area), vault) || inside(vault, path.join(root, area))) throw new TypeError('the vault may not overlap private publication state')
+    if (inside(path.join(root, area), vault) || inside(vault, path.join(root, area))) refuse('vault-overlaps-private-state', 'the vault may not overlap private publication state')
   }
   const manifests = privateDir('state', 'manifests', segment(scopeId))
   const journals = privateDir('state', 'journals', segment(scopeId))
@@ -149,6 +293,22 @@ export function createRecoveryStore({ workspaceRoot, workspaceId, scopeId, vault
     workspaceId,
     scopeId,
     vaultRoot: vault,
+    // Placed by this store under the workspace state or where the view's vault was allocated, rather than named by the
+    // caller, and really there: a vault path that is a link leads to a folder someone else chose, which is only looked
+    // at and never receives the bearer.
+    managedVaultRoot: vaultRoot === undefined && vault === requestedVault,
+    linkedVaultRoot: vaultRoot === undefined && vault !== requestedVault,
+    // Where the vault is and why: named by the caller, allocated for the view, or under the data root.
+    vaultOrigin: vaultRoot !== undefined ? 'explicit' : allocation === null ? 'legacy-data-root' : 'allocated',
+    allocation,
+    // Refuses, typed, once the folder of an allocated vault is no longer the one this store was made for (see
+    // assertAllocatedFolder), and once any other vault root is gone or leads elsewhere (vault-root-moved).
+    checkAllocatedVault() {
+      if (allocation !== null) { assertAllocatedFolder(allocation); return }
+      let real = null
+      try { real = realPathAsStored(vault) } catch { /* gone: refused below */ }
+      if (real !== vault) refuse('vault-root-moved', 'this view\'s vault is gone, or its path now leads somewhere else; nothing more is written into it', { path: vault, leadsTo: real })
+    },
     journalsRoot: journals,
     lockPath: path.join(locks, `${segment(scopeId)}.lock`),
     // One publisher per vault, whichever view or workspace state it belongs to.

package/src/projection/obsidian/selection-ui/contribution.mjs

@@ -4,7 +4,7 @@ import { isoTime } from '../../../runtime/obsidian/documents.mjs'
 import { refuse } from '../../../runtime/obsidian/errors.mjs'
 import { protectedRoots, readMachineSettings } from '../../../runtime/obsidian/machine-settings.mjs'
 import { resolveScope } from '../../../runtime/obsidian/opening.mjs'
-import { DEFAULT_ELIGIBILITY, createProductionSeams } from '../../../runtime/obsidian/pipeline.mjs'
+import { createProductionSeams, eligibilityFor } from '../../../runtime/obsidian/pipeline.mjs'
 import { createMaintenanceStateStore } from '../../../runtime/obsidian/state-store.mjs'
 import { readConflictView } from './conflict-view.mjs'
 import { runPolicySetup } from './policy-setup.mjs'
@@ -28,8 +28,9 @@ const EXIT = Object.freeze({ ok: 0, notSuccess: 3 })
 const MAX_REQUEST_BYTES = 64 * 1024
 
 // The canonical snapshot selectScope reads, built exactly as the engine
-// builds it: the canonical graph with fail-closed eligibility, and the
-// declared relations whose both endpoints the census knows.
+// builds it: the canonical graph with the eligibility the machine settings
+// decide (fail closed), and the declared relations whose both endpoints the
+// census knows.
 function snapshotNow({ project, seams, eligibility }) {
   const graph = seams.buildGraph({ project, eligibility })
   const known = new Set(graph.nodes.map((node) => node.id))
@@ -49,7 +50,7 @@ function readRequest(value) {
   }
 }
 
-export function createSelectionOperation({ seams = createProductionSeams(), eligibility = DEFAULT_ELIGIBILITY } = {}) {
+export function createSelectionOperation({ seams = createProductionSeams(), eligibility: fixedEligibility = null } = {}) {
   return {
     name: 'selection',
     summary: 'resolve ID | persist ID [allow-empty] | show ID | list  The exact selected set of a declared view, its note paths and, for a focus, the graph query; persisted in Atelier state.',
@@ -74,7 +75,7 @@ export function createSelectionOperation({ seams = createProductionSeams(), elig
       const usable = workspace !== null && workspace.workspaceRoot !== null
       const machine = usable ? readMachineSettings(workspace) : null
       const profile = seams.profileFor({ project, workspaceId: workspace?.workspaceId ?? 'ws-unprepared', audienceAllow: machine?.audienceAllow ?? [] })
-      const canonicalSnapshot = snapshotNow({ project, seams, eligibility })
+      const canonicalSnapshot = snapshotNow({ project, seams, eligibility: fixedEligibility ?? eligibilityFor({ machine, project }) })
       const pathRegistry = usable ? createMaintenanceStateStore(workspace).readPathRegistry() : null
       // Explicit empty is an honest answer of `resolve`; `persist` of an empty selection is refused and asks for it by name.
       const selection = resolveSelection({ canonicalSnapshot, profile, scope, pathRegistry, allowEmpty: sub === 'resolve' || option === 'allow-empty' })