@mnstry/atelier 0.2.0-alpha.12 → 0.2.0-alpha.13

package/src/projection/obsidian/publication/publisher.mjs

@@ -9,7 +9,7 @@ import { PLUGIN_DATA_MODE, PLUGIN_DATA_PATH, PLUGIN_SOURCE_MODE } from '../plugi
 import { createJournal, newJournalId } from '../recovery/journal.mjs'
 import { recheckDisplacedFiles } from '../recovery/late-writer.mjs'
 import { publishedSinceCommit, reconcileUnit, recordDisplaced, recoverPublicationsLocked, retireStagedFile } from '../recovery/restart.mjs'
-import { PublicationRefusal, acquireVaultLock, readFileBytes, readFileDigest, refuse, sha256Digest } from '../recovery/store.mjs'
+import { PublicationRefusal, acquireVaultLock, allocatedFolderState, readFileBytes, readFileDigest, refuse, sha256Digest } from '../recovery/store.mjs'
 import { PROTOCOL_ID, isAddressableVaultPath } from './bridge-script.mjs'
 import { probeExchange } from './exchange.mjs'
 import { CRASH_INJECTION_TEST_SEAM } from './test-seam.mjs'
@@ -44,11 +44,34 @@ import { createDirectAdapter } from './transport.mjs'
 // displaced to recovery and never lost, and a plugin path that a person has to
 // repair never holds the view back. The plugin's data file names a bearer and
 // is written only into a vault root that is private to this user.
+//
+// First publication into a vault no Obsidian lists (`direct-unheld`). A running
+// or unknowable app that cannot be coordinated with still refuses the whole
+// publication, as ever, except in one case: the view has never been committed,
+// its vault is the folder Atelier allocated for it (the record's device and
+// inode), and the evidence (`unheldEvidence`, read by the caller from the app's
+// own settings file) says no list this account's Obsidian keeps names that
+// folder, a folder above it or one inside it, on macOS or Linux. The vault is
+// then filled in this process, with no editor, by creating files only: every
+// file appears through the exclusive link, where nothing is, or not at all. A
+// unit that would replace or remove a file, or write a settings file over one
+// that is there, refuses as `editor-uncoordinated` (blocking) and writes
+// nothing. No editor can hold an unsaved buffer of a file that does not exist,
+// so nothing a person wrote can be lost, whoever holds the vault. The evidence
+// is read again immediately before the first unit and whenever two seconds
+// have passed since the last reading; once a reading gives no evidence, every
+// remaining unit refuses and nothing is committed. A run that completes is
+// committed before `open` tells the app about the vault; a run that stops
+// partway reports why, and what it left is published through the app.
 
 const hex = (digest) => digest.slice('sha256:'.length)
 const iso = (clock) => { const value = clock(); return (value instanceof Date ? value : new Date(value)).toISOString() }
 const REFUSED_BY_EDIT = new Set(['editor-edit', 'disk-changed'])
 const unreleased = new Map()
+// A release kept earlier whose lock folder is gone when it is tried again (the vault deleted, replaced, or made again
+// empty at its path) holds nothing there, and is dropped rather than holding every later publication of that vault back.
+// A vault put back holds its ticket again, and the release kept for it then succeeds.
+const lockFolderGone = (error) => error?.code === 'ENOENT' || error?.code === 'ENOTDIR'
 
 // A note another program replaces by rename can change between the check of its leaf and the open
 // (ELEAFCHANGED). Every rename leaves a complete file, so it is read again; one that keeps changing is left to
@@ -212,17 +235,47 @@ function currentDigestOf(vaultRoot, relativePath) {
   try { return readFileDigest(path.join(vaultRoot, relativePath)) } catch { return null }
 }
 
+// Whether publishing would only leave this plugin path for the person, as it
+// stands: a parent that is a link or not a directory, a leaf that is not a
+// regular file (path-unsafe), or the data file where the vault root cannot hold
+// the bearer and is not one Atelier makes private itself (vault-not-private;
+// see ensurePrivateVaultRoot). Read-only. Conservative: a leaf nobody may
+// read, a parent that cannot be looked into, and a vault root Atelier keeps
+// whose mode cannot be changed are left for the person too, but count here as
+// a drift, as before.
+function leftForThePerson(store, relativePath) {
+  let current = store.vaultRoot
+  for (const part of relativePath.split('/').slice(0, -1)) {
+    current = path.join(current, part)
+    const stat = fs.lstatSync(current, { throwIfNoEntry: false })
+    if (!stat) break
+    if (stat.isSymbolicLink() || !stat.isDirectory()) return true
+  }
+  const leaf = fs.lstatSync(path.join(store.vaultRoot, relativePath), { throwIfNoEntry: false })
+  if (leaf && !leaf.isFile()) return true
+  if (relativePath !== PLUGIN_DATA_PATH) return false
+  if (store.linkedVaultRoot === true) return true
+  const uid = typeof process.getuid === 'function' ? process.getuid() : null
+  const root = fs.lstatSync(store.vaultRoot, { throwIfNoEntry: false })
+  if (!root?.isDirectory() || uid === null || root.uid !== uid) return true
+  return (root.mode & 0o077) !== 0 && store.managedVaultRoot !== true
+}
+
 // A generation that is already committed is published again, as it is, when a
 // plugin file it carries is not on disk as it pins it: the person repaired a
 // path Atelier had to leave, or removed or changed a file. The bytes are
 // Atelier's and nothing else of the view changed, so the generation stays the
 // same; its notes are kept, and its plugin units are planned from the disk as
-// ever. A file prepared only where present that is gone is not a drift.
+// ever. A file prepared only where present that is gone is not a drift, and
+// neither is one that publishing would only leave for the person again: it
+// would change nothing, and it would need the app for nothing (a view that
+// waits for an app for it would wait for a write that never comes).
 function pluginFilesDrifted(preparedView, store) {
   return preparedView.files.some((file) => {
     if (file.kind !== 'plugin') return false
     const current = currentDigestOf(store.vaultRoot, file.path)
-    return current !== file.digest && !(current === null && file.onlyIfPresent === true)
+    if (current === file.digest || (current === null && file.onlyIfPresent === true)) return false
+    try { return !leftForThePerson(store, file.path) } catch { return true }
   })
 }
 
@@ -264,8 +317,38 @@ export function planUnits({ files, priorManifest, pointer, ledger, pluginDisk =
   return units
 }
 
-export async function publishView(options = {}) {
+// The rules the oracle tests are sensitive to. Production always uses these; the tests substitute a deliberately
+// broken one through publishViewForOracleTests to prove the oracle can fail.
+export const PUBLICATION_PRIMITIVES = Object.freeze({
+  // The one operation the `direct-unheld` path writes into the vault: a file created where nothing is.
+  unheldWrites: (op) => op === 'create',
+})
+
+// Whether the `direct-unheld` path applies, after the adapter found an app it cannot coordinate with (see the head of
+// this file). Every condition must hold; an evidence reader that is absent, throws or answers anything but
+// `unlisted: true` gives none.
+async function unheldPathApplies({ probe, pointer, store, unheldEvidence, platform }) {
+  if (probe.code !== undefined || pointer !== null) return false
+  if (platform !== 'darwin' && platform !== 'linux') return false
+  const { allocation } = store
+  if (store.vaultOrigin !== 'allocated' || store.managedVaultRoot !== true || !allocation || store.vaultRoot !== allocation.path || allocatedFolderState(allocation) !== 'same') return false
+  return readsUnlisted(unheldEvidence, store)
+}
+
+async function readsUnlisted(unheldEvidence, store) {
+  if (typeof unheldEvidence !== 'function') return false
+  try { return (await unheldEvidence({ vaultRoot: store.vaultRoot }))?.unlisted === true } catch { return false }
+}
+
+export function publishView(options = {}) {
+  return publishViewForOracleTests(options, PUBLICATION_PRIMITIVES)
+}
+
+export async function publishViewForOracleTests(options = {}, primitives = PUBLICATION_PRIMITIVES) {
   const { preparedView, protocolId, expectedGeneration, recoveryStore: store, adapter, clock = () => new Date(), quietPeriodMs = 1500, exchangeOptions = {} } = options
+  // `unheldEvidence({ vaultRoot })` answers whether the app's own list names this vault (see the head of this file).
+  const { unheldEvidence = null, platform = process.platform } = options
+  const rules = { ...PUBLICATION_PRIMITIVES, ...primitives }
   const seam = options[CRASH_INJECTION_TEST_SEAM] ?? null
   const crash = (point) => { if (seam && seam.at === point) seam.halt(point) }
   if (!store || typeof store.commitManifest !== 'function') throw new TypeError('publishView needs a recoveryStore')
@@ -280,19 +363,27 @@ export async function publishView(options = {}) {
     // A release that could not be written (a full disk) is finished first.
     for (const lockPath of [store.vaultLockPath, store.lockPath]) {
       if (!unreleased.has(lockPath)) continue
-      try { unreleased.get(lockPath)() } catch (error) { refuse('state-unwritable', 'private publication state cannot be written; nothing in the vault was touched', { cause: error.code ?? String(error.message) }) }
+      try { unreleased.get(lockPath)() } catch (error) { if (!lockFolderGone(error)) refuse('state-unwritable', 'private publication state cannot be written; nothing in the vault was touched', { cause: error.code ?? String(error.message) }) }
       unreleased.delete(lockPath)
     }
     // Two locks, the view's and then the vault's: a second view or a second
     // workspace state pointed at the same vault refuses instead of racing.
     const acquire = (lockPath, take, held) => {
       try { releases.push([lockPath, take()]) } catch (error) {
+        if (error instanceof PublicationRefusal) throw error
         if (error.code === 'EEXIST') refuse('publication-in-progress', `another publication ${held} holds the lock`)
         refuse('state-unwritable', 'private publication state cannot be written; nothing in the vault was touched', { cause: error.code ?? String(error.message) })
       }
     }
     acquire(store.lockPath, () => acquirePrivateLock(store.lockPath), 'of this view')
+    // A vault allocated for the view is still the folder it made, before anything is written in it (the vault lock
+    // included) and again once the lock is held: a store kept by a long-running service may outlive its folder. It is
+    // checked again after every wait on the app, before each unit and before the commit, so a folder replaced during a
+    // publication refuses it and is never reported current. (Only this account can replace it; the check and the
+    // write that follows it are still two steps.)
+    store.checkAllocatedVault?.()
     acquire(store.vaultLockPath, () => acquireVaultLock(store), 'into this vault')
+    store.checkAllocatedVault?.()
     const recovered = recoverPublicationsLocked({ store, clock })
     const pointer = store.readCurrent()
     if (pointer?.generationId === manifest.generationId && !pluginFilesDrifted(preparedView, store)) {
@@ -303,8 +394,12 @@ export async function publishView(options = {}) {
     // Path selection. An app with this vault open in several windows is refused as such: publishing through one of
     // them would leave the others uncoordinated.
     const probe = await adapter.probe({ vaultRoot: store.vaultRoot })
-    if (probe.state !== 'coordinated' && probe.state !== 'absent') refuse(probe.code === 'vault-open-in-several-windows' ? probe.code : 'editor-uncoordinated', `an Obsidian process may have this vault open and cannot be coordinated with: ${probe.reason}`)
-    const mode = probe.state === 'coordinated' ? 'in-app' : 'direct'
+    store.checkAllocatedVault?.()
+    const unheld = probe.state !== 'coordinated' && probe.state !== 'absent' && await unheldPathApplies({ probe, pointer, store, unheldEvidence, platform })
+    // The evidence took time to read: the folder is checked again.
+    if (unheld) store.checkAllocatedVault?.()
+    if (probe.state !== 'coordinated' && probe.state !== 'absent' && !unheld) refuse(probe.code === 'vault-open-in-several-windows' ? probe.code : 'editor-uncoordinated', `an Obsidian process may have this vault open and cannot be coordinated with: ${probe.reason}`)
+    const mode = probe.state === 'coordinated' ? 'in-app' : unheld ? 'direct-unheld' : 'direct'
     const channel = mode === 'in-app' ? adapter : createDirectAdapter({ crashSeam: seam })
 
     // Same volume, and an exchange that works on it.
@@ -329,7 +424,8 @@ export async function publishView(options = {}) {
     let stagingDir = null
     try {
       stagingDir = store.stagingDir(journalId)
-      for (const unit of units.filter((item) => item.op === 'replace' || item.op === 'create')) {
+      // On the `direct-unheld` path a replacement is never written, so no candidate is staged for one.
+      for (const unit of units.filter((item) => item.op === 'create' || (item.op === 'replace' && (mode !== 'direct-unheld' || rules.unheldWrites(item.op))))) {
         const existing = fs.lstatSync(path.join(store.vaultRoot, unit.path), { throwIfNoEntry: false })
         unit.preparedPath = store.preparedPath(journalId, unit.unit)
         stageCandidate(unit.preparedPath, unit.bytes, unit.mode ?? (existing?.isFile() ? existing.mode & 0o777 : 0o644), created)
@@ -368,7 +464,7 @@ export async function publishView(options = {}) {
     }
     crash('after-staging')
 
-    const context = { store, journal, journalId, channel, clock, crash, mode }
+    const context = { store, journal, journalId, channel, clock, crash, mode, rules }
     const results = []
     // Kept notes are compared first, several at a time; one that holds exactly its candidate bytes is unchanged.
     const unchanged = await unchangedKeepUnits(units, store)
@@ -379,6 +475,8 @@ export async function publishView(options = {}) {
     // passed since the last reading. An app that starts after a reading and
     // before the next is not seen; that window is at most two seconds plus
     // one note's publication.
+    // The `direct-unheld` path reads its evidence on the same schedule, and once a reading gives none, every remaining
+    // unit refuses, a kept one included, so nothing is committed.
     let lastProbe = null
     for (const unit of units) {
       if (mode === 'direct' && (lastProbe === null || Date.now() - lastProbe > 2000)) {
@@ -386,8 +484,13 @@ export async function publishView(options = {}) {
         const again = await adapter.probe({ vaultRoot: store.vaultRoot })
         if (again.state !== 'absent') context.uncoordinated = again.reason
       }
+      if (mode === 'direct-unheld' && !context.uncoordinated && (lastProbe === null || Date.now() - lastProbe > 2000)) {
+        lastProbe = Date.now()
+        if (!(await readsUnlisted(unheldEvidence, store))) context.uncoordinated = 'the vault list of the app no longer shows, positively, that no Obsidian lists this vault'
+      }
+      store.checkAllocatedVault?.()
       if (unit.op === 'keep' && unchanged.has(unit.path)) {
-        results.push({ path: unit.path, kind: unit.kind, op: unit.op, outcome: context.uncoordinated ? 'editor-uncoordinated' : 'unchanged', blocking: false })
+        results.push({ path: unit.path, kind: unit.kind, op: unit.op, outcome: context.uncoordinated ? 'editor-uncoordinated' : 'unchanged', blocking: mode === 'direct-unheld' && Boolean(context.uncoordinated) })
         continue
       }
       try { results.push(await publishUnit(unit, context)) } catch (error) {
@@ -402,7 +505,7 @@ export async function publishView(options = {}) {
     const retainedEdits = results.filter((result) => result.retained).map((result) => result.retained)
     // Notes kept earlier stay surfaced until they leave the vault or come back into a view.
     const base = { journalId, generationId: manifest.generationId, mode, notes: results.map(({ retained, ...rest }) => rest), retainedEdits, recovered }
-    if (blocking.length > 0) {
+    if (blocking.length > 0 || (mode === 'direct-unheld' && context.uncoordinated)) {
       const lateWriters = recheckDisplacedFiles({ store, journalIds: [journalId], clock })
       return { ...base, state: 'updating', lateWriters }
     }
@@ -416,6 +519,7 @@ export async function publishView(options = {}) {
     }
     journal.append({ step: 'verify', outcome: 'ok', state: 'verifying', detail: { settled: true, retained: retainedEdits } })
     crash('before-manifest-commit')
+    store.checkAllocatedVault?.()
     store.commitManifest({ manifestBytes, generationId: manifest.generationId, journalId, retained: retainedEdits, committedAt: iso(clock) })
     crash('after-manifest-pointer')
     journal.append({ step: 'manifest-commit', outcome: 'ok', state: 'committed', detail: { manifestDigest: sha256Digest(manifestBytes) } })
@@ -429,6 +533,8 @@ export async function publishView(options = {}) {
     }
     return { state: 'refused', refusal: { code: error.code, message: error.message, detail: error.detail }, notes: [], retainedEdits: [], lateWriters: [] }
   } finally {
+    // A release that fails is kept and tried again before the next publication of that lock, even when the lock's folder
+    // is not there now: a vault moved away keeps its ticket and may be put back.
     for (const [lockPath, release] of releases.reverse()) try { release() } catch { unreleased.set(lockPath, release) }
   }
 }
@@ -487,9 +593,15 @@ async function publishOneUnit(unit, context) {
   const { store, journal, journalId, clock } = context
   const note = path.join(store.vaultRoot, unit.path)
   const outcome = (code, extra = {}) => ({ path: unit.path, kind: unit.kind, op: unit.op, outcome: code, blocking: false, ...extra })
-  if (unit.op === 'leave-absent') return outcome('left-absent')
+  // On the `direct-unheld` path a unit after a failed reading refuses, whatever it would have done, so the run says why
+  // it stopped.
+  if (unit.op === 'leave-absent') return context.mode === 'direct-unheld' && context.uncoordinated ? outcome('editor-uncoordinated', { blocking: true }) : outcome('left-absent')
   const observe = (bytes) => store.retainObject(bytes)
-  if (context.uncoordinated) return outcome('editor-uncoordinated', { blocking: unit.op !== 'keep' })
+  if (context.uncoordinated) return outcome('editor-uncoordinated', { blocking: unit.op !== 'keep' || context.mode === 'direct-unheld' })
+  // The `direct-unheld` path creates files and nothing else. A unit planned as a replacement or a removal has no
+  // candidate staged, and is refused before its file is even read. (A kept unit may still become a create; a settings
+  // unit is decided in planSettings.)
+  if (context.mode === 'direct-unheld' && unit.op !== 'keep' && unit.op !== 'settings' && !context.rules.unheldWrites(unit.op)) return outcome('editor-uncoordinated', { blocking: true })
   // A settings path that cannot be written safely (a symlinked `.obsidian`,
   // say) is reported and left alone; it must not keep every note from
   // converging while the person repairs it. Notes and attachments block.
@@ -532,6 +644,11 @@ async function publishOneUnit(unit, context) {
     if (plan.stagedPath) retire(plan, context)
     return outcome('already-current')
   }
+  // Whatever a unit became on the way here, the `direct-unheld` path writes nothing below this point but a create.
+  if (context.mode === 'direct-unheld' && !context.rules.unheldWrites(plan.op)) {
+    if (plan.stagedPath) retire(plan, context)
+    return outcome('editor-uncoordinated', { blocking: true })
+  }
 
   if (unit.path === PLUGIN_DATA_PATH && plan.op !== 'remove') {
     const privacy = ensurePrivateVaultRoot(store)
@@ -706,6 +823,11 @@ function planSettings(unit, context) {
   if (Object.hasOwn(unit, 'expectedDigest') && (existing === null ? null : sha256Digest(existing)) !== unit.expectedDigest) {
     return { path: unit.path, kind: 'settings', op: 'settings', outcome: 'settings-changed', blocking: true }
   }
+  // On the `direct-unheld` path a settings file that is there is never written over, and no candidate is staged for it.
+  // Only one that already holds exactly what the policy asks (Atelier's own, from an interrupted run) is left as it is.
+  if (context.mode === 'direct-unheld' && existing !== null && !context.rules.unheldWrites('replace') && !holdsPolicy(unit.path, existing)) {
+    return { path: unit.path, kind: 'settings', op: 'settings', outcome: 'editor-uncoordinated', blocking: true }
+  }
   let file
   try { file = preparePolicySettingsFile(unit.path, existing) } catch (error) {
     if (error instanceof ObsidianContractRefusal) return { path: unit.path, kind: 'settings', op: 'settings', outcome: 'settings-invalid', blocking: false }
@@ -720,6 +842,13 @@ function planSettings(unit, context) {
   return plan
 }
 
+function holdsPolicy(settingsPath, bytes) {
+  try { return preparePolicySettingsFile(settingsPath, bytes).bytes.equals(bytes) } catch (error) {
+    if (error instanceof ObsidianContractRefusal) return false
+    throw error
+  }
+}
+
 function verify(unit, plan, { store, journal }, result) {
   const bytes = readNote(path.join(store.vaultRoot, unit.path))
   const digest = bytes === null ? null : sha256Digest(bytes)

package/src/projection/obsidian/publication/vault-list.mjs

@@ -109,13 +109,14 @@ const currentUid = () => (typeof process.getuid === 'function' ? process.getuid(
 // { ok: false, code, message }. The user-data directory and the file must be
 // this user's own, a real directory and a regular file; the file must be a
 // JSON object whose `vaults`, when present, is an object. A missing directory
-// or file means Obsidian has not run on this account.
+// or file means Obsidian has not run on this account, or has shown only its
+// starter window, which writes no list: that refusal names `userDataDir`.
 export function readObsidianSettings({ userDataDir, uid = currentUid() } = {}) {
   if (typeof userDataDir !== 'string' || !path.isAbsolute(userDataDir)) return refused('obsidian-settings-location-unknown', 'where Obsidian keeps its settings on this system is not known')
   const owned = (stat) => uid === null || stat.uid === uid
   let directory
   try { directory = fs.lstatSync(userDataDir) } catch (error) {
-    if (error.code === 'ENOENT') return refused('obsidian-settings-missing', 'Obsidian has no settings directory on this account; it has not run here')
+    if (error.code === 'ENOENT') return { ...refused('obsidian-settings-missing', 'Obsidian has no settings directory on this account; it has not run here'), userDataDir }
     return refused('obsidian-settings-unreadable', 'the Obsidian settings directory cannot be read')
   }
   if (directory.isSymbolicLink() || !directory.isDirectory()) return refused('obsidian-settings-unsafe', 'the Obsidian settings directory is a link or not a directory')
@@ -123,7 +124,7 @@ export function readObsidianSettings({ userDataDir, uid = currentUid() } = {}) {
   const file = path.join(userDataDir, OBSIDIAN_SETTINGS_FILE)
   let leaf
   try { leaf = fs.lstatSync(file) } catch (error) {
-    if (error.code === 'ENOENT') return refused('obsidian-settings-missing', 'Obsidian has no settings file on this account; it has not run here')
+    if (error.code === 'ENOENT') return { ...refused('obsidian-settings-missing', 'Obsidian has no settings file on this account; it has not run here'), userDataDir }
     return refused('obsidian-settings-unreadable', 'the Obsidian settings file cannot be read')
   }
   if (leaf.isSymbolicLink() || !leaf.isFile()) return refused('obsidian-settings-unsafe', 'the Obsidian settings file is a link or not a regular file')

package/src/projection/obsidian/recovery/index.mjs

@@ -1,6 +1,9 @@
 // Recovery state for Obsidian publication: the immutable store, the durable
 // journal, restart recovery and the late-writer re-check.
-export { EXCHANGE_CANDIDATE_NAME, LATE_EXCHANGE_CANDIDATE_NAME, PublicationRefusal, VAULT_LOCK_DIRECTORY, acquireVaultLock, createRecoveryStore, readFileDigest, sha256Digest } from './store.mjs'
+export {
+  EXCHANGE_CANDIDATE_NAME, LATE_EXCHANGE_CANDIDATE_NAME, PublicationRefusal, VAULT_ALLOCATION_SCHEMA, VAULT_LOCK_DIRECTORY, VAULT_ORIGINS, acquireVaultLock, allocatedFolderState, assertAllocatedFolder, allocationFile, folderIdentity,
+  createRecoveryStore, hasCommittedGeneration, legacyVaultRoot, readFileDigest, readVaultAllocation, sha256Digest, validateVaultAllocation, vaultRootFor, writeVaultAllocation,
+} from './store.mjs'
 export { JOURNAL_SCHEMA, createJournal, journalDetail, listJournals, newJournalId } from './journal.mjs'
 export { classifyCandidateFile, namedCandidates, publishedSinceCommit, reconcileUnit, recoverPublications, retireStagedFile } from './restart.mjs'
 export { recheckDisplacedFiles } from './late-writer.mjs'

package/src/projection/obsidian/recovery/store.mjs

@@ -7,7 +7,8 @@ import { atomicReplacePrivateText, ensureContainedPrivateDirectory, openRegularF
 
 // Private per-workspace state for one Obsidian view:
 //
-//   <workspaceRoot>/vaults/<scopeId>/                 the editable vault (or an explicit vaultRoot)
+//   <workspaceRoot>/vaults/<scopeId>/                 the editable vault, unless it was allocated elsewhere or a vaultRoot is named
+//   <workspaceRoot>/state/allocations/<scopeId>.json  where the view's vault was allocated, when it was (see below)
 //   <workspaceRoot>/state/manifests/<scopeId>/        trusted manifests and the current pointer
 //   <workspaceRoot>/state/journals/<scopeId>/<id>/    publication journals
 //   <workspaceRoot>/recovery/objects/<sha256>.bin     immutable content-addressed bytes
@@ -49,7 +50,15 @@ export const VAULT_LOCK_DIRECTORY = '.atelier-publication'
 // marker before its ticket, so the directory does not grow inside a person's
 // vault and an interrupted removal never leaves a marker without its ticket.
 export function acquireVaultLock(store) {
+  // Only in the vault the store was made for, reached through no link: the lock's folder is made inside whatever the
+  // vault root leads to.
+  let real = null
+  try { real = realPathAsStored(store.vaultRoot) } catch { /* not reachable: refused below */ }
+  if (real !== store.vaultRoot) refuse(store.allocation ? 'vault-allocation-moved' : 'vault-root-moved', 'the vault is no longer the folder this publication was prepared for: its path now leads somewhere else; nothing was written', { path: store.vaultRoot, leadsTo: real })
   const directory = ensureContainedPrivateDirectory({ workspaceRoot: store.vaultRoot, directory: path.dirname(store.vaultLockPath), label: 'vault publication lock' })
+  // The lock's folder resolved, again, to the one inside the vault: a link put there after the check above is refused
+  // before any ticket is written (only the empty folder may have been made through it).
+  if (directory !== path.dirname(store.vaultLockPath)) refuse(store.allocation ? 'vault-allocation-moved' : 'vault-root-moved', 'the vault is no longer the folder this publication was prepared for: its path now leads somewhere else; no lock was taken', { path: store.vaultRoot, leadsTo: path.dirname(directory) })
   const release = acquirePrivateLock(path.join(directory, path.basename(store.vaultLockPath)))
   try {
     const owners = `${store.vaultLockPath}.owners`
@@ -111,11 +120,135 @@ function publishOnce(file, bytes) {
   return true
 }
 
+// ---------------------------------------------------------------------------
+// Where a view's vault is
+// ---------------------------------------------------------------------------
+
+// A view of a workspace that decided where its vaults live gets a folder
+// there, allocated once at its first publication (by the maintenance engine)
+// and recorded, owner only, in the workspace's private state:
+//
+//   <workspaceRoot>/state/allocations/<scopeId>.json   atelier-obsidian-vault-allocation/v1
+//
+// A view without a record has its vault where every earlier release put it,
+// `<workspaceRoot>/vaults/<scopeId>`: a vault published there stays there
+// until it is moved, and a workspace that decided no place publishes there as
+// before. The record is the one thing that names another folder, and the
+// store reads it, so every reader of a view's vault (the engine, source apply,
+// the proposal adapter, `open`) finds the same one.
+
+export const VAULT_ALLOCATION_SCHEMA = 'atelier-obsidian-vault-allocation/v1'
+export const VAULT_ORIGINS = Object.freeze(['allocated', 'legacy-data-root'])
+
+const TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/
+const CONTROL = /[\u0000-\u001f\u007f]/
+// `device` and `inode` name the folder that was made, as decimal strings (a 64-bit number does not fit a JSON number):
+// a folder at the recorded path that is another one (restored, moved in, made again by someone else) is never
+// published into.
+const ALLOCATION_KEYS = Object.freeze(['schema', 'workspaceId', 'scopeId', 'path', 'name', 'parent', 'device', 'inode', 'allocatedAt'])
+const DECIMAL = /^(0|[1-9][0-9]{0,19})$/
+const isPlainPath = (value) => typeof value === 'string' && value.length <= 4096 && !CONTROL.test(value) && path.isAbsolute(value) && path.resolve(value) === value
+
+export const allocationFile = (workspaceRoot, scopeId) => path.join(workspaceRoot, 'state', 'allocations', `${segment(scopeId)}.json`)
+export const legacyVaultRoot = (workspaceRoot, scopeId) => path.join(workspaceRoot, 'vaults', segment(scopeId))
+
+export function validateVaultAllocation(document, { workspaceId, scopeId }) {
+  const code = 'invalid-vault-allocation'
+  if (document === null || typeof document !== 'object' || Array.isArray(document)) refuse(code, 'a vault allocation is an object')
+  const unknown = Object.keys(document).filter((key) => !ALLOCATION_KEYS.includes(key))
+  if (unknown.length > 0 || ALLOCATION_KEYS.some((key) => !Object.hasOwn(document, key))) refuse(code, 'a vault allocation carries exactly its own members', { unknown: unknown.sort() })
+  if (document.schema !== VAULT_ALLOCATION_SCHEMA) refuse(code, 'a vault allocation names an unknown schema')
+  if (document.workspaceId !== workspaceId || document.scopeId !== scopeId || !IDENTIFIER.test(String(scopeId))) refuse(code, 'the vault allocation belongs to another workspace or view')
+  if (!isPlainPath(document.path) || !isPlainPath(document.parent)) refuse(code, 'the vault allocation names a folder that is not an absolute, plainly written path')
+  if (path.dirname(document.path) !== document.parent || path.basename(document.path) !== document.name) refuse(code, 'the vault allocation names its folder inconsistently')
+  if (typeof document.device !== 'string' || !DECIMAL.test(document.device) || typeof document.inode !== 'string' || !DECIMAL.test(document.inode)) refuse(code, 'the vault allocation names its folder\'s device and inode as decimal strings')
+  if (typeof document.allocatedAt !== 'string' || !TIMESTAMP.test(document.allocatedAt)) refuse(code, 'the vault allocation needs a UTC time')
+  return document
+}
+
+// The record of a view, validated, or null when it has none. Reads only.
+export function readVaultAllocation({ workspaceRoot, workspaceId, scopeId }) {
+  let text
+  try { text = readRegularTextNoFollow(allocationFile(workspaceRoot, scopeId)) } catch (error) {
+    if (error.code === 'ENOENT') return null
+    return refuse('invalid-vault-allocation', 'the vault allocation cannot be read', { cause: error.code ?? String(error.message) })
+  }
+  let document
+  try { document = JSON.parse(text) } catch { return refuse('invalid-vault-allocation', 'the vault allocation is not JSON') }
+  return validateVaultAllocation(document, { workspaceId, scopeId })
+}
+
+// The device and inode of a folder, as an allocation records them; null when nothing is there.
+export function folderIdentity(folder) {
+  const stat = fs.lstatSync(folder, { bigint: true, throwIfNoEntry: false })
+  return stat === undefined ? null : { device: String(stat.dev), inode: String(stat.ino), directory: stat.isDirectory(), link: stat.isSymbolicLink() }
+}
+
+// Whether the folder at an allocation's path is the one it recorded: 'same', 'missing', or 'replaced'.
+export function allocatedFolderState(allocation) {
+  const found = folderIdentity(allocation.path)
+  if (found === null) return 'missing'
+  return found.directory && !found.link && found.device === allocation.device && found.inode === allocation.inode ? 'same' : 'replaced'
+}
+
+// Refuses, typed, unless the folder at an allocation's path is the one it recorded, at that real path: checked when a store is made, by
+// the maintenance engine before it uses a store again, and by the publisher before and after it takes the vault lock,
+// so a folder replaced while a service runs is never published into.
+export function assertAllocatedFolder(allocation) {
+  const found = allocatedFolderState(allocation)
+  if (found === 'missing') refuse('vault-allocation-missing', 'the folder allocated to this view is gone; the maintenance service makes it again at its next tick', { path: allocation.path })
+  if (found === 'replaced') refuse('vault-allocation-replaced', 'another folder is where this view\'s vault was allocated; Atelier publishes only into the folder it made', { path: allocation.path })
+  // Reached through no link: the record holds the folder's real path, so the same folder moved elsewhere (into a
+  // vault the app lists, say) and linked back, which keeps its device and inode, is not published into either.
+  let real = null
+  try { real = realPathAsStored(allocation.path) } catch { /* not reachable: refused below */ }
+  if (real !== allocation.path) refuse('vault-allocation-moved', 'this view\'s vault is now reached through a link, somewhere else than where it was allocated; Atelier publishes only into the folder at the path it recorded', { path: allocation.path, leadsTo: real })
+  return allocation
+}
+
+// Written only by the maintenance engine, under its lock, and by what moves a vault under the same lock.
+export function writeVaultAllocation({ workspaceRoot, allocation }) {
+  validateVaultAllocation(allocation, allocation)
+  const directory = ensureContainedPrivateDirectory({ workspaceRoot, directory: path.dirname(allocationFile(workspaceRoot, allocation.scopeId)), label: 'Obsidian vault allocations' })
+  atomicReplacePrivateText(path.join(directory, path.basename(allocationFile(workspaceRoot, allocation.scopeId))), `${JSON.stringify(allocation, null, 2)}\n`)
+  return allocation
+}
+
+// A view without a record that was published, and has no vault under the data root, where a view published there
+// always has its folder: its record was lost (removed, or a backup restored without it), or, for a view that was never
+// allocated a folder, its folder under the data root was removed. Refused, typed, rather than published again into a
+// new, empty vault under the data root while a vault it had elsewhere stays orphaned.
+function refuseLostAllocation({ workspaceRoot, scopeId }) {
+  const legacy = legacyVaultRoot(workspaceRoot, scopeId)
+  if (!hasCommittedGeneration({ workspaceRoot, scopeId }) || fs.lstatSync(legacy, { throwIfNoEntry: false }) !== undefined) return
+  refuse('vault-allocation-lost', `this view was published, and its vault is not where Atelier can find it: there is no record of a folder allocated for it, and no folder under the data root. If its vault was allocated elsewhere, restore ${allocationFile(workspaceRoot, scopeId)} from a backup; otherwise, or to publish the view under the data root from now on, make the folder ${legacy}: the view is published there at the next change at its sources`, { record: allocationFile(workspaceRoot, scopeId), path: legacy })
+}
+
+// Where a view's vault is, without creating anything: { path, origin, allocation }.
+export function vaultRootFor({ workspaceRoot, workspaceId, scopeId }) {
+  const allocation = readVaultAllocation({ workspaceRoot, workspaceId, scopeId })
+  if (allocation === null) refuseLostAllocation({ workspaceRoot, scopeId })
+  return allocation === null
+    ? { path: legacyVaultRoot(workspaceRoot, scopeId), origin: 'legacy-data-root', allocation: null }
+    : { path: allocation.path, origin: 'allocated', allocation }
+}
+
+// Whether a view has a committed generation, whichever folder it was published into.
+export const hasCommittedGeneration = ({ workspaceRoot, scopeId }) => fs.existsSync(path.join(workspaceRoot, 'state', 'manifests', segment(scopeId), 'current.json'))
+
 // `repositoryRoots` is required: every enrolled repository root of the loaded
 // project. Neither the workspace state nor the vault may overlap one of them,
 // in either direction, lexically or by real path; the store refuses before it
 // creates anything. A caller with no enrolled repository (a test in a
 // temporary directory) says so with an explicit empty list.
+//
+// Without `vaultRoot` the vault is where the view's allocation says, else in
+// the workspace's `vaults/` (vaultRootFor). An allocated folder must be the
+// very folder the record names (device and inode): one that has gone is made
+// again by the maintenance engine under its lock (ensureVaultAllocation), and
+// until then, like one that another folder replaced, the store refuses. A
+// published view whose record was lost is refused too, never published again
+// into a new vault under the data root.
 export function createRecoveryStore({ workspaceRoot, workspaceId, scopeId, vaultRoot, repositoryRoots } = {}) {
   if (typeof workspaceRoot !== 'string' || !path.isAbsolute(workspaceRoot)) throw new TypeError('workspaceRoot must be an absolute path')
   for (const [label, value] of [['workspaceId', workspaceId], ['scopeId', scopeId]]) {
@@ -125,20 +258,28 @@ export function createRecoveryStore({ workspaceRoot, workspaceId, scopeId, vault
     throw new TypeError('repositoryRoots must list the absolute root of every enrolled repository; pass an explicit empty list when there is none')
   }
   if (vaultRoot !== undefined && (typeof vaultRoot !== 'string' || !path.isAbsolute(vaultRoot))) throw new TypeError('vaultRoot must be an absolute path')
-  const guard = checkManagedRoots({ managedRoots: [workspaceRoot, ...(vaultRoot === undefined ? [] : [vaultRoot])], repositoryRoots })
+  const allocation = vaultRoot === undefined ? readVaultAllocation({ workspaceRoot, workspaceId, scopeId }) : null
+  const namedVault = vaultRoot ?? allocation?.path
+  // A folder that is there but is not the one allocated (a link put where it was, say) is refused as such first, with
+  // its own next step; the checks below only read. One that has gone is checked against the repositories first.
+  if (allocation !== null && allocatedFolderState(allocation) !== 'missing') assertAllocatedFolder(allocation)
+  const guard = checkManagedRoots({ managedRoots: [workspaceRoot, ...(namedVault === undefined ? [] : [namedVault])], repositoryRoots })
   if (!guard.ok) refuse(guard.refusals[0].code, guard.refusals[0].message, { refusals: guard.refusals })
+  if (allocation !== null) assertAllocatedFolder(allocation)
+  else if (vaultRoot === undefined) refuseLostAllocation({ workspaceRoot, scopeId })
   fs.mkdirSync(workspaceRoot, { recursive: true, mode: 0o700 })
   // Both as the file system stores them: the vault root is what the app is told, and what it compares its own
   // working-directory spelling with.
   const root = realPathAsStored(workspaceRoot)
   const privateDir = (...parts) => ensureContainedPrivateDirectory({ workspaceRoot: root, directory: path.join(root, ...parts), label: 'Obsidian publication state' })
-  const requestedVault = vaultRoot ?? path.join(root, 'vaults', segment(scopeId))
-  // A vault this store places itself is private to this user from the start: it will hold the plugin's bearer.
+  const requestedVault = namedVault ?? legacyVaultRoot(root, scopeId)
+  // A vault this store places itself, under the data root or where the view's vault was allocated, is private to this
+  // user from the start: it will hold the plugin's bearer.
   fs.mkdirSync(requestedVault, { recursive: true, ...(vaultRoot === undefined ? { mode: 0o700 } : {}) })
   const vault = realPathAsStored(requestedVault)
   const inside = (parent, child) => { const relative = path.relative(parent, child); return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative)) }
   for (const area of ['state', 'recovery', 'staging']) {
-    if (inside(path.join(root, area), vault) || inside(vault, path.join(root, area))) throw new TypeError('the vault may not overlap private publication state')
+    if (inside(path.join(root, area), vault) || inside(vault, path.join(root, area))) refuse('vault-overlaps-private-state', 'the vault may not overlap private publication state')
   }
   const manifests = privateDir('state', 'manifests', segment(scopeId))
   const journals = privateDir('state', 'journals', segment(scopeId))
@@ -152,10 +293,22 @@ export function createRecoveryStore({ workspaceRoot, workspaceId, scopeId, vault
     workspaceId,
     scopeId,
     vaultRoot: vault,
-    // Placed by this store under the workspace state, rather than named by the caller, and really there: a vault path
-    // that is a link leads to a folder someone else chose, which is only looked at and never receives the bearer.
+    // Placed by this store under the workspace state or where the view's vault was allocated, rather than named by the
+    // caller, and really there: a vault path that is a link leads to a folder someone else chose, which is only looked
+    // at and never receives the bearer.
     managedVaultRoot: vaultRoot === undefined && vault === requestedVault,
     linkedVaultRoot: vaultRoot === undefined && vault !== requestedVault,
+    // Where the vault is and why: named by the caller, allocated for the view, or under the data root.
+    vaultOrigin: vaultRoot !== undefined ? 'explicit' : allocation === null ? 'legacy-data-root' : 'allocated',
+    allocation,
+    // Refuses, typed, once the folder of an allocated vault is no longer the one this store was made for (see
+    // assertAllocatedFolder), and once any other vault root is gone or leads elsewhere (vault-root-moved).
+    checkAllocatedVault() {
+      if (allocation !== null) { assertAllocatedFolder(allocation); return }
+      let real = null
+      try { real = realPathAsStored(vault) } catch { /* gone: refused below */ }
+      if (real !== vault) refuse('vault-root-moved', 'this view\'s vault is gone, or its path now leads somewhere else; nothing more is written into it', { path: vault, leadsTo: real })
+    },
     journalsRoot: journals,
     lockPath: path.join(locks, `${segment(scopeId)}.lock`),
     // One publisher per vault, whichever view or workspace state it belongs to.

package/src/projection/obsidian/selection-ui/contribution.mjs

@@ -4,7 +4,7 @@ import { isoTime } from '../../../runtime/obsidian/documents.mjs'
 import { refuse } from '../../../runtime/obsidian/errors.mjs'
 import { protectedRoots, readMachineSettings } from '../../../runtime/obsidian/machine-settings.mjs'
 import { resolveScope } from '../../../runtime/obsidian/opening.mjs'
-import { DEFAULT_ELIGIBILITY, createProductionSeams } from '../../../runtime/obsidian/pipeline.mjs'
+import { createProductionSeams, eligibilityFor } from '../../../runtime/obsidian/pipeline.mjs'
 import { createMaintenanceStateStore } from '../../../runtime/obsidian/state-store.mjs'
 import { readConflictView } from './conflict-view.mjs'
 import { runPolicySetup } from './policy-setup.mjs'
@@ -28,8 +28,9 @@ const EXIT = Object.freeze({ ok: 0, notSuccess: 3 })
 const MAX_REQUEST_BYTES = 64 * 1024
 
 // The canonical snapshot selectScope reads, built exactly as the engine
-// builds it: the canonical graph with fail-closed eligibility, and the
-// declared relations whose both endpoints the census knows.
+// builds it: the canonical graph with the eligibility the machine settings
+// decide (fail closed), and the declared relations whose both endpoints the
+// census knows.
 function snapshotNow({ project, seams, eligibility }) {
   const graph = seams.buildGraph({ project, eligibility })
   const known = new Set(graph.nodes.map((node) => node.id))
@@ -49,7 +50,7 @@ function readRequest(value) {
   }
 }
 
-export function createSelectionOperation({ seams = createProductionSeams(), eligibility = DEFAULT_ELIGIBILITY } = {}) {
+export function createSelectionOperation({ seams = createProductionSeams(), eligibility: fixedEligibility = null } = {}) {
   return {
     name: 'selection',
     summary: 'resolve ID | persist ID [allow-empty] | show ID | list  The exact selected set of a declared view, its note paths and, for a focus, the graph query; persisted in Atelier state.',
@@ -74,7 +75,7 @@ export function createSelectionOperation({ seams = createProductionSeams(), elig
       const usable = workspace !== null && workspace.workspaceRoot !== null
       const machine = usable ? readMachineSettings(workspace) : null
       const profile = seams.profileFor({ project, workspaceId: workspace?.workspaceId ?? 'ws-unprepared', audienceAllow: machine?.audienceAllow ?? [] })
-      const canonicalSnapshot = snapshotNow({ project, seams, eligibility })
+      const canonicalSnapshot = snapshotNow({ project, seams, eligibility: fixedEligibility ?? eligibilityFor({ machine, project }) })
       const pathRegistry = usable ? createMaintenanceStateStore(workspace).readPathRegistry() : null
       // Explicit empty is an honest answer of `resolve`; `persist` of an empty selection is refused and asks for it by name.
       const selection = resolveSelection({ canonicalSnapshot, profile, scope, pathRegistry, allowEmpty: sub === 'resolve' || option === 'allow-empty' })