@wjarka/cezarion 0.15.1 → 0.16.0

package/dist/runs/legacy-index.js

@@ -0,0 +1,168 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, fstatSync, fsyncSync, linkSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { anotherCockpitOwner } from '../server/cockpit-ownership.js';
+/**
+ * The legacy run index at the moment `runs.db` imports it (#779, plan step 4): its exact bytes,
+ * a durable copy of them beside it, and the checks that no older cezar is still writing it.
+ *
+ * An older cezar writes only `runs.json` and knows nothing of `runs.db`, so importing while one
+ * still runs would freeze a file that keeps moving. Two signals say one does:
+ * - a live cockpit other than this process holds `cockpit.lock`. A new cockpit takes that lock
+ *   before it opens its store, so with no import done yet the holder is an older cockpit (v0.15.1
+ *   and later write the lock), or a new one about to import, which a retry lets finish first;
+ * - `runs.json` is not the file that was read. Older cezars save it by temp file and rename, so
+ *   every save replaces the inode, and a save during the import shows.
+ * An older process that holds no lock (a `cez run`, a cockpit before v0.15.1) and saves nothing
+ * while the import runs is not seen; whatever it writes later is never imported.
+ */
+/** The legacy index (#779): read once, imported into `runs.db`, never written again. */
+export const LEGACY_INDEX_FILE = 'runs.json';
+/** The exact bytes `runs.json` held when it was imported, kept beside it. */
+export const LEGACY_INDEX_BACKUP_FILE = 'runs.json.pre-sqlite.bak';
+const identityOf = (stats) => ({ dev: stats.dev, ino: stats.ino, size: stats.size, mtimeMs: stats.mtimeMs });
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+/** `path` read in one go through one descriptor, so its bytes and identity belong together.
+ *  Undefined when there is no such file. */
+export function readLegacyIndex(path) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    try {
+        const identity = identityOf(fstatSync(fd));
+        const bytes = readFileSync(fd);
+        return { bytes, sha256: sha256(bytes), identity };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Whether `path` holds exactly `snapshot`'s bytes. */
+function holds(path, snapshot) {
+    try {
+        if (statSync(path).size !== snapshot.bytes.length)
+            return false;
+        return sha256(readFileSync(path)) === snapshot.sha256;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Create `path` holding `bytes`, durably and never half-written: a temp file is written and
+ * synced, then linked into place, which refuses a name that already exists. False when it does.
+ * The directory is synced too, so a crash cannot forget the new name. A file system without hard
+ * links gets a rename, guarded by an existence check instead.
+ */
+function createDurably(path, bytes) {
+    const temp = `${path}.${randomUUID()}.tmp`;
+    // Removed on every way out, a failed write (ENOSPC) included: the name is either linked or gone.
+    try {
+        const fd = openSync(temp, 'wx');
+        try {
+            for (let written = 0; written < bytes.length;)
+                written += writeSync(fd, bytes, written);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        try {
+            linkSync(temp, path);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'EEXIST')
+                return false;
+            if (code !== 'EPERM' && code !== 'ENOTSUP' && code !== 'EXDEV')
+                throw error;
+            if (statSync(path, { throwIfNoEntry: false }))
+                return false;
+            renameSync(temp, path);
+        }
+    }
+    finally {
+        try {
+            unlinkSync(temp);
+        }
+        catch { /* never created, or renamed into place */ }
+    }
+    syncDirectory(path);
+    return true;
+}
+function syncDirectory(path) {
+    let fd;
+    try {
+        fd = openSync(dirname(path), 'r');
+        fsyncSync(fd);
+    }
+    catch {
+        // Not every platform can sync a directory; the file itself is already synced.
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * Keep `snapshot`'s exact bytes beside `runs.json` and answer the backup's file name. An existing
+ * `runs.json.pre-sqlite.bak` is trusted only when it holds those very bytes (same size and
+ * sha256). One that does not — an earlier snapshot, a file a crash cut short — is never touched:
+ * the bytes go to `runs.json.pre-sqlite.<sha256 prefix>.bak` instead.
+ *
+ * The import calls this only inside its transaction, once nothing can refuse it any more: an
+ * attempt an older cezar's writes refuse leaves no backup, so retries cannot multiply them.
+ */
+export function backUpLegacyIndex(dataDir, snapshot) {
+    for (const name of [LEGACY_INDEX_BACKUP_FILE, `runs.json.pre-sqlite.${snapshot.sha256.slice(0, 12)}.bak`]) {
+        const path = join(dataDir, name);
+        if (holds(path, snapshot))
+            return name;
+        // Re-checked only after creating it: a file this did not create may hold other bytes.
+        if (createDurably(path, snapshot.bytes) || holds(path, snapshot))
+            return name;
+    }
+    throw new Error(`cannot back up ${LEGACY_INDEX_FILE}: both backup names are taken by other contents`);
+}
+/** An older cezar still writes `runs.json`, so it was not imported. */
+export class LegacyWriterError extends Error {
+    /** `cockpit`: a live cockpit other than this process holds `cockpit.lock`. `changed`: the file
+     *  changed between the read and the import. */
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'LegacyWriterError';
+        this.reason = reason;
+    }
+}
+/** Throw `LegacyWriterError` when a live cockpit other than this process owns `dataDir`. Cheap: one
+ *  small file read and a liveness probe, so the import asks it before it reads anything. */
+export function assertNoLegacyCockpit(dataDir) {
+    const owner = anotherCockpitOwner(dataDir);
+    if (owner) {
+        throw new LegacyWriterError('cockpit', `An older cezar (pid ${owner.pid}${owner.url ? ` at ${owner.url}` : ''}) still serves this project and writes ${LEGACY_INDEX_FILE}. Stop it, then restart cezar: ${LEGACY_INDEX_FILE} is imported once, while nothing else writes it.`);
+    }
+}
+/**
+ * Throw `LegacyWriterError` when an older cezar may still be writing `runs.json`: another live
+ * cockpit owns `dataDir` (`assertNoLegacyCockpit`), or the file is no longer what `snapshot` read
+ * (undefined: there was none). Inside the import transaction, right before it commits, this is
+ * the authority; asked earlier it only saves the work of an import that could not commit.
+ */
+export function assertNoLegacyWriter(dataDir, snapshot) {
+    assertNoLegacyCockpit(dataDir);
+    const now = statSync(join(dataDir, LEGACY_INDEX_FILE), { throwIfNoEntry: false });
+    const read = snapshot?.identity;
+    const same = now === undefined ? read === undefined
+        : read !== undefined && now.dev === read.dev && now.ino === read.ino && now.size === read.size && now.mtimeMs === read.mtimeMs;
+    if (!same) {
+        throw new LegacyWriterError('changed', `${LEGACY_INDEX_FILE} changed while cezar was importing it: an older cezar process still writes it. Stop every older cezar process for this project, then restart cezar.`);
+    }
+}
+//# sourceMappingURL=legacy-index.js.map

package/dist/runs/legacy-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-index.js","sourceRoot":"","sources":["../../src/runs/legacy-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AACrJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;;;;;;;;;;GAaG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAC7C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAiBnE,MAAM,UAAU,GAAG,CAAC,KAAY,EAAgB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAClI,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE3F;4CAC4C;AAC5C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,SAAS,KAAK,CAAC,IAAY,EAAE,QAA6B;IACxD,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChE,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAC3C,iGAAiG;IACjG,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM;gBAAG,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACxF,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACpC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,KAAK,CAAC;YAC5E,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5D,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IAChF,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;IAChF,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAA6B;IAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,wBAAwB,EAAE,wBAAwB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,sFAAsF;QACtF,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,iBAAiB,iDAAiD,CAAC,CAAC;AACxG,CAAC;AAED,uEAAuE;AACvE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C;mDAC+C;IACtC,MAAM,CAAwB;IAEvC,YAAY,MAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;4FAC4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,uBAAuB,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,0CAA0C,iBAAiB,kCAAkC,iBAAiB,kDAAkD,CAAC,CAAC;IACjR,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,QAAyC;IAC7F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;QACjD,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC;IACjI,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,iBAAiB,qJAAqJ,CAAC,CAAC;IACpN,CAAC;AACH,CAAC"}

package/dist/runs/raw-record.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The raw-record codec (#779, plan step 4): a run row keeps what this cezar cannot read.
+ *
+ * A record goes through the runtime schema on the way in, and zod drops every key it does not
+ * declare. Before this codec, the next write serialized the parsed record, so a field an older or
+ * newer cezar stored was lost the first time this one touched the run. Now the parse still
+ * produces the unchanged runtime record, and `collectRawExtras` notes, beside it, what the stored
+ * JSON held that the parse dropped. A write goes through `encodeRawRecord`: every field the
+ * runtime record has is written exactly as it is now, so changes and deletions of known fields
+ * apply at every depth, and the dropped fields go back in wherever their parent still exists.
+ *
+ * Plain JSON only: nothing here knows the run schema. Arrays whose elements all carry a distinct
+ * string `id` (steps, queued messages) are matched by that id, so an unknown field follows its
+ * step through reordering, insertion and removal. Any other array is matched by position, and
+ * only while its known content is exactly what was read; once the runtime changes it, the array is
+ * written as the runtime has it and whatever unknown fields it carried are dropped with it.
+ */
+/** What one stored record held beyond its parse. Opaque outside this module. */
+export type RawExtras = ObjectExtras | KeyedArrayExtras | IndexedArrayExtras;
+interface ObjectExtras {
+    kind: 'object';
+    /** Keys the parse dropped, with their stored values. */
+    fields: Map<string, unknown>;
+    /** Keys the parse kept whose values hold dropped fields further down. */
+    children: Map<string, RawExtras>;
+}
+interface KeyedArrayExtras {
+    kind: 'keyed';
+    elements: Map<string, RawExtras>;
+}
+interface IndexedArrayExtras {
+    kind: 'indexed';
+    /** The array's known content when it was read: the extras apply only while it is unchanged. */
+    known: string;
+    elements: Map<number, RawExtras>;
+}
+/**
+ * What `raw` (a record as stored) holds that `parsed` (the same record through the runtime schema)
+ * does not: undefined when the parse kept every stored field, which is the common case and makes
+ * every later write a plain `JSON.stringify`. Defaults the parse added are not extras.
+ */
+export declare function collectRawExtras(raw: unknown, parsed: unknown): RawExtras | undefined;
+/**
+ * The JSON to store for `record`: exactly `JSON.stringify(record)` without extras, else the record
+ * with every extra that still fits put back. `extras` in the result is what the stored JSON now
+ * holds beyond the record, for the next write of the same row.
+ */
+export declare function encodeRawRecord(record: unknown, extras: RawExtras | undefined): {
+    data: string;
+    extras: RawExtras | undefined;
+};
+export {};

package/dist/runs/raw-record.js

@@ -0,0 +1,145 @@
+/**
+ * The raw-record codec (#779, plan step 4): a run row keeps what this cezar cannot read.
+ *
+ * A record goes through the runtime schema on the way in, and zod drops every key it does not
+ * declare. Before this codec, the next write serialized the parsed record, so a field an older or
+ * newer cezar stored was lost the first time this one touched the run. Now the parse still
+ * produces the unchanged runtime record, and `collectRawExtras` notes, beside it, what the stored
+ * JSON held that the parse dropped. A write goes through `encodeRawRecord`: every field the
+ * runtime record has is written exactly as it is now, so changes and deletions of known fields
+ * apply at every depth, and the dropped fields go back in wherever their parent still exists.
+ *
+ * Plain JSON only: nothing here knows the run schema. Arrays whose elements all carry a distinct
+ * string `id` (steps, queued messages) are matched by that id, so an unknown field follows its
+ * step through reordering, insertion and removal. Any other array is matched by position, and
+ * only while its known content is exactly what was read; once the runtime changes it, the array is
+ * written as the runtime has it and whatever unknown fields it carried are dropped with it.
+ */
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** The ids of an array whose every element is an object with a distinct string `id`. */
+function elementIds(array) {
+    const ids = array.map((element) => (isObject(element) && typeof element.id === 'string' ? element.id : undefined));
+    if (ids.length === 0 || ids.some((id) => id === undefined) || new Set(ids).size !== ids.length)
+        return undefined;
+    return ids;
+}
+/**
+ * What `raw` (a record as stored) holds that `parsed` (the same record through the runtime schema)
+ * does not: undefined when the parse kept every stored field, which is the common case and makes
+ * every later write a plain `JSON.stringify`. Defaults the parse added are not extras.
+ */
+export function collectRawExtras(raw, parsed) {
+    if (isObject(raw) && isObject(parsed)) {
+        const fields = new Map();
+        const children = new Map();
+        for (const [key, value] of Object.entries(raw)) {
+            if (value === undefined)
+                continue;
+            if (parsed[key] === undefined) {
+                fields.set(key, value);
+                continue;
+            }
+            const child = collectRawExtras(value, parsed[key]);
+            if (child)
+                children.set(key, child);
+        }
+        return fields.size > 0 || children.size > 0 ? { kind: 'object', fields, children } : undefined;
+    }
+    if (!Array.isArray(raw) || !Array.isArray(parsed))
+        return undefined;
+    const rawIds = elementIds(raw);
+    const parsedIds = elementIds(parsed);
+    if (rawIds && parsedIds) {
+        const byId = new Map(parsedIds.map((id, index) => [id, parsed[index]]));
+        const elements = new Map();
+        rawIds.forEach((id, index) => {
+            const child = byId.has(id) ? collectRawExtras(raw[index], byId.get(id)) : undefined;
+            if (child)
+                elements.set(id, child);
+        });
+        return elements.size > 0 ? { kind: 'keyed', elements } : undefined;
+    }
+    // Positions only line up while the parse kept every element.
+    if (raw.length !== parsed.length)
+        return undefined;
+    const elements = new Map();
+    raw.forEach((element, index) => {
+        const child = collectRawExtras(element, parsed[index]);
+        if (child)
+            elements.set(index, child);
+    });
+    return elements.size > 0 ? { kind: 'indexed', known: JSON.stringify(parsed), elements } : undefined;
+}
+/** `current` with `extras` put back where they still fit, and the extras that did. Never changes
+ *  `current`: only the containers on the way to a restored field are copied. */
+function merge(current, extras) {
+    if (extras.kind === 'object') {
+        if (!isObject(current))
+            return [current, undefined];
+        const out = { ...current };
+        const fields = new Map();
+        const children = new Map();
+        for (const [key, value] of extras.fields) {
+            // A key the runtime now has a value for is its own: it was dropped as unreadable before.
+            if (out[key] !== undefined)
+                continue;
+            out[key] = value;
+            fields.set(key, value);
+        }
+        for (const [key, child] of extras.children) {
+            // The known parent is gone: everything stored under it goes with it.
+            if (out[key] === undefined)
+                continue;
+            const [value, kept] = merge(out[key], child);
+            out[key] = value;
+            if (kept)
+                children.set(key, kept);
+        }
+        if (fields.size === 0 && children.size === 0)
+            return [current, undefined];
+        return [out, { kind: 'object', fields, children }];
+    }
+    if (!Array.isArray(current))
+        return [current, undefined];
+    if (extras.kind === 'keyed') {
+        const elements = new Map();
+        const out = current.map((element) => {
+            const id = isObject(element) && typeof element.id === 'string' ? element.id : undefined;
+            const child = id === undefined ? undefined : extras.elements.get(id);
+            if (!child)
+                return element;
+            const [value, kept] = merge(element, child);
+            if (kept)
+                elements.set(id, kept);
+            return value;
+        });
+        return elements.size > 0 ? [out, { kind: 'keyed', elements }] : [current, undefined];
+    }
+    if (JSON.stringify(current) !== extras.known)
+        return [current, undefined];
+    const elements = new Map();
+    const out = current.map((element, index) => {
+        const child = extras.elements.get(index);
+        if (!child)
+            return element;
+        const [value, kept] = merge(element, child);
+        if (kept)
+            elements.set(index, kept);
+        return value;
+    });
+    return elements.size > 0 ? [out, { kind: 'indexed', known: extras.known, elements }] : [current, undefined];
+}
+/**
+ * The JSON to store for `record`: exactly `JSON.stringify(record)` without extras, else the record
+ * with every extra that still fits put back. `extras` in the result is what the stored JSON now
+ * holds beyond the record, for the next write of the same row.
+ */
+export function encodeRawRecord(record, extras) {
+    if (!extras)
+        return { data: JSON.stringify(record), extras: undefined };
+    const [value, kept] = merge(record, extras);
+    return { data: JSON.stringify(value), extras: kept };
+}
+//# sourceMappingURL=raw-record.js.map

package/dist/runs/raw-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-record.js","sourceRoot":"","sources":["../../src/runs/raw-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA2BH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,wFAAwF;AACxF,SAAS,UAAU,CAAC,KAAyB;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACnH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACjH,OAAO,GAAe,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,MAAe;IAC5D,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACnD,IAAI,KAAK;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAU,CAAC,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,KAAK;gBAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IACD,6DAA6D;IAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,IAAI,KAAK;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtG,CAAC;AAED;gFACgF;AAChF,SAAS,KAAK,CAAC,OAAgB,EAAE,MAAiB;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,GAAG,GAAe,EAAE,GAAG,OAAO,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACzC,yFAAyF;YACzF,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS;YACrC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,qEAAqE;YACrE,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS;YACrC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7C,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACjB,IAAI,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,MAAM,KAAK,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK;gBAAE,OAAO,OAAO,CAAC;YAC3B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,EAAG,EAAE,IAAI,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,KAAK;QAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,IAAI;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe,EAAE,MAA6B;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC"}

package/dist/runs/retention.d.ts

@@ -1,23 +1,28 @@
+import type { PreviewHostLike } from '../preview/registration.ts';
 import type { RunRecord } from './store.ts';
 /** A run is reclaimable when it is finished, still has a materialized worktree
  *  directory, and has not already been reclaimed. Finished owned workers count
  *  (#575) once their parent is gone or `done` (collection-gated). A live,
  *  failed, or cancelled parent can still collect/diff from the dir. Live runs,
- *  `review`, `invalid`, and workers mid-destroy do not. */
-export declare function isReclaimable(run: RunRecord, runs?: readonly RunRecord[]): boolean;
+ *  `review`, `invalid`, and workers mid-destroy do not. `lookup` finds the parent
+ *  by id (the store's `getRun`; a parent need not have a worktree of its own). */
+export declare function isReclaimable(run: RunRecord, lookup?: (id: string) => RunRecord | undefined): boolean;
 /**
- * Given every run and the keep-count `keep`, return the ids of the finished
+ * Given the runs with a worktree and the keep-count `keep`, return the ids of the finished
  * worktrees whose *directory* should be reclaimed: keep the `keep`
- * most-recently-finished reclaimable worktrees, reclaim the rest.
+ * most-recently-finished reclaimable worktrees, reclaim the rest. `lookup` finds an owned
+ * worker's parent; without it, the parent is looked for among `runs`.
  *
  * `keep === 0` means "unlimited — never auto-reclaim" and returns `[]`.
  * Pure: no I/O, no mutation of the input.
  */
-export declare function selectReclaimableWorktrees(runs: readonly RunRecord[], keep: number): string[];
+export declare function selectReclaimableWorktrees(runs: readonly RunRecord[], keep: number, lookup?: (id: string) => RunRecord | undefined): string[];
 /** The slice of the runs store the enforcer needs. Kept structural so the
  *  enforcer stays easy to test and never imports the concrete store. */
 export interface RetentionStore {
-    listRuns(): RunRecord[];
+    /** The candidates: runs with a materialized worktree (an indexed query, #779). */
+    listRunsWithWorktree(): RunRecord[];
+    getRun(id: string): RunRecord | undefined;
     updateRun(id: string, patch: {
         worktreeReclaimedAt?: string;
     }): unknown;
@@ -70,6 +75,8 @@ export interface ReclaimOptions {
      *  worker's evidence snapshot; a person pressing Reclaim on one row (issue 08 §B4) is not shown
      *  that a diff snapshot drops binary content and caps its size, so that path asks for clean. */
     requireClean?: boolean;
+    /** The workspace preview host (#781): the default reclaimer releases the run's preview first. */
+    previewHost?: Pick<PreviewHostLike, 'release'>;
 }
 export declare function reclaimWorktrees(repoRoot: string, store: RetentionStore, keep: number, opts?: ReclaimOptions): Promise<string[]>;
 /**

package/dist/runs/retention.js

@@ -6,8 +6,9 @@
 // is pure and unit-testable; the enforcer never throws (helper discipline).
 import { existsSync } from 'node:fs';
 import { collectWorkerEvidence } from '../delegation/results.js';
-import { createWorktree, removeWorktree } from '../git-worktree.js';
-/** The "finished" status set — mirrors `RunStore.archiveFinished`. A run at the
+import { createWorktree } from '../git-worktree.js';
+import { releaseThenRemoveWorktree } from '../git-worktree-release.js';
+/** The "finished" status set — mirrors the statuses `RunStore.archiveFinished` sweeps. A run at the
  *  `review` gate is deliberately excluded: it still needs its worktree to render
  *  the diff and open a draft PR, so reclaiming it would break the gate. */
 const FINISHED = new Set(['done', 'failed', 'cancelled']);
@@ -21,8 +22,9 @@ function recencyKey(run) {
  *  directory, and has not already been reclaimed. Finished owned workers count
  *  (#575) once their parent is gone or `done` (collection-gated). A live,
  *  failed, or cancelled parent can still collect/diff from the dir. Live runs,
- *  `review`, `invalid`, and workers mid-destroy do not. */
-export function isReclaimable(run, runs = []) {
+ *  `review`, `invalid`, and workers mid-destroy do not. `lookup` finds the parent
+ *  by id (the store's `getRun`; a parent need not have a worktree of its own). */
+export function isReclaimable(run, lookup = () => undefined) {
     if (run.delegation?.role === 'invalid')
         return false;
     if (run.delegation?.role === 'worker' && run.delegation.destroy)
@@ -30,8 +32,7 @@ export function isReclaimable(run, runs = []) {
     if (!FINISHED.has(run.status) || !run.worktreePath || !existsSync(run.worktreePath) || run.worktreeReclaimedAt)
         return false;
     if (run.delegation?.role === 'worker') {
-        const parentId = run.delegation.parentRunId;
-        const parent = runs.find((candidate) => candidate.id === parentId);
+        const parent = lookup(run.delegation.parentRunId);
         // `done` is collection-gated. failed/cancelled parents can still collect later.
         if (parent && parent.status !== 'done')
             return false;
@@ -39,18 +40,19 @@ export function isReclaimable(run, runs = []) {
     return true;
 }
 /**
- * Given every run and the keep-count `keep`, return the ids of the finished
+ * Given the runs with a worktree and the keep-count `keep`, return the ids of the finished
  * worktrees whose *directory* should be reclaimed: keep the `keep`
- * most-recently-finished reclaimable worktrees, reclaim the rest.
+ * most-recently-finished reclaimable worktrees, reclaim the rest. `lookup` finds an owned
+ * worker's parent; without it, the parent is looked for among `runs`.
  *
  * `keep === 0` means "unlimited — never auto-reclaim" and returns `[]`.
  * Pure: no I/O, no mutation of the input.
  */
-export function selectReclaimableWorktrees(runs, keep) {
+export function selectReclaimableWorktrees(runs, keep, lookup = (id) => runs.find((run) => run.id === id)) {
     if (!Number.isFinite(keep) || keep <= 0)
         return [];
     const reclaimable = runs
-        .filter((run) => isReclaimable(run, runs))
+        .filter((run) => isReclaimable(run, lookup))
         .sort((a, b) => (recencyKey(a) < recencyKey(b) ? 1 : recencyKey(a) > recencyKey(b) ? -1 : 0));
     return reclaimable.slice(keep).map((r) => r.id);
 }
@@ -95,10 +97,10 @@ async function preserveWorkerResult(repoRoot, store, run) {
     return evidence.diffSnapshot !== undefined || evidence.result.diff.state === 'available';
 }
 export async function reclaimWorktrees(repoRoot, store, keep, opts = {}) {
-    const runs = store.listRuns();
+    const runs = store.listRunsWithWorktree();
     const byId = new Map(runs.map((r) => [r.id, r]));
     const reclaimed = [];
-    for (const id of selectReclaimableWorktrees(runs, keep)) {
+    for (const id of selectReclaimableWorktrees(runs, keep, (parentId) => store.getRun(parentId))) {
         const run = byId.get(id);
         if (run && (await reclaimWorktree(repoRoot, store, run, opts)))
             reclaimed.push(id);
@@ -119,15 +121,41 @@ export async function reclaimWorktree(repoRoot, store, run, opts = {}) {
     // Branch kept. An owned worker's evidence (uncommitted diff included) is snapshotted first; any
     // other run's uncommitted work lives only in the directory, so a dirty one is left for later.
     const onlyClean = opts.requireClean === true || run.delegation?.role !== 'worker';
-    const remove = opts.remove ?? ((root, path) => removeWorktree(root, path, undefined, { reclaimOwnedDirectory: true, onlyClean }));
+    const execution = run.delegation?.role === 'worker' ? store.readWorkerExecution?.(run.id) : undefined;
+    const assertSafe = () => {
+        if (run.delegation?.role !== 'worker')
+            return;
+        const real = store;
+        // Structural test stores have no private execution machinery. Real stores must attest both
+        // generation ownership and fresh resource holders, including after async evidence/preview.
+        if (typeof real.workerResourcesSafe === 'function' && (!execution ||
+            !real.workerResourcesSafe(run.id, execution.generation, run.delegation.workspace.resourceId)))
+            throw Error('Worker resources are not safe to reclaim');
+    };
+    const remove = opts.remove ?? ((root, path) => releaseThenRemoveWorktree({ previewHost: opts.previewHost }, run.id, root, path, undefined, { reclaimOwnedDirectory: true, onlyClean, assertCurrent: assertSafe }));
     if (!run.worktreePath)
         return null;
     const release = opts.claim ? opts.claim(run) : () => undefined;
     if (!release)
         return null; // in use since it was selected
+    // Claimed in the run database too, for the whole reclaim (#779, plan step 3): no other cezar
+    // process writes this run or reclaims it meanwhile, and another process's run is left alone.
+    // Structural test stores have no claims.
+    const real = store;
+    let pinned = typeof real.pin !== 'function';
+    try {
+        pinned ||= real.pin.call(store, run.id, 'cleanup') !== undefined;
+    }
+    catch { /* busy: not claimed */ }
+    if (!pinned) {
+        release();
+        return null;
+    }
     try {
         if (!(await preserveWorkerResult(repoRoot, store, run).catch(() => false)))
             return null;
+        if (opts.remove)
+            assertSafe(); // injected reclaimer has no final callback
         await remove(repoRoot, run.worktreePath);
         if (existsSync(run.worktreePath))
             return null; // reclaim failed; retry next pass
@@ -140,6 +168,7 @@ export async function reclaimWorktree(repoRoot, store, run, opts = {}) {
         return null;
     }
     finally {
+        real.unpin?.call(store, run.id, 'cleanup');
         release();
     }
 }

package/dist/runs/retention.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../src/runs/retention.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpE;;2EAE2E;AAC3E,MAAM,QAAQ,GAA2B,IAAI,GAAG,CAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAE7F;;kFAEkF;AAClF,SAAS,UAAU,CAAC,GAAc;IAChC,OAAO,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;AACzC,CAAC;AAED;;;;2DAI2D;AAC3D,MAAM,UAAU,aAAa,CAAC,GAAc,EAAE,IAAI,GAAyB,EAAE;IAC3E,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC7H,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QACnE,gFAAgF;QAChF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA0B,EAAE,IAAY;IACjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI;SACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAeD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAgB,EAChB,KAAyB,EACzB,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,GAAG,EAAE,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,EAAE,UAAU,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC;QAChE,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAgCD;;gEAEgE;AAChE,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,KAAqB,EAAE,GAAc;IACzF,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAI,KAA2B,CAAC,kBAAkB,CAAC;IAC/D,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAiB,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,KAAqB,EACrB,IAAY,EACZ,IAAI,GAAmB,EAAE;IAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,KAAqB,EACrB,GAAc,EACd,IAAI,GAAmB,EAAE;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,gGAAgG;IAChG,8FAA8F;IAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClI,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAC1D,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxF,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;QACjF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;QACpB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../src/runs/retention.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAIvE;;2EAE2E;AAC3E,MAAM,QAAQ,GAA2B,IAAI,GAAG,CAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAE7F;;kFAEkF;AAClF,SAAS,UAAU,CAAC,GAAc;IAChC,OAAO,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;AACzC,CAAC;AAED;;;;;kFAKkF;AAClF,MAAM,UAAU,aAAa,CAAC,GAAc,EAAE,MAAM,GAA0C,GAAG,EAAE,CAAC,SAAS;IAC3G,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC7H,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAClD,gFAAgF;QAChF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAA0B,EAC1B,IAAY,EACZ,MAAM,GAA0C,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;IAEzF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI;SACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAiBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAgB,EAChB,KAAyB,EACzB,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,GAAG,EAAE,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,EAAE,UAAU,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC;QAChE,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAkCD;;gEAEgE;AAChE,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,KAAqB,EAAE,GAAc;IACzF,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAI,KAA2B,CAAC,kBAAkB,CAAC;IAC/D,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAiB,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,KAAqB,EACrB,IAAY,EACZ,IAAI,GAAmB,EAAE;IAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,0BAA0B,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,KAAqB,EACrB,GAAc,EACd,IAAI,GAAmB,EAAE;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,gGAAgG;IAChG,8FAA8F;IAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC;IAClF,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,KAA2B,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7H,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,KAA0B,CAAC;QACxC,2FAA2F;QAC3F,2FAA2F;QAC3F,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS;YAC/D,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC3J,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAC5C,yBAAyB,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EACxF,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAC1D,6FAA6F;IAC7F,6FAA6F;IAC7F,yCAAyC;IACzC,MAAM,IAAI,GAAG,KAA0B,CAAC;IACxC,IAAI,MAAM,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC;IAC5C,IAAI,CAAC;QAAC,MAAM,KAAK,IAAI,CAAC,GAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxF,IAAI,IAAI,CAAC,MAAM;YAAE,UAAU,EAAE,CAAC,CAAC,2CAA2C;QAC1E,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;QACjF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;QACpB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/runs/run-claims.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Who owns a run claim, and whether that owner can still be writing (#779, plan step 3).
+ *
+ * A claim in `run_claims` names the RunStore that holds a delegation family: a session id (one per
+ * `RunStore.open`), its process id, and that process's start identity (`processStartToken`: the
+ * Linux `/proc/<pid>/stat` start time scoped by boot id, or macOS `ps -o lstart`). Only a PROVEN
+ * dead owner's claim may be taken over: its pid is gone, the pid now belongs to a process with a
+ * different start identity, or — for our own pid, which can only be this process or a dead earlier
+ * one — its session is not open here. Anything that cannot be proven dead counts as live, which is
+ * what a claim with no start identity on a pid that exists is: there is nothing to compare it with.
+ */
+export interface ClaimOwner {
+    session: string;
+    pid: number;
+    /** Null only where the platform cannot read a start identity. */
+    startToken: string | null;
+}
+/** A fresh owner identity for one store, live until `closeClaimSession`. */
+export declare function openClaimSession(): ClaimOwner;
+/** The store behind `session` is gone: any claim it left behind is now provably dead. */
+export declare function closeClaimSession(session: string): void;
+/** Whether the owner of `claim` may still be writing. False only when it is proven gone. */
+export declare function claimOwnerLive(claim: ClaimOwner): boolean;

package/dist/runs/run-claims.js

@@ -0,0 +1,24 @@
+import { randomUUID } from 'node:crypto';
+import { isCurrentProcess, processStartToken, recordedProcessLive } from '../delegation/process-liveness.js';
+/** The sessions open in this process: the only way to tell two stores in one process apart. */
+const openSessions = new Set();
+let ownStartToken;
+/** A fresh owner identity for one store, live until `closeClaimSession`. */
+export function openClaimSession() {
+    ownStartToken ??= processStartToken(process.pid) ?? null;
+    const owner = { session: randomUUID(), pid: process.pid, startToken: ownStartToken };
+    openSessions.add(owner.session);
+    return owner;
+}
+/** The store behind `session` is gone: any claim it left behind is now provably dead. */
+export function closeClaimSession(session) {
+    openSessions.delete(session);
+}
+/** Whether the owner of `claim` may still be writing. False only when it is proven gone. */
+export function claimOwnerLive(claim) {
+    const entry = { pid: claim.pid, ...(claim.startToken === null ? {} : { startToken: claim.startToken }) };
+    if (claim.pid === process.pid)
+        return isCurrentProcess(entry) && openSessions.has(claim.session);
+    return recordedProcessLive(entry);
+}
+//# sourceMappingURL=run-claims.js.map

package/dist/runs/run-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-claims.js","sourceRoot":"","sources":["../../src/runs/run-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAqB7G,+FAA+F;AAC/F,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;AACvC,IAAI,aAAwC,CAAC;AAE7C,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB;IAC9B,aAAa,KAAK,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IACrF,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;IACzG,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjG,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}