@noopolis/daimon 0.2.0 → 0.2.1

package/dist/runtime/taskClock.js

@@ -0,0 +1,102 @@
+export const TASK_CLOCK_ENV = "NOOPOLIS_TASK_CLOCK";
+export const TASK_CLOCK_VERSION = "noopolis.task-clock.v1";
+export const TASK_CLOCK_MIN_MS = 0;
+export const TASK_CLOCK_MAX_MS = 253_402_300_799_999;
+export function validTaskInstant(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= TASK_CLOCK_MIN_MS && value <= TASK_CLOCK_MAX_MS;
+}
+export function assertTaskInstant(value) {
+    if (!validTaskInstant(value))
+        throw invalid("task instant must be within 1970-01-01T00:00:00.000Z .. 9999-12-31T23:59:59.999Z");
+    return value;
+}
+/** Environment-only contract: no clock callbacks or compiler config in the public API. */
+export function readTaskClock(environment = process.env) {
+    return parseTaskClock(environment[TASK_CLOCK_ENV]);
+}
+export function parseTaskClock(raw) {
+    if (raw === undefined)
+        return undefined;
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw invalid("must be valid JSON");
+    }
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw invalid("must be an object");
+    const fields = value;
+    if (Object.keys(fields).sort().join() !== "anchorEpochMs,origin,version")
+        throw invalid("requires exactly version, origin, anchorEpochMs (no unknown fields)");
+    if (fields.version !== TASK_CLOCK_VERSION)
+        throw invalid(`version must be ${TASK_CLOCK_VERSION}`);
+    if (typeof fields.origin !== "string" || !validInstant(fields.origin))
+        throw invalid("origin must be a valid ISO-8601 instant with Z or an explicit offset");
+    if (typeof fields.anchorEpochMs !== "number" || !Number.isSafeInteger(fields.anchorEpochMs))
+        throw invalid("anchorEpochMs must be a safe integer");
+    const origin = fields.origin, anchorEpochMs = fields.anchorEpochMs, originMs = Date.parse(origin);
+    assertTaskInstant(originMs);
+    const at = (realEpochMs) => assertTaskInstant(originMs + (realEpochMs - anchorEpochMs));
+    return Object.freeze({ raw, origin, anchorEpochMs, at, now: () => at(Date.now()) });
+}
+/** The caller installs libfaketime; Daimon derives one process-independent offset. */
+export function taskClockChildEnvironment(declared = {}, clock = readTaskClock(), environment = process.env) {
+    if (clock === undefined)
+        return {};
+    for (const name of Object.keys(declared)) {
+        if (declared[name] !== undefined && clockVariable(name))
+            throw invalid(`declared child environment conflicts with ${name}`);
+    }
+    // Integer arithmetic keeps every millisecond even at the safe-integer anchor limits.
+    const offset = BigInt(Date.parse(clock.origin)) - BigInt(clock.anchorEpochMs);
+    const magnitude = offset < 0n ? -offset : offset;
+    const fraction = magnitude % 1000n;
+    const seconds = `${offset < 0n ? "-" : "+"}${magnitude / 1000n}${fraction === 0n ? "" : `.${String(fraction).padStart(3, "0")}`}`;
+    const preload = taskClockPreload(environment.LD_PRELOAD);
+    if (preload === undefined)
+        throw invalid("process clock startup probe requires caller-provided LD_PRELOAD naming libfaketime*.so*; refusing clocked execution");
+    return {
+        // The child process clock owns the offset; Mneme and nested consumers use Date.now().
+        // libfaketime's relative format defaults to seconds; an `s` suffix is not supported.
+        FAKETIME: seconds,
+        FAKETIME_DONT_FAKE_MONOTONIC: "1",
+        // libfaketime parses decimal fractions using the process locale.
+        LC_ALL: "C",
+        LD_PRELOAD: preload
+    };
+}
+/** Inherited environments must not reintroduce another offset owner or loader controls. */
+export function taskClockProcessEnvironment(inherited, derived = taskClockChildEnvironment()) {
+    if (Object.keys(derived).length === 0)
+        return inherited;
+    return { ...Object.fromEntries(Object.entries(inherited).filter(([name]) => !clockVariable(name))), ...derived };
+}
+function clockVariable(name) {
+    return /^(?:LD_PRELOAD$|DYLD_|FAKETIME|NOOPOLIS_TASK_CLOCK$|MNEME_CLOCK_)/u.test(name);
+}
+/** Provider/auth/control processes must never inherit the agent's process clock. */
+export function realTimeProcessEnvironment(inherited) {
+    if (readTaskClock() === undefined)
+        return inherited;
+    return Object.fromEntries(Object.entries(inherited).filter(([name]) => !clockVariable(name)));
+}
+/** Reject mixed loader lists: unrelated libraries must never ride this exception. */
+export function taskClockPreload(value) {
+    const libraries = value?.split(/[\s:]+/u).filter(Boolean);
+    return libraries?.length && libraries.every((library) => /^libfaketime[^/]*\.so[^/]*$/u.test(library.split("/").at(-1))) ? value : undefined;
+}
+/** Project real delivery/receipt timestamps, never historical dates inside tool payloads. */
+export function taskClockTimestamp(realTimestamp, clock = readTaskClock()) {
+    return clock === undefined ? realTimestamp : new Date(clock.at(Date.parse(realTimestamp))).toISOString();
+}
+function invalid(reason) { return new Error(`${TASK_CLOCK_ENV}: ${reason}`); }
+function validInstant(value) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})T([01]\d|2[0-3]):([0-5]\d):([0-5]\d)(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):?[0-5]\d)$/u.exec(value);
+    if (match === null || !Number.isFinite(Date.parse(value)))
+        return false;
+    const year = Number(match[1]), month = Number(match[2]), day = Number(match[3]);
+    const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    return month >= 1 && month <= 12 && day >= 1 && day <= days[month - 1];
+}

package/dist/runtime/taskClockProcess.d.ts

@@ -0,0 +1,17 @@
+import childProcess from "node:child_process";
+import { type TaskClock } from "./taskClock.js";
+export type { ChildProcess } from "node:child_process";
+/** @internal Synchronous injection seam; never runtime configuration. */
+export type TaskClockProcessProbe = (command: string, args: readonly string[], environment: NodeJS.ProcessEnv) => string;
+/** @internal Isolate simulated probes between tests. */
+export declare function resetTaskClockProcessForTest(): void;
+/** Shared child-launch boundary, including SDK transports and Pi's spawn hook.
+ * Keep the synchronous spawn API: only the first launch blocks for the bounded probes.
+ * Every launch derives a fresh environment; only successful interposition is memoized.
+ */
+export declare function readyTaskClockEnvironment(environment: NodeJS.ProcessEnv, clock?: TaskClock | undefined, probe?: TaskClockProcessProbe): NodeJS.ProcessEnv;
+/** Only agent-facing tool/server children cross the shifted readiness gate. */
+export declare const spawn: typeof childProcess.spawn;
+/** Engine CLIs and operational helpers stay real; no libfaketime probe runs here. */
+export declare const spawnRealTime: typeof childProcess.spawn;
+//# sourceMappingURL=taskClockProcess.d.ts.map

package/dist/runtime/taskClockProcess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taskClockProcess.d.ts","sourceRoot":"","sources":["../../src/runtime/taskClockProcess.ts"],"names":[],"mappings":"AAAA,OAAO,YAAmC,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAqG,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEnJ,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC;AAGzH,wDAAwD;AACxD,wBAAgB,4BAA4B,IAAI,IAAI,CAAsB;AAS1E;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,GAAE,SAAS,GAAG,SAA2B,EAAE,KAAK,GAAE,qBAAiC,GACvH,MAAM,CAAC,UAAU,CAyBnB;AAED,+EAA+E;AAC/E,eAAO,MAAM,KAAK,EAAE,OAAO,YAAY,CAAC,KAIT,CAAC;AAEhC,qFAAqF;AACrF,eAAO,MAAM,aAAa,EAAE,OAAO,YAAY,CAAC,KAIjB,CAAC"}

package/dist/runtime/taskClockProcess.js

@@ -0,0 +1,58 @@
+import childProcess from "node:child_process";
+import { readTaskClock, realTimeProcessEnvironment, taskClockChildEnvironment, taskClockProcessEnvironment } from "./taskClock.js";
+const verified = new Set();
+/** @internal Isolate simulated probes between tests. */
+export function resetTaskClockProcessForTest() { verified.clear(); }
+const dateProbe = (command, args, env) => {
+    const result = childProcess.spawnSync(command, [...args], { env, encoding: "utf8", timeout: 5000, killSignal: "SIGKILL", maxBuffer: 1024 });
+    // Loaders can ignore a missing library and still exit zero, including at zero offset.
+    if (result.error || result.status !== 0 || result.stderr?.trim())
+        throw result.error ?? new Error("date/libfaketime emitted a startup diagnostic");
+    return result.stdout;
+};
+/** Shared child-launch boundary, including SDK transports and Pi's spawn hook.
+ * Keep the synchronous spawn API: only the first launch blocks for the bounded probes.
+ * Every launch derives a fresh environment; only successful interposition is memoized.
+ */
+export function readyTaskClockEnvironment(environment, clock = readTaskClock(), probe = dateProbe) {
+    if (clock === undefined)
+        return environment;
+    const refuse = (reason) => new Error(`NOOPOLIS_TASK_CLOCK: process clock startup probe ${reason}; refusing clocked execution`);
+    if (process.platform !== "linux")
+        throw refuse("requires Linux libfaketime interposition");
+    const derived = taskClockChildEnvironment({}, clock);
+    const env = taskClockProcessEnvironment(environment, derived);
+    clock.now(); // A cached process clock never permits reads outside the supported calendar.
+    const key = JSON.stringify([process.pid, process.platform, derived.LD_PRELOAD, derived.FAKETIME]);
+    if (verified.has(key))
+        return env;
+    for (const sentinel of [true, false]) {
+        let output;
+        try {
+            // Absolute path: engine-specific PATHs need not contain system utilities.
+            output = probe("/bin/date", ["-u", "+%s"], sentinel ? { ...env, FAKETIME: "-31536000" } : env);
+        }
+        catch (cause) {
+            throw new Error(refuse("could not run date -u +%s (date/libfaketime missing or unusable)").message, { cause });
+        }
+        const seconds = Number(output.trim());
+        const expected = sentinel ? Date.now() - 31_536_000_000 : clock.now();
+        if (!/^-?\d+$/u.test(output.trim()) || !Number.isSafeInteger(seconds) || Math.abs(seconds * 1000 - expected) > 5000) {
+            throw refuse(`did not observe ${sentinel ? "sentinel offset" : "task time"} within ±5 seconds (check libfaketime and its offset)`);
+        }
+    }
+    verified.add(key);
+    return env;
+}
+/** Only agent-facing tool/server children cross the shifted readiness gate. */
+export const spawn = ((command, args, options) => {
+    const argv = Array.isArray(args) ? args : [];
+    const settings = (Array.isArray(args) ? options : args ?? options);
+    return childProcess.spawn(command, argv, { ...settings, env: readyTaskClockEnvironment(settings?.env ?? process.env) });
+});
+/** Engine CLIs and operational helpers stay real; no libfaketime probe runs here. */
+export const spawnRealTime = ((command, args, options) => {
+    const argv = Array.isArray(args) ? args : [];
+    const settings = (Array.isArray(args) ? options : args ?? options);
+    return childProcess.spawn(command, argv, { ...settings, env: realTimeProcessEnvironment(settings?.env ?? process.env) });
+});

package/dist/runtime/turnRequestLedger.d.ts

@@ -123,11 +123,6 @@ export type GrokTurnRequestEntry = Readonly<{
  * field is not.
  */
 export declare const renderGrokTurnRequestLines: (entry: GrokTurnRequestEntry) => string;
-/**
- * Append already-rendered, newline-terminated ledger lines in one write, with the
- * same rotation and file mode as both ledgers. Advisory: never rejects. The
- * broker uses it to append the exact bytes it sealed into a turn record.
- */
 export declare const recordLedgerLines: (file: string, lines: string) => Promise<boolean>;
 /** Advisory and never rejects, like {@link recordTurnRequests}; an empty turn writes nothing. */
 export declare const recordGrokTurnRequests: (file: string, entry: GrokTurnRequestEntry) => Promise<boolean>;

package/dist/runtime/turnRequestLedger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"turnRequestLedger.d.ts","sourceRoot":"","sources":["../../src/runtime/turnRequestLedger.ts"],"names":[],"mappings":"AAGA,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B,EAAG,kCAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAG,kCAA2C,CAAC;AAExF,eAAO,MAAM,4BAA4B,GAAI,cAAa,MAAM,CAAC,UAAwB,KAAG,MAG3F,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAIH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,gBAAgB,KAAG,MAqBhE,CAAC;AASF,0FAA0F;AAC1F;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACvQ;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/M;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,oBAAoB,KAAG,MAuBxE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAU,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,OAAO,CAGpF,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,GAAU,MAAM,MAAM,EAAE,OAAO,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAGvG,CAAC;AA4BF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAU,MAAM,MAAM,EAAE,OAAO,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAU/F,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GAAU,OAAO,QAAQ,CAAC;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,KAAG,OAAO,CAAC,OAAO,CAiBnB,CAAC"}
+{"version":3,"file":"turnRequestLedger.d.ts","sourceRoot":"","sources":["../../src/runtime/turnRequestLedger.ts"],"names":[],"mappings":"AAIA,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B,EAAG,kCAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAG,kCAA2C,CAAC;AAExF,eAAO,MAAM,4BAA4B,GAAI,cAAa,MAAM,CAAC,UAAwB,KAAG,MAG3F,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAIH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,gBAAgB,KAAG,MAqBhE,CAAC;AASF,0FAA0F;AAC1F;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACvQ;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/M;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,oBAAoB,KAAG,MAuBxE,CAAC;AASF,eAAO,MAAM,iBAAiB,GAAU,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,OAAO,CAWpF,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,GAAU,MAAM,MAAM,EAAE,OAAO,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAGvG,CAAC;AAoBF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAU,MAAM,MAAM,EAAE,OAAO,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAQ/F,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GAAU,OAAO,QAAQ,CAAC;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,KAAG,OAAO,CAAC,OAAO,CAiBnB,CAAC"}

package/dist/runtime/turnRequestLedger.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { constants } from "node:fs";
 import { open, rename, stat } from "node:fs/promises";
 import { readCodexRolloutRequests } from "../pi/codexRolloutUsage.js";
@@ -138,16 +139,29 @@ export const renderGrokTurnRequestLines = (entry) => {
  * same rotation and file mode as both ledgers. Advisory: never rejects. The
  * broker uses it to append the exact bytes it sealed into a turn record.
  */
+const ledgerWrites = new Map();
 export const recordLedgerLines = async (file, lines) => {
     if (lines.length === 0)
         return false;
+    const key = path.resolve(file);
+    const previous = ledgerWrites.get(key) ?? Promise.resolve(true);
+    const pending = previous.then(async () => {
+        try {
+            await rotate(key);
+            await appendLines(key, lines);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+    ledgerWrites.set(key, pending);
     try {
-        await rotate(file);
-        await appendLines(file, lines);
-        return true;
+        return await pending;
     }
-    catch {
-        return false;
+    finally {
+        if (ledgerWrites.get(key) === pending)
+            ledgerWrites.delete(key);
     }
 };
 /** Advisory and never rejects, like {@link recordTurnRequests}; an empty turn writes nothing. */
@@ -155,9 +169,7 @@ export const recordGrokTurnRequests = async (file, entry) => {
     if (entry.requests.length === 0)
         return false;
     try {
-        await rotate(file);
-        await appendLines(file, renderGrokTurnRequestLines(entry));
-        return true;
+        return await recordLedgerLines(file, renderGrokTurnRequestLines(entry));
     }
     catch {
         return false;
@@ -174,16 +186,8 @@ const rotate = async (file) => {
     if (size >= TURN_USAGE_ROTATE_BYTES)
         await rename(file, `${file}.1`);
 };
-/**
- * One `write(2)` for the whole wake's rows.
- *
- * Turns for different agents run concurrently inside the single broker process.
- * `O_APPEND` makes a single sub-page write atomic against them, so a wake's rows
- * are contiguous and never interleaved with another wake's — which matters more
- * here than in the per-wake ledger, because a row only means something beside
- * the other rows of its own thread. A wake with enough requests to exceed a page
- * is still append-ordered per line; interleaving would cost grouping, not
- * correctness, since every row carries its own thread id.
+/** Rotation and all writes are serialized per canonical path in this broker process.
+ * The realm lease excludes another broker. Independent paths remain concurrent.
  */
 const appendLines = async (file, lines) => {
     const bytes = Buffer.from(lines, "utf8");
@@ -209,9 +213,7 @@ export const recordTurnRequests = async (file, entry) => {
     if (entry.requests.length === 0)
         return false;
     try {
-        await rotate(file);
-        await appendLines(file, renderTurnRequestLines(entry));
-        return true;
+        return await recordLedgerLines(file, renderTurnRequestLines(entry));
     }
     catch {
         /* advisory: instrumentation never fails a wake that published */

package/dist/runtime/wakeAcceptanceClaimDiagnostics.d.ts

@@ -0,0 +1,34 @@
+import type { WakeExecutionClaim } from "./wakeAcceptanceStore.js";
+import { type TransitionLock } from "./wakeAcceptanceProcessIdentity.js";
+type Identity = WakeExecutionClaim | TransitionLock | string | null;
+export type WakeClaimFailure = Readonly<{
+    step: string;
+    assertion: string;
+    acceptance_id: string;
+    expected: Identity;
+    current: Identity;
+    lock?: TransitionLock | null;
+}>;
+export declare class WakeExecutionClaimLostError extends Error {
+    readonly detail?: WakeClaimFailure | undefined;
+    constructor(detail?: WakeClaimFailure | undefined, cause?: unknown);
+}
+export declare class WakeTransitionLockContentionError extends WakeExecutionClaimLostError {
+    constructor(detail: WakeClaimFailure);
+}
+type LockWaitTiming = Readonly<{
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+}>;
+/**
+ * Only an occupied lock is retried; claim mismatches and I/O failures are not.
+ * The 250 ms budget bounds attempt starts and requested sleeps. Filesystem I/O
+ * is not cancellable, so an admitted acquisition can finish after the deadline.
+ * Keep that lock: callers revalidate the claim before writing and release the
+ * lock in finally, so late acquisition cannot authorize a stale claim.
+ */
+export declare function waitForClaimTransitionLock(acquire: () => Promise<TransitionLock | undefined>, read: () => Promise<TransitionLock | undefined>, acceptanceId: string, claim: WakeExecutionClaim, step: string, timing?: LockWaitTiming): Promise<TransitionLock>;
+/** Read errors retain their errno as cause; no record/event/credential data enters diagnostics. */
+export declare function readExpectedClaim(read: () => Promise<WakeExecutionClaim>, acceptanceId: string, expected: WakeExecutionClaim, step: string, now: () => number, lock?: TransitionLock): Promise<WakeExecutionClaim>;
+export {};
+//# sourceMappingURL=wakeAcceptanceClaimDiagnostics.d.ts.map

package/dist/runtime/wakeAcceptanceClaimDiagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceClaimDiagnostics.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceClaimDiagnostics.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAkC,KAAK,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzG,KAAK,QAAQ,GAAG,kBAAkB,GAAG,cAAc,GAAG,MAAM,GAAG,IAAI,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AACzK,qBAAa,2BAA4B,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB;gBAAzB,MAAM,CAAC,EAAE,gBAAgB,YAAA,EAAE,KAAK,CAAC,EAAE,OAAO;CAIhE;AACD,qBAAa,iCAAkC,SAAQ,2BAA2B;gBACpE,MAAM,EAAE,gBAAgB;CACrC;AAED,KAAK,cAAc,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAAC;AAE5F;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,cAA+B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiBrR;AAUD,mGAAmG;AACnG,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAcxN"}

package/dist/runtime/wakeAcceptanceClaimDiagnostics.js

@@ -0,0 +1,79 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { performance } from "node:perf_hooks";
+import { WakeTransitionLockBlockedError } from "./wakeAcceptanceProcessIdentity.js";
+export class WakeExecutionClaimLostError extends Error {
+    detail;
+    constructor(detail, cause) {
+        super(`wake execution claim was lost${detail === undefined ? "" : `: step=${detail.step} assertion=${detail.assertion} ${JSON.stringify({ ...detail, expected: diagnosticIdentity(detail.expected), current: diagnosticIdentity(detail.current) })}`}`, { cause });
+        this.detail = detail;
+        this.name = "WakeExecutionClaimLostError";
+    }
+}
+export class WakeTransitionLockContentionError extends WakeExecutionClaimLostError {
+    constructor(detail) { super(detail); this.name = "WakeTransitionLockContentionError"; }
+}
+const lockWaitTiming = { now: () => performance.now(), sleep: async (ms) => { await delay(ms); } };
+/**
+ * Only an occupied lock is retried; claim mismatches and I/O failures are not.
+ * The 250 ms budget bounds attempt starts and requested sleeps. Filesystem I/O
+ * is not cancellable, so an admitted acquisition can finish after the deadline.
+ * Keep that lock: callers revalidate the claim before writing and release the
+ * lock in finally, so late acquisition cannot authorize a stale claim.
+ */
+export async function waitForClaimTransitionLock(acquire, read, acceptanceId, claim, step, timing = lockWaitTiming) {
+    const deadline = timing.now() + 250;
+    for (let attempt = 0;; attempt++) {
+        if (attempt >= 26 || timing.now() >= deadline) {
+            let current;
+            try {
+                current = await read();
+            }
+            catch (cause) {
+                throw new WakeExecutionClaimLostError({ step, assertion: "transition_lock_read", acceptance_id: acceptanceId, expected: claim, current: null }, cause);
+            }
+            throw new WakeTransitionLockContentionError({ step, assertion: "transition_lock_contended", acceptance_id: acceptanceId, expected: claim, current: current ?? null, lock: current ?? null });
+        }
+        let lock;
+        try {
+            lock = await acquire();
+        }
+        catch (cause) {
+            if (cause instanceof WakeTransitionLockBlockedError)
+                throw cause;
+            throw new WakeExecutionClaimLostError({ step, assertion: "transition_lock_acquire", acceptance_id: acceptanceId, expected: claim, current: null }, cause);
+        }
+        if (lock !== undefined)
+            return lock;
+        const remaining = deadline - timing.now();
+        if (remaining > 0 && attempt < 25)
+            await timing.sleep(Math.min(10, remaining));
+    }
+}
+function diagnosticIdentity(value) {
+    if (value === null || typeof value === "string" || "pid" in value)
+        return value;
+    // Membership can contain 32 UUIDs. Keep both identities and the lock visible
+    // through the host's 2 KiB diagnostic bound; the typed detail keeps membership.
+    const { acceptance_ids: _members, ...identity } = value;
+    return identity;
+}
+/** Read errors retain their errno as cause; no record/event/credential data enters diagnostics. */
+export async function readExpectedClaim(read, acceptanceId, expected, step, now, lock) {
+    let current;
+    try {
+        current = await read();
+    }
+    catch (cause) {
+        const assertion = cause?.code === "ENOENT" ? "claim_missing" : "claim_read";
+        throw new WakeExecutionClaimLostError({ step, assertion, acceptance_id: acceptanceId, expected, current: null, ...(lock === undefined ? {} : { lock }) }, cause);
+    }
+    const assertion = !(current.acceptance_id === acceptanceId || current.acceptance_ids?.includes(acceptanceId)) ? "claim_membership"
+        : current.acceptance_id !== expected.acceptance_id ? "claim_acceptance_id"
+            : current.owner_id !== expected.owner_id ? "claim_owner_id"
+                : current.generation !== expected.generation ? "claim_generation"
+                    : current.expires_at !== expected.expires_at ? "claim_expires_at"
+                        : Date.parse(current.expires_at) <= now() ? "claim_expired" : undefined;
+    if (assertion !== undefined)
+        throw new WakeExecutionClaimLostError({ step, assertion, acceptance_id: acceptanceId, expected, current, ...(lock === undefined ? {} : { lock }) });
+    return current;
+}

package/dist/runtime/wakeAcceptanceIndex.d.ts

@@ -0,0 +1,55 @@
+export type WakeAcceptanceStat = Readonly<{
+    ino: bigint;
+    size: bigint;
+    mtimeNs: bigint;
+    ctimeNs: bigint;
+}>;
+export type WakeAcceptanceIndexSource = Readonly<{
+    /** Opened-handle stat of the store directory. */
+    directoryStat: () => Promise<WakeAcceptanceStat>;
+    /** Record file names, after the store's own root validation and bounds. */
+    files: () => Promise<readonly string[]>;
+    /** Acceptance id of one record, read through every safety check of the store. */
+    readId: (file: string) => Promise<string>;
+    /** Identity stamp of one record file; undefined when it is gone. */
+    fileStat: (file: string) => Promise<WakeAcceptanceStat | undefined>;
+}>;
+/**
+ * Acceptance-id → record-file index. Own writes keep it current; a directory
+ * whose stamp moved since the last sync (another process, or this one) is
+ * re-listed, and only record files whose own stamp moved are read again. A miss
+ * against an unchanged directory reads no record file.
+ */
+export declare class WakeAcceptanceIndex {
+    private readonly root;
+    private readonly source;
+    private readonly nowNs;
+    private readonly byId;
+    private readonly byFile;
+    private synced;
+    /** Bumped by every binding change made outside a sync; a sync that saw one never vouches for the directory. */
+    private mutations;
+    private refreshing;
+    constructor(root: string, source: WakeAcceptanceIndexSource, nowNs?: () => bigint);
+    /**
+     * The record bound to this id, verified to still carry it. Unknown and
+     * compacted ids are polled, so a miss against an unchanged directory reads
+     * no record file.
+     */
+    find<T extends Readonly<{
+        acceptance_id: string;
+    }>>(acceptanceId: string, read: (file: string) => Promise<T | undefined>): Promise<T | undefined>;
+    /** Binds a record this process wrote; its file stamp is learned on the next sync. */
+    set(acceptanceId: string, file: string): void;
+    /** Drops a record file this process deleted. */
+    forget(file: string): void;
+    /** Brings the index level with the directory; a no-op while the directory is unchanged. Single-flight. */
+    refresh(): Promise<void>;
+    private refreshNow;
+    private scan;
+    /** A binding found stale: drop only what still says so, never a newer binding of the same file. */
+    private unbind;
+    private drop;
+    private bind;
+}
+//# sourceMappingURL=wakeAcceptanceIndex.d.ts.map

package/dist/runtime/wakeAcceptanceIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceIndex.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceIndex.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3G,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,iDAAiD;IACjD,aAAa,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjD,2EAA2E;IAC3E,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACxC,iFAAiF;IACjF,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,oEAAoE;IACpE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACrE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,MAAM;IAA6B,OAAO,CAAC,QAAQ,CAAC,KAAK;IANrH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,MAAM,CAAqB;IACnC,+GAA+G;IAC/G,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,UAAU,CAA4B;gBACjB,IAAI,EAAE,MAAM,EAAmB,MAAM,EAAE,yBAAyB,EAAmB,KAAK,GAAE,MAAM,MAA8C;IAC3K;;;;OAIG;IACG,IAAI,CAAC,CAAC,SAAS,QAAQ,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAYvJ,qFAAqF;IACrF,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAK7C,gDAAgD;IAChD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAC1B,0GAA0G;IACpG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAMhB,UAAU;YAiBV,IAAI;IAiBlB,mGAAmG;IACnG,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,IAAI;CAMb"}

package/dist/runtime/wakeAcceptanceIndex.js

@@ -0,0 +1,158 @@
+import path from "node:path";
+import { MAX_WAKE_ACCEPTANCE_RECORDS } from "./wakeAcceptanceRetention.js";
+/**
+ * A stamp younger than this may share a coarse filesystem timestamp tick with
+ * a write that lands after it was taken, so it is never trusted to prove that
+ * nothing changed (the racy-timestamp rule).
+ */
+const RACY_WINDOW_NS = 2000000000n;
+/**
+ * Own writes bind without a sync, so another process compacting behind a host
+ * that only ever hits could leave bindings for files that are gone. Past this
+ * many the index is dropped and the next miss rebuilds it from the directory.
+ */
+const MAX_INDEX_ENTRIES = MAX_WAKE_ACCEPTANCE_RECORDS * 2;
+/**
+ * Acceptance-id → record-file index. Own writes keep it current; a directory
+ * whose stamp moved since the last sync (another process, or this one) is
+ * re-listed, and only record files whose own stamp moved are read again. A miss
+ * against an unchanged directory reads no record file.
+ */
+export class WakeAcceptanceIndex {
+    root;
+    source;
+    nowNs;
+    byId = new Map();
+    byFile = new Map();
+    synced;
+    /** Bumped by every binding change made outside a sync; a sync that saw one never vouches for the directory. */
+    mutations = 0;
+    refreshing;
+    constructor(root, source, nowNs = () => BigInt(Date.now()) * 1000000n) {
+        this.root = root;
+        this.source = source;
+        this.nowNs = nowNs;
+    }
+    /**
+     * The record bound to this id, verified to still carry it. Unknown and
+     * compacted ids are polled, so a miss against an unchanged directory reads
+     * no record file.
+     */
+    async find(acceptanceId, read) {
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const known = this.byId.get(acceptanceId);
+            if (known !== undefined) {
+                const record = await read(known);
+                if (record?.acceptance_id === acceptanceId)
+                    return record;
+                this.unbind(acceptanceId, known);
+            }
+            if (attempt === 0)
+                await this.refresh();
+        }
+        return undefined;
+    }
+    /** Binds a record this process wrote; its file stamp is learned on the next sync. */
+    set(acceptanceId, file) {
+        this.mutations += 1;
+        if (this.byFile.size >= MAX_INDEX_ENTRIES) {
+            this.byFile.clear();
+            this.byId.clear();
+            this.synced = undefined;
+        }
+        this.bind(file, acceptanceId, undefined);
+    }
+    /** Drops a record file this process deleted. */
+    forget(file) { this.mutations += 1; this.drop(file); }
+    /** Brings the index level with the directory; a no-op while the directory is unchanged. Single-flight. */
+    async refresh() {
+        while (this.refreshing !== undefined)
+            await this.refreshing.catch(() => undefined);
+        const run = this.refreshNow();
+        this.refreshing = run;
+        try {
+            await run;
+        }
+        finally {
+            if (this.refreshing === run)
+                this.refreshing = undefined;
+        }
+    }
+    async refreshNow() {
+        const startedAt = this.nowNs();
+        const directory = await this.source.directoryStat();
+        const directoryStamp = stampOf(directory);
+        if (this.synced === directoryStamp)
+            return;
+        const mutations = this.mutations;
+        const listed = (await this.source.files()).map((name) => path.join(this.root, name));
+        // Prune what the directory no longer lists even when a record below fails to
+        // read, so the maps stay bounded by the store's own record bound.
+        const present = new Set(listed);
+        try {
+            await this.scan(listed, present);
+        }
+        finally {
+            for (const file of [...this.byFile.keys()])
+                if (!present.has(file))
+                    this.drop(file);
+        }
+        // Vouch for the directory only if nothing rebound while listing and its stamp
+        // was already settled when it was taken (the racy-timestamp rule).
+        this.synced = this.mutations === mutations && !racy(directory, startedAt) ? directoryStamp : undefined;
+    }
+    async scan(listed, present) {
+        for (const file of listed) {
+            const seenAt = this.nowNs();
+            const stat = await this.source.fileStat(file);
+            if (stat === undefined) {
+                present.delete(file);
+                continue;
+            }
+            const stamp = racy(stat, seenAt) ? undefined : stampOf(stat);
+            const known = this.byFile.get(file);
+            if (known !== undefined && known.stamp !== undefined && known.stamp === stamp)
+                continue;
+            let id;
+            try {
+                id = await this.source.readId(file);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+                present.delete(file);
+                continue;
+            }
+            this.bind(file, id, stamp);
+        }
+    }
+    /** A binding found stale: drop only what still says so, never a newer binding of the same file. */
+    unbind(acceptanceId, file) {
+        this.mutations += 1;
+        if (this.byId.get(acceptanceId) === file)
+            this.byId.delete(acceptanceId);
+        if (this.byFile.get(file)?.id === acceptanceId)
+            this.byFile.delete(file);
+        this.synced = undefined;
+    }
+    drop(file) {
+        const entry = this.byFile.get(file);
+        if (entry !== undefined && this.byId.get(entry.id) === file)
+            this.byId.delete(entry.id);
+        this.byFile.delete(file);
+        this.synced = undefined;
+    }
+    bind(file, acceptanceId, stamp) {
+        const prior = this.byFile.get(file);
+        if (prior !== undefined && prior.id !== acceptanceId && this.byId.get(prior.id) === file)
+            this.byId.delete(prior.id);
+        this.byFile.set(file, { id: acceptanceId, ...(stamp === undefined ? {} : { stamp }) });
+        this.byId.set(acceptanceId, file);
+    }
+}
+/** A stamp taken within the window of its own last change may share a tick with a later write. */
+function racy(stat, observedAt) {
+    const changed = stat.mtimeNs > stat.ctimeNs ? stat.mtimeNs : stat.ctimeNs;
+    return observedAt - changed < RACY_WINDOW_NS;
+}
+function stampOf(stat) { return `${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`; }

package/dist/runtime/wakeAcceptanceProcessIdentity.d.ts

@@ -7,11 +7,19 @@ export type TransitionLock = Readonly<{
     pid_namespace_dev: number;
     pid_namespace_ino: number;
 }>;
+type BlockedLockDetail = Readonly<{
+    step: string;
+    acceptance_id: string;
+    expected: Omit<TransitionLock, "owner_id" | "generation">;
+    current: TransitionLock;
+}>;
 export declare class WakeTransitionLockBlockedError extends Error {
+    readonly detail?: BlockedLockDetail | undefined;
     readonly code: "offline_reconciliation_required";
-    constructor();
+    constructor(detail?: BlockedLockDetail | undefined);
 }
 export declare function sameNamespace(left: Pick<TransitionLock, "pid_namespace_dev" | "pid_namespace_ino">, right: Pick<TransitionLock, "pid_namespace_dev" | "pid_namespace_ino">): boolean;
 export declare function currentProcessIdentity(): Promise<Omit<TransitionLock, "owner_id" | "generation">>;
 export declare function processIsAlive(lock: TransitionLock): Promise<boolean>;
+export {};
 //# sourceMappingURL=wakeAcceptanceProcessIdentity.d.ts.map