@mnstry/atelier 0.2.0-alpha.13 → 0.2.0-alpha.14

package/src/projection/obsidian/publication/publisher.mjs

@@ -1,3 +1,4 @@
+import { createCooperativeBudget, isSchedulingStop } from '../materialize/prepare-view.mjs'
 import fs from 'node:fs'
 import fsp from 'node:fs/promises'
 import path from 'node:path'
@@ -317,11 +318,33 @@ export function planUnits({ files, priorManifest, pointer, ledger, pluginDisk =
   return units
 }
 
+// The code of a failure met while candidates were being cleaned up after a staging that did not complete, for the detail
+// of what ended it. Nothing else of the failure is kept: its message may name a path.
+const cleanupCauseOf = (failure) => (failure === null ? {} : { cleanupCause: typeof failure?.code === 'string' && failure.code !== '' ? failure.code.slice(0, 64) : 'unknown' })
+// The stop or refusal itself is handed on, so the caller can still tell it by identity: its `detail` is replaced by a
+// copy that adds `cleanupCause`, and an object shared as its detail is left as it was. A caller that throws the same
+// error object again keeps that field on it.
+function withCleanupCause(error, failure) {
+  if (failure !== null) try { error.detail = { ...(error.detail ?? {}), ...cleanupCauseOf(failure) } } catch { /* an error that cannot be extended is handed on as it is */ }
+  return error
+}
+
 // The rules the oracle tests are sensitive to. Production always uses these; the tests substitute a deliberately
 // broken one through publishViewForOracleTests to prove the oracle can fail.
 export const PUBLICATION_PRIMITIVES = Object.freeze({
   // The one operation the `direct-unheld` path writes into the vault: a file created where nothing is.
   unheldWrites: (op) => op === 'create',
+  // Whether an error that stopped staging was the caller's stop (its settings check, or a cancellation), handed on
+  // under its own code once the candidates are cleaned up, rather than reported as a staging failure.
+  callerStoppedStaging: (error) => isSchedulingStop(error),
+  // Whether a refusal raised while candidates are being staged (the vault's folder replaced or gone under the run) is
+  // handed on only once those candidates are cleaned up, as a stop is. A candidate staged before the journal is
+  // written is named by no journal, so restart recovery would never remove one left there.
+  refusedStagingCleansUp: () => true,
+  // The code the journal's last entry gives an error that ended the publication once the journal was open: a
+  // caller's stop under its own code, which is what the caller is told, and anything else as a fault of the publisher.
+  // Decided by the tag a stop carries, never by what an error looks like; a stop that carries no code has none to give.
+  journalFailureCode: (error) => (isSchedulingStop(error) && typeof error.code === 'string' && error.code !== '' ? error.code.slice(0, 200) : 'publisher-error'),
 })
 
 // Whether the `direct-unheld` path applies, after the adapter found an app it cannot coordinate with (see the head of
@@ -355,6 +378,8 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
   if (!adapter || typeof adapter.probe !== 'function') throw new TypeError('publishView needs an editor coordination adapter')
   if (expectedGeneration !== null && typeof expectedGeneration !== 'string') throw new TypeError('expectedGeneration must be a generation identity or null')
 
+  const budget = createCooperativeBudget(options.scheduling)
+  budget.check()
   const releases = []
   let journal = null
   try {
@@ -384,9 +409,16 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     store.checkAllocatedVault?.()
     acquire(store.vaultLockPath, () => acquireVaultLock(store), 'into this vault')
     store.checkAllocatedVault?.()
+    await budget.checkpoint('recover', true)
+    store.checkAllocatedVault?.()
     const recovered = recoverPublicationsLocked({ store, clock })
+    await budget.checkpoint('recovery-complete', true)
+    store.checkAllocatedVault?.()
     const pointer = store.readCurrent()
     if (pointer?.generationId === manifest.generationId && !pluginFilesDrifted(preparedView, store)) {
+      await options.beforeCommit?.()
+      budget.check()
+      store.checkAllocatedVault?.()
       return { state: 'committed', alreadyCommitted: true, generationId: manifest.generationId, journalId: pointer.journalId, notes: [], retainedEdits: pointer.retained ?? [], lateWriters: [], recovered }
     }
     if ((pointer?.generationId ?? null) !== expectedGeneration) refuse('generation-mismatch', 'the committed generation is not the one this publication expects', { committed: pointer?.generationId ?? null })
@@ -426,12 +458,16 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
       stagingDir = store.stagingDir(journalId)
       // On the `direct-unheld` path a replacement is never written, so no candidate is staged for one.
       for (const unit of units.filter((item) => item.op === 'create' || (item.op === 'replace' && (mode !== 'direct-unheld' || rules.unheldWrites(item.op))))) {
+        await budget.checkpoint('stage-candidate')
+        store.checkAllocatedVault?.()
         const existing = fs.lstatSync(path.join(store.vaultRoot, unit.path), { throwIfNoEntry: false })
         unit.preparedPath = store.preparedPath(journalId, unit.unit)
         stageCandidate(unit.preparedPath, unit.bytes, unit.mode ?? (existing?.isFile() ? existing.mode & 0o777 : 0o644), created)
         // A replacement is exchanged, and the exchange leaves the displaced bytes at this path: it is in recovery.
         unit.stagedPath = unit.op === 'replace' ? store.exchangeCandidatePath(journalId, unit.unit) : unit.preparedPath
       }
+      await budget.checkpoint('staging-complete', true)
+      store.checkAllocatedVault?.()
       syncPrivateDirectory(stagingDir)
       const manifestFile = path.join(store.journalDir(journalId), 'manifest.json')
       publishPrivateFile(manifestFile, manifestBytes)
@@ -446,22 +482,39 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
       // The journal now names every exchange candidate by path and digest. Only complete, fsynced files are moved
       // in, so a file at an exchange path is never a partial candidate.
       for (const unit of units.filter((item) => item.stagedPath && item.stagedPath !== item.preparedPath)) {
+        await budget.checkpoint('move-candidate')
+        store.checkAllocatedVault?.()
         moveToExchangePath(store, journalId, unit, moved)
       }
     } catch (error) {
-      if (error instanceof PublicationRefusal) throw error
+      const stopped = rules.callerStoppedStaging(error)
+      // A refusal raised between two candidates (the publisher's own check found the vault's folder replaced or gone)
+      // is handed on under its own code too, and like a stop only after the cleanup below.
+      const refused = error instanceof PublicationRefusal && !stopped
+      if (refused && !rules.refusedStagingCleansUp(error)) throw error
       // No payload has named any of these paths, so nothing was exchanged and they can only hold our own
       // candidates. In staging they are removed by name. In recovery a file is removed only when its bytes are
       // the candidate's; anything else stays for restart recovery, which the journal header points at it. Only
       // empty directories are removed, so a failed staging leaves nothing that looks like an unfinished unit.
+      // Each file is cleaned up on its own, so one that cannot be removed (EBUSY, EPERM, a volume gone) leaves the
+      // others removed; the first such failure is kept.
+      let cleanupFailure = null
+      const cleanUp = (operation) => { try { operation() } catch (failure) { cleanupFailure ??= failure } }
       for (const unit of moved) {
-        if (readFileDigest(unit.stagedPath) === unit.candidateDigest) fs.rmSync(unit.stagedPath, { force: true })
+        cleanUp(() => { if (readFileDigest(unit.stagedPath) === unit.candidateDigest) fs.rmSync(unit.stagedPath, { force: true }) })
         try { fs.rmdirSync(path.dirname(unit.stagedPath)) } catch { /* not empty: left for restart recovery */ }
       }
-      for (const file of created) fs.rmSync(file, { force: true })
+      for (const file of created) cleanUp(() => fs.rmSync(file, { force: true }))
       for (const directory of [stagingDir, store.unitsRoot(journalId)]) if (directory) try { fs.rmdirSync(directory) } catch { /* absent, or not empty */ }
-      refuse('staging-failed', 'the candidates could not be staged; nothing in the vault was touched', { cause: error.code ?? String(error.message) })
+      // The caller stopped the publication between two candidates: nothing failed to stage, and its reason (a
+      // setting that changed during the tick, `mixed-read`, or a cancellation) is the one reported. So is a refusal's.
+      // A cleanup that failed does not replace either: it is named in their detail as `cleanupCause`, and what it could
+      // not remove stays where it is.
+      if (stopped || refused) throw withCleanupCause(error, cleanupFailure)
+      refuse('staging-failed', 'the candidates could not be staged; nothing in the vault was touched', { cause: error.code ?? String(error.message), ...cleanupCauseOf(cleanupFailure) })
     }
+    await budget.checkpoint('journal-and-moves-complete', true)
+    store.checkAllocatedVault?.()
     crash('after-staging')
 
     const context = { store, journal, journalId, channel, clock, crash, mode, rules }
@@ -479,6 +532,8 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     // unit refuses, a kept one included, so nothing is committed.
     let lastProbe = null
     for (const unit of units) {
+      await budget.checkpoint('publish-unit')
+      store.checkAllocatedVault?.()
       if (mode === 'direct' && (lastProbe === null || Date.now() - lastProbe > 2000)) {
         lastProbe = Date.now()
         const again = await adapter.probe({ vaultRoot: store.vaultRoot })
@@ -501,6 +556,8 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
       }
     }
 
+    await budget.checkpoint('publication-complete', true)
+    store.checkAllocatedVault?.()
     const blocking = results.filter((result) => result.blocking)
     const retainedEdits = results.filter((result) => result.retained).map((result) => result.retained)
     // Notes kept earlier stay surfaced until they leave the vault or come back into a view.
@@ -517,6 +574,16 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
       journal.append({ step: 'verify', outcome: 'conflict', state: 'verifying', notePath: finding.notePath, beforeDigest: finding.digestAtMove, afterDigest: finding.observedDigest, recoveryRef: finding.displacedRef,
         detail: { unit: finding.unit, code: 'late-writer-captured', objectRef: finding.objectRef } })
     }
+    await budget.checkpoint('verify-before-commit', true)
+    // The resident engine revalidates the selected source pins here, while
+    // publication still owns its locks. Its check may yield; no durability
+    // unit or committed pointer is half-written across that wait. It comes
+    // before the entry that says the publication settled: restart recovery
+    // commits a journal that holds that entry, so a refusal after it would be
+    // committed by the next publication of this view.
+    await options.beforeCommit?.()
+    budget.check()
+    store.checkAllocatedVault?.()
     journal.append({ step: 'verify', outcome: 'ok', state: 'verifying', detail: { settled: true, retained: retainedEdits } })
     crash('before-manifest-commit')
     store.checkAllocatedVault?.()
@@ -528,7 +595,7 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     return { ...base, state: 'committed', lateWriters }
   } catch (error) {
     if (!(error instanceof PublicationRefusal)) {
-      if (journal) try { journal.append({ step: 'verify', outcome: 'failed', state: 'failed', detail: { code: 'publisher-error', message: String(error.code ?? error.message).slice(0, 200) } }) } catch { /* the journal itself cannot be written */ }
+      if (journal) try { journal.append({ step: 'verify', outcome: 'failed', state: 'failed', detail: { code: rules.journalFailureCode(error), message: String(error.code ?? error.message).slice(0, 200) } }) } catch { /* the journal itself cannot be written */ }
       throw error
     }
     return { state: 'refused', refusal: { code: error.code, message: error.message, detail: error.detail }, notes: [], retainedEdits: [], lateWriters: [] }

package/src/projection/project.mjs

@@ -3,6 +3,7 @@ import { isDeepStrictEqual } from 'node:util'
 import path from 'node:path'
 import { commandProject, readJson, writeJson } from '../project/config.mjs'
 import { summarizeReadinessJourney } from '../readiness-protocols/runtime.mjs'
+import { atelierControlStyles } from '../ui/control-system.mjs'
 
 const esc = (value) => String(value ?? '').replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;')
 
@@ -53,7 +54,7 @@ export function buildProjectProjection(project) {
     <h3>${esc(item.title)}</h3>
     <p><strong>${esc(item.status)}</strong> · ${esc(item.score)} / 100 answers complete</p>
     <p>${esc(item.blockers[0] || 'review-ready')}</p>
-    <button type="button" data-copy="${esc(item.agentPrompt)}">Copy protocol prompt</button>
+    <button type="button" class="system-control" data-variant="secondary" data-size="compact" data-copy="${esc(item.agentPrompt)}">Copy protocol prompt</button>
   </article>`).join('\n')
   const cards = graph.nodes.map((node) => `<article class="card" data-node="${esc(node.id)}">
     <p class="eyebrow">${esc(node.repo)} · ${esc(node.type)} · ${esc(node.audience)}</p>
@@ -80,9 +81,9 @@ h1{font-size:clamp(2rem,4vw,4rem);margin:.2em 0}
 .readiness-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px;margin-top:16px}
 .readiness-card{border:1px solid #342b26;border-radius:8px;padding:14px;background:#171312}
 .readiness-card h3{font-size:1.05rem;margin:.2rem 0}
-.readiness-card button{min-height:44px;border:1px solid #755f43;border-radius:6px;background:#241d18;color:var(--atelier-text);padding:8px 10px;cursor:pointer}
 .eyebrow{color:var(--atelier-eyebrow);text-transform:uppercase;letter-spacing:.08em;font-size:.8rem}
 a{color:var(--atelier-accent)}
+${atelierControlStyles}
 ${branding.themeCss}</style>
 </head>
 <body><main>