@retaw106/mmc-oc 2.2.0 → 2.3.0

package/src/shared/sqlite.ts

@@ -71,14 +71,21 @@ export function registerSlowWriteReporter(reporter: SlowWriteReporter): void {
  */
 type SqliteDiagnosticSink = (message: string) => void;
 let sqliteDiagnosticSink: SqliteDiagnosticSink | undefined;
+let sqliteDiagnosticHost: () => string = () => "unknown";
 
-export function registerSqliteDiagnosticSink(sink: SqliteDiagnosticSink): void {
+export function registerSqliteDiagnosticSink(
+    sink: SqliteDiagnosticSink,
+    host?: () => string,
+): void {
     sqliteDiagnosticSink = sink;
+    if (host) sqliteDiagnosticHost = host;
 }
 
 function reportSqliteDiagnostic(message: string): void {
     try {
-        sqliteDiagnosticSink?.(`[magic-context] ${message}`);
+        sqliteDiagnosticSink?.(
+            `[magic-context] ${message} pid=${process.pid} host=${sqliteDiagnosticHost()}`,
+        );
     } catch {
         // Diagnostics must never change the outcome of the write they describe.
     }
@@ -169,13 +176,51 @@ export class SqliteRuntimeUnavailableError extends Error {
     }
 }
 
+// Node requests this warning during node:sqlite's module evaluation, although
+// warning delivery happens later. Intercept only the request while importing;
+// replacing warning listeners would not suppress the default stderr output.
+function isNodeSqliteExperimentalWarning(args: unknown[]): boolean {
+    const [warning, options] = args;
+    const message = warning instanceof Error ? warning.message : warning;
+    const type =
+        typeof options === "string"
+            ? options
+            : options && typeof options === "object"
+              ? (options as { type?: unknown }).type
+              : undefined;
+    return (
+        type === "ExperimentalWarning" &&
+        typeof message === "string" &&
+        message.startsWith("SQLite is an experimental feature")
+    );
+}
+
+async function importSqliteModuleForRuntime(
+    runtime: SqliteRuntime,
+    specifier: string,
+    importer: (specifier: string) => Promise<SqliteModule>,
+): Promise<SqliteModule> {
+    if (runtime !== "Node.js") return importer(specifier);
+
+    const originalEmitWarning = process.emitWarning;
+    process.emitWarning = function (this: unknown, ...args: unknown[]): void {
+        if (isNodeSqliteExperimentalWarning(args)) return;
+        Reflect.apply(originalEmitWarning, this, args);
+    } as typeof process.emitWarning;
+    try {
+        return await importer(specifier);
+    } finally {
+        process.emitWarning = originalEmitWarning;
+    }
+}
+
 export async function loadSqliteModule(
     runtime: SqliteRuntime = detectSqliteRuntime(),
     importer: (specifier: string) => Promise<SqliteModule> = importSqliteModule,
 ): Promise<SqliteModule> {
     const specifier = runtime === "Bun" ? bunSpec : nodeSpec;
     try {
-        return await importer(specifier);
+        return await importSqliteModuleForRuntime(runtime, specifier, importer);
     } catch (error) {
         if (isModuleNotFoundError(error, specifier)) {
             throw new SqliteRuntimeUnavailableError(runtime, specifier, error);
@@ -234,6 +279,110 @@ export interface SqliteMemoryStats {
 const trackedSqliteConnections = new Map<number, TrackedSqliteConnection>();
 let nextSqliteConnectionSequence = 1;
 
+/**
+ * Columns of Magic Context's `tags` table (context.db) that never decide which
+ * message a tag belongs to, its number, its type, or its reasoning token estimate.
+ */
+const TAG_COLUMNS_OUTSIDE_IDENTITY = new Set([
+    "status",
+    "drop_mode",
+    "byte_size",
+    "input_byte_size",
+    "reasoning_byte_size",
+    "token_count",
+    "input_token_count",
+    "caveman_depth",
+    "entry_fingerprint",
+    "tool_name",
+    "harness",
+]);
+
+let tagIdentityWriteGeneration = 0;
+
+/**
+ * Whether a write statement may change an existing `tags` row's identity
+ * (session, number, type, owner message, reasoning token count) or remove a
+ * row. Plain appends without an explicit `id`, and updates that assign only
+ * columns in {@link TAG_COLUMNS_OUTSIDE_IDENTITY}, cannot; everything else that
+ * names the table is treated as if it could, including DDL and multi-statement
+ * scripts. Erring towards true only costs a cache rebuild.
+ */
+export function mayChangeTagIdentity(sql: string): boolean {
+    if (!/\btags\b/i.test(sql) || /^\s*(?:SELECT|EXPLAIN|PRAGMA)\b/i.test(sql)) return false;
+    if (/^\s*WITH\b/i.test(sql) && !/\b(?:INSERT|UPDATE|DELETE|REPLACE)\b/i.test(sql)) return false;
+    // One statement only: a script can hide a DELETE behind a harmless first statement.
+    if (/;\s*\S/.test(sql) || /\bREPLACE\b/i.test(sql) || /\bON\s+CONFLICT\b/i.test(sql))
+        return true;
+    const insert = /^\s*INSERT\s+INTO\s+(?:main\.)?["`]?tags["`]?\s*\(([^)]*)\)/i.exec(sql);
+    if (insert) {
+        const columns = (insert[1] ?? "").split(",").map((column) =>
+            column
+                .trim()
+                .replace(/["`[\]]/g, "")
+                .toLowerCase(),
+        );
+        return columns.includes("id") || columns.includes("rowid");
+    }
+    const update = /^\s*UPDATE\s+(?:main\.)?["`]?tags["`]?\s+SET\s+([\s\S]*?)\bWHERE\b/i.exec(sql);
+    if (update && !/\bSELECT\b/i.test(sql)) {
+        // Provably identity-free only when every top-level assignment is a plain
+        // `column = ...` naming an allowed column. A tuple assignment such as
+        // `(tag_number, reasoning_token_count) = (...)`, or anything this cannot
+        // read, counts as an identity write.
+        const assignments = topLevelCommaSegments(update[1] ?? "");
+        if (!assignments) return true;
+        return !assignments.every((assignment) => {
+            const column = /^\s*["`]?(\w+)["`]?\s*=(?!=)/.exec(assignment)?.[1];
+            return column !== undefined && TAG_COLUMNS_OUTSIDE_IDENTITY.has(column.toLowerCase());
+        });
+    }
+    return true;
+}
+
+/**
+ * Split SQL text at commas outside parentheses and quotes. Returns null when
+ * the parentheses or quotes do not balance.
+ */
+function topLevelCommaSegments(text: string): string[] | null {
+    const segments: string[] = [];
+    let depth = 0;
+    let quote: string | null = null;
+    let start = 0;
+    for (let index = 0; index < text.length; index += 1) {
+        const char = text[index];
+        if (quote) {
+            // A doubled quote inside a quoted run is an escaped quote.
+            if (char === quote) {
+                if (text[index + 1] === quote) index += 1;
+                else quote = null;
+            }
+            continue;
+        }
+        if (char === "'" || char === '"' || char === "`") quote = char;
+        else if (char === "(") depth += 1;
+        else if (char === ")") {
+            depth -= 1;
+            if (depth < 0) return null;
+        } else if (char === "," && depth === 0) {
+            segments.push(text.slice(start, index));
+            start = index + 1;
+        }
+    }
+    if (quote || depth !== 0) return null;
+    segments.push(text.slice(start));
+    return segments;
+}
+
+/**
+ * Counts executions, on any connection this process opened, of statements for
+ * which {@link mayChangeTagIdentity} is true. A cache built from `tags` stays
+ * valid for this process's own writes while the count is unchanged; commits by
+ * other connections show up in `PRAGMA data_version` instead.
+ */
+export function getTagIdentityWriteGeneration(): number {
+    return tagIdentityWriteGeneration;
+}
+
 /** Route native Bun and Node transaction entry through the same acquisition retry.
  * Native Bun transaction wrappers execute BEGIN internally, bypassing an exec override,
  * so both runtimes use this small synchronous wrapper instead. Writable handles
@@ -250,15 +399,31 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
                 // A transaction that ended without passing through exec (for
                 // example an automatic rollback) must not be timed as this one.
                 openWriterTransactions.delete(db);
-                if (transformPassScope.getStore()?.active || backgroundWriterScope.getStore())
+                if (transformPassScope.getStore()?.active || backgroundWriterScope.getStore()) {
                     acquireShort(db, () => nativeExec(sql), sql.trim());
-                else nativeExec(sql);
+                } else {
+                    nativeExec(sql);
+                    openWriterTransactions.set(db, {
+                        site: sql.trim(),
+                        lane: "background",
+                        acquireMs: 0,
+                        attempts: 1,
+                        acquiredAt: performance.now(),
+                    });
+                }
                 return db;
             }
             if (WRITER_TRANSACTION_END.test(sql) && openWriterTransactions.has(db))
                 return endWriterTransaction(db, () => nativeExec(sql), sql);
-            if (!/^\s*(?:SELECT|EXPLAIN|PRAGMA|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(sql))
-                return withAutocommitTimeout(db, () => nativeExec(sql));
+            if (
+                !/^\s*(?:SELECT|EXPLAIN|PRAGMA|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(sql)
+            ) {
+                try {
+                    return withAutocommitTimeout(db, () => nativeExec(sql));
+                } finally {
+                    if (mayChangeTagIdentity(sql)) tagIdentityWriteGeneration += 1;
+                }
+            }
             return nativeExec(sql);
         },
     });
@@ -271,15 +436,22 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
             // SELECT/EXPLAIN cannot acquire a writer. Treat CTEs conservatively:
             // WITH can introduce INSERT/UPDATE/DELETE as well as a read query.
             if (!readonly && !/^\s*(?:SELECT|EXPLAIN|PRAGMA)\b/i.test(sql)) {
+                const changesTagIdentity = mayChangeTagIdentity(sql);
                 for (const method of ["run", "get", "all"] as const) {
                     const execute = statement[method].bind(statement);
                     Object.defineProperty(statement, method, {
                         configurable: true,
                         // biome-ignore lint/suspicious/noExplicitAny: retain SQLite's native binding overloads.
-                        value: (...args: any[]) =>
-                            withAutocommitTimeout(db, () => execute(...args)),
+                        value: (...args: any[]) => {
+                            try {
+                                return withAutocommitTimeout(db, () => execute(...args));
+                            } finally {
+                                if (changesTagIdentity) tagIdentityWriteGeneration += 1;
+                            }
+                        },
                     });
                 }
+                if (changesTagIdentity) wrapRemainingTagWriteForms(statement);
             }
             return statement;
         },
@@ -330,6 +502,43 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
     });
 }
 
+/**
+ * Count tag identity writes made through the statement forms the transaction
+ * routing does not wrap. `iterate()` runs the statement while its result is
+ * consumed, so the generation moves both when iteration starts and when it
+ * ends: a summary read in between is then rebuilt on its next read.
+ */
+// biome-ignore lint/suspicious/noExplicitAny: statements from both backends share these method names.
+function wrapRemainingTagWriteForms(statement: any): void {
+    if (typeof statement.iterate === "function") {
+        const iterate = statement.iterate.bind(statement);
+        Object.defineProperty(statement, "iterate", {
+            configurable: true,
+            value: function* (...args: unknown[]) {
+                tagIdentityWriteGeneration += 1;
+                try {
+                    yield* iterate(...args);
+                } finally {
+                    tagIdentityWriteGeneration += 1;
+                }
+            },
+        });
+    }
+    if (typeof statement.values === "function") {
+        const values = statement.values.bind(statement);
+        Object.defineProperty(statement, "values", {
+            configurable: true,
+            value: (...args: unknown[]) => {
+                try {
+                    return values(...args);
+                } finally {
+                    tagIdentityWriteGeneration += 1;
+                }
+            },
+        });
+    }
+}
+
 function trackSqliteConnection(
     db: BetterSqlite3.Database,
     filename: unknown,
@@ -431,6 +640,23 @@ function buildNodeSqliteDatabaseClass(DatabaseSync: any): typeof BetterSqlite3 {
 
 export const Database: typeof BetterSqlite3 = TrackedDatabase;
 
+/** The constructor path, without querying SQLite on the prompt thread. */
+export function getSqliteDatabasePath(db: Database): string | null {
+    for (const connection of trackedSqliteConnections.values()) {
+        if (connection.reference.deref() === db) {
+            return connection.filename === ":memory:" || connection.filename === "<buffer>"
+                ? null
+                : connection.filename;
+        }
+    }
+    // Native Bun/better-sqlite3 handles can reach readers without our constructor
+    // wrapper. Their filename is still available without a SQLite query.
+    const native = db as unknown as { filename?: unknown; name?: unknown };
+    const path = native.filename ?? native.name;
+    if (typeof path === "string" && path !== ":memory:" && path !== "") return path;
+    return null;
+}
+
 function pragmaValue(db: BetterSqlite3.Database, name: string): unknown {
     const row = db.prepare(`PRAGMA ${name}`).get() as Record<string, unknown> | undefined;
     if (!row) return undefined;
@@ -665,22 +891,31 @@ export function withSqliteBackgroundWriter<T>(operation: () => T): T {
 export function withSqliteTransformPass<T>(operation: () => T): T {
     const existing = transformPassScope.getStore();
     if (existing?.active) return operation();
-    const lease = { active: true, remainingWaitMs: FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS };
-    return transformPassScope.run(lease, () => {
-        try {
-            const result = operation();
-            if (result && typeof (result as { then?: unknown }).then === "function") {
-                return Promise.resolve(result).finally(() => {
-                    lease.active = false;
-                }) as T;
+    const reservation = reserveForegroundSqliteTurn();
+    const run = (release: () => void): T => {
+        const lease = { active: true, remainingWaitMs: FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS };
+        return transformPassScope.run(lease, () => {
+            try {
+                const result = operation();
+                if (result && typeof (result as { then?: unknown }).then === "function") {
+                    return Promise.resolve(result).finally(() => {
+                        lease.active = false;
+                        release();
+                    }) as T;
+                }
+                lease.active = false;
+                release();
+                return result;
+            } catch (error) {
+                lease.active = false;
+                release();
+                throw error;
             }
-            lease.active = false;
-            return result;
-        } catch (error) {
-            lease.active = false;
-            throw error;
-        }
-    });
+        });
+    };
+    // Foreground callers racing maintenance are awaited transforms. Idle
+    // synchronous callers keep the existing immediate return/throw behavior.
+    return typeof reservation === "function" ? run(reservation) : (reservation.then(run) as T);
 }
 
 /** Start detached maintenance work without borrowing a foreground pass's budget. */
@@ -720,10 +955,10 @@ export class SqliteAcquisitionBusyError extends Error {
 }
 
 const SHORT_BUSY_TIMEOUT_MS = 25;
-const FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS = 250;
+const FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS = 2_000;
 const FOREGROUND_ACQUISITION_BUDGET_MS = 16_500;
 /** Waiting this long for the writer lock, or holding it this long, is logged. */
-const SLOW_WRITER_LOG_MS = 250;
+const SLOW_WRITER_LOG_MS = 100;
 const WRITER_TRANSACTION_END = /^\s*(?:COMMIT|END|ROLLBACK)(?:\s+TRANSACTION)?\s*;?\s*$/i;
 
 type WriterLane = "foreground" | "background";
@@ -771,25 +1006,33 @@ function foregroundWaitLease() {
 function withAutocommitTimeout<T>(db: Database, operation: () => T): T {
     assertTransformWrite();
     const lease = foregroundWaitLease();
-    if (isInTransaction(db) || (!lease && !backgroundWriterScope.getStore())) return operation();
-    const previous = pragmaNumber(db, "busy_timeout");
-    db.exec(
-        `PRAGMA busy_timeout=${lease ? Math.floor(lease.remainingWaitMs) : SHORT_BUSY_TIMEOUT_MS}`,
-    );
+    if (isInTransaction(db)) return operation();
+    const scoped = lease || backgroundWriterScope.getStore();
+    const previous = scoped ? pragmaNumber(db, "busy_timeout") : null;
+    if (scoped)
+        db.exec(
+            `PRAGMA busy_timeout=${lease ? Math.floor(Math.min(lease.remainingWaitMs, lease.guard?.remainingMs() ?? Infinity)) : SHORT_BUSY_TIMEOUT_MS}`,
+        );
     const started = performance.now();
+    let completed = false;
     try {
-        return operation();
+        const result = operation();
+        completed = true;
+        return result;
     } catch (error) {
         if (lease && isTransientSqliteError(error))
             throw new SqliteAcquisitionBusyError(error, "autocommit");
         throw error;
     } finally {
-        if (lease)
-            lease.remainingWaitMs = Math.max(
-                0,
-                lease.remainingWaitMs - (performance.now() - started),
-            );
+        const elapsed = performance.now() - started;
+        if (lease) lease.remainingWaitMs = Math.max(0, lease.remainingWaitMs - elapsed);
         if (previous !== null) db.exec(`PRAGMA busy_timeout=${previous}`);
+        // Native autocommit does not expose the instant its lock was acquired.
+        // Label the upper bound so a waiting statement is not blamed as a holder.
+        if (elapsed >= SLOW_WRITER_LOG_MS)
+            reportSqliteDiagnostic(
+                `sqlite writer site=autocommit lane=${lease ? "foreground" : "background"} elapsed_ms=${Math.round(elapsed)} timing=statement_including_acquisition outcome=${completed ? "completed" : "failed"} caller=${writerCaller()}`,
+            );
     }
 }
 
@@ -851,7 +1094,9 @@ function acquireShort(db: Database, acquire: () => unknown, site: string): void
  * `acquireShort`, then report how long the writer waited for the lock
  * (`acquire_ms`) and how long it then held it (`hold_ms`) when either crosses
  * the threshold. A long hold blocks every other process's writer, so it is
- * worth seeing even when the lock itself came quickly.
+ * worth seeing even when the lock itself came quickly. This interval includes
+ * COMMIT: an automatic PASSIVE checkpoint can run after writer-lock release,
+ * so hold_ms is a conservative upper bound, not proof of continuous ownership.
  */
 function endWriterTransaction(db: Database, end: () => unknown, sql: string): unknown {
     let ended = false;
@@ -872,13 +1117,32 @@ function endWriterTransaction(db: Database, end: () => unknown, sql: string): un
                       ? "committed"
                       : "failed";
                 reportSqliteDiagnostic(
-                    `sqlite writer site=${open.site} lane=${open.lane} acquire_ms=${Math.round(open.acquireMs)} hold_ms=${Math.round(holdMs)} attempts=${open.attempts} outcome=${outcome}`,
+                    `sqlite writer site=${open.site} lane=${open.lane} acquire_ms=${Math.round(open.acquireMs)} hold_ms=${Math.round(holdMs)} attempts=${open.attempts} outcome=${outcome} timing=through_commit_upper_bound caller=${writerCaller()}`,
                 );
             }
         }
     }
 }
 
+// Capture a stack only for slow writes. Synchronous COMMIT retains the writer's
+// caller, so fast transactions need neither stack allocation nor source mapping.
+function writerCaller(): string {
+    return (
+        new Error().stack
+            ?.split("\n")
+            .find(
+                (line) =>
+                    line.includes(" at ") &&
+                    !/[/\\]sqlite\.[tj]s[:)]/.test(line) &&
+                    !/\b(?:writerCaller|endWriterTransaction|withAutocommitTimeout|value)\b/.test(
+                        line,
+                    ),
+            )
+            ?.trim()
+            .replace(/\s+/g, "_") ?? "unknown"
+    );
+}
+
 /** Begin an immediate transaction with bounded asynchronous retries on writer contention.
  * Callers must recheck any lease or source snapshot after this function returns.
  * Resolves with the `performance.now()` time at which BEGIN IMMEDIATE succeeded,
@@ -1071,3 +1335,80 @@ export function withPrivilegedWriter<T>(db: Database, operation: () => T): T {
         throw error;
     }
 }
+
+// Process-local admission only; SQLite remains the cross-process writer arbiter.
+const indexCoordinationKey = Symbol.for("magic-context.index-foreground-coordination.v1");
+const indexCoordinationHeap = globalThis as unknown as Record<
+    symbol,
+    SharedArrayBuffer | undefined
+>;
+const indexCoordinationBuffer =
+    indexCoordinationHeap[indexCoordinationKey] ??
+    new SharedArrayBuffer(3 * Int32Array.BYTES_PER_ELEMENT);
+indexCoordinationHeap[indexCoordinationKey] = indexCoordinationBuffer;
+const indexCoordinationState = new Int32Array(indexCoordinationBuffer);
+// Slots: foreground interest, current maintenance owner, next owner token.
+
+export function indexCoordinationInput(): {
+    indexCoordination: SharedArrayBuffer;
+    indexOwner: number;
+} {
+    return {
+        indexCoordination: indexCoordinationBuffer,
+        indexOwner: Atomics.add(indexCoordinationState, 2, 1) + 1,
+    };
+}
+
+const yieldIndexTurn = () => new Promise<void>((resolve) => setTimeout(resolve, 1));
+
+/** Announce interest before waiting, so no maintenance chunk overtakes a foreground turn. */
+function reserveForegroundSqliteTurn(): (() => void) | Promise<() => void> {
+    Atomics.add(indexCoordinationState, 0, 1);
+    const release = () => {
+        Atomics.sub(indexCoordinationState, 0, 1);
+        Atomics.notify(indexCoordinationState, 0);
+    };
+    if (Atomics.load(indexCoordinationState, 1) === 0) return release;
+    return (async () => {
+        while (Atomics.load(indexCoordinationState, 1) !== 0) await yieldIndexTurn();
+        return release;
+    })();
+}
+
+export function releaseIndexOwner(input: {
+    indexCoordination?: SharedArrayBuffer;
+    indexOwner?: number;
+}): void {
+    if (!input.indexCoordination || !input.indexOwner) return;
+    const shared = new Int32Array(input.indexCoordination);
+    Atomics.compareExchange(shared, 1, input.indexOwner, 0);
+    Atomics.notify(shared, 1);
+}
+
+/** One synchronous transaction per permit; release the permit before yielding. */
+export async function withIndexChunk<T>(
+    input: { indexCoordination?: SharedArrayBuffer; indexOwner?: number },
+    operation: () => T,
+): Promise<T> {
+    if (!input.indexCoordination || !input.indexOwner) return operation();
+    const shared = new Int32Array(input.indexCoordination);
+    for (;;) {
+        if (
+            Atomics.load(shared, 0) === 0 &&
+            Atomics.compareExchange(shared, 1, 0, input.indexOwner) === 0
+        ) {
+            if (Atomics.load(shared, 0) === 0) break;
+            releaseIndexOwner(input);
+        }
+        await yieldIndexTurn();
+    }
+    try {
+        return await operation();
+    } finally {
+        releaseIndexOwner(input);
+    }
+}
+
+export async function yieldIndexChunk(): Promise<void> {
+    await yieldIndexTurn();
+}

package/src/shared/stable-json.ts

@@ -18,12 +18,38 @@
  * signing), build a separate utility — do NOT widen this contract.
  */
 export function stableStringify(value: unknown, seen = new WeakSet<object>()): string {
-    if (value === undefined) return "undefined";
-    if (value === null || typeof value !== "object") return JSON.stringify(value) ?? String(value);
-    if (seen.has(value)) return '"[Circular]"';
+    // Collect pieces and join once. Joining at every level copied each nested
+    // value's text once per enclosing level, so a large value N levels deep cost
+    // N copies of itself.
+    const pieces: string[] = [];
+    writeStable(value, seen, pieces);
+    return pieces.join("");
+}
+
+function writeStable(value: unknown, seen: WeakSet<object>, pieces: string[]): void {
+    if (value === undefined) {
+        pieces.push("undefined");
+        return;
+    }
+    if (value === null || typeof value !== "object") {
+        pieces.push(JSON.stringify(value) ?? String(value));
+        return;
+    }
+    // Any object met a second time, shared or cyclic, is written as "[Circular]".
+    if (seen.has(value)) {
+        pieces.push('"[Circular]"');
+        return;
+    }
     seen.add(value);
     if (Array.isArray(value)) {
-        return `[${value.map((item) => stableStringify(item, seen)).join(",")}]`;
+        pieces.push("[");
+        for (let index = 0; index < value.length; index += 1) {
+            if (index > 0) pieces.push(",");
+            // A hole writes nothing between its commas, as joining a mapped array did.
+            if (index in value) writeStable(value[index], seen, pieces);
+        }
+        pieces.push("]");
+        return;
     }
     // Code-point sort (NOT localeCompare). Stable across runtimes/locales.
     const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) => {
@@ -31,7 +57,11 @@ export function stableStringify(value: unknown, seen = new WeakSet<object>()): s
         if (a > b) return 1;
         return 0;
     });
-    return `{${entries
-        .map(([key, child]) => `${JSON.stringify(key)}:${stableStringify(child, seen)}`)
-        .join(",")}}`;
+    pieces.push("{");
+    entries.forEach(([key, child], index) => {
+        if (index > 0) pieces.push(",");
+        pieces.push(JSON.stringify(key), ":");
+        writeStable(child, seen, pieces);
+    });
+    pieces.push("}");
 }

package/src/shared/storage-file-mutex.test.ts

@@ -0,0 +1,50 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { withStorageFileMutex } from "./storage-file-mutex";
+
+const directories: string[] = [];
+const newDirectory = () => {
+    const directory = mkdtempSync(join(tmpdir(), "mmc-storage-file-mutex-"));
+    directories.push(directory);
+    return directory;
+};
+afterAll(() => {
+    for (const directory of directories) rmSync(directory, { recursive: true, force: true });
+});
+
+describe("withStorageFileMutex", () => {
+    test("serializes two critical sections", () => {
+        const directory = newDirectory();
+        const orderPath = join(directory, "order");
+        withStorageFileMutex(directory, () => {
+            // Only our own contender file may remain while we hold the mutex.
+            const locks = readdirSync(directory).filter((name) => name.endsWith(".lock"));
+            expect(locks.length).toBe(1);
+            writeFileSync(orderPath, "first");
+        });
+        withStorageFileMutex(directory, () => {
+            expect(readFileSync(orderPath, "utf8")).toBe("first");
+            writeFileSync(orderPath, "first,second");
+        });
+        expect(readFileSync(orderPath, "utf8")).toBe("first,second");
+        expect(readdirSync(directory).filter((name) => name.endsWith(".lock")).length).toBe(0);
+    });
+
+    test("reclaims a dead holder's ticket", () => {
+        const directory = newDirectory();
+        const deadName = `0-${randomUUID()}.lock`;
+        const ticket = { choosing: false, number: 999, birth: null };
+        const checksum = createHash("sha256")
+            .update(JSON.stringify([deadName, ticket.choosing, ticket.number, ticket.birth]))
+            .digest("hex");
+        writeFileSync(join(directory, deadName), JSON.stringify({ ...ticket, checksum }));
+        // pid 0 is never alive, so the stale ticket must be reclaimed and the
+        // critical section must run despite the holder's high ticket number.
+        const value = withStorageFileMutex(directory, () => 42);
+        expect(value).toBe(42);
+        expect(readdirSync(directory).filter((name) => name.endsWith(".lock")).length).toBe(0);
+    });
+});