@mnstry/atelier 0.2.0-alpha.12 → 0.2.0-alpha.13

package/src/runtime/obsidian/machine-settings.mjs

@@ -6,12 +6,13 @@ import { LOCAL_STATE_DIR, localStateRoot } from '../../project/config.mjs'
 import { checkManagedRoots } from '../../project/file-class.mjs'
 import { atomicReplacePrivateText, ensureContainedPrivateDirectory, readRegularTextNoFollow } from '../../project/private-state.mjs'
 import { OBSIDIAN_EXT_KEY, ObsidianContractRefusal, assertObsidianContract } from '../../projection/obsidian/contracts.mjs'
+import { LOCAL_AUDIENCES } from '../../projection/policy.mjs'
 import { refuse } from './errors.mjs'
 import { canonicalJson, closedObject, isPlainObject } from './documents.mjs'
 
 // Machine-private settings of the Obsidian maintenance runtime.
 //
-//   <data>/obsidian/<workspace-id>/state/settings/machine.json       mode, audiences, policy reference
+//   <data>/obsidian/<workspace-id>/state/settings/machine.json       mode, audiences, policy reference, remembered decisions
 //   <data>/obsidian/<workspace-id>/state/settings/apply-policy.json  the installed apply policy
 //   <project>/.atelier-local/obsidian.json                           pointer: workspace id, optional data root
 //
@@ -22,14 +23,33 @@ import { canonicalJson, closedObject, isPlainObject } from './documents.mjs'
 // checkout keeps its vaults) and, optionally, where this machine keeps the
 // data directory.
 
-export const MACHINE_SETTINGS_SCHEMA = 'atelier-obsidian-machine-settings/v1'
+export const MACHINE_SETTINGS_SCHEMA = 'atelier-obsidian-machine-settings/v2'
+// What releases up to 0.2.0-alpha.12 wrote. It is still read, as the v2 document it stands for, and never written:
+// the next write writes v2. A release that knows only v1 refuses a v2 document, so a downgrade stops, loudly, rather
+// than working from settings it cannot read.
+export const MACHINE_SETTINGS_SCHEMA_V1 = 'atelier-obsidian-machine-settings/v1'
 export const LOCAL_POINTER_SCHEMA = 'atelier-obsidian-local-pointer/v1'
 export const LOCAL_POINTER_FILE = 'obsidian.json'
 export const MAINTENANCE_MODES = Object.freeze(['manual', 'automatic'])
 
+// What a person decided once for this workspace on this machine, so that no later run has to ask again: who may see
+// its vaults, where they live, whether maintenance starts at login, and that the installed app may be reached. Each is
+// null until it is decided.
+export const DECISIONS = Object.freeze(['audience', 'location', 'loginItem', 'adapter'])
+// How a decision was made: answered to a question at a terminal, given on the command line (an operation or a flag),
+// taken as the defaults, or carried over from a v1 document.
+export const DECISION_SOURCES = Object.freeze(['question', 'command', 'defaults', 'v1'])
+// "Only you": every audience of a note, except `sensitive`, which a vault takes only when it is named. A vault is a
+// folder in which the app's community plugins run with full access to its files.
+export const ONLY_YOU_AUDIENCES = Object.freeze(LOCAL_AUDIENCES.filter((audience) => audience !== 'sensitive').sort())
+// Whether the notes that carry no classification enter this workspace's vaults. They may only for "only you": a vault
+// of any other audience never shows them. Withheld unless a person decided otherwise.
+export const UNCLASSIFIED_CHOICES = Object.freeze(['shown', 'withheld'])
+
 const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/
 const DIGEST = /^sha256:[0-9a-f]{64}$/
 const TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/
+const CONTROL = /[\u0000-\u001f\u007f]/
 
 const segment = (identifier) => identifier.replaceAll(':', '_')
 
@@ -138,9 +158,9 @@ export function ensureWorkspaceIdentity({ project, dataRoot, randomBytes = crypt
 // Machine settings
 // ---------------------------------------------------------------------------
 
-function validateMachineSettings(document, workspaceId) {
-  closedObject(document, { required: ['schema', 'workspaceId', 'maintenanceMode', 'audienceAllow', 'applyPolicy', 'updatedAt'] }, 'invalid-machine-settings', 'machine settings')
-  if (document.schema !== MACHINE_SETTINGS_SCHEMA) refuse('invalid-machine-settings', 'machine settings name an unknown schema')
+const MACHINE_FIELDS = Object.freeze(['schema', 'workspaceId', 'maintenanceMode', 'audienceAllow', 'applyPolicy', 'updatedAt'])
+
+function validateCommonFields(document, workspaceId) {
   if (document.workspaceId !== workspaceId) refuse('invalid-machine-settings', 'machine settings belong to another workspace')
   if (!MAINTENANCE_MODES.includes(document.maintenanceMode)) refuse('invalid-machine-settings', 'maintenanceMode must be manual or automatic')
   if (!Array.isArray(document.audienceAllow) || document.audienceAllow.length > 64 || document.audienceAllow.some((item) => typeof item !== 'string' || !IDENTIFIER.test(item))
@@ -155,29 +175,116 @@ function validateMachineSettings(document, workspaceId) {
     }
   }
   if (typeof document.updatedAt !== 'string' || !TIMESTAMP.test(document.updatedAt)) refuse('invalid-machine-settings', 'updatedAt must be a UTC timestamp')
+}
+
+const isOneOf = (values) => (value) => values.includes(value)
+const isAbsoluteDirectory = (value) => typeof value === 'string' && value.length <= 4096 && !CONTROL.test(value) && path.isAbsolute(value) && path.resolve(value) === value
+// The members of each decision besides its stamp, and what each may hold. A decision gains a member here, and a
+// document that carries it is refused by a release that does not know it, loudly.
+const DECISION_MEMBERS = Object.freeze({
+  audience: Object.freeze({ choice: isOneOf(['only-you', 'custom']), unclassified: isOneOf(UNCLASSIFIED_CHOICES) }),
+  location: Object.freeze({ parent: isAbsoluteDirectory }),
+  loginItem: Object.freeze({ choice: isOneOf(['on', 'off']) }),
+  adapter: Object.freeze({ choice: isOneOf(['obsidian-cli']) }),
+})
+function sameMembers(left, right) {
+  const [sortedLeft, sortedRight] = [[...left].sort(), [...right].sort()]
+  return sortedLeft.length === sortedRight.length && sortedLeft.every((item, index) => item === sortedRight[index])
+}
+
+// `deciding` is true when the audience decision is being recorded (withDecision). Only then must "only you" be exactly
+// the set this release stands for. Read, or written back by any other change, an "only you" list is the one recorded
+// when it was decided: any part of this release's set, never `sensitive` and never an audience this release does not
+// know. So a later release that adds an audience to "only you" still reads what an earlier one recorded, and
+// `audience set me` records the current set again.
+function validateDecisions(document, { deciding = false } = {}) {
+  const code = 'invalid-machine-settings'
+  closedObject(document.decisions, { required: DECISIONS }, code, 'the remembered decisions')
+  for (const name of DECISIONS) {
+    const decision = document.decisions[name]
+    if (decision === null) continue
+    const members = DECISION_MEMBERS[name]
+    closedObject(decision, { required: [...Object.keys(members), 'decidedAt', 'decidedBy', 'via'] }, code, `the ${name} decision`)
+    for (const [member, holds] of Object.entries(members)) if (!holds(decision[member])) refuse(code, `the ${name} decision carries an unknown ${member}`)
+    if (typeof decision.decidedAt !== 'string' || !TIMESTAMP.test(decision.decidedAt)) refuse(code, `the ${name} decision needs a UTC time`)
+    // Who decided, when it is known: an identifier, or null.
+    if (decision.decidedBy !== null && (typeof decision.decidedBy !== 'string' || !IDENTIFIER.test(decision.decidedBy))) refuse(code, `the ${name} decision names who decided as an identifier or null`)
+    if (!DECISION_SOURCES.includes(decision.via)) refuse(code, `the ${name} decision says how it was made`)
+  }
+  // "Only you" is a set of audiences, and the list the engine reads is exactly that set when it is decided.
+  if (document.decisions.audience?.choice === 'only-you') {
+    const recorded = document.audienceAllow.length > 0 && document.audienceAllow.every((audience) => ONLY_YOU_AUDIENCES.includes(audience))
+    if (deciding ? !sameMembers(document.audienceAllow, ONLY_YOU_AUDIENCES) : !recorded) refuse(code, 'the audiences allowed are not the ones "only you" stands for')
+  }
+  if (document.decisions.audience?.unclassified === 'shown' && document.decisions.audience.choice !== 'only-you') {
+    refuse(code, 'notes without a classification are shown only in a vault that is only yours')
+  }
+}
+
+function validateV1(document, workspaceId) {
+  closedObject(document, { required: MACHINE_FIELDS }, 'invalid-machine-settings', 'machine settings')
+  validateCommonFields(document, workspaceId)
   return document
 }
 
-// The defaults fail closed: edits are only queued, no audience is visible and
-// no apply policy is installed until the person says otherwise.
+function validateV2(document, workspaceId, { deciding = false } = {}) {
+  closedObject(document, { required: [...MACHINE_FIELDS, 'decisions'] }, 'invalid-machine-settings', 'machine settings')
+  if (document.schema !== MACHINE_SETTINGS_SCHEMA) refuse('invalid-machine-settings', 'machine settings name an unknown schema')
+  validateCommonFields(document, workspaceId)
+  validateDecisions(document, { deciding })
+  return document
+}
+
+// A v1 document as the v2 document it stands for. Nothing was remembered then, except that a list of audiences a
+// person set (`audience set`) is their decision, and is carried over as one, with the notes that carry no
+// classification withheld as they were; who made it is not known.
+function fromV1(document) {
+  const { schema: _v1, ...fields } = document
+  const audience = fields.audienceAllow.length === 0 ? null : { choice: 'custom', unclassified: 'withheld', decidedAt: fields.updatedAt, decidedBy: null, via: 'v1' }
+  return { ...fields, schema: MACHINE_SETTINGS_SCHEMA, decisions: { audience, location: null, loginItem: null, adapter: null } }
+}
+
+// Every document this module reads or is handed, as a validated v2 document.
+function normalizeMachineSettings(document, workspaceId) {
+  if (isPlainObject(document) && document.schema === MACHINE_SETTINGS_SCHEMA_V1) return validateV2(fromV1(validateV1(document, workspaceId)), workspaceId)
+  return validateV2(document, workspaceId)
+}
+
+// The defaults fail closed: edits are only queued, no audience is visible,
+// no apply policy is installed and nothing is decided until the person says
+// otherwise.
 export function defaultMachineSettings({ workspaceId, updatedAt }) {
-  return { schema: MACHINE_SETTINGS_SCHEMA, workspaceId, maintenanceMode: 'manual', audienceAllow: [], applyPolicy: null, updatedAt }
+  return {
+    schema: MACHINE_SETTINGS_SCHEMA, workspaceId, maintenanceMode: 'manual', audienceAllow: [], applyPolicy: null,
+    decisions: Object.fromEntries(DECISIONS.map((name) => [name, null])), updatedAt,
+  }
+}
+
+// The settings with one decision recorded, validated; nothing is written. `decision` holds the decision's own members
+// (`{ choice, unclassified }`, `{ parent }`, `{ choice }`); the stamp says when, by whom (an identifier, or null when not
+// known) and how.
+export function withDecision(settings, name, decision, { decidedAt, decidedBy = null, via }) {
+  if (!DECISIONS.includes(name)) throw new TypeError(`unknown decision: ${String(name)}`)
+  const next = { ...settings, decisions: { ...settings.decisions, [name]: { ...decision, decidedAt, decidedBy, via } } }
+  return validateV2(next, settings.workspaceId, { deciding: name === 'audience' })
 }
 
 const settingsDirectory = (workspaceRoot) => ensureContainedPrivateDirectory({ workspaceRoot, directory: path.join(workspaceRoot, 'state', 'settings'), label: 'Obsidian machine settings' })
 const settingsFile = (workspaceRoot, name) => path.join(workspaceRoot, 'state', 'settings', name)
 
+// A v1 document is returned as v2 (see fromV1); the file keeps its v1 bytes until the next write.
 export function readMachineSettings({ workspaceRoot, workspaceId }) {
   const document = readJsonFile(settingsFile(workspaceRoot, 'machine.json'), 'invalid-machine-settings', 'machine settings')
-  return document === null ? null : validateMachineSettings(document, workspaceId)
+  return document === null ? null : normalizeMachineSettings(document, workspaceId)
 }
 
+// Writes v2, whatever version it is handed, and returns what it wrote.
 export function writeMachineSettings({ workspaceRoot, workspaceId, settings, repositoryRoots }) {
-  validateMachineSettings(settings, workspaceId)
+  const document = normalizeMachineSettings(settings, workspaceId)
   assertOutsideRepositories({ managedRoot: workspaceRoot, repositoryRoots })
   fs.mkdirSync(workspaceRoot, { recursive: true, mode: 0o700 })
-  atomicReplacePrivateText(path.join(settingsDirectory(workspaceRoot), 'machine.json'), canonicalJson(settings))
-  return settings
+  atomicReplacePrivateText(path.join(settingsDirectory(workspaceRoot), 'machine.json'), canonicalJson(document))
+  return document
 }
 
 // ---------------------------------------------------------------------------

package/src/runtime/obsidian/opening.mjs

@@ -1,8 +1,9 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { enclosingVaults, findVaultEntry, vaultRoute } from '../../projection/obsidian/publication/vault-list.mjs'
-import { createRecoveryStore as createStore, readFileBytes, sha256Digest } from '../../projection/obsidian/recovery/store.mjs'
+import { createRecoveryStore as createStore, readFileBytes, sha256Digest, vaultRootFor } from '../../projection/obsidian/recovery/store.mjs'
 import { inspectApp, qualifyApp } from './app-capability.mjs'
+import { settingsWriteOutlook } from './app-registration.mjs'
 import { readObsidianEnablement } from './enablement.mjs'
 import { ObsidianMaintenanceRefusal, refuse } from './errors.mjs'
 import { UNAVAILABLE_APPLY_OPERATION } from './extension-points.mjs'
@@ -30,20 +31,32 @@ import { OPEN_EDIT_STATES, createMaintenanceStateStore } from './state-store.mjs
 //
 // Nothing a person does by hand is needed on the way. The app is made to know
 // the vault: through the app itself while it runs and answers, or, while no
-// Obsidian runs, in the app's own vault list (app-registration.mjs). A view
-// that the app kept from being published (an app that runs without the vault,
-// or that could not be qualified) is published again once the app holds the
-// vault, through the app, before the answer is given.
+// Obsidian runs, in the app's own vault list (app-registration.mjs), which is
+// created for an Obsidian that never started, and whose command-line switch is
+// turned on in the same write. A view that the app kept from being published
+// (an app that runs without the vault, or that could not be qualified) is
+// published again once the app holds the vault, through the app, before the
+// answer is given.
+//
+// Two states of a running app cannot be got through that way: its command line
+// is turned off, or it has no vault open and does not list this one. Only when
+// the person asked for it (`restartApp`, `--restart-obsidian`; never implied),
+// and only after a read-only check that the write can succeed and a copy of the
+// settings file kept beside it, the app is quit (app-restart.mjs), the vault
+// added with the switch on while it is quit, and the app started again plainly,
+// which reopens every vault it had open. Without that, those states are
+// answered, naming the flag.
 //
 // Nothing here talks to an app or an operating system itself: `appProbe`,
-// `registry` and `launcher` are injected, and there is no default for any.
+// `registry`, `launcher` and `quitter` are injected, and there is no default for
+// any.
 
 export const OPENING_OUTCOMES = Object.freeze({
   current: { summary: 'the vault is the present generation, verified by read-back, and the app has it open', next: 'nothing to do' },
   updating: { summary: 'maintenance is publishing or has not finished; the vault is not confirmed current', next: 'run `obsidian open` again in a moment' },
   'held-for-your-edit': { summary: 'a note you edited is preserved and held; the view is not republished over it', next: 'apply or withdraw the pending edit, then open again' },
   'stale-readable': { summary: 'a last good vault exists and can be read, but it is not proven to be the present generation', next: 'see `obsidian status` for the reason; `obsidian open --allow-stale` opens it as it is' },
-  'not-prepared': { summary: 'no generation of this view has been published yet', next: 'see `obsidian status` for the reason' },
+  'not-prepared': { summary: 'no generation of this view can be read back: none was published yet, or its vault cannot be found or used (the reason says which)', next: 'see `obsidian status` for the reason' },
   'app-missing': { summary: 'no Obsidian installation was found', next: 'install Obsidian, then open again' },
   'app-version-unsupported': { summary: 'the installed Obsidian is below the minimum supported version, or its version cannot be read', next: 'update Obsidian, then open again' },
   'app-cli-unavailable': { summary: 'the installed Obsidian has no usable command-line capability', next: 'enable the command-line interface in Obsidian, then open again' },
@@ -80,11 +93,16 @@ const QUIT = 'quit Obsidian (on Linux, also any app that runs on a system Electr
 // Obsidian's settings file could not be used to add the vault while the app was quit: adding it through the app works instead.
 const THROUGH_THE_APP = 'start Obsidian with any vault open, then open again: the vault is then added through the app'
 export const REASON_NEXT = Object.freeze({
-  'cli-turned-off': 'Obsidian\'s command line is turned off (the default of a new installation): turn it on in Obsidian under Settings > General > Advanced > Command line interface, then open again',
-  'no-vault-open': 'open any vault in Obsidian, or quit Obsidian, then open again; open then adds this view\'s vault to Obsidian itself',
+  'cli-turned-off': 'Obsidian\'s command line is turned off (the default of a new installation), and it runs, so its settings are its own: run `atelier obsidian open --restart-obsidian` to let Atelier quit Obsidian, turn its command line on, add this view\'s vault and start it again (the vaults it has open reopen); or turn it on yourself in Obsidian under Settings > General > Advanced > Command line interface, then open again',
+  'no-vault-open': 'Obsidian runs with no vault open, so it can be asked nothing: run `atelier obsidian open --restart-obsidian` to let Atelier quit Obsidian (no vault is open, so nothing closes), add this view\'s vault and start it again; or open any vault in Obsidian, or quit Obsidian, then open again',
+  'restart-platform-unqualified': 'Atelier restarts Obsidian on macOS only; turn its command line on yourself (Settings > General > Advanced > Command line interface), or open any vault in Obsidian, or quit it, then open again',
+  'restart-unavailable': 'this command was given no way to quit Obsidian; quit Obsidian yourself, then open again',
+  'app-main-process-unproven': 'Obsidian was not asked to quit: its main process could not be proven from the process table (`restart.detail` says why: more than one Obsidian main process, an Obsidian process of another user, a helper that is not its child, or a table that could not be read); quit Obsidian yourself, then open again',
+  'app-did-not-quit': 'Obsidian was asked to quit and did not within the wait; nothing was written to its settings. Quit it yourself, or wait until it has quit, then open again',
+  'app-not-started-again': 'Obsidian was quit to add this view\'s vault and could not be started again; start Obsidian yourself: it reopens the vaults it had open',
   'vault-open-cli-silent': 'Obsidian has this view\'s vault open, as Atelier\'s plugin in it shows, but its command line did not answer, so the vault can be neither found nor opened through it; make sure the command-line interface is turned on in Obsidian\'s settings, then open again',
   'editor-uncoordinated': `${UNCOORDINATED}; \`atelier obsidian open\` adds this view's vault to Obsidian and publishes through it, or ${QUIT}; it is retried automatically`,
-  'obsidian-settings-missing': 'Obsidian has not run on this account yet: start it once (it creates its settings), then open again with it running or quit',
+  'obsidian-settings-missing': 'Obsidian has no settings file on this account, and the folder it would be in does not exist or is not yours, so Atelier cannot create it: open any vault in Obsidian (starting it if it is not running; it then writes its settings), then open again',
   'obsidian-settings-location-unknown': THROUGH_THE_APP,
   'obsidian-settings-unsafe': `Obsidian's settings file is a link or not a regular file, so it is not written; ${THROUGH_THE_APP}`,
   'obsidian-settings-not-owned': `Obsidian's settings file belongs to another user, so it is not written; ${THROUGH_THE_APP}`,
@@ -105,6 +123,17 @@ export const REASON_NEXT = Object.freeze({
   'service-outdated': 'the maintenance service runs an earlier release of Atelier that could not be replaced; run `atelier obsidian service stop`, then open again',
   'service-other-release': 'the maintenance service runs a later release of Atelier than this command, which never replaces a later release by itself; run `atelier obsidian service stop`, then open again, or open with the later release',
   'vault-open-in-several-windows': 'Obsidian\'s vault list marks this view\'s folder open under more than one entry (in another letter case, or through a link), so it may hold the vault in more than one window, and a publication coordinates with one window only; remove the extra entries from Obsidian\'s vault list (Obsidian keeps the last window it closed marked open, so closing windows does not clear this), then open again',
+  'vault-allocation-lost': 'this view was published, but its vault is not where Atelier can find it: no record of a folder allocated for it (state/allocations/<view>.json in Atelier\'s private state), and no folder under the data root (vaults/<view>); restore that record from a backup if its vault was allocated elsewhere, or else make the folder vaults/<view> under the data root: the view is published there at the next change at its sources',
+  'vault-allocation-moved': 'this view\'s vault is now reached through a link, or leads somewhere other than where it was allocated, and Atelier publishes only into the folder at the path it recorded; put that folder back at the path `atelier obsidian location show` names, with no link on the way',
+  'vault-allocation-replaced': 'another folder, or a link, is where this view\'s vault was allocated, and Atelier publishes only into the folder it made; put the vault back there, or move what is there away: a folder that is gone is made again at the next tick, and the view published into it',
+  'vault-note-missing': 'a note of the generation this view last published is missing from its vault; the view is published again, and the note written back, at the next change at its sources',
+  'vault-root-moved': 'this view\'s vault was removed, moved or replaced by a link while it was being published, and nothing more was written into it; a vault allocated for the view is made again at the next tick and published into; a vault under the data root is asked for as lost until its folder is there again',
+  'vault-allocation-missing': 'the folder allocated to this view is gone; the maintenance service makes it again at its next tick, and publishes the view into it',
+  // A publisher-conflict whose first blocking cause is a file Atelier writes in the vault's settings folder. One change
+  // is enough to stop a publication, and the reason names only the first file that did: nothing says that no other
+  // publisher or editor is involved.
+  'plugin-file-changed': 'a file of Atelier\'s plugin in this vault (under .obsidian/plugins) changed while the view was published, by another program or by you, so the publication did not finish; it is retried automatically, and if this keeps happening, stop what keeps writing there (a sync tool, say)',
+  'settings-changed': 'a settings file Atelier writes in this vault (the plugin list or a plugin setting under .obsidian) changed while the view was published, by Obsidian, another program or you, and was not written over; it is retried automatically, reading the file as it is then',
   'vault-inside-another-vault': 'Obsidian lists another vault at a folder that contains this view\'s vault; open never adds a vault inside another one, and never sends a call that could reach that vault instead: remove that vault from Obsidian\'s vault list, or keep Atelier\'s data root outside that folder, then open again',
 })
 
@@ -136,11 +165,13 @@ export const OPENING_PRIMITIVES = Object.freeze({
   // Whether a view that is not current was kept from publication by the app: then making the app hold the vault
   // and asking for the view again can make it current. A vault open in several windows is asked for again once one
   // window is left; while more are open, open names them instead.
-  keptByApp: (view) => ['publisher-conflict', 'stale-readable', 'not-prepared'].includes(view.outcome) && ['editor-uncoordinated', 'vault-open-in-several-windows', 'app-version-unsupported'].includes(view.reason),
+  // A view the service did not publish because the app's command line is turned off is one of them: once the app runs
+  // with it on and holds the vault, it is published through it.
+  keptByApp: (view) => ['publisher-conflict', 'stale-readable', 'not-prepared'].includes(view.outcome) && ['editor-uncoordinated', 'vault-open-in-several-windows', 'app-version-unsupported', 'app-cli-unavailable'].includes(view.reason),
 })
 
 const segment = (identifier) => identifier.replaceAll(':', '_')
-const STORE_AREAS = (scopeId) => [['vaults', segment(scopeId)], ['state', 'manifests', segment(scopeId)], ['state', 'journals', segment(scopeId)], ['state', 'locks'], ['recovery', 'objects'], ['staging']]
+const STORE_AREAS = (scopeId) => [['state', 'manifests', segment(scopeId)], ['state', 'journals', segment(scopeId)], ['state', 'locks'], ['recovery', 'objects'], ['staging']]
 
 // Reads the trusted pointer of a view and every note of its vault. Read-only:
 // the store is only constructed when everything it would create already exists.
@@ -148,7 +179,13 @@ const STORE_AREAS = (scopeId) => [['vaults', segment(scopeId)], ['state', 'manif
 // store could be constructed, even before a first generation.
 export function readBackTrustedGeneration({ workspaceRoot, workspaceId, scopeId, repositoryRoots, createRecoveryStore = createStore }) {
   const unreadable = (reason) => ({ readable: false, reason, generationId: null, intact: false, noteCount: 0, differing: 0, missing: 0 })
-  if (!STORE_AREAS(scopeId).every((parts) => fs.existsSync(path.join(workspaceRoot, ...parts)))) return unreadable('no-published-vault')
+  // The view's vault wherever it is: allocated for the view, or under the data root.
+  let vault
+  try { vault = vaultRootFor({ workspaceRoot, workspaceId, scopeId }) } catch (error) {
+    if (typeof error?.code === 'string') return unreadable(error.code)
+    throw error
+  }
+  if (!fs.existsSync(vault.path) || !STORE_AREAS(scopeId).every((parts) => fs.existsSync(path.join(workspaceRoot, ...parts)))) return unreadable('no-published-vault')
   let store
   let trusted
   try {
@@ -204,8 +241,14 @@ export function scopeReport({ workspace, scopeId, repositoryRoots, serviceState,
     reason = edited ? 'vault-differs-from-trusted-generation' : verification.readable ? 'trusted-generation-differs' : verification.reason
   } else if (serviceState !== 'healthy') { outcome = 'stale-readable'; reason = serviceState === 'busy' ? 'maintenance-busy-not-rechecked' : 'maintenance-not-running' }
   else { outcome = 'current'; reason = entry.reason }
+  // Where the view's vault is, published or not: allocated for the view, or under the data root.
+  let vault
+  try { const found = vaultRootFor({ ...workspace, scopeId }); vault = { path: found.path, origin: found.origin } } catch (error) {
+    if (typeof error?.code !== 'string') throw error
+    vault = { path: null, origin: 'unreadable', reason: error.code }
+  }
   return {
-    scopeId, ...describeOutcome(outcome), next: nextStep(outcome, reason), reason,
+    scopeId, ...describeOutcome(outcome), next: nextStep(outcome, reason), reason, vault,
     freshness: entry === null ? null : { state: entry.state, reason: entry.reason, verified: entry.verified, generationId: entry.generationId, preparedGenerationId: entry.preparedGenerationId, heldNoteCount: entry.heldNotes.length, retainedEdits: entry.retainedEdits, checkedAt: entry.checkedAt },
     readBack: { readable: verification.readable, reason: verification.reason, generationId: verification.generationId, intact: verification.intact, noteCount: verification.noteCount, differing: verification.differing, missing: verification.missing },
     pendingEdits: pendingSummary(stateStore, scopeId, applyAvailable),
@@ -226,6 +269,9 @@ const defaultSleep = (ms) => new Promise((resolve) => { setTimeout(resolve, ms)
 const READABLE = new Set(['stale-readable', 'held-for-your-edit', 'updating', 'publisher-conflict'])
 // After a launch: the app is still starting, or still opening the vault it was asked for.
 const NOT_UP_YET = new Set(['version-unknown', 'no-vault-open'])
+// After a launch: how many rounds in a row the command line must be silent, with only the plugin giving the version,
+// before `open` says the command line is what is missing.
+const SILENT_ROUNDS = 2
 const REGISTRY_OPERATIONS = ['listThroughApp', 'registerThroughApp', 'readSettings', 'registerInSettings']
 
 const attempt = async (operation) => { try { return await operation() } catch { return null } }
@@ -250,28 +296,29 @@ const attempt = async (operation) => { try { return await operation() } catch {
 // (`vault-inside-another-vault`): the app would show its notes in that vault
 // too, and a call run in its folder would reach that vault.
 //
-// { ok: true, path, how, vaults } with the path the app knows the vault by and
-// the list it was found in, or { ok: false, reason }.
+// { ok: true, path, how, open, vaults } with the path the app knows the vault
+// by, whether its list flags it open (an app started plainly reopens it then),
+// and the list it was found in, or { ok: false, reason }.
 //
 // The window the app opens for an added vault takes the next command-line
 // call while it may still be loading, and can then answer that a command
 // does not exist yet: the list is asked again, a bounded number of times,
 // before an addition counts as not verified.
 const VERIFY_ATTEMPTS = 10
-async function ensureAppKnowsVault({ registry, observation, vaultRoot, sleep, pollMs }) {
+async function ensureAppKnowsVault({ registry, observation, vaultRoot, sleep, pollMs, keepBackups = [] }) {
   const inside = (vaults) => enclosingVaults({ vaults, vaultRoot }).length > 0
   if (observation.noVaultOpen === true) {
     const settings = await attempt(() => registry.readSettings())
     const vaults = settings?.ok === true ? settings.vaults : null
     const entry = findVaultEntry(vaults, vaultRoot)
-    if (entry) return { ok: true, path: entry.path, how: 'listed', vaults }
+    if (entry) return { ok: true, path: entry.path, how: 'listed', open: entry.open === true, vaults }
     return { ok: false, reason: inside(vaults) ? 'vault-inside-another-vault' : observation.fromPlugin === true ? 'vault-open-cli-silent' : 'no-vault-open' }
   }
   if (observation.answering === true) {
     const listed = await attempt(() => registry.listThroughApp())
     if (listed?.answered !== true) return { ok: false, reason: listed?.reason === 'no-vault-open' ? 'no-vault-open' : 'app-did-not-list-its-vaults' }
     const known = findVaultEntry(listed.vaults, vaultRoot)
-    if (known) return { ok: true, path: known.path, how: 'listed', vaults: listed.vaults }
+    if (known) return { ok: true, path: known.path, how: 'listed', open: known.open === true, vaults: listed.vaults }
     if (inside(listed.vaults)) return { ok: false, reason: 'vault-inside-another-vault' }
     const asked = await attempt(() => registry.registerThroughApp({ vaultRoot }))
     if (asked?.answered !== true && asked?.reason === 'no-vault-open') return { ok: false, reason: 'no-vault-open' }
@@ -280,16 +327,30 @@ async function ensureAppKnowsVault({ registry, observation, vaultRoot, sleep, po
     for (let attempts = 1; ; attempts += 1) {
       const again = await attempt(() => registry.listThroughApp())
       const added = again?.answered === true ? findVaultEntry(again.vaults, vaultRoot) : null
-      if (added) return { ok: true, path: added.path, how: 'added-through-app', vaults: again.vaults }
+      if (added) return { ok: true, path: added.path, how: 'added-through-app', open: true, vaults: again.vaults }
       if (attempts >= VERIFY_ATTEMPTS) return { ok: false, reason: asked?.answered === true ? 'registration-not-verified' : 'addition-not-answered' }
       await sleep(pollMs)
     }
   }
-  const written = await attempt(() => registry.registerInSettings({ vaultRoot }))
+  const written = await attempt(() => registry.registerInSettings({ vaultRoot, keepBackups }))
   if (written === null) return { ok: false, reason: 'obsidian-settings-unwritable' }
   if (written.ok !== true) return { ok: false, reason: typeof written.code === 'string' ? written.code : 'obsidian-settings-unwritable' }
-  if (written.confirmed !== true) return { ok: false, reason: written.reason === 'registration-not-read-back' ? 'registration-not-read-back' : 'app-started-during-registration' }
-  return { ok: true, path: written.entry.path, how: written.registered === 'already' ? 'listed' : 'added-to-settings', vaults: written.vaults }
+  const settings = settingsWritten(written)
+  if (written.confirmed !== true) return { ok: false, reason: written.reason === 'registration-not-read-back' ? 'registration-not-read-back' : 'app-started-during-registration', ...(settings === null ? {} : { settings }) }
+  const how = written.registered === 'created' ? 'created-settings' : written.registered === 'already' ? 'listed' : 'added-to-settings'
+  // A vault already listed keeps its own open flag; one written here is written flagged open.
+  return { ok: true, path: written.entry.path, how, open: written.registered === 'already' ? written.entry.open === true : true, vaults: written.vaults, ...(settings === null ? {} : { settings }) }
+}
+
+// What was written to Obsidian's settings file, for the answer to show: null when nothing was.
+function settingsWritten(written) {
+  const created = written.registered === 'created'
+  const cliTurnedOn = written.cliTurnedOn === true
+  if (!created && written.registered !== 'written' && !cliTurnedOn) return null
+  return {
+    ...(typeof written.file === 'string' ? { file: written.file } : {}), created, ...(created ? { directoryCreated: written.created?.directory === true } : {}),
+    vaultAdded: written.registered !== 'already', cliTurnedOn, ...(typeof written.backupPath === 'string' ? { backupPath: written.backupPath } : {}),
+  }
 }
 
 // Starts or reconnects the owned service, asks it for a tick, reads the view
@@ -297,7 +358,7 @@ async function ensureAppKnowsVault({ registry, observation, vaultRoot, sleep, po
 // again for a view the app kept from being published, and reports one outcome.
 export async function openScopeForOracleTests(options = {}, rules = OPENING_PRIMITIVES, lifecycleRules = LIFECYCLE_PRIMITIVES) {
   const {
-    loadProject, dataRoot, scopeId: requestedScope, appProbe, launcher, registry, service = {}, consent, allowStale = false, extensions = null,
+    loadProject, dataRoot, scopeId: requestedScope, appProbe, launcher, registry, quitter = null, restartApp = false, service = {}, consent, allowStale = false, extensions = null,
     tickTimeoutMs = 120 * 1000, appWaitMs = 30 * 1000, appPollMs = 500, sleep = defaultSleep, monotonic = () => Date.now(),
     env = process.env, platform = process.platform, probeTimeoutMs,
   } = options
@@ -311,9 +372,13 @@ export async function openScopeForOracleTests(options = {}, rules = OPENING_PRIM
   const project = loadProject()
   const enablement = readObsidianEnablement(project)
   const applyAvailable = extensions !== null && extensions.applyOperation() !== UNAVAILABLE_APPLY_OPERATION
+  // A restart this run made, and what it wrote to Obsidian's settings: every answer after them shows both.
+  let restart = null
+  let settingsShown = null
   const finish = (outcome, extra = {}) => {
     const { afterOpen = false, ...shown } = extra
-    return { ok: outcome === 'current', ...describeOutcome(outcome), next: nextStep(outcome, shown.reason, { afterOpen }), launched: false, ...shown }
+    const next = restart?.quit === true && restart.startedAgain === false ? REASON_NEXT['app-not-started-again'] : nextStep(outcome, shown.reason, { afterOpen })
+    return { ok: outcome === 'current', ...describeOutcome(outcome), next, launched: false, ...shown, ...(restart === null ? {} : { restart }), ...(settingsShown === null ? {} : { obsidianSettings: settingsShown }) }
   }
   if (enablement.state === 'disabled') return finish('disabled', { reason: enablement.reason, scopeId: requestedScope ?? null })
   const scopeId = resolveScope(enablement, requestedScope)
@@ -323,6 +388,8 @@ export async function openScopeForOracleTests(options = {}, rules = OPENING_PRIM
   //    release, under the consent already recorded, when a tick is asked of it (requestServiceTick).
   let status = await serviceStatus(lifecycle, lifecycleRules)
   if (status.state === 'busy') return finish('busy', { scopeId, reason: status.reason, service: { state: status.state } })
+  // How a login item took part in starting the service (started through it, refreshed, or not used and why).
+  let loginItem = null
   if (status.state !== 'healthy') {
     let started
     try {
@@ -331,8 +398,10 @@ export async function openScopeForOracleTests(options = {}, rules = OPENING_PRIM
       if (!(error instanceof ObsidianMaintenanceRefusal)) throw error
       return finish('service-unavailable', { scopeId, reason: error.code, service: { state: status.state } })
     }
-    if (started.state === 'busy') return finish('busy', { scopeId, reason: started.reason, service: { state: 'busy', started: started.started } })
-    if (started.state !== 'healthy') return finish('service-unavailable', { scopeId, reason: started.reason ?? started.state, service: { state: started.state } })
+    loginItem = started.loginItem ?? null
+    const item = loginItem === null ? {} : { loginItem }
+    if (started.state === 'busy') return finish('busy', { scopeId, reason: started.reason, service: { state: 'busy', started: started.started, ...item } })
+    if (started.state !== 'healthy') return finish('service-unavailable', { scopeId, reason: started.reason ?? started.state, service: { state: started.state, ...item } })
     status = started
   }
   let runtimeId = status.record?.runtimeId ?? null
@@ -346,7 +415,7 @@ export async function openScopeForOracleTests(options = {}, rules = OPENING_PRIM
     const asked = await requestServiceTick({ ...lifecycle, tickTimeoutMs, scopeId, service }, lifecycleRules)
     if (asked.restarted) restarted = asked.restarted
     if (typeof asked.runtimeId === 'string') runtimeId = asked.runtimeId
-    const serviceShown = { state: asked.state, runtimeId, ...(restarted === null ? {} : { restarted }) }
+    const serviceShown = { state: asked.state, runtimeId, ...(restarted === null ? {} : { restarted }), ...(loginItem === null ? {} : { loginItem }) }
     if (asked.state === 'busy') return { answer: { outcome: 'busy', extra: { scopeId, reason: asked.reason, service: serviceShown } } }
     if (!asked.requested) return { answer: { outcome: 'service-unavailable', extra: { scopeId, reason: asked.reason, service: serviceShown } } }
     let view = report()
@@ -372,8 +441,45 @@ export async function openScopeForOracleTests(options = {}, rules = OPENING_PRIM
   if (view.outcome !== 'current' && !readable && !keptByApp) return finish(view.outcome, common)
 
   // 3. The app, before anything is launched. With no vault open it answers nothing; a vault it already lists can still be opened by path.
-  const before = qualifyApp(await inspectApp(appProbe), { requireVersion: false })
+  let before = qualifyApp(await inspectApp(appProbe), { requireVersion: false })
   const app = (qualification) => ({ outcome: qualification.outcome, reason: qualification.reason, version: qualification.version, floor: qualification.floor })
+
+  // A running app that cannot be reached (`state`: its command line is off, or it has no vault open and does not list
+  // this one) is quit, only when the person asked for it. { quit: true } with the app gone, or { answer } to give.
+  const QUIT_APP = { installed: true, cli: true, running: false, version: null }
+  const quitToRestart = async (state, stateOutcome) => {
+    if (!restartApp) return { answer: finish(stateOutcome, { ...common, reason: state, app: app(before) }) }
+    if (typeof quitter?.quit !== 'function' || typeof launcher.startPlain !== 'function' || typeof registry.backupSettings !== 'function') return { answer: finish(stateOutcome, { ...common, reason: 'restart-unavailable', app: app(before) }) }
+    // Read-only, before anything is sent: the write the restart is for can succeed. What it would refuse is answered
+    // now, with the app left running.
+    const notRestarted = (outcome, reason) => { restart = { asked: true, state, quit: false, signalled: false, signals: 0, reason }; return { answer: finish(outcome, { ...common, reason, app: app(before) }) } }
+    if (typeof view.vaultRoot !== 'string') return notRestarted('not-prepared', 'no-vault-folder')
+    const outlook = settingsWriteOutlook({ settings: await attempt(() => registry.readSettings()), vaultRoot: view.vaultRoot })
+    if (!outlook.ok) return notRestarted('launch-failed', outlook.code)
+    // A copy of the settings as they are, kept beside them once the main process is proven, right before the first
+    // signal; a copy that cannot be kept sends nothing. An app that has shown only its starter window has no file yet:
+    // there is nothing to copy, and the write creates it.
+    const quit = await attempt(() => quitter.quit({ beforeSignal: outlook.create === true ? null : () => registry.backupSettings() }))
+    restart = {
+      asked: true, state, quit: quit?.quit === true, signalled: quit?.signalled === true, ...(Number.isSafeInteger(quit?.pid) ? { pid: quit.pid } : {}),
+      signals: Number.isSafeInteger(quit?.signals) ? quit.signals : 0, ...(typeof quit?.settingsCopy === 'string' ? { settingsCopy: quit.settingsCopy } : {}),
+    }
+    if (quit?.quit === true) { before = qualifyApp(QUIT_APP, { requireVersion: false }); return { quit: true } }
+    restart.reason = typeof quit?.reason === 'string' ? quit.reason : 'app-did-not-quit'
+    if (typeof quit?.detail === 'string') restart.detail = quit.detail
+    // An app that was signalled and has not gone is neither started again nor written for: the person decides.
+    return { answer: finish(quit?.signalled === true ? 'launch-failed' : stateOutcome, { ...common, reason: restart.reason, app: app(before) }) }
+  }
+  // After a restart, every answer given before the launch starts the app again as it was: plainly, so it reopens the
+  // vaults it had open. Nothing was added for this view.
+  const giveBack = async () => {
+    if (restart?.quit !== true || restart.startedAgain !== undefined) return
+    restart.startedAgain = (await attempt(() => launcher.startPlain())) === true
+  }
+  if (before.reason === 'cli-turned-off') {
+    const stopped = await quitToRestart('cli-turned-off', before.outcome)
+    if (stopped.answer) return stopped.answer
+  }
   const noVaultOpen = before.reason === 'no-vault-open'
   if (!rules.appQualifies(before) && !noVaultOpen) {
     // No app answered and none is known to run (a process table that could not be read, on Linux any app on a system
@@ -386,19 +492,27 @@ export async function openScopeForOracleTests(options = {}, rules = OPENING_PRIM
   //    call about it then reaches it and no other vault: in its folder, or by its id when a vault listed at a folder
   //    above it would take a call run there.
   const { vaultRoot } = view
-  if (typeof vaultRoot !== 'string') return finish('not-prepared', { ...common, reason: 'no-vault-folder', app: app(before) })
+  if (typeof vaultRoot !== 'string') { await giveBack(); return finish('not-prepared', { ...common, reason: 'no-vault-folder', app: app(before) }) }
   // A version Atelier's plugin reported is not the command line answering (withPluginReportedVersion).
   const fromPlugin = before.versionSource === 'plugin'
-  const known = await ensureAppKnowsVault({ registry, observation: { answering: typeof before.version === 'string' && !fromPlugin, noVaultOpen: noVaultOpen || fromPlugin, fromPlugin }, vaultRoot, sleep, pollMs: appPollMs })
+  const knowVault = () => ensureAppKnowsVault({ registry, observation: { answering: typeof before.version === 'string' && !fromPlugin, noVaultOpen: before.reason === 'no-vault-open' || fromPlugin, fromPlugin }, vaultRoot, sleep, pollMs: appPollMs, keepBackups: typeof restart?.settingsCopy === 'string' ? [restart.settingsCopy] : [] })
+  let known = await knowVault()
+  // With no vault open, a vault the app does not list cannot be added while it runs: a restart the person asked for.
+  if (!known.ok && known.reason === 'no-vault-open' && restart === null) {
+    const stopped = await quitToRestart('no-vault-open', 'app-version-unsupported')
+    if (stopped.answer) return stopped.answer
+    known = await knowVault()
+  }
+  if (known.settings) settingsShown = known.settings
   // An app that answered its version and then closed its last vault window is one with no vault open; one that holds
   // this vault open but whose command line does not answer has no usable command line.
-  if (!known.ok) return finish(known.reason === 'no-vault-open' ? 'app-version-unsupported' : known.reason === 'vault-open-cli-silent' ? 'app-cli-unavailable' : 'launch-failed', { ...common, reason: known.reason, app: app(before) })
+  if (!known.ok) { await giveBack(); return finish(known.reason === 'no-vault-open' ? 'app-version-unsupported' : known.reason === 'vault-open-cli-silent' ? 'app-cli-unavailable' : 'launch-failed', { ...common, reason: known.reason, app: app(before) }) }
   const registration = { how: known.how }
   const route = vaultRoute({ vaults: known.vaults, vaultRoot })
   // Open in several windows, one per entry of the list that names its folder: each holds the vault, and a publication
   // coordinates with one only. Nothing is launched; the entries are named.
-  if (route.how === 'duplicated') return finish('publisher-conflict', { ...common, reason: 'vault-open-in-several-windows', duplicates: route.entries, app: app(before), registration })
-  if (route.how !== 'folder' && route.how !== 'id') return finish('launch-failed', { ...common, reason: route.how === 'ambiguous' ? 'vault-inside-another-vault' : 'registration-not-verified', app: app(before), registration })
+  if (route.how === 'duplicated') { await giveBack(); return finish('publisher-conflict', { ...common, reason: 'vault-open-in-several-windows', duplicates: route.entries, app: app(before), registration }) }
+  if (route.how !== 'folder' && route.how !== 'id') { await giveBack(); return finish('launch-failed', { ...common, reason: route.how === 'ambiguous' ? 'vault-inside-another-vault' : 'registration-not-verified', app: app(before), registration }) }
 
   // 5. Launch, then wait, bounded, for the app to answer for exactly this vault.
   let launch
@@ -408,11 +522,21 @@ export async function openScopeForOracleTests(options = {}, rules = OPENING_PRIM
   // otherwise the vault's own path, which the app matches exactly since the folder is listed.
   const target = route.how === 'id' ? { vaultId: route.id, vaultPath: known.path } : { vaultPath: known.path }
   try { launch = await launcher.open({ vaultRoot: known.path, ...target, appRunning: before.running === true }) } catch { launch = { launched: false, reason: 'launcher-threw' } }
+  // A restart ends here: the app was started again, or could not be (the next step then says to start it).
+  if (restart?.quit === true) restart.startedAgain = launch?.launched === true
   if (launch?.launched !== true) return finish('launch-failed', { ...common, reason: typeof launch?.reason === 'string' ? launch.reason : 'launcher-refused', app: app(before), registration })
   const deadline = monotonic() + appWaitMs
   let after = before
   let vault = { answered: false, indexReady: false }
+  // Rounds in a row in which only Atelier's plugin gave the version and the command line did not answer for the vault.
+  let silentRounds = 0
+  // A quit app started plainly reopens only the vaults its list flags open. A listed vault that is closed opens through
+  // the link alone, so a link the started app did not take (it answered its tool, then refused the link) is handed
+  // once more, to the app that now runs, one round later, before the vault counts as not answering.
+  let linkRetry = launch.reason === 'app-started-link-not-taken' && known.open !== true ? 'due' : 'none'
+  let rounds = 0
   for (;;) {
+    rounds += 1
     after = qualifyApp(await inspectApp(appProbe), { requireVersion: true })
     // A running app below the floor is final; an app that has not come up yet, or not yet opened a vault, is asked again.
     if (!rules.appQualifies(after) && !NOT_UP_YET.has(after.reason)) return finish(after.outcome, { ...common, launched: true, reason: after.reason, app: app(after), registration })
@@ -420,13 +544,23 @@ export async function openScopeForOracleTests(options = {}, rules = OPENING_PRIM
       try { vault = await appProbe.vaultState({ vaultRoot, route }) } catch { vault = { answered: false, indexReady: false } }
       if (vault?.answered === true && vault.indexReady === true) break
       // Only the command line answers for a vault. An app whose version still only Atelier's plugin reports gives no
-      // answer there, and waiting changes nothing: its command line is what is missing, not a launch.
-      if (vault?.answered !== true && after.versionSource === 'plugin') return finish('app-cli-unavailable', { ...common, launched: true, reason: 'vault-open-cli-silent', app: app(after), registration })
-    }
+      // answer there, and waiting changes nothing: its command line is what is missing, not a launch. One such round
+      // is not enough: a tool call that timed out while the app was busy opening the window looks the same once, so
+      // the answer is given at the second round in a row.
+      silentRounds = vault?.answered !== true && after.versionSource === 'plugin' ? silentRounds + 1 : 0
+      if (silentRounds >= SILENT_ROUNDS) return finish('app-cli-unavailable', { ...common, launched: true, reason: 'vault-open-cli-silent', app: app(after), registration })
+      if (linkRetry === 'due' && rounds >= 2 && vault?.answered !== true) {
+        linkRetry = 'done'
+        // Through the app's tool only: this `open` started the app, so the link never goes to the operating system.
+        try { await launcher.open({ vaultRoot: known.path, ...target, appRunning: true, startedByThisOpen: true }) } catch { /* the wait decides */ }
+      }
+    } else silentRounds = 0
     if (monotonic() >= deadline) break
     await sleep(appPollMs)
   }
   if (!rules.appQualifies(after)) return finish(after.outcome, { ...common, launched: true, reason: after.reason, app: app(after), registration })
+  // The wait ended on a silent round with only the plugin giving the version: the command line is what did not answer.
+  if (vault?.answered !== true && silentRounds > 0) return finish('app-cli-unavailable', { ...common, launched: true, reason: 'vault-open-cli-silent', app: app(after), registration })
   if (vault?.answered !== true) return finish('launch-failed', { ...common, launched: true, reason: 'app-did-not-answer-for-this-vault', app: app(after), registration })
   if (vault.indexReady !== true) return finish('indexing', { ...common, launched: true, reason: 'metadata-cache-not-ready', app: app(after), registration })