@prjct.app/pi-team 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.6.1](https://github.com/prjct-app/pi-team/compare/v0.6.0...v0.6.1) (2026-09-11)
+
+### Bug Fixes
+
+* preserve mailbox locks across rolling upgrades ([3509903](https://github.com/prjct-app/pi-team/commit/3509903026205a0a3d00fcd52eecb3b970ba4d7b))
+
 ## [0.6.0](https://github.com/prjct-app/pi-team/compare/v0.5.7...v0.6.0) (2026-09-10)
 
 ### Features

package/README.md

@@ -180,6 +180,7 @@ defaults, not user-configurable yet.
 | --- | --- |
 | A request stays queued | Run `/team status`. The recipient may be busy, paused, offline, missing a model, or typing. After five minutes, review turns chase it or surface the blockage. |
 | `Team auto-turn limit reached` | Five automatic turns ran without user input. Review the transcript, then `/team resume`. |
+| `Message not claimed by this session` | The durable claim changed before settlement. Review for partial effects, then `/reload` or leave and rejoin before `/team resume`. After updating pi-team, reload every live teammate so all sessions use the same runtime. |
 | `Membership expired or replaced` | Another live session took your alias. Rejoin, choosing a new alias if the old one is in use. |
 | `Recipient inbox full` / `Sender inbox full` | Fifty unsettled deliveries per member, one slot reserved per outstanding request. Let the teammate drain; notes need no reservation. |
 | `Team history full (500 records)` | At capacity; history is never deleted. Create a fresh team and rejoin. |

package/docs/architecture.md

@@ -25,9 +25,14 @@ next one. The history doubles as recovery evidence for an interrupted write.
 Writers compare-and-swap on the revision under a short-lived per-team lock in
 `~/.pi/agent/teams/.locks/`. Keeping the lock outside the team directory lets
 rename and deletion fence stale publishers without allowing them to recreate a
-moved directory. A conflict fails fast and the caller retries against a fresh
-read, so many agents write concurrently instead of queueing behind a team-wide
-lock. A lock abandoned by a crashed writer is reclaimed after ten seconds.
+moved directory. Normal publications also acquire the pre-0.6 compatibility
+lock beside `state.json`, after the stable lock. This overlap is required while
+sessions from both sides of the lock migration remain alive during a rolling
+reload; without it, two versions could publish the same next revision and lose
+a claim. The compatibility lock is opened without creating its parent, so a
+stale writer still cannot resurrect a deleted team. A conflict fails fast and
+the caller retries against a fresh read. A lock abandoned by a crashed writer
+is reclaimed after ten seconds.
 
 Because every publication renames a **new inode** into place, readers can safely
 cache a parsed record keyed on `(inode, size, mtime)`: a write by any process

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prjct.app/pi-team",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Coordinate independent PI Agent sessions with local team messaging, queued tasks, and shared results.",
   "type": "module",
   "keywords": [

package/src/store.ts

@@ -151,8 +151,8 @@ async function acquireLock(lockPath: string) {
 }
 
 /** Run one storage operation while holding a caller-chosen private lock. */
-export async function withFileLock<T>(lockPath: string, action: () => Promise<T>): Promise<T> {
-  await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
+export async function withFileLock<T>(lockPath: string, action: () => Promise<T>, createParent = true): Promise<T> {
+  if (createParent) await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
   const lock = await acquireLock(lockPath);
   try { return await action(); }
   finally {
@@ -225,6 +225,23 @@ export async function publish<T>(
   path: string, expectedRevision: number, payload: T, normalize: Normalize<T>,
   options: { maxBytes: number; durability?: Durability; payloadJson?: string; lockPath?: string },
 ): Promise<Record<T>> {
-  return withFileLock(options.lockPath ?? `${path}.lock`, () =>
-    publishLocked(path, expectedRevision, payload, normalize, options));
+  const legacyLock = `${path}.lock`;
+  const primaryLock = options.lockPath ?? legacyLock;
+  // Releases before 0.6.0 lock the record path, while lifecycle-safe writers
+  // use the stable external team lock. During a rolling reload both versions
+  // can be alive, so new normal publications must intersect both lock sets or
+  // two writers can pass the revision check and publish the same next revision.
+  return withFileLock(primaryLock, async () => {
+    if (primaryLock === legacyLock) return publishLocked(path, expectedRevision, payload, normalize, options);
+    // Acquiring an in-directory compatibility lock must not recreate a team
+    // that a lifecycle operation deleted while this writer was waiting for the
+    // stable lock. Revision-zero creation is the only intentional exception.
+    const current = await readRecord(path, normalize, options.maxBytes);
+    if (!current && expectedRevision !== 0) {
+      throw Object.assign(new Error('Record changed before the write; current revision is 0.'), { code: 'STALE_REVISION' });
+    }
+    if (!current) await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    return withFileLock(legacyLock,
+      () => publishLocked(path, expectedRevision, payload, normalize, options), false);
+  });
 }