@zixcel/projection-runtime 0.0.0-stage → 0.10.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-PREVIOUS

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 NuxtJP contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,5 @@
+
+projection-runtime
+Copyright 2026 HAT Inc.
+Licensed under the Apache License, Version 2.0; see LICENSE.
+Earlier permissions and attribution remain in accompanying LICENSE-* files.

package/README.md

@@ -1,3 +1,72 @@
-# Temporary Holding Version
+# @zixcel/projection-runtime
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Execute explicitly registered projection producers in bounded Node.js workers and
+publish disposable read-only snapshots with durable fencing and exact owner leases.
+The runtime never chooses a latest source, loads request-supplied code or owns
+application authorization. Owner adapters decide visibility and retention.
+
+## Install and use
+
+```sh
+npm install @zixcel/projection-runtime@0.10.0
+```
+
+```ts
+import { ProducerRegistry, ProjectionRuntime, ExactSourceReader } from '@zixcel/projection-runtime'
+import { FileProjectionStore } from '@zixcel/projection-runtime/store'
+
+const registry = new ProducerRegistry()
+const producer = registry.register({ id: 'review', kind: 'data' })
+// Provision this existing parent as mode 0700 before creating the store once.
+const store = FileProjectionStore.create('/private/application/projections')
+// adapters is a Map of owner IDs to bounded acquire/read/release/releaseHolder APIs.
+const reader = new ExactSourceReader(adapters)
+const runtime = new ProjectionRuntime({ store, registry, reader })
+try {
+  const { snapshot } = await runtime.submit({
+    key: 'review', producer, sources: exactOwnerReferences,
+    focus: 'selected-resources', purpose: 'review', visibilityRef: acceptedVisibility,
+    limits: {}
+  }, { accessRef: acceptedOwnerAccess })
+  console.log(snapshot.revision)
+} finally {
+  await runtime.close()
+}
+```
+
+The application supplies `adapters`, `exactOwnerReferences`, `acceptedVisibility`
+and `acceptedOwnerAccess`; these are explicit authorization bindings, not defaults.
+A producer must be registered before requests can reference its returned identity.
+
+## Boundaries and operating environment
+
+The file store requires Linux/WSL, Node.js 22 or newer, `/usr/bin/flock` and
+`/usr/bin/setpriv`. It rejects non-private directories, foreign ownership, symbolic
+links and hard-linked state files. It runs local transaction helpers and built-in
+producer workers; it does not execute arbitrary owner commands. It does not provide
+an OS sandbox against another process running as the same user.
+
+Store hints are wakeups, not revision authorities. Read/inspect never initializes
+state. Repair leases preserve exact source identity, and cancelled or timed-out
+work must drain before protection is released. Owner IO must honor its deadline
+and AbortSignal, including independently bounded lost-response cleanup.
+
+`@zixcel/projection-contracts` owns wire validation and deterministic sealing;
+projection-client owns disposable browser adoption; dom-renderer owns presentation.
+This package owns execution/publication and no product-specific meaning.
+
+## Development
+
+```sh
+pnpm install --frozen-lockfile --ignore-scripts
+pnpm -r --include-workspace-root typecheck
+pnpm -r --include-workspace-root test
+pnpm audit --audit-level=low
+```
+
+Production manifests use registry versions. Numeric workspace linking is only a
+local development convenience. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+
+## Package ownership and scope migration
+
+[保守正本と移行条件](docs/package-ownership.ja.md)。The maintained source and npm scope are owned by Zixcel. New `@zixcel` names require their first registry publication before downstream dependency migration. Existing `@hathq` releases remain historical distributions.

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@zixcel/projection-runtime",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.10.0",
+  "type": "module",
+  "license": "Apache-2.0",
+  "description": "Bounded read-only producer execution and disposable durable projection publication",
+  "engines": {
+    "node": ">=22"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "LICENSE-PREVIOUS"
+  ],
+  "exports": {
+    ".": {
+      "types": "./src/runtime.d.mts",
+      "import": "./src/runtime.mjs"
+    },
+    "./store": {
+      "types": "./src/store.d.mts",
+      "import": "./src/store.mjs"
+    }
+  },
+  "dependencies": {
+    "@zixcel/projection-contracts": "0.10.0"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "typecheck": "tsc --noEmit --strict --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zixcel/projection-runtime.git"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "types": "./src/runtime.d.mts",
+  "devDependencies": {
+    "typescript": "5.9.3",
+    "@types/node": "24.12.0"
+  },
+  "packageManager": "pnpm@10.29.3"
+}

package/src/common.mjs

@@ -0,0 +1,15 @@
+import {createHash} from 'node:crypto'
+import {canonical,ProjectionError} from '@zixcel/projection-contracts'
+export const fail=code=>{throw new ProjectionError(code)}
+export const hash=bytes=>createHash('sha256').update(bytes).digest('hex')
+export const clone=value=>JSON.parse(canonical(value))
+export function check(ok,code='InvalidProjection'){if(!ok)fail(code)}
+export function shape(value,keys){check(value&&Object.getPrototypeOf(value)===Object.prototype&&Object.keys(value).length===keys.length&&keys.every(k=>Object.hasOwn(value,k)))}
+export function token(value){check(typeof value==='string'&&value.length>0&&Buffer.byteLength(value)<=512&&!/[\x00-\x1f\x7f]/u.test(value));return value}
+export const ceilings=Object.freeze({concurrent:2,queued:16,inputBytes:2097152,executionMs:5000,keys:8,snapshots:2,repairs:16,attempts:3,repairMs:300000})
+export function bounds(input={}){
+  check(input&&Object.getPrototypeOf(input)===Object.prototype)
+  const b={...ceilings,...input}
+  for(const k of Object.keys(b))check(Object.hasOwn(ceilings,k)&&Number.isSafeInteger(b[k])&&b[k]>=1&&b[k]<=ceilings[k],'ProjectionLimitExceeded')
+  return Object.freeze(b)
+}

package/src/exact-sources.mjs

@@ -0,0 +1,84 @@
+import {canonical,produce} from '@zixcel/projection-contracts'
+import {check,clone,token} from './common.mjs'
+
+// Generic lifecycle orchestration only. Owners decide visibility, exact payload,
+// closure (including []), physical protection and expiry. No Graph/sem-lang API.
+// Adapter IO must honor deadline/signal and drain before resolving/rejecting.
+// releaseHolder must be independently bounded and work after a lost response.
+// A holder identifies one durable, fenced job attempt; owners must never reuse
+// it for unrelated work. Exact release must reject/subsume stale generations.
+export class ExactSourceReader {
+  #owners
+  constructor(owners){
+    check(owners instanceof Map&&owners.size>0&&owners.size<=8,'ProjectionLimitExceeded')
+    this.#owners=new Map()
+    for(const [id,adapter] of owners){
+      token(id)
+      check(['acquire','read','release','releaseHolder'].every(k=>typeof adapter?.[k]==='function'))
+      this.#owners.set(id,Object.freeze(Object.fromEntries(['acquire','read','release','releaseHolder'].map(k=>[k,adapter[k].bind(adapter)]))))
+    }
+  }
+  async acquireExact(refs,options){
+    const {holder,accessRef,until,deadline,signal}=options
+    token(holder);token(accessRef)
+    check(Number.isSafeInteger(until)&&Number.isSafeInteger(deadline)&&deadline<=until&&signal instanceof AbortSignal)
+    check(Array.isArray(refs)&&refs.length>0&&refs.length<=8,'ProjectionLimitExceeded')
+    // PP0 owns source contract validation and uniqueness; never duplicate it here.
+    const request={key:'source-validation',producer:{id:'source-validation',version:'0.10.0',contract:'projection/0.10.0',configuration:'source-validation'},sources:refs,focus:'source',purpose:'read',visibilityRef:accessRef,limits:{}}
+    const ordered=produce(request,refs.map(source=>({source,items:[],relations:[],unresolved:[],truncated:false}))).lineage.sources
+      .toSorted((a,b)=>{const x=canonical([a.owner,a.ref,a.revision,a.kind]),y=canonical([b.owner,b.ref,b.revision,b.kind]);return x<y?-1:x>y?1:0})
+    ordered.forEach(r=>check(this.#owners.has(r.owner),'SourceUnavailable'))
+    const running=()=>{
+      check(!signal.aborted,signal.reason?.code==='ProjectionExecutionTimeout'?'ProjectionExecutionTimeout':'ProjectionCancelled')
+      check(Date.now()<deadline,'ProjectionExecutionTimeout')
+    }
+    const acquired=[]
+    try{
+      for(const source of ordered){
+        running()
+        const lease=token(await this.#owners.get(source.owner).acquire(clone(source),options))
+        acquired.push({source,lease});running()
+      }
+      const sources=[]
+      for(const {source,lease} of acquired){
+        running()
+        const value=await this.#owners.get(source.owner).read(clone(source),lease,options)
+        running();check(canonical(value?.source)===canonical(source),'SourceRevisionMismatch')
+        sources.push(value)
+      }
+      // The isolated producer validates payload contracts; do not build a second
+      // projection here just to discard it. Bound bytes before handing them off.
+      canonical(sources)
+      return {sources,leaseRefs:acquired.map(({source,lease})=>token(canonical([source.owner,lease])))}
+    }catch(error){
+      // Include the owner whose acquire response was lost. Do not release only
+      // the leases successfully returned to this process.
+      await this.release([],holder)
+      throw error
+    }
+  }
+  async release(leaseRefs,holder){
+    token(holder);check(Array.isArray(leaseRefs)&&leaseRefs.length<=8,'ProjectionLimitExceeded')
+    // Known generations are released exactly; holder cleanup is only the recovery
+    // path when acquisition responses were not durably recorded. No ABA release.
+    let failure
+    if(leaseRefs.length){
+      const selected=leaseRefs.map(ref=>{
+        token(ref);let value
+        try{value=JSON.parse(ref)}catch{check(false)}
+        check(Array.isArray(value)&&value.length===2);value.forEach(token)
+        check(this.#owners.has(value[0]),'SourceUnavailable');return value
+      })
+      for(const [owner,lease] of selected.reverse()){
+        try{await this.#owners.get(owner).release(lease,holder)}catch(error){failure??=error}
+      }
+      if(failure)throw failure
+      return
+    }
+    // Try every owner even if one fails. PP retains its repair intent on failure.
+    for(const [,owner] of [...this.#owners].sort(([a],[b])=>a<b?-1:a>b?1:0)){
+      try{await owner.releaseHolder(holder)}catch(error){failure??=error}
+    }
+    if(failure)throw failure
+  }
+}

package/src/private-files.mjs

@@ -0,0 +1,21 @@
+import fs from 'node:fs'
+import {check} from './common.mjs'
+
+/** Refuse shared state, symlinks and hard links before reading or truncating. */
+export function privateDirectory(directory) {
+  const stat = fs.lstatSync(directory)
+  check(stat.isDirectory() && stat.uid === process.getuid()
+    && (stat.mode & 0o077) === 0, 'ProjectionStoreCorrupt')
+}
+
+export function privateFile(stat) {
+  check(stat.isFile() && stat.nlink === 1 && stat.uid === process.getuid()
+    && (stat.mode & 0o077) === 0, 'ProjectionStoreCorrupt')
+}
+
+/** Remove only an owner-private stale file; exclusive creation prevents clobbering. */
+export function removeStaleTemporary(filename) {
+  try { privateFile(fs.lstatSync(filename)) }
+  catch (error) { if (error.code === 'ENOENT') return; throw error }
+  fs.unlinkSync(filename)
+}

package/src/producer-worker.mjs

@@ -0,0 +1,14 @@
+import {parentPort,workerData} from 'node:worker_threads'
+import {produce,scene} from '@zixcel/projection-contracts'
+try{
+  // A visible value alone exceeding the entire output ceiling is a resource
+  // failure, before PP0's strict per-value serializer can classify its shape.
+  const ceiling=workerData.request.limits.snapshotBytes??524288
+  for(const source of workerData.sources)for(const item of source.items){
+    if(item.visibility==='visible'&&Buffer.byteLength(JSON.stringify(item.value))>ceiling)throw Object.assign(new Error('ProjectionLimitExceeded'),{code:'ProjectionLimitExceeded'})
+  }
+  const data=produce(workerData.request,workerData.sources)
+  const snapshot=workerData.entry.kind==='scene'?scene(data,workerData.entry.configuration):data
+  parentPort.postMessage({snapshot})
+}catch(e){parentPort.postMessage({error:e.code??'ProjectionProducerFailed'})}
+parentPort.close()

package/src/runtime.d.mts

@@ -0,0 +1,28 @@
+import type { ProducerIdentity, ProjectionRequest, Snapshot } from '@zixcel/projection-contracts';
+import type { RuntimeLimits, ProjectionStore, SourceAdapter, SourceReadOptions, SourceReader, ProducerConfiguration, SubmissionOptions, StoreReceipt, StoreInspection } from './types/runtime.mjs';
+export type * from './types/runtime.mjs';
+/** Register installed built-in producers; requests cannot supply executable code. */
+export class ProducerRegistry {
+  register(definition: { id: string; kind: 'data' | 'scene'; configuration?: ProducerConfiguration }): ProducerIdentity;
+  exact(identity: ProducerIdentity): Readonly<{ identity: ProducerIdentity; kind: 'data' | 'scene'; configuration: ProducerConfiguration }>;
+  unregister(identity: ProducerIdentity): void;
+  readonly artifactDigest: string;
+}
+export class ExactSourceReader implements SourceReader {
+  constructor(owners: Map<string, SourceAdapter>);
+  acquireExact(refs: readonly import('@zixcel/projection-contracts').SourceRef[], options: SourceReadOptions): ReturnType<SourceReader['acquireExact']>;
+  release(leaseRefs: readonly string[], holder: string): Promise<void>;
+}
+/** Bounded isolated execution with explicit source ownership and publication fencing. */
+export class ProjectionRuntime {
+  constructor(options: { store: ProjectionStore; registry: ProducerRegistry; reader: SourceReader; limits?: Partial<RuntimeLimits> });
+  inspect(): { active: number; queued: number; closed: boolean; limits: Readonly<RuntimeLimits>; store: StoreInspection };
+  submit(request: ProjectionRequest, options: SubmissionOptions): Promise<{ snapshot: Snapshot; receipt: StoreReceipt }>;
+  retry(id: string, options?: Omit<SubmissionOptions, 'accessRef' | 'id'>): ReturnType<ProjectionRuntime['submit']>;
+  expire(id: string): Promise<void>;
+  recoverState(input: { key: string; revision?: string | null }):
+    { kind: 'RecoveryUnavailable'; reason: string } |
+    { kind: 'NoChange'; revision: string } |
+    { kind: 'Snapshot'; revision: string; payload: Uint8Array };
+  close(): Promise<void>;
+}

package/src/runtime.mjs

@@ -0,0 +1,168 @@
+import fs from 'node:fs'
+import {Worker} from 'node:worker_threads'
+import {randomUUID} from 'node:crypto'
+import {canonical,produce,recovery,validateSnapshot} from '@zixcel/projection-contracts'
+import {bounds,check,clone,fail,hash,shape,token} from './common.mjs'
+export {ExactSourceReader} from './exact-sources.mjs'
+
+const workerUrl=new URL('./producer-worker.mjs',import.meta.url)
+const implementation=hash(Buffer.concat([
+  fs.readFileSync(workerUrl),fs.readFileSync(import.meta.filename),
+  fs.readFileSync(new URL('./common.mjs',import.meta.url)),
+  ...['index.mjs','contract.mjs','producer.mjs','publication.mjs','hash-node.mjs','../package.json'].map(name=>fs.readFileSync(new URL(name,import.meta.resolve('@zixcel/projection-contracts')))),
+]))
+// Explicit installed built-ins only. No request-supplied path/module/code is loaded.
+export class ProducerRegistry {
+  #entries=new Map()
+  register({id,kind,configuration={}}){
+    token(id);check(['data','scene'].includes(kind));check(this.#entries.size<8,'ProjectionLimitExceeded');check(!this.#entries.has(id),'ProjectionIdentityConflict')
+    canonical(configuration,16384)
+    const identity={id,version:'0.10.0',contract:'projection/0.10.0',configuration:hash(canonical({implementation,kind,configuration}))}
+    const entry=Object.freeze({identity:Object.freeze(identity),kind,configuration:clone(configuration)})
+    this.#entries.set(id,entry);return clone(identity)
+  }
+  exact(identity){const entry=this.#entries.get(identity?.id);check(entry&&canonical(entry.identity)===canonical(identity),'ProjectionProducerUnavailable');return clone(entry)}
+  // Unregister only the exact installed definition. Submitted jobs already own
+  // an immutable copy; stale cleanup cannot remove a different configuration.
+  unregister(identity){this.exact(identity);this.#entries.delete(identity.id)}
+  get artifactDigest(){return implementation}
+}
+
+function validatedRequest(r){
+  // Reuse PP0 validation, without exposing an implicit reader or duplicating schema.
+  return produce(r,r.sources.map(source=>({source,items:[],relations:[],unresolved:[],truncated:false}))).lineage.request
+}
+function execute(entry,request,sources,signal,ms){
+  return new Promise((resolve,reject)=>{
+    let settled=false
+    const worker=new Worker(workerUrl,{workerData:{entry,request,sources},resourceLimits:{maxOldGenerationSizeMb:32,maxYoungGenerationSizeMb:8,stackSizeMb:2}})
+    const finish=async(error,value)=>{
+      if(settled)return;settled=true;clearTimeout(timer);signal.removeEventListener('abort',aborted)
+      // Await termination before releasing slot/source holds, including timeout.
+      try{await worker.terminate()}catch(e){error??=e}
+      if(error)reject(error);else resolve(value)
+    }
+    const error=code=>Object.assign(new Error(code),{code})
+    const aborted=()=>void finish(error(signal.reason?.code==='ProjectionExecutionTimeout'?'ProjectionExecutionTimeout':'ProjectionCancelled'))
+    const timer=setTimeout(()=>void finish(error('ProjectionExecutionTimeout')),ms)
+    worker.once('error',e=>void finish(error(e.code==='ERR_WORKER_OUT_OF_MEMORY'?'ProjectionLimitExceeded':'ProjectionProducerFailed')))
+    worker.once('message',m=>void finish(m.error?error(m.error):null,m.snapshot))
+    worker.once('exit',code=>{if(!settled)void finish(error('ProjectionProducerFailed'))})
+    signal.addEventListener('abort',aborted,{once:true});if(signal.aborted)aborted()
+  })
+}
+
+// Reader contract: acquireExact(refs, {accessRef, holder, until, signal}) returns
+// {sources, leaseRefs}; release(leaseRefs) is idempotent; holds survive process exit
+// until explicit release/owner expiry. Reader must bound/cancel its own IO and never
+// invoke canonical creation, latest, provider refresh or source-body restoration.
+export class ProjectionRuntime {
+  #store;#registry;#reader;#limits;#active=new Map();#queue=[];#closed=false
+  constructor({store,registry,reader,limits={}}){
+    check(store&&registry instanceof ProducerRegistry&&typeof reader?.acquireExact==='function'&&typeof reader.release==='function')
+    this.#store=store;this.#registry=registry;this.#reader=reader;this.#limits=bounds(limits)
+  }
+  inspect(){return {active:this.#active.size,queued:this.#queue.length,closed:this.#closed,limits:this.#limits,store:this.#store.inspect()}}
+  submit(input,{accessRef,signal=new AbortController().signal,id=randomUUID()}={}){
+    check(!this.#closed,'ProjectionRuntimeClosed');token(accessRef);token(id)
+    const request=clone(input);validatedRequest(request);const entry=this.#registry.exact(request.producer)
+    check(entry.kind==='data'||entry.configuration.key===request.key)
+    if(this.#active.size>=this.#limits.concurrent&&this.#queue.length>=this.#limits.queued)fail('ProjectionQueueFull')
+    check(!this.#active.has(id)&&!this.#queue.some(j=>j.id===id),'ProjectionIdentityConflict')
+    const pending=this.#store.repair(id)
+    if(pending){check(canonical(pending.request)===canonical(request)&&pending.accessRef===accessRef,'ProjectionIdentityConflict')}
+    const job={id,request,entry,accessRef,controller:new AbortController(),pending,signal}
+    return new Promise((resolve,reject)=>{
+      job.resolve=resolve;job.reject=reject
+      job.abort=()=>{job.controller.abort();const index=this.#queue.indexOf(job);if(index>=0){this.#queue.splice(index,1);job.signal.removeEventListener('abort',job.abort);reject(Object.assign(new Error('ProjectionCancelled'),{code:'ProjectionCancelled'}))}}
+      signal.addEventListener('abort',job.abort,{once:true})
+      if(signal.aborted){signal.removeEventListener('abort',job.abort);reject(Object.assign(new Error('ProjectionCancelled'),{code:'ProjectionCancelled'}));return}
+      this.#queue.push(job);this.#pump()
+    })
+  }
+  retry(id,options={}){
+    const r=this.#store.repair(token(id));check(r,'ProjectionRepairUnavailable')
+    return this.submit(r.request,{...options,accessRef:r.accessRef,id})
+  }
+  async expire(id){
+    check(!this.#active.has(id)&&!this.#queue.some(j=>j.id===id),'ProjectionStoreBusy')
+    const r=this.#store.repair(token(id));if(!r)return
+    await this.#store.withAttempt(id,async()=>{
+      const current=this.#store.repair(id);if(!current)return
+      await this.#cleanup([{holder:current.holder,leases:current.leases},...current.previous]);this.#store.finish(id)
+    })
+  }
+  #pump(){
+    while(!this.#closed&&this.#active.size<this.#limits.concurrent&&this.#queue.length){
+      const j=this.#queue.shift();this.#active.set(j.id,j)
+      const finished=()=>{
+        this.#active.delete(j.id);j.signal.removeEventListener('abort',j.abort);this.#pump()
+      }
+      j.done=this.#store.withAttempt(j.id,()=>this.#run(j)).then(value=>{finished();j.resolve(value)},error=>{finished();j.reject(error)})
+    }
+  }
+  async #cleanup(sets){
+    let failure
+    for(const {holder,leases} of sets){try{await this.#reader.release(leases,holder)}catch(error){failure??=error}}
+    if(failure)throw failure
+  }
+  async #run(j){
+    // Re-read after acquiring the process-wide attempt fence, not before queueing.
+    const signal=j.controller.signal,now=Date.now(),p=this.#store.repair(j.id),holder=randomUUID()
+    if(p)check(canonical(p.request)===canonical(j.request)&&p.accessRef===j.accessRef,'ProjectionIdentityConflict')
+    let ticket=p?.ticket
+    const expiresAt=p?.expiresAt??now+this.#limits.repairMs,attempts=(p?.attempts??0)+1
+    if(expiresAt<=now||attempts>this.#limits.attempts){if(p)await this.#cleanup([{holder:p.holder,leases:p.leases},...p.previous]);this.#store.finish(j.id);fail('ProjectionRepairExpired')}
+    // One deadline covers source acquisition/read, producer and publication.
+    // Abort is cooperative: await actual owner IO/worker termination, never race
+    // away from an acquisition which could still create a durable hold later.
+    const deadline=Math.min(now+this.#limits.executionMs,expiresAt)
+    const timeout=()=>j.controller.abort(Object.assign(new Error('ProjectionExecutionTimeout'),{code:'ProjectionExecutionTimeout'}))
+    const timer=setTimeout(timeout,Math.max(1,deadline-Date.now()))
+    const running=()=>{
+      if(Date.now()>=deadline&&!signal.aborted)timeout()
+      check(!signal.aborted,signal.reason?.code==='ProjectionExecutionTimeout'?'ProjectionExecutionTimeout':'ProjectionCancelled')
+    }
+    let leases=[],previous=p?[...p.previous,{holder:p.holder,leases:p.leases}]:[],saved=false,published=false,cleaned=false
+    try{
+      running();ticket??=this.#store.begin(j.request.key,{deadline});running()
+      // Exact hold metadata is recorded BEFORE acquisition so interrupted readers
+      // can be reconciled by deterministic holder identity, never source bodies.
+      const base={id:j.id,holder,previous,ticket,request:j.request,producer:j.entry.identity,accessRef:j.accessRef,expiresAt,attempts,failure:null,leases}
+      this.#store.pending(base,{deadline,previousHolder:p?.holder});saved=true;running()
+      const result=await this.#reader.acquireExact(j.request.sources,{accessRef:j.accessRef,holder,until:expiresAt,deadline,signal})
+      shape(result,['sources','leaseRefs']);check(Array.isArray(result.leaseRefs)&&result.leaseRefs.length<=8,'ProjectionLimitExceeded');result.leaseRefs.forEach(token)
+      leases=result.leaseRefs;this.#store.pending({...base,leases},{deadline})
+      // Transfer physical protection only AFTER replacement exact leases are
+      // durable. A crash preserves both generations for idempotent cleanup.
+      await this.#cleanup(previous);previous=[]
+      this.#store.pending({...base,leases,previous},{deadline})
+      running();canonical(result.sources,this.#limits.inputBytes);running()
+      const snapshot=await execute(j.entry,j.request,result.sources,signal,Math.max(1,deadline-Date.now()))
+      running();validateSnapshot(snapshot)
+      check(canonical(snapshot.lineage.sources)===canonical(produce(j.request,result.sources).lineage.sources),'SourceRevisionMismatch')
+      running();const receipt=this.#store.publish(ticket,snapshot,j.id,{deadline});published=true
+      running()
+      return {snapshot,receipt}
+    }catch(error){
+      if(signal.aborted&&signal.reason?.code==='ProjectionExecutionTimeout')error=signal.reason
+      if(saved){
+        const terminal=attempts>=this.#limits.attempts||['ProjectionCancelled','ProjectionExecutionTimeout','StaleProjectionPublication','SourceNotRetained','VisibilityDenied','SourceRevisionMismatch','SourceCorrupt'].includes(error.code)
+        if(terminal){await this.#cleanup([{holder,leases},...previous]);cleaned=true;this.#store.finish(j.id);saved=false}
+        else this.#store.pending({id:j.id,holder,previous,ticket,request:j.request,producer:j.entry.identity,accessRef:j.accessRef,expiresAt,attempts,failure:error.code??'ProjectionProducerFailed',leases})
+      }
+      throw error
+    }finally{
+      clearTimeout(timer)
+      if(!cleaned&&(published||!saved))await this.#cleanup([{holder,leases},...previous])
+    }
+  }
+  recoverState({key,revision=null}){
+    try{const snapshot=this.#store.read(token(key));return snapshot?recovery(snapshot,revision):{kind:'RecoveryUnavailable',reason:'ProjectionUnavailable'}}
+    catch(error){return {kind:'RecoveryUnavailable',reason:error.code??'ProjectionUnavailable'}}
+  }
+  async close(){
+    this.#closed=true;for(const j of [...this.#queue])j.abort();for(const j of this.#active.values())j.controller.abort()
+    await Promise.all([...this.#active.values()].map(j=>j.done))
+  }
+}

package/src/store-process.mjs

@@ -0,0 +1,104 @@
+// One short-lived process per transaction, protected by inherited kernel lock.
+// One atomic bounded image; no DAG, source data, general journal or commit theory.
+import fs from 'node:fs'
+import path from 'node:path'
+import {randomUUID} from 'node:crypto'
+import {validateSnapshot,canonical,produce} from '@zixcel/projection-contracts'
+import {bounds,check,clone,hash,shape,token} from './common.mjs'
+import {privateDirectory,privateFile,removeStaleTemporary} from './private-files.mjs'
+const directory=process.argv[2],operation=process.argv[3],image=path.join(directory,'projection.json'),temporary=path.join(directory,'projection.next')
+const MAX=12*1024*1024
+function readBounded(file,max){
+  const fd=fs.openSync(file,fs.constants.O_RDONLY|fs.constants.O_NOFOLLOW)
+  try{privateFile(fs.fstatSync(fd));check(fs.fstatSync(fd).size<=max,'ProjectionStoreCorrupt');const bytes=Buffer.alloc(max+1);const n=fs.readSync(fd,bytes,0,max+1,0);check(n<=max,'ProjectionLimitExceeded');return bytes.subarray(0,n)}finally{fs.closeSync(fd)}
+}
+function load(){
+  const envelope=JSON.parse(readBounded(image,MAX));shape(envelope,['digest','state'])
+  check(hash(JSON.stringify(envelope.state))===envelope.digest,'ProjectionStoreCorrupt')
+  const s=envelope.state;shape(s,['format','instance','limits','keys','repairs']);check(s.format==='projection-runtime/0.10.0','ProjectionStoreCorrupt');token(s.instance);bounds(s.limits)
+  check(Array.isArray(s.keys)&&s.keys.length<=s.limits.keys&&Array.isArray(s.repairs)&&s.repairs.length<=s.limits.repairs,'ProjectionStoreCorrupt')
+  check(new Set(s.keys.map(k=>k.key)).size===s.keys.length&&new Set(s.repairs.map(r=>r.id)).size===s.repairs.length,'ProjectionStoreCorrupt')
+  for(const k of s.keys){shape(k,['key','fence','current','snapshots','receipts']);token(k.key);token(k.fence);check(k.current===null||typeof k.current==='string','ProjectionStoreCorrupt');check(k.snapshots.length<=s.limits.snapshots&&k.receipts.length<=s.limits.snapshots,'ProjectionStoreCorrupt')}
+  for(const r of s.repairs)record(r)
+  return s
+}
+function save(s){
+  const bytes=JSON.stringify({digest:hash(JSON.stringify(s)),state:s});check(Buffer.byteLength(bytes)<=MAX,'ProjectionLimitExceeded')
+  // Same lock covers stale temp cleanup, write/fsync/rename and directory fsync.
+  removeStaleTemporary(temporary)
+  const fd=fs.openSync(temporary,fs.constants.O_WRONLY|fs.constants.O_CREAT|fs.constants.O_EXCL|fs.constants.O_NOFOLLOW,0o600)
+  try{fs.writeFileSync(fd,bytes);fs.fsyncSync(fd)}finally{fs.closeSync(fd)}
+  fs.renameSync(temporary,image);const dir=fs.openSync(directory,'r');try{fs.fsyncSync(dir)}finally{fs.closeSync(dir)}
+}
+function record(r){
+  shape(r,['id','holder','previous','ticket','request','producer','accessRef','expiresAt','attempts','failure','leases'])
+  canonical(r,65536);token(r.id);token(r.holder);token(r.accessRef);shape(r.ticket,['key','expected']);token(r.ticket.key);token(r.ticket.expected)
+  check(r.request.key===r.ticket.key&&Number.isSafeInteger(r.expiresAt)&&r.expiresAt>0&&Number.isSafeInteger(r.attempts)&&r.attempts>=0,'InvalidProjection')
+  check(Array.isArray(r.request.sources)&&r.request.sources.length<=8&&Array.isArray(r.leases)&&r.leases.length<=8,'ProjectionLimitExceeded')
+  produce(r.request,r.request.sources.map(source=>({source,items:[],relations:[],unresolved:[],truncated:false})))
+  check(canonical(r.producer)===canonical(r.request.producer))
+  for(const ref of r.request.sources)shape(ref,['owner','ref','revision','kind'])
+  for(const ref of r.leases)token(ref)
+  check(Array.isArray(r.previous)&&r.previous.length<=2,'ProjectionLimitExceeded')
+  for(const old of r.previous){shape(old,['holder','leases']);token(old.holder);check(old.holder!==r.holder&&Array.isArray(old.leases)&&old.leases.length<=8);old.leases.forEach(token)}
+  check(new Set(r.previous.map(p=>p.holder)).size===r.previous.length)
+  return r
+}
+try{
+  // setpriv installed PDEATHSIG before exec. If the caller died before that
+  // installation, its exact parent identity must still reject BEFORE any IO.
+  check(Number(process.argv[4])===process.ppid&&process.ppid>1,'ProjectionUnavailable')
+  privateDirectory(directory)
+  // The parent bounds all requests; limit stdin independently for adapter callers.
+  const chunks=[];let n=0;for await(const b of process.stdin){n+=b.length;check(n<=MAX,'ProjectionLimitExceeded');chunks.push(b)}
+  const input=JSON.parse(Buffer.concat(chunks));let s
+  if(operation==='create'){check(!fs.existsSync(image),'ProjectionStoreExists');s={format:'projection-runtime/0.10.0',instance:randomUUID(),limits:bounds(input.limits),keys:[],repairs:[]};save(s)}
+  else s=load()
+  let value=null,changed=false
+  const find=key=>s.keys.find(k=>k.key===key)
+  const initial=key=>hash(s.instance+'\0'+token(key))
+  switch(operation){
+    case 'create':break
+    case 'inspect':value={keys:s.keys.map(({key,current,fence,snapshots})=>({key,current,fence,snapshots:snapshots.length})),repairs:clone(s.repairs),limits:s.limits};break
+    case 'begin':value={key:input.key,expected:find(input.key)?.fence??initial(input.key)};break
+    case 'read':{const k=find(input.key);const rev=input.revision??k?.current;value=k?.snapshots.find(p=>p.revision===rev)??null;if(value)validateSnapshot(value);break}
+    case 'publish':{
+      const {ticket,snapshot,jobId}=input;shape(ticket,['key','expected']);token(jobId);validateSnapshot(snapshot);check(snapshot.key===ticket.key)
+      let k=find(ticket.key);const prior=k?.receipts.find(r=>r.jobId===jobId)
+      if(prior){
+        check(prior.revision===snapshot.revision,'ProjectionIdentityConflict');value=prior
+        if(!k.snapshots.some(p=>p.revision===snapshot.revision)){k.snapshots.push(snapshot);k.snapshots=k.snapshots.slice(-s.limits.snapshots);changed=true}
+        if(s.repairs.some(r=>r.id===jobId)){s.repairs=s.repairs.filter(r=>r.id!==jobId);changed=true}
+        break
+      }
+      check((k?.fence??initial(ticket.key))===ticket.expected,'StaleProjectionPublication')
+      if(!k){check(s.keys.length<s.limits.keys,'ProjectionLimitExceeded');k={key:ticket.key,fence:ticket.expected,current:null,snapshots:[],receipts:[]};s.keys.push(k)}
+      if(!k.snapshots.some(p=>p.revision===snapshot.revision))k.snapshots.push(snapshot)
+      k.snapshots=k.snapshots.slice(-s.limits.snapshots);k.fence=randomUUID();k.current=snapshot.revision
+      value={key:k.key,expected:ticket.expected,publication:k.fence,revision:k.current,jobId}
+      k.receipts.push(value);k.receipts=k.receipts.slice(-s.limits.snapshots)
+      // Result and removal of pending repair have one durable boundary.
+      s.repairs=s.repairs.filter(r=>r.id!==jobId);changed=true;break
+    }
+    case 'pending':{
+      const r=record(input.record),prior=s.repairs.find(p=>p.id===r.id)
+      if(prior){
+        check(canonical({...prior,holder:null,previous:[],attempts:0,failure:null,leases:[]})===canonical({...r,holder:null,previous:[],attempts:0,failure:null,leases:[]}),'ProjectionIdentityConflict')
+        check(prior.holder===r.holder||input.previousHolder===prior.holder,'ProjectionAttemptConflict')
+        check(r.attempts===prior.attempts+(prior.holder===r.holder?0:1),'ProjectionAttemptConflict')
+        prior.holder=r.holder;prior.previous=r.previous;prior.attempts=r.attempts;prior.failure=r.failure;prior.leases=r.leases
+      }
+      else{check(s.repairs.length<s.limits.repairs,'ProjectionLimitExceeded');s.repairs.push(r)}
+      changed=true;value=r;break
+    }
+    case 'repair':value=s.repairs.find(r=>r.id===input.id)??null;break
+    case 'finish':s.repairs=s.repairs.filter(r=>r.id!==input.id);changed=true;break
+    case 'drop':{const k=find(input.key);if(k){k.snapshots=[];changed=true}break}
+    default:check(false)
+  }
+  if(changed)save(s)
+  // No extra durable notification store. This existing file's metadata is only
+  // a wakeup hint after the atomic publication, never a cursor or receipt.
+  if(changed&&['publish','drop'].includes(operation))fs.utimesSync(path.join(directory,'lock'),new Date(),new Date())
+  process.stdout.write(JSON.stringify({value}))
+}catch(error){process.stdout.write(JSON.stringify({error:error.code?.startsWith('Projection')||['InvalidProjection','StaleProjectionPublication'].includes(error.code)?error.code:error.code==='ENOENT'?'ProjectionUnavailable':'ProjectionStoreCorrupt'}))}

package/src/store.d.mts

@@ -0,0 +1,17 @@
+import type { Snapshot, PublicationTicket } from '@zixcel/projection-contracts';
+import type { RuntimeLimits, ProjectionStore, StoreOptions, StoreInspection, StoreReceipt, RepairRecord } from './types/runtime.mjs';
+/** Linux/WSL kernel-flock adapter. Call create once inside an existing private parent. */
+export class FileProjectionStore implements ProjectionStore {
+  constructor(directory: string);
+  static create(directory: string, limits?: Partial<RuntimeLimits>): FileProjectionStore;
+  inspect(): StoreInspection;
+  watch(onChange: () => void): () => void;
+  withAttempt<T>(id: string, operation: () => T | PromiseLike<T>): Promise<T>;
+  begin(key: string, options?: StoreOptions): PublicationTicket;
+  read(key: string, revision?: string | null): Snapshot | null;
+  publish(ticket: PublicationTicket, snapshot: Snapshot, jobId: string, options?: StoreOptions): StoreReceipt;
+  pending(record: RepairRecord, options?: StoreOptions): RepairRecord;
+  repair(id: string): RepairRecord | null;
+  finish(id: string): null;
+  dropSnapshots(key: string): null;
+}

package/src/store.mjs

@@ -0,0 +1,82 @@
+// Linux projection-local adapter. Kernel flock, not PID/TTL lock stealing.
+// Generic runtime depends only on this adapter's method contract.
+import fs from 'node:fs'
+import path from 'node:path'
+import {fileURLToPath} from 'node:url'
+import {spawnSync} from 'node:child_process'
+import {bounds,check,fail,token} from './common.mjs'
+import {privateDirectory,privateFile} from './private-files.mjs'
+const helper=fileURLToPath(new URL('./store-process.mjs',import.meta.url))
+export class FileProjectionStore {
+  #directory
+  constructor(directory){this.#directory=path.resolve(directory)}
+  static create(directory,limits={}){
+    check(process.platform==='linux','ProjectionStoreUnsupported')
+    privateDirectory(path.dirname(path.resolve(directory)))
+    const store=new FileProjectionStore(directory)
+    // Caller supplies an existing private parent. Never implicitly initializes on read.
+    fs.mkdirSync(store.#directory,{mode:0o700})
+    const fd=fs.openSync(path.join(store.#directory,'lock'),'wx',0o600);fs.fsyncSync(fd);fs.closeSync(fd)
+    // Fixed stripes bound physical lock files. Collisions return Busy, never steal
+    // a live attempt by PID or wall-clock expiry. The parent retains the OFD lock.
+    for(let n=0;n<16;n++){const fd=fs.openSync(path.join(store.#directory,`attempt-${n}`),'wx',0o600);fs.fsyncSync(fd);fs.closeSync(fd)}
+    store.#call('create',{limits:bounds(limits)})
+    return store
+  }
+  #call(operation,input,{deadline=null}={}){
+    check(deadline===null||Number.isSafeInteger(deadline),'InvalidProjection')
+    const remaining=deadline===null?10000:deadline-Date.now()
+    check(remaining>0,'ProjectionExecutionTimeout')
+    const lock=path.join(this.#directory,'lock')
+    try{privateDirectory(this.#directory);privateFile(fs.lstatSync(lock))}
+    catch(e){if(e.code==='ENOENT')fail('ProjectionUnavailable');throw e}
+    // Pass a pre-opened existing lock FD: flock can never create a missing file.
+    const fd=fs.openSync(lock,fs.constants.O_RDONLY|fs.constants.O_NOFOLLOW)
+    try{privateFile(fs.fstatSync(fd))}catch(error){fs.closeSync(fd);throw error}
+    let result
+    const mode=['read','inspect','repair','begin'].includes(operation)?'--shared':'--exclusive'
+    // Short reads/publications serialize within a bounded kernel wait. Attempt
+    // ownership remains nonblocking below; this never retries an effect or CAS.
+    const waitSeconds=String(Math.min(250,remaining)/1000)
+    try{result=spawnSync('/usr/bin/setpriv',['--pdeathsig','SIGKILL','--','/usr/bin/flock',mode,'--timeout',waitSeconds,'--no-fork','--conflict-exit-code','73','/proc/self/fd/3',process.execPath,helper,this.#directory,operation,String(process.pid)],
+      {input:JSON.stringify(input),stdio:['pipe','pipe','pipe',fd],maxBuffer:13*1024*1024,timeout:Math.min(10000,remaining),killSignal:'SIGKILL'})}
+    finally{fs.closeSync(fd)}
+    if(result.status===73)fail('ProjectionStoreBusy')
+    if(result.error?.code==='ETIMEDOUT'&&deadline!==null)fail('ProjectionExecutionTimeout')
+    if(result.error||result.status!==0)fail('ProjectionUnavailable')
+    let output;try{output=JSON.parse(result.stdout)}catch{fail('ProjectionStoreCorrupt')}
+    if(output.error)fail(output.error)
+    return output.value
+  }
+  inspect(){return this.#call('inspect',{})}
+  // Hints only: readers validate the durable image under the existing lock.
+  // Its mtime is touched only after publication/drop, never pending lease writes.
+  // Neither this timestamp nor event delivery is a state/revision authority.
+  watch(onChange){
+    let timer,closed=false
+    const notify=()=>{if(closed||timer)return;timer=setTimeout(()=>{timer=null;if(!closed)onChange()},20)}
+    const watcher=fs.watch(this.#directory,(_event,name)=>{if(name===null||String(name)==='lock')notify()})
+    watcher.on('error',notify)
+    return ()=>{if(closed)return;closed=true;clearTimeout(timer);watcher.close()}
+  }
+  async withAttempt(id,operation){
+    token(id);privateDirectory(this.#directory);let stripe=0;for(const byte of Buffer.from(id))stripe=(stripe*31+byte)%16
+    let fd
+    try{fd=fs.openSync(path.join(this.#directory,`attempt-${stripe}`),fs.constants.O_RDONLY|fs.constants.O_NOFOLLOW)}
+    catch(error){if(error.code==='ENOENT')fail('ProjectionUnavailable');throw error}
+    try{
+      privateFile(fs.fstatSync(fd))
+      const result=spawnSync('/usr/bin/flock',['--exclusive','--nonblock','--conflict-exit-code','73','3'],{stdio:['ignore','pipe','pipe',fd],timeout:1000})
+      if(result.status===73)fail('ProjectionStoreBusy')
+      check(!result.error&&result.status===0,'ProjectionUnavailable')
+      return await operation()
+    }finally{fs.closeSync(fd)}
+  }
+  begin(key,options){return this.#call('begin',{key:token(key)},options)}
+  read(key,revision=null){return this.#call('read',{key:token(key),revision})}
+  publish(ticket,snapshot,jobId,options){return this.#call('publish',{ticket,snapshot,jobId:token(jobId)},options)}
+  pending(record,options={}){return this.#call('pending',{record,previousHolder:options.previousHolder??null},options)}
+  repair(id){return this.#call('repair',{id:token(id)})}
+  finish(id){return this.#call('finish',{id:token(id)})}
+  dropSnapshots(key){return this.#call('drop',{key:token(key)})}
+}

package/src/types/runtime.d.mts

@@ -0,0 +1,37 @@
+import type { ExactSource, ProjectionRequest, ProducerIdentity, SceneConfiguration, SourceRef, Snapshot, PublicationTicket, PublicationReceipt } from '@zixcel/projection-contracts';
+export interface RuntimeLimits { concurrent: number; queued: number; inputBytes: number; executionMs: number; keys: number; snapshots: number; repairs: number; attempts: number; repairMs: number }
+export interface StoreOptions { deadline?: number | null; previousHolder?: string | null }
+export interface RepairRecord {
+  id: string; holder: string; previous: readonly { holder: string; leases: readonly string[] }[];
+  ticket: PublicationTicket; request: ProjectionRequest; producer: ProducerIdentity;
+  accessRef: string; expiresAt: number; attempts: number; failure: string | null; leases: readonly string[];
+}
+export interface StoreReceipt extends PublicationReceipt { readonly jobId: string }
+export interface StoreInspection {
+  keys: readonly { key: string; current: string | null; fence: string; snapshots: number }[];
+  repairs: readonly RepairRecord[]; limits: Readonly<RuntimeLimits>;
+}
+export interface ProjectionStore {
+  inspect(): StoreInspection;
+  withAttempt<T>(id: string, operation: () => T | PromiseLike<T>): Promise<T>;
+  begin(key: string, options?: StoreOptions): PublicationTicket;
+  read(key: string, revision?: string | null): Snapshot | null;
+  publish(ticket: PublicationTicket, snapshot: Snapshot, jobId: string, options?: StoreOptions): StoreReceipt;
+  pending(record: RepairRecord, options?: StoreOptions): RepairRecord;
+  repair(id: string): RepairRecord | null;
+  finish(id: string): null;
+}
+export interface SourceReadOptions { accessRef: string; holder: string; until: number; deadline: number; signal: AbortSignal }
+export interface SourceReader {
+  acquireExact(refs: readonly SourceRef[], options: SourceReadOptions): Promise<{ sources: readonly ExactSource[]; leaseRefs: readonly string[] }>;
+  release(leaseRefs: readonly string[], holder: string): void | Promise<void>;
+}
+/** Owner adapters retain authorization, durable leases and bounded/cancellable IO. */
+export interface SourceAdapter {
+  acquire(source: SourceRef, options: SourceReadOptions): string | Promise<string>;
+  read(source: SourceRef, lease: string, options: SourceReadOptions): ExactSource | Promise<ExactSource>;
+  release(lease: string, holder: string): void | Promise<void>;
+  releaseHolder(holder: string): void | Promise<void>;
+}
+export interface SubmissionOptions { accessRef: string; signal?: AbortSignal; id?: string }
+export type ProducerConfiguration = Readonly<Record<string, import('@zixcel/projection-contracts').Json>> | SceneConfiguration;