@mnstry/atelier 0.2.0-alpha.14 → 0.2.0-alpha.15

package/src/knowledge-health/rule-identity.mjs

@@ -1,7 +1,7 @@
 export const ruleIdentity = Object.freeze({
   "profile": "source-qualified-required-direction/r1",
-  "commit": "0a77cdc0f4f949d9aef29e3567303e2a6588a610",
-  "tree": "4aaadc77690868921c1748e15079e0965e06faae",
+  "commit": "43a6d6a9d4718e735576bdd878cbea1f9b7e454a",
+  "tree": "306d92f8f3a36fa8938419bf8df32cb3b30f6704",
   "files": [
     {
       "path": "src/knowledge/plan.mjs",
@@ -24,8 +24,8 @@ export const ruleIdentity = Object.freeze({
     {
       "path": "src/graph/knowledge-graph.mjs",
       "bytes": 66377,
-      "sha256": "fce2815bbc851451fca187082238a286f4796742b917229ec1b55af85d9e8eb0",
-      "blob": "95cf2bf277c5a6599c0c95f046adea786cfc3f53"
+      "sha256": "ee62867895c7a8ab16295365120c2b4a69754066bf2258fc9156708d9b61bc96",
+      "blob": "fc6c543d08bef5de449709674122994cb1c51b75"
     },
     {
       "path": "templates/knowledge-workspace/knowledge-plan.schema.json",
@@ -42,8 +42,8 @@ export const ruleIdentity = Object.freeze({
     "note": "The supplier qualified against this earlier commit. The pinned plan, context and schema files are byte-identical there and at the source authority above; src/graph/graph.mjs and src/graph/knowledge-graph.mjs are not, and that qualification does not cover their current bytes."
   },
   "previousSourceAuthority": {
-    "commit": "fcfdbe5ded672d41c717f49e0cfdf68b6060834d",
-    "tree": "400e181cd0cb55976f3ef7ab1a1405531dacd521",
-    "note": "Regenerated by the source owner for a changed candidate: the canonical graph build became a set of steps that a caller may run with waits between them (the census of Markdown sources), and buildKnowledgeGraph and buildCanonicalGraph run them through. Their results and errors are meant to be unchanged; the Knowledge Health tests pass on the current bytes."
+    "commit": "0a77cdc0f4f949d9aef29e3567303e2a6588a610",
+    "tree": "4aaadc77690868921c1748e15079e0965e06faae",
+    "note": "Regenerated by the source owner for a changed candidate: workspace link resolution in src/graph/knowledge-graph.mjs now recognises Markdown sources by the existing isMarkdownPath test, so links from uppercase .MD files resolve. One line changes; the file keeps its size. The other pinned files are byte-identical; the Knowledge Health tests pass on the current bytes."
   }
 })

package/src/knowledge-health/workshop.mjs

@@ -28,12 +28,32 @@ function read(file) {
   } finally { fs.closeSync(fd) }
 }
 
+// Every directory is created by this copy and every file is created exclusively, so an entry that arrived meanwhile
+// refuses instead of being merged. Nothing is overwritten, and nothing unknown is cleaned up on failure.
+function copyExclusive(source, target) {
+  const stat = fs.lstatSync(source)
+  if (stat.isDirectory()) {
+    fs.mkdirSync(target, { recursive: false })
+    for (const name of fs.readdirSync(source)) copyExclusive(path.join(source, name), path.join(target, name))
+  } else if (stat.isFile()) fs.copyFileSync(source, target, fs.constants.COPYFILE_EXCL)
+  else throw Error('The workshop fixture holds an entry that is neither a file nor a directory')
+}
+
+// Entries created inside these new directories after they were made are not ours either; refuse before Git sees them.
+function assertExactCopy(source, target) {
+  const expected = fs.readdirSync(source).sort(), actual = fs.readdirSync(target).sort()
+  if (expected.length !== actual.length || expected.some((name, index) => name !== actual[index]))
+    throw Object.assign(Error('The new workshop holds entries this initialization did not create'), { code: 'EEXIST' })
+  for (const name of expected) if (fs.lstatSync(path.join(source, name)).isDirectory()) assertExactCopy(path.join(source, name), path.join(target, name))
+}
+
 /** Copy the actual shipped public fixture into a NEW disposable workspace. */
 export function initializeKnowledgeHealthWorkshop(destination) {
   const root = path.resolve(destination)
   fs.mkdirSync(root, { recursive: false })
-  fs.cpSync(fileURLToPath(new URL('../../fixtures/knowledge-health/workshop/', import.meta.url)), root,
-    { recursive: true, force: false, errorOnExist: true })
+  const fixture = fileURLToPath(new URL('../../fixtures/knowledge-health/workshop/', import.meta.url))
+  for (const name of fs.readdirSync(fixture)) copyExclusive(path.join(fixture, name), path.join(root, name))
+  assertExactCopy(fixture, root)
   fs.writeFileSync(path.join(root, '.gitignore'), '.atelier-local/\noutput/\n', { flag: 'wx' })
   const git = spawnSync('git', ['init', '--quiet'], { cwd: root, encoding: 'utf8', timeout: 15000,
     env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1',

package/src/personal-workspace/selection.mjs

@@ -19,6 +19,7 @@ const MAX_RECORD = 1024 * 1024
 const MAX_GENERATION_FILE = 8 * 1024 * 1024
 const MAX_RESTORE_RECORD = 4 * MAX_RECORD
 const ID = /^[0-9a-f]{64}$/
+const CONFIRMATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
 // Every temporary name this module writes, including restore aside copies
 // (.restore-<uuid>-aside-<key>.json).
 const TEMPORARY = /^\.(selection|restore|validate)-[0-9a-f-]{36}(-[a-z]+)*\.json$/
@@ -136,7 +137,7 @@ function readHistory(personalHome) {
     let record
     try { record = JSON.parse(bytes) } catch { refuse('selection-history-corrupt') }
     if (record?.schema !== SELECTION_SCHEMA || record.sequence !== index + 1 || record.previous !== head || !ID.test(record.generationId ?? '') ||
-      canonical(record) !== bytes.toString('utf8')) refuse('selection-history-corrupt')
+      (record.confirmationId !== undefined && !CONFIRMATION_ID.test(record.confirmationId)) || canonical(record) !== bytes.toString('utf8')) refuse('selection-history-corrupt')
     records.push(record)
     head = hash(bytes)
     files.push({ name, bytes: bytes.length, digest: head })
@@ -163,7 +164,7 @@ export function selectPersonalGeneration(options) {
     const { eligible, reason } = eligibility(personalHome, generationId)
     if (!eligible) refuse(reason)
     const dir = privateDir(personalHome, 'selections', true)
-    const record = { schema: SELECTION_SCHEMA, sequence: records.length + 1, previous: head, generationId }
+    const record = { schema: SELECTION_SCHEMA, sequence: records.length + 1, previous: head, generationId, confirmationId: randomUUID() }
     const content = canonical(record)
     try { publishExclusive(dir, `${String(record.sequence).padStart(6, '0')}.json`, content, 'selection') }
     catch (error) { if (error.code === 'EEXIST') refuse('selection-concurrent'); throw error }
@@ -198,6 +199,20 @@ export function readPersonalSelectionHead(options) {
   }, 'personal-home-unavailable')
 }
 
+// Package-internal snapshot for a host that keeps continuity across starts. The public head reader keeps its exact
+// result. These identities come from the same verified history read, including every previously confirmed prefix.
+export function readPersonalSelectionSnapshot(options) {
+  return safe(() => {
+    const { personalHome } = options ?? {}
+    privateHome(personalHome)
+    const { records, files, head } = readHistory(personalHome)
+    const current = records.at(-1) ?? null
+    return freeze({ selected: current?.generationId ?? null, sequence: current?.sequence ?? 0, head,
+      confirmationId: current?.confirmationId ?? null, recordDigests: files.map((file) => file.digest),
+      confirmationIds: records.flatMap((record) => record.confirmationId === undefined ? [] : [record.confirmationId]) })
+  }, 'personal-home-unavailable')
+}
+
 // Lists entries without failing the whole inventory: a concurrently removed entry
 // is skipped; an unreadable, foreign or oversized one is reported without a digest.
 function listFiles(dir, keep) {

package/src/project/config.mjs

@@ -557,7 +557,7 @@ export function validateProjectConfigDoc(doc, { neutralTemplate = false } = {})
     errors.push('setup.profile is invalid')
   }
   // The census reads these as path patterns relative to the project config's
-  // folder (docs/knowledge-graph.md), under the contract's pathString rules.
+  // folder (docs/reference/knowledge-graph.md), under the contract's pathString rules.
   for (const key of ['include', 'exclude']) {
     errors.push(...stringPathErrors(setup[key], `setup.${key}`))
     if (typeof setup[key] === 'string' && (setup[key].includes('\u0000') || /^[a-z][a-z0-9+.-]*:/.test(setup[key]) || path.isAbsolute(setup[key]))) {

package/src/project/providers/github.mjs

@@ -0,0 +1,24 @@
+import { execFileSync } from 'node:child_process'
+
+export const PROVIDER_HOSTS = Object.freeze({ 'github.com': 'github' })
+
+const lower = (value) => String(value ?? '').trim().toLowerCase()
+
+// Ask the provider to resolve the recorded ref. GitHub follows the rename redirect
+// and answers with the stable numeric id plus the current full name, which is the
+// only signal that survives a rename.
+export function githubLookup({ owner, name }) {
+  try {
+    const out = execFileSync('gh', ['api', `repos/${owner}/${name}`, '--jq', '{id: .id, fullName: .full_name}'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    })
+    const parsed = JSON.parse(out)
+    if (!parsed?.id) return null
+    return { id: String(parsed.id), fullName: lower(parsed.fullName), currentName: lower(String(parsed.fullName).split('/').pop()) }
+  } catch {
+    return null
+  }
+}
+
+export const defaultLookups = { github: githubLookup }

package/src/project/repo-identity.mjs

@@ -1,9 +1,9 @@
-import { execFileSync } from 'node:child_process'
 import { SUPPORTED_IDENTITY_PROVIDERS, gitRemoteUrl, remoteHost } from './config.mjs'
+import { PROVIDER_HOSTS, defaultLookups } from './providers/github.mjs'
 
-export const SUPPORTED_PROVIDERS = Object.freeze([...SUPPORTED_IDENTITY_PROVIDERS])
+export { githubLookup } from './providers/github.mjs'
 
-const PROVIDER_HOSTS = Object.freeze({ 'github.com': 'github' })
+export const SUPPORTED_PROVIDERS = Object.freeze([...SUPPORTED_IDENTITY_PROVIDERS])
 
 const lower = (value) => String(value ?? '').trim().toLowerCase()
 
@@ -23,25 +23,6 @@ export function parseRemoteRef(url) {
   return { host, provider: PROVIDER_HOSTS[host] ?? null, owner: lower(parts[0]), name: lower(parts.slice(1).join('/')) }
 }
 
-// Ask the provider to resolve the recorded ref. GitHub follows the rename redirect
-// and answers with the stable numeric id plus the current full name, which is the
-// only signal that survives a rename.
-export function githubLookup({ owner, name }) {
-  try {
-    const out = execFileSync('gh', ['api', `repos/${owner}/${name}`, '--jq', '{id: .id, fullName: .full_name}'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    })
-    const parsed = JSON.parse(out)
-    if (!parsed?.id) return null
-    return { id: String(parsed.id), fullName: lower(parsed.fullName), currentName: lower(String(parsed.fullName).split('/').pop()) }
-  } catch {
-    return null
-  }
-}
-
-const defaultLookups = { github: githubLookup }
-
 /**
  * Resolve a clone's stable identity.
  *

package/src/projection/obsidian/contracts.mjs

@@ -404,7 +404,7 @@ export function cutName(value, maxBytes) {
 
 // One file or folder name made safe for macOS, Linux, Windows and Obsidian
 // links, or '' when nothing is left of it. The author's casing and words are
-// kept; see "File names" in docs/obsidian-contract.md for each rule.
+// kept; see "File names" in docs/reference/obsidian-contract.md for each rule.
 export function vaultName(value, maxBytes = NAME_BYTES) {
   const cleaned = trimName(String(value ?? '')
     .toWellFormed()

package/src/projection/obsidian/materialize/path-registry.mjs

@@ -7,7 +7,7 @@ import { refuse } from './byte-lens.mjs'
 
 export { collisionKey }
 
-// Vault paths of layout 2 (see "Vault layout" in docs/obsidian-contract.md):
+// Vault paths of layout 2 (see "Vault layout" in docs/reference/obsidian-contract.md):
 //
 //   <repository folder>/<source directory>/<title>.md           a Markdown note
 //   <repository folder>/<source directory>/<file name>          a wrapped file

package/src/projection/obsidian/materialize/prepare-view.mjs

@@ -75,7 +75,7 @@ import { isUserOwnedSettingsPath, prepareSettings } from './settings.mjs'
 //
 // A view is laid out in vault layout 2: folders mirror the repository, the
 // file name is the note's title and each note names its identity in generated
-// front-matter properties (see "Vault layout" in docs/obsidian-contract.md).
+// front-matter properties (see "Vault layout" in docs/reference/obsidian-contract.md).
 // Layout 1, the earlier release's, is kept for a view whose prior generation
 // is in layout 1 and holds a note with an open edit, and for recovering a
 // layout 1 generation as it was published.

package/src/projection/obsidian/materialize/redaction.mjs

@@ -5,7 +5,7 @@ import { refuse } from './byte-lens.mjs'
 // judges the assembled result, every note included, whether the note was
 // emitted on this call or reused from the preparation cache, and refuses the
 // view with `redaction-failure`, naming the in-view note (or file) and the
-// rule, never the value. See "The redaction guard" in docs/obsidian-contract.md.
+// rule, never the value. See "The redaction guard" in docs/reference/obsidian-contract.md.
 //
 //   allow-list  every path the emitter wrote (note and attachment paths,
 //               rewritten link and embed targets, link targets in generated

package/src/projection/obsidian/personal-workspace.mjs

@@ -2,11 +2,12 @@ import { createHash } from 'node:crypto'
 import fs from 'node:fs'
 import path from 'node:path'
 import { Worker, isMainThread, parentPort, workerData } from 'node:worker_threads'
-import { PersonalWorkspaceRefusal, composePersonalWorkspace, readPersonalSelectionHead } from '@mnstry/atelier/personal-workspace'
+import { PersonalWorkspaceRefusal, composePersonalWorkspace } from '@mnstry/atelier/personal-workspace'
 import { ensureLocalState, resolveProjectConfig, validateProjectConfigDoc } from '@mnstry/atelier/project'
 import { buildCanonicalGraph } from '../../graph/graph.mjs'
 import { ObsidianMaintenanceRefusal, refuse } from '../../runtime/obsidian/errors.mjs'
 import { OBSIDIAN_EXT_KEY } from './contracts.mjs'
+import { readPersonalSelectionSnapshot } from '../../personal-workspace/selection.mjs'
 
 // The one personal-workspace route of the Obsidian projection.
 //
@@ -411,22 +412,17 @@ export async function validatePersonalWorkspace(project) {
 
 const selectionRecord = ({ personalHome }, sequence) => path.join(personalHome, 'selections', `${String(sequence).padStart(6, '0')}.json`)
 
-// The highest record number this process has read each home's selection history ending at, at any read of it: a
-// loader's first read, its read-again, the recheck of a pinned project, and the read the engine's guard asks for when
-// it stops a view (notePersonalSelectionNow). Kept in the main thread: no composition worker reads the history's end,
-// and one that did would have a map of its own and escape the rule.
+// The most recently accepted head observed in this process. Durable continuity is checked by the loader's note
+// callback before this index changes. The index only tells an engine when another reader requires it to reload.
 const READ_UP_TO = new Map()
 
-// Notes where a home's selection history ends, as just read, and answers that head. Selections are only ever appended,
-// so a history that ends at an earlier record than this process has read it ending at was cut short by something other
-// than a confirmation. It refuses `selection-history-shortened` at every read, the read-again and the recheck of a
-// project already loaded included, while it is shorter. Only the number is kept, and only in this process: a record in
-// a place already read, with other content, is read as a confirmation, and a process started after the cut reads the
-// history as it then stands. `refusesShortened: false` is a test seam only, the rule's mutation control.
-export function notePersonalSelectionHead(personalHome, head, { refusesShortened = true } = {}) {
-  const before = READ_UP_TO.get(personalHome) ?? 0
-  if (head.sequence > before) READ_UP_TO.set(personalHome, head.sequence)
-  else if (refusesShortened && head.sequence < before) refuse('selection-history-shortened', 'the selection history of the personal workspace ends at an earlier record than this process has read it ending at; nothing is used from it while it is shorter', { source: 'personal-workspace' })
+export function notePersonalSelectionHead(personalHome, head, { refusesShortened = true, note = null } = {}) {
+  if (note !== null) note(head)
+  else {
+    const before = READ_UP_TO.get(personalHome)?.sequence ?? 0
+    if (refusesShortened && head.sequence < before) refuse('selection-history-shortened', 'the selection history of the personal workspace ends at an earlier record than this process has read; nothing is used from it', { source: 'personal-workspace' })
+  }
+  if (refusesShortened) READ_UP_TO.set(personalHome, { sequence: head.sequence, head: head.head })
   return head
 }
 
@@ -435,8 +431,8 @@ export function notePersonalSelectionHead(personalHome, head, { refusesShortened
 // appended to the history, or a history cut short, is a change. And every time the composition is asked again
 // (validatePersonalWorkspace) the history is read again and must still end with that record. `observe: false`,
 // `recheck: false` and `refusesShortened: false` are test seams only, the mutation controls of each.
-export function pinPersonalSelection(project, { sequence, head }, { observe = true, recheck = true, refusesShortened = true } = {}) {
-  SELECTED.set(personalWorkspaceBindingOf(project), Object.freeze({ sequence, head, observe, recheck, refusesShortened }))
+export function pinPersonalSelection(project, { sequence, head }, { observe = true, recheck = true, refusesShortened = true, note = null } = {}) {
+  SELECTED.set(personalWorkspaceBindingOf(project), Object.freeze({ sequence, head, observe, recheck, refusesShortened, note }))
   return project
 }
 
@@ -449,25 +445,23 @@ export function personalSelectionOf(project) {
 
 // Refuses `personal-selection-changed` unless the history still ends with the record this project is pinned to; a
 // history that cannot be read refuses with the module's own code. What is read is noted first
-// (notePersonalSelectionHead): a later record seen here counts from then on, and a history shorter than this process
-// has read refuses `selection-history-shortened`, also when it ends with the pinned record. Nothing for a project that
-// is not pinned.
+// (notePersonalSelectionHead): the same durable continuity rule applies to this read, before its head is compared
+// with the pin. Nothing for a project that is not pinned.
 export function assertPersonalSelection(project) {
   const pinned = personalSelectionOf(project)
   if (pinned === null) return
   let now
-  try { now = readPersonalSelectionHead({ personalHome: pinned.personalHome }) } catch (error) { asMaintenanceRefusal(error, 'the selection history of the personal workspace could not be read; nothing is used from it') }
+  try { now = readPersonalSelectionSnapshot({ personalHome: pinned.personalHome }) } catch (error) { asMaintenanceRefusal(error, 'the selection history of the personal workspace could not be read; nothing is used from it') }
   notePersonalSelectionHead(pinned.personalHome, now, SELECTED.get(personalWorkspaceBindingOf(project)))
   if (now.sequence !== pinned.sequence || now.head !== pinned.head) refuse('personal-selection-changed', 'the confirmed selection of the personal workspace is no longer the one this project was loaded under; nothing is used from it', { source: 'personal-workspace' })
 }
 
-// Whether this process has read a pinned project's selection history ending at a later record than the one the
-// project is pinned to: a confirmation since, or a history that was longer and is cut short now. Either way the project
-// is not the one to publish under any more, and is loaded again: the load follows the confirmation, or refuses the
-// shortened history. In memory, with no read. False for a project that is not pinned.
+// Whether another reader in this process accepted a head different from the pin: a later confirmation or a newly
+// confirmed shorter history. In memory, with no read. False for a project that is not pinned.
 export function personalSelectionBehind(project) {
   const pinned = personalSelectionOf(project)
-  return pinned !== null && (READ_UP_TO.get(pinned.personalHome) ?? 0) > pinned.sequence
+  const latest = pinned === null ? null : READ_UP_TO.get(pinned.personalHome)
+  return latest !== undefined && latest !== null && (latest.sequence !== pinned.sequence || latest.head !== pinned.head)
 }
 
 // Reads where the history of a pinned project's home ends now, for the note alone: what the read refuses is not this
@@ -498,10 +492,12 @@ export function personalOverlayRepoOf(project) {
 }
 
 // Settings that a personal binding takes from the overlay or does not have yet. A saved view is authored in the
-// overlay, so `view add` would write a module-owned generation file; who may see and where vaults live wait for a
-// stable per-person projection configuration. Refused before anything is resolved or written.
+// overlay, so `view add` would write a module-owned generation file. The machine records an owner-only audience or
+// an explicit clear. Custom audiences refuse; vault location remains unavailable for this binding.
 export function refuseOnPersonalBinding(project, operation) {
   if (personalWorkspaceBindingOf(project) === null) return
+  if (operation === 'audience set me' || operation === 'audience clear') return
+  if (operation.startsWith('audience ')) refuse('personal-binding-owner-only', 'a personal workspace vault is owner only; use `audience set me` or `audience clear`', { operation })
   if (operation === 'view add') refuse('views-from-personal-overlay', 'the views of a personal workspace come from its overlay; nothing was written', { operation })
   refuse('personal-binding-decision-unavailable', `${operation} is not available for a personal workspace yet; nothing was written`, { operation })
 }

package/src/projection/obsidian/plugin-bridge/channel.mjs

@@ -38,7 +38,7 @@ import { createHmac } from 'node:crypto'
 // and the exact bytes of the answer. A handshake is used once and lapses after
 // five seconds, a session after fifteen minutes. Nothing here takes a path to
 // act on, a command or code, and every command maps to state the service
-// already keeps (see docs/obsidian-plugin.md).
+// already keeps (see docs/reference/obsidian-plugin.md).
 //
 // The plugin cannot import this module: it runs inside the app, from the
 // vault. It carries the same constants and the same computations, and the test

package/src/projection/obsidian/publication/publisher.mjs

@@ -16,6 +16,10 @@ import { probeExchange } from './exchange.mjs'
 import { CRASH_INJECTION_TEST_SEAM } from './test-seam.mjs'
 import { createDirectAdapter } from './transport.mjs'
 
+// The caller's private-state location refusals: once the state root may lie in a declared repository, no further
+// entry is written there.
+const isLocationRefusal = (error) => /^managed-root-|^repository-inside-managed-root$/.test(String(error?.code ?? ''))
+
 // publishView: conditional publication of one prepared view into an editable
 // vault. The order is the contract's:
 //
@@ -380,6 +384,9 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
 
   const budget = createCooperativeBudget(options.scheduling)
   budget.check()
+  // The caller's guard alone, not the cancellation signal: a cancelled publication still records its failure, and so
+  // does one the guard stops for another reason (a changed selection or settings). Only a location refusal suppresses it.
+  const locationStillProven = () => { try { options.scheduling?.guard?.(); return true } catch (error) { return !isLocationRefusal(error) } }
   const releases = []
   let journal = null
   try {
@@ -426,9 +433,11 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     // Path selection. An app with this vault open in several windows is refused as such: publishing through one of
     // them would leave the others uncoordinated.
     const probe = await adapter.probe({ vaultRoot: store.vaultRoot })
+    budget.check()
     store.checkAllocatedVault?.()
     const unheld = probe.state !== 'coordinated' && probe.state !== 'absent' && await unheldPathApplies({ probe, pointer, store, unheldEvidence, platform })
-    // The evidence took time to read: the folder is checked again.
+    // The evidence took time to read: the location and the folder are checked again.
+    budget.check()
     if (unheld) store.checkAllocatedVault?.()
     if (probe.state !== 'coordinated' && probe.state !== 'absent' && !unheld) refuse(probe.code === 'vault-open-in-several-windows' ? probe.code : 'editor-uncoordinated', `an Obsidian process may have this vault open and cannot be coordinated with: ${probe.reason}`)
     const mode = probe.state === 'coordinated' ? 'in-app' : unheld ? 'direct-unheld' : 'direct'
@@ -517,10 +526,14 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     store.checkAllocatedVault?.()
     crash('after-staging')
 
-    const context = { store, journal, journalId, channel, clock, crash, mode, rules }
+    // `check` runs the caller's guard: every wait for the app resumes through it before the next recovery, journal or
+    // vault write.
+    const context = { store, journal, journalId, channel, clock, crash, mode, rules, check: () => budget.check() }
     const results = []
     // Kept notes are compared first, several at a time; one that holds exactly its candidate bytes is unchanged.
     const unchanged = await unchangedKeepUnits(units, store)
+    // The comparison read the disk: the location is proven again before any unit's recovery, journal or vault write.
+    budget.check()
     // The direct path has no editor coordination, so it is only right while no
     // Obsidian runs. Staging takes time and an app may have started since path
     // selection: the process table is read again immediately before the first
@@ -537,11 +550,14 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
       if (mode === 'direct' && (lastProbe === null || Date.now() - lastProbe > 2000)) {
         lastProbe = Date.now()
         const again = await adapter.probe({ vaultRoot: store.vaultRoot })
+        budget.check()
         if (again.state !== 'absent') context.uncoordinated = again.reason
       }
       if (mode === 'direct-unheld' && !context.uncoordinated && (lastProbe === null || Date.now() - lastProbe > 2000)) {
         lastProbe = Date.now()
-        if (!(await readsUnlisted(unheldEvidence, store))) context.uncoordinated = 'the vault list of the app no longer shows, positively, that no Obsidian lists this vault'
+        const listed = await readsUnlisted(unheldEvidence, store)
+        budget.check()
+        if (!listed) context.uncoordinated = 'the vault list of the app no longer shows, positively, that no Obsidian lists this vault'
       }
       store.checkAllocatedVault?.()
       if (unit.op === 'keep' && unchanged.has(unit.path)) {
@@ -569,6 +585,7 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
 
     // Quiet period, then look at the displaced files again.
     if (quietPeriodMs > 0 && results.some((result) => result.recoveryRef)) await sleep(quietPeriodMs)
+    budget.check()
     const lateWriters = recheckDisplacedFiles({ store, journalIds: [journalId], clock })
     for (const finding of lateWriters.filter((item) => item.code === 'late-writer-captured')) {
       journal.append({ step: 'verify', outcome: 'conflict', state: 'verifying', notePath: finding.notePath, beforeDigest: finding.digestAtMove, afterDigest: finding.observedDigest, recoveryRef: finding.displacedRef,
@@ -595,7 +612,9 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     return { ...base, state: 'committed', lateWriters }
   } catch (error) {
     if (!(error instanceof PublicationRefusal)) {
-      if (journal) try { journal.append({ step: 'verify', outcome: 'failed', state: 'failed', detail: { code: rules.journalFailureCode(error), message: String(error.code ?? error.message).slice(0, 200) } }) } catch { /* the journal itself cannot be written */ }
+      // A private-state location refusal records nothing more there, a failure entry included, and neither does a
+      // failure that leaves the location unproven now (a rejected wait for the app). Locks are still released.
+      if (journal && !isLocationRefusal(error) && locationStillProven()) try { journal.append({ step: 'verify', outcome: 'failed', state: 'failed', detail: { code: rules.journalFailureCode(error), message: String(error.code ?? error.message).slice(0, 200) } }) } catch { /* the journal itself cannot be written */ }
       throw error
     }
     return { state: 'refused', refusal: { code: error.code, message: error.message, detail: error.detail }, notes: [], retainedEdits: [], lateWriters: [] }
@@ -772,6 +791,7 @@ async function publishOneUnit(unit, context) {
   }
   const baseObject = observe(current)
   const inspected = await context.channel.inspect({ vaultRoot: store.vaultRoot, path: unit.path })
+  context.check?.()
   if (inspected.status !== 'inspected') {
     capture('failed', inspected.status, { beforeDigest: currentDigest })
     if (plan.stagedPath) retire(plan, context)
@@ -790,6 +810,7 @@ async function publishOneUnit(unit, context) {
     ? { op: 'publish', mode: 'remove', vaultRoot: store.vaultRoot, path: unit.path, operationId, baseSha256: hex(plan.baseDigest), recoveryPath: displaced }
     : { op: 'publish', mode: 'replace', vaultRoot: store.vaultRoot, path: unit.path, operationId, baseSha256: hex(plan.baseDigest), candidateSha256: hex(plan.candidateDigest), stagedPath: plan.stagedPath, recoveryPath: displaced })
   context.crash('after-publish')
+  context.check?.()
 
   if (reply.status === 'published' || reply.status === 'published-external-captured' || reply.status === 'removed' || reply.status === 'removed-external-captured') {
     syncPrivateDirectory(path.dirname(displaced))

package/src/projection/project.mjs

@@ -3,6 +3,7 @@ import { isDeepStrictEqual } from 'node:util'
 import path from 'node:path'
 import { commandProject, readJson, writeJson } from '../project/config.mjs'
 import { summarizeReadinessJourney } from '../readiness-protocols/runtime.mjs'
+import { bundledReadinessEnabled } from '../readiness-protocols/bundled-selection.mjs'
 import { atelierControlStyles } from '../ui/control-system.mjs'
 
 const esc = (value) => String(value ?? '').replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;')
@@ -45,11 +46,12 @@ function resolveDistributionBranding(project) {
 }
 
 export function buildProjectProjection(project) {
+  const includeBundled = bundledReadinessEnabled(project)
   const graph = readJson(project.graphPath)
   const branding = resolveDistributionBranding(project)
-  const readinessJourney = summarizeReadinessJourney(project)
+  const readinessJourney = includeBundled ? summarizeReadinessJourney(project) : null
   const output = path.join(project.outputRoot, 'index.html')
-  const dimensionCards = readinessJourney.dimensions.map((item) => `<article class="readiness-card" data-protocol="${esc(item.protocolId)}">
+  const dimensionCards = (readinessJourney?.dimensions ?? []).map((item) => `<article class="readiness-card" data-protocol="${esc(item.protocolId)}">
     <p class="eyebrow">${esc(item.label)}</p>
     <h3>${esc(item.title)}</h3>
     <p><strong>${esc(item.status)}</strong> · ${esc(item.score)} / 100 answers complete</p>
@@ -90,7 +92,7 @@ ${branding.themeCss}</style>
 <p class="eyebrow">${esc(branding.name)} · ${esc(branding.eyebrow)}</p>
 <h1>${esc(project.config.name || 'Project Workspace')}</h1>
 <p>${graph.counts.nodes} graph nodes · ${graph.counts.edges} graph edges · ${graph.counts.diagnostics} diagnostics</p>
-<section class="readiness" aria-labelledby="tenant-readiness-title">
+${readinessJourney ? `<section class="readiness" aria-labelledby="tenant-readiness-title">
   <div class="readiness-head">
     <div>
       <p class="eyebrow">MNSTRY Tenant Readiness</p>
@@ -101,7 +103,7 @@ ${branding.themeCss}</style>
     <div class="readiness-score">${esc(readinessJourney.score)}%</div>
   </div>
   <div class="readiness-grid">${dimensionCards}</div>
-</section>
+</section>` : ''}
 <section class="grid">${cards}</section>
 <script>
 document.addEventListener('click', async (event) => {
@@ -126,16 +128,18 @@ export function buildProjectManifest(project, projection) {
     generatedAt: 'deterministic',
     graphPath: path.relative(project.outputRoot, project.graphPath).split(path.sep).join('/'),
     entry: 'index.html',
-    tenantReadiness: {
-      score: projection.readinessJourney.score,
-      ready: projection.readinessJourney.ready,
-      dimensions: projection.readinessJourney.dimensions.map((item) => ({
-        key: item.key,
-        protocolId: item.protocolId,
-        status: item.status,
-        score: item.score,
-      })),
-    },
+    ...(projection.readinessJourney ? {
+      tenantReadiness: {
+        score: projection.readinessJourney.score,
+        ready: projection.readinessJourney.ready,
+        dimensions: projection.readinessJourney.dimensions.map((item) => ({
+          key: item.key,
+          protocolId: item.protocolId,
+          status: item.status,
+          score: item.score,
+        })),
+      },
+    } : {}),
     nodes: projection.graph.nodes.map((node) => ({ id: node.id, title: node.title, audience: node.audience, path: node.path })),
   }
 }