@volter/twin 0.1.0 → 0.1.1

package/src/plan.ts

@@ -7,17 +7,18 @@
 // orchestrator: recompute requiresApproval from the plan's own data (never trust
 // the stored bit) → refuse a stale base → acquire lease → push each call through
 // phases → release.
-import { existsSync, mkdirSync, readdirSync, writeFileSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
-import { pendingActions, projectResources } from './actions.ts';
-import type { TwinAction, TwinActionPrecondition } from './actions.ts';
+import { getActiveWorldStore } from './world-store.ts';
+import { checkPrecondition, pendingActions, projectResources } from './actions.ts';
+import type { TwinAction } from './actions.ts';
 import { isBaseStale } from './refs.ts';
 import type { WorldLocalRef, WorldRemoteRef } from './refs.ts';
 import { acquireLease, releaseLease } from './lease.ts';
 import { pushTransaction } from './pushLedger.ts';
 import type { PushOutcome, WorldPushRecord } from './pushLedger.ts';
 import type { TwinResource } from './serve.ts';
-import { readJsonFile, worldPaths } from './storage.ts';
+import { appendDurable, readJsonFile, worldPaths } from './storage.ts';
 
 export type ProviderCall = {
   actionId: string;
@@ -41,6 +42,121 @@ export type WorldApplyPlan = {
   createdAt: string;
 };
 
+export type PlanReviewDecision = 'approved' | 'rejected';
+export type PlanReviewRecord = {
+  id: string;
+  service: string;
+  transactionSetId: string;
+  transactions: string[];
+  decision: PlanReviewDecision;
+  actor: { kind: 'agent' | 'human'; id: string };
+  reason?: string;
+  occurredAt: string;
+};
+export type LocalActionPlan = {
+  id: string;
+  service: string;
+  transactions: Array<{ id: string; operation?: string; subject: { type: string; id: string } }>;
+  conflicts: Array<{ actionId: string; reason: string }>;
+  review: PlanReviewRecord | null;
+  requiresApproval: boolean;
+};
+
+/** Stable identity for the exact ordered pending-action set being reviewed. */
+export function transactionSetId(service: string, transactions: string[]): string {
+  const digest = createHash('sha256').update(JSON.stringify([service, transactions])).digest('hex').slice(0, 16);
+  return `plan:${service}:${digest}`;
+}
+
+function reviewsPath(service: string, root?: string): string {
+  return join(worldPaths(service, root).dir, 'plan-reviews.jsonl');
+}
+
+export function listPlanReviews(service: string, root?: string): PlanReviewRecord[] {
+  const path = reviewsPath(service, root);
+  return getActiveWorldStore().readLines(path).filter(Boolean).map((line) => JSON.parse(line) as PlanReviewRecord);
+}
+
+export function latestPlanReview(service: string, transactions: string[], root?: string): PlanReviewRecord | null {
+  const id = transactionSetId(service, transactions);
+  return listPlanReviews(service, root).filter((review) => review.transactionSetId === id).at(-1) ?? null;
+}
+
+/** Review view over the same pending actions written by SDK-backed twin traffic. */
+export function buildLocalActionPlan(service: string, root?: string): LocalActionPlan {
+  const pending = pendingActions(service, root);
+  const ids = pending.map((action) => action.id);
+  const review = latestPlanReview(service, ids, root);
+  return {
+    id: transactionSetId(service, ids),
+    service,
+    transactions: pending.map((action) => ({ id: action.id, operation: action.operation, subject: action.subject })),
+    conflicts: pendingConflicts(service, root),
+    review,
+    requiresApproval: ids.length > 0 && review?.decision !== 'approved',
+  };
+}
+
+export function recordPlanReview(opts: {
+  service: string;
+  expectedTransactionSetId: string;
+  decision: PlanReviewDecision;
+  actor: { kind: 'agent' | 'human'; id: string };
+  reason?: string;
+  occurredAt?: string;
+  root?: string;
+}): PlanReviewRecord {
+  const transactions = pendingActions(opts.service, opts.root).map((action) => action.id);
+  if (transactions.length === 0) throw new Error(`cannot review ${opts.service}: no pending transactions`);
+  const currentTransactionSetId = transactionSetId(opts.service, transactions);
+  if (opts.expectedTransactionSetId !== currentTransactionSetId) {
+    throw new Error(`cannot review ${opts.service}: transaction set changed (expected ${opts.expectedTransactionSetId}, current ${currentTransactionSetId})`);
+  }
+  if (!opts.actor.id.trim()) throw new Error('plan review actor id is required');
+  if (opts.decision === 'rejected' && !opts.reason?.trim()) throw new Error('rejected plan review requires a reason');
+  const record: PlanReviewRecord = {
+    id: `review:${randomUUID()}`,
+    service: opts.service,
+    transactionSetId: currentTransactionSetId,
+    transactions,
+    decision: opts.decision,
+    actor: opts.actor,
+    ...(opts.reason ? { reason: opts.reason } : {}),
+    occurredAt: opts.occurredAt ?? new Date().toISOString(),
+  };
+  const path = reviewsPath(opts.service, opts.root);
+  getActiveWorldStore().mkdir(join(path, '..'));
+  appendDurable(path, `${JSON.stringify(record)}\n`);
+  return record;
+}
+
+export type ApprovedPendingActionSet = {
+  review: PlanReviewRecord | null;
+  actions: TwinAction[];
+};
+
+/**
+ * Credential-bound connector snapshot: refuse an unapproved exact set and return only
+ * the actions that were compared with that approval. Callers must consume this snapshot
+ * instead of rereading pending actions, or a concurrent append could enter the push after
+ * the approval check.
+ */
+export function approvedPendingActionSet(service: string, root?: string): ApprovedPendingActionSet {
+  const actions = pendingActions(service, root);
+  const transactions = actions.map((action) => action.id);
+  if (transactions.length === 0) return { review: null, actions };
+  const review = latestPlanReview(service, transactions, root);
+  if (review?.decision !== 'approved') {
+    throw new Error(`push refused: transaction set ${transactionSetId(service, transactions)} requires a durable approval`);
+  }
+  return { review, actions };
+}
+
+/** Credential-bound connector guard retained for callers that only need the verdict. */
+export function assertPendingActionsApproved(service: string, root?: string): PlanReviewRecord | null {
+  return approvedPendingActionSet(service, root).review;
+}
+
 /** Map a local transaction commit → the provider call that materializes it (vendor-specific). Return null to skip. */
 export type ActionMapper = (action: TwinAction) => Omit<ProviderCall, 'actionId'> | null;
 
@@ -52,20 +168,11 @@ function preconditionFailure(action: TwinAction, byId: Map<string, TwinResource>
   for (const p of action.preconditions ?? []) {
     const resource = byId.get(`${p.subject.type}:${p.subject.id}`);
     const actual = resource ? (resource as Record<string, unknown>)[p.field] : undefined;
-    const ok = evalPrecondition(p, actual);
+    const ok = checkPrecondition(p, actual);
     if (!ok) return `${p.subject.type}:${p.subject.id}.${p.field} ${p.op}${p.value !== undefined ? ` ${JSON.stringify(p.value)}` : ''}`;
   }
   return null;
 }
-function evalPrecondition(p: TwinActionPrecondition, actual: unknown): boolean {
-  switch (p.op) {
-    case 'exists': return actual !== undefined;
-    case 'not_exists': return actual === undefined;
-    case 'eq': case 'version_eq': return Object.is(actual, p.value);
-    case 'neq': return !Object.is(actual, p.value);
-    default: return false;
-  }
-}
 
 /** Pending transactions whose preconditions would fail against current projected state. */
 export function pendingConflicts(service: string, root?: string): Array<{ actionId: string; reason: string }> {
@@ -106,7 +213,7 @@ export function buildApplyPlan(opts: {
   return {
     id: opts.id, service: opts.service, forkId: opts.forkId, baseRemoteRef: opts.baseRemoteRef,
     transactions: pending.map((a) => a.id), providerCalls, conflicts,
-    requiresApproval: conflicts.length > 0 || providerCalls.some((c) => c.destructive),
+    requiresApproval: pending.length > 0,
     createdAt: opts.createdAt,
   };
 }
@@ -117,18 +224,16 @@ function plansDir(service: string, root?: string): string {
 export function writePlan(plan: WorldApplyPlan, root?: string): WorldApplyPlan {
   if (!/^[A-Za-z0-9_.-]+$/.test(plan.id)) throw new Error(`invalid plan id: ${plan.id}`);
   const path = join(plansDir(plan.service, root), `${plan.id}.json`);
-  mkdirSync(join(path, '..'), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(plan, null, 2)}\n`);
+  getActiveWorldStore().write(path, `${JSON.stringify(plan, null, 2)}\n`);
   return plan;
 }
 export function readPlan(service: string, id: string, root?: string): WorldApplyPlan | null {
   const path = join(plansDir(service, root), `${id}.json`);
-  return existsSync(path) ? readJsonFile<WorldApplyPlan>(path) : null;
+  return getActiveWorldStore().exists(path) ? readJsonFile<WorldApplyPlan>(path) : null;
 }
 export function listPlans(service: string, root?: string): WorldApplyPlan[] {
   const dir = plansDir(service, root);
-  if (!existsSync(dir)) return [];
-  return readdirSync(dir).filter((f) => f.endsWith('.json')).map((f) => readJsonFile<WorldApplyPlan>(join(dir, f)));
+  return getActiveWorldStore().list(dir).filter((f) => f.endsWith('.json')).map((f) => readJsonFile<WorldApplyPlan>(join(dir, f)));
 }
 
 export type ApplyResult = { planId: string; leaseId: string; pushed: WorldPushRecord[]; skipped: string[] };
@@ -143,7 +248,7 @@ export type ApplyResult = { planId: string; leaseId: string; pushed: WorldPushRe
  * removing the destructive calls/conflicts themselves does.
  */
 export function planRequiresApproval(plan: WorldApplyPlan): boolean {
-  return plan.conflicts.length > 0 || plan.providerCalls.some((c) => c.destructive);
+  return plan.transactions.length > 0;
 }
 
 /**
@@ -159,9 +264,12 @@ export function planRequiresApproval(plan: WorldApplyPlan): boolean {
 export async function applyPlan(
   plan: WorldApplyPlan,
   writeFn: (call: ProviderCall) => Promise<PushOutcome>,
-  opts: { holder: { kind: 'agent' | 'human' | 'system'; id: string }; leaseId: string; acquiredAt: string; expiresAt: string; occurredAt: string; approve?: boolean; overrideStaleBase?: boolean; root?: string },
+  opts: { holder: { kind: 'agent' | 'human' | 'system'; id: string }; leaseId: string; acquiredAt: string; expiresAt: string; occurredAt: string; overrideStaleBase?: boolean; root?: string },
 ): Promise<ApplyResult> {
-  if (planRequiresApproval(plan) && !opts.approve) throw new Error(`plan ${plan.id} requires approval (conflicts or destructive calls); pass approve:true to apply`);
+  const review = latestPlanReview(plan.service, plan.transactions, opts.root);
+  if (planRequiresApproval(plan) && review?.decision !== 'approved') {
+    throw new Error(`plan ${plan.id} requires approval: record a durable approval for transaction set ${transactionSetId(plan.service, plan.transactions)}`);
+  }
   const localRefView: WorldLocalRef = { service: plan.service, forkId: plan.forkId, baseRemoteRef: plan.baseRemoteRef, recordedAt: plan.createdAt };
   if (isBaseStale(localRefView, opts.root) && !opts.overrideStaleBase) {
     throw new Error(`plan ${plan.id} base (${plan.baseRemoteRef.provider}/${plan.baseRemoteRef.name}) is stale — the remote ref advanced since this plan's base was recorded; rebase and rebuild the plan, or pass overrideStaleBase:true to apply anyway`);

package/src/proxy.ts

@@ -154,9 +154,12 @@ export function createTwinProxy(opts: TwinProxyOptions): TwinProxy {
     }, redirectOrigins);
   });
 
-  // WebSocket / HTTP upgrade passthrough to the app.
+  // WebSocket / HTTP upgrade passthrough — routed by the SAME vendor map as plain
+  // requests, so a vendor whose browser surface speaks WebSocket (a media SFU's
+  // signal path, a realtime API) reaches its twin instead of the app.
   server.on('upgrade', (req, socket, head) => {
-    const target = new URL(req.url || '/', opts.target);
+    const upgradeVendor = vendorForPath(req.url || '/', map);
+    const target = new URL(req.url || '/', upgradeVendor ? map[upgradeVendor].origin : opts.target);
     const upstream = net.connect(Number(target.port || 80), target.hostname, () => {
       upstream.write(`${req.method} ${target.pathname}${target.search} HTTP/${req.httpVersion}\r\n`);
       for (const [name, value] of Object.entries(req.headers)) upstream.write(`${name}: ${value}\r\n`);

package/src/pushLedger.ts

@@ -16,9 +16,10 @@
 // (UnreconciledPushError) unless the caller verifies external state and passes
 // onUnreconciled: 'retry' (mirrors egress.ts's UnreconciledWriteIntentError).
 import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { getActiveWorldStore } from './world-store.ts';
 import { join } from 'node:path';
-import { confirmAction } from './actions.ts';
+import { confirmAction, listActions } from './actions.ts';
+import { remoteRefs } from './shadow.ts';
 import type { SubjectFields } from './shadow.ts';
 import { appendDurable, twinLog, withFileLock, worldPaths } from './storage.ts';
 
@@ -70,7 +71,7 @@ function ledgerLockPath(service: string, root?: string): string {
 
 export function appendPushRecord(record: WorldPushRecord, root?: string): WorldPushRecord {
   const path = ledgerPath(record.service, root);
-  mkdirSync(join(path, '..'), { recursive: true });
+  getActiveWorldStore().mkdir(join(path, '..'));
   appendDurable(path, `${JSON.stringify(record)}\n`);
   twinLog('push.append', { service: record.service, id: record.id, actionId: record.actionId, status: record.status, correlationId: record.correlationId });
   return record;
@@ -78,8 +79,7 @@ export function appendPushRecord(record: WorldPushRecord, root?: string): WorldP
 
 export function listPushLedger(service: string, root?: string): WorldPushRecord[] {
   const path = ledgerPath(service, root);
-  if (!existsSync(path)) return [];
-  return readFileSync(path, 'utf8').split('\n').filter((l) => l.trim()).map((l) => JSON.parse(l) as WorldPushRecord);
+  return getActiveWorldStore().readLines(path).filter((l) => l.trim()).map((l) => JSON.parse(l) as WorldPushRecord);
 }
 
 /** Latest phase per push id (append order is the tiebreak). */
@@ -106,6 +106,86 @@ export class UnreconciledPushError extends Error {
   }
 }
 
+/** Runtime contract R14: the remote moved since this action was authored — a push now
+ *  would overwrite changes we have already observed but never merged (the lost-update
+ *  class two §9 rounds paid for). Fetch + reconcile (reconcile.ts, three-way over the
+ *  stamped base), then revert or re-author the action; there is no rebase. */
+export class NonFastForwardPushError extends Error {
+  readonly pushId: string;
+  /** subjectKey → { base: ref at authoring, current: ref now } for every drifted subject. */
+  readonly drifted: Record<string, { base: string | null; current: string | null }>;
+
+  constructor(pushId: string, drifted: Record<string, { base: string | null; current: string | null }>) {
+    const subjects = Object.keys(drifted).join(', ');
+    super(
+      `Push ${pushId} is not a fast-forward: the observed mirror moved past this action's shadow basis for ${subjects}. ` +
+      `Fetch + reconcile, then revert or re-author the action (or pass onDrift: 'force' only after a reviewed reconcile).`,
+    );
+    this.name = 'NonFastForwardPushError';
+    this.pushId = pushId;
+    this.drifted = drifted;
+  }
+}
+
+/** Compare an action's stamped shadow basis against the mirror's current remote refs.
+ *  Returns the drifted subjects (empty = fast-forward). Unstamped actions (pre-R14
+ *  ledgers, hand-built rows) have nothing to compare — the stamp is the opt-in; the
+ *  skip is logged so ungated pushes stay visible in the audit trail.
+ *
+ *  Ancestry rule (the git semantics): a confirmation of an action authored BEFORE the
+ *  pushed one is a fast-forward (our own earlier push moved the remote — pushing in
+ *  order stacks). A confirmation of an action authored AFTER it counts as DRIFT:
+ *  pushing a stale action once a newer one already landed remotely is the out-of-order
+ *  lost update, and the gate refuses it. */
+function shadowDrift(
+  service: string,
+  actionId: string,
+  root?: string,
+): Record<string, { base: string | null; current: string | null }> {
+  const actions = listActions(service, root);
+  const index = actions.findIndex((a) => a.id === actionId);
+  const basis = index === -1 ? undefined : actions[index]!.shadowBasis;
+  if (!basis) {
+    twinLog('push.drift.unstamped', { service, actionId, found: index !== -1 });
+    return {};
+  }
+  // Descendant confirmations count as drift; ancestor (and the pushed action's own)
+  // confirmations are fast-forward, and ORPHANED confirm events (no confirm row —
+  // confirmAction crash artifacts) stay excluded like they were at stamp time.
+  const ancestorIds = new Set(actions.slice(0, index + 1).map((a) => a.id));
+  const countAsDrift = new Set<string>();
+  for (const a of actions) {
+    if (a.op !== 'confirm' || !a.confirmsActionId || ancestorIds.has(a.confirmsActionId)) continue;
+    for (const id of a.observedEventIds ?? (a.observedEventId ? [a.observedEventId] : [])) countAsDrift.add(id);
+  }
+  const subjects = Object.keys(basis).map((key) => {
+    const sep = key.indexOf(':');
+    return { type: key.slice(0, sep), id: key.slice(sep + 1) };
+  });
+  const current = remoteRefs(service, subjects, root, { countAsDrift });
+  const drifted: Record<string, { base: string | null; current: string | null }> = {};
+  for (const [key, base] of Object.entries(basis)) {
+    if (current[key] !== base) drifted[key] = { base, current: current[key] ?? null };
+  }
+  return drifted;
+}
+
+/**
+ * The R14 gate as a standalone choke, for push paths that do their vendor I/O
+ * themselves: connectors doing `pendingActions → vendor HTTP → confirmAction` call this
+ * IMMEDIATELY BEFORE the vendor write (the sweep enrolling all of them is tracked in the
+ * roadmap; pushTransaction and syncPush are wired already). Throws
+ * NonFastForwardPushError on drift; silent for unstamped actions (logged).
+ *
+ * Honest bound: this check narrows the lost-update window, it cannot close it — a delta
+ * observed between this check and the vendor call still loses; only vendor-side
+ * preconditions (etags, versions) inside the write itself close that residue.
+ */
+export function assertFastForward(service: string, actionId: string, root?: string): void {
+  const drifted = shadowDrift(service, actionId, root);
+  if (Object.keys(drifted).length > 0) throw new NonFastForwardPushError(`push:${service}:${actionId}`, drifted);
+}
+
 /**
  * Drive one local transaction commit through the push phases against the real
  * provider via the injected writeFn (the ONLY real I/O — kernel holds no creds).
@@ -132,10 +212,14 @@ export async function pushTransaction(
     occurredAt: string;
     root?: string;
     onUnreconciled?: 'fail' | 'retry';
+    /** R14 non-fast-forward posture. 'refuse' (default): drifted remote refs abort the
+     *  push with NonFastForwardPushError before any ledger row lands. 'force': push
+     *  anyway — only after a reviewed reconcile has decided the twin's value wins. */
+    onDrift?: 'refuse' | 'force';
   },
   writeFn: () => Promise<PushOutcome>,
 ): Promise<WorldPushRecord> {
-  const { service, action, provider, operation, idempotencyKey, occurredAt, root, onUnreconciled = 'fail' } = opts;
+  const { service, action, provider, operation, idempotencyKey, occurredAt, root, onUnreconciled = 'fail', onDrift = 'refuse' } = opts;
   const pushId = `push:${service}:${action.id}`;
   // Inherit the action's correlationId (D3) so every phase row this push writes joins
   // back to the action row on that id alone. Actions appended after D3 always carry
@@ -147,9 +231,18 @@ export async function pushTransaction(
   // Read (prior status) + decide (terminal replay / unreconciled refusal) + the
   // fresh intent/attempted append, all under one lock — the atomic critical
   // section a cross-process race would otherwise be able to interleave (TWIN-56).
+  let resumeFrom: WorldPushRecord | null = null;
   const early = withFileLock(ledgerLockPath(service, root), (): WorldPushRecord | null => {
     const prior = latestPushByActionId(service, root).get(action.id);
     if (prior && TERMINAL.includes(prior.status)) return prior; // idempotent replay
+    if (prior && (prior.status === 'provider_accepted' || prior.status === 'observed_confirmed')) {
+      // The provider call DEFINITELY landed (final audit M9): a crash between
+      // provider_accepted and the confirm chain must resume the CONFIRM — re-invoking
+      // writeFn here would double-apply against a non-idempotent vendor, strictly worse
+      // than the 'attempted' ambiguity this function already refuses.
+      resumeFrom = prior;
+      return null;
+    }
     if (prior && prior.status === 'attempted' && onUnreconciled === 'fail') {
       throw new UnreconciledPushError(
         pushId,
@@ -157,6 +250,12 @@ export async function pushTransaction(
         `Verify external state, then retry with onUnreconciled: 'retry'.`,
       );
     }
+    // R14 non-fast-forward gate, inside the same critical section as the intent append:
+    // the drift decision and the rows it guards cannot interleave with another pusher.
+    if (onDrift === 'refuse') {
+      const drifted = shadowDrift(service, action.id, root);
+      if (Object.keys(drifted).length > 0) throw new NonFastForwardPushError(pushId, drifted);
+    }
     appendPushRecord({ ...base, status: 'intent' }, root);
     appendPushRecord({ ...base, status: 'attempted' }, root);
     return null;
@@ -164,12 +263,16 @@ export async function pushTransaction(
   if (early) return early;
 
   let outcome: PushOutcome;
-  try {
-    outcome = await writeFn();
-  } catch (error) {
-    return appendPushRecord({ ...base, status: 'failed', error: error instanceof Error ? error.message : String(error) }, root);
+  if (resumeFrom !== null) {
+    outcome = { externalId: (resumeFrom as WorldPushRecord).external?.id ?? '', ...((resumeFrom as WorldPushRecord).data ? { data: (resumeFrom as WorldPushRecord).data } : {}) };
+  } else {
+    try {
+      outcome = await writeFn();
+    } catch (error) {
+      return appendPushRecord({ ...base, status: 'failed', error: error instanceof Error ? error.message : String(error) }, root);
+    }
+    appendPushRecord({ ...base, status: 'provider_accepted', external: { id: outcome.externalId, ...(outcome.url ? { url: outcome.url } : {}) }, ...(outcome.data ? { data: outcome.data } : {}) }, root);
   }
-  appendPushRecord({ ...base, status: 'provider_accepted', external: { id: outcome.externalId, ...(outcome.url ? { url: outcome.url } : {}) }, ...(outcome.data ? { data: outcome.data } : {}) }, root);
 
   // Confirm: append the observed provider fact + map it back, suppressing the local projection.
   const { observedEventId } = confirmAction({ service, actionId: action.id, subject: action.subject, fields: action.fields, occurredAt, root });
@@ -180,10 +283,12 @@ export async function pushTransaction(
 
 /** Mark a push intent abandoned (e.g. operator decided not to push). */
 export function abandonPush(service: string, actionId: string, opts: { root?: string; at?: string; reason?: string } = {}): WorldPushRecord {
+  return withFileLock(ledgerLockPath(service, opts.root), () => {
   const prior = latestPushByActionId(service, opts.root).get(actionId);
   return appendPushRecord({
     id: `push:${service}:${actionId}`, service, actionId, provider: prior?.provider ?? '', operation: prior?.operation ?? '',
     idempotencyKey: prior?.idempotencyKey ?? `abandon:${actionId}`, createdAt: opts.at ?? new Date().toISOString(),
     status: 'abandoned', ...(opts.reason ? { error: opts.reason } : {}),
   }, opts.root);
+  });
 }

package/src/queueLifecycle.ts

@@ -5,9 +5,9 @@
 // poisoned — as an append-only status ledger over the existing queue, so the
 // queue file itself stays immutable delivery history. Current status = the latest
 // transition (default `queued`). Deterministic: caller may supply `at`.
-import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { appendDurable, appendEvent, listQueuedEvents, rebuildGenericState, worldPaths } from './storage.ts';
+import { getActiveWorldStore } from './world-store.ts';
 import type { AppendEventResult, QueuedWorldServiceEvent } from './types.ts';
 
 export type QueueRowStatus = 'queued' | 'committed' | 'ignored' | 'superseded' | 'poisoned';
@@ -35,8 +35,7 @@ function statusPath(service: string, root?: string): string {
 
 function readTransitions(service: string, root?: string): QueueStatusTransition[] {
   const path = statusPath(service, root);
-  if (!existsSync(path)) return [];
-  return readFileSync(path, 'utf8').split('\n').filter((l) => l.trim()).map((l) => JSON.parse(l) as QueueStatusTransition);
+  return getActiveWorldStore().readLines(path).filter((l) => l.trim()).map((l) => JSON.parse(l) as QueueStatusTransition);
 }
 
 /** Latest transition per queue row (append order is the tiebreak — last wins). */
@@ -53,7 +52,7 @@ export function setQueueRowStatus(
   opts: { root?: string; at?: string; reason?: string; eventId?: string; supersededBy?: string } = {},
 ): QueueStatusTransition {
   const path = statusPath(service, opts.root);
-  mkdirSync(join(path, '..'), { recursive: true });
+  getActiveWorldStore().mkdir(join(path, '..'));
   const transition: QueueStatusTransition = {
     queueId,
     status,