@zq-silk/yui 0.15.12 → 0.16.0

package/dist/resources/resourceGc.js

@@ -9,24 +9,70 @@
  * Safety model:
  * - `planResourceGc` is strictly read-only: it discovers, scans, classifies,
  *   and returns a plan. It never writes the registry or moves files.
- * - `applyResourceGc` re-discovers and re-scans live references immediately
- *   before each mutation, so a stale plan can never release a resource that
- *   gained a reference after planning.
+ * - `applyResourceGc` refreshes discovery and scans each physical subtree.
+ *   Durable owners are re-read under SQLite's writer fence through the move.
  * - `purgeResourceQuarantine` scans both the original and quarantine paths;
  *   a file held open inside quarantine triggers a restore instead of deletion.
  * - `restoreAllResourceGc` is the explicit rollback entry point.
  */
-import { execFile, execFileSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { promisify } from "node:util";
-import { removeResourceRecord, isResourceQuarantinePath, resourceQuarantineRoot, upsertResourceRecord } from "./resourceRegistry.js";
-import { createResourceRegistryStore } from "./resourceRegistryStore.js";
-import { isReleasable, isTerminalTaskStatus } from "./resourceTypes.js";
-import { scanLiveReferences } from "./liveReferences.js";
+import { dirname, join, resolve, relative, isAbsolute } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { scanLiveReferences, readSessionOwnerClaims } from "./liveReferences.js";
 import { discoverResources } from "./resourceDiscovery.js";
-const executeFile = promisify(execFile);
+import { isResourceQuarantinePath, removeResourceRecord, resourceQuarantineRoot, upsertResourceRecord } from "./resourceRegistry.js";
+import { withResourceRegistry } from "./resourceRegistryStore.js";
+import { isReleasable, isTerminalTaskStatus } from "./resourceTypes.js";
 export const DEFAULT_QUARANTINE_TTL_HOURS = 24;
+/** One current snapshot shared by manual and automatic GC. The execution
+ * boundary reads it again while holding the database's existing writer fence. */
+export function readResourceGcState(store) {
+    return store.readTransaction(reader => {
+        const tasks = reader.listTasks();
+        return {
+            projects: reader.listProjects(),
+            sessionOwners: reader.listSessionOwners(),
+            managedWorkspaces: tasks.flatMap(task => reader.listManagedWorkspaces(task.id)),
+            taskStatusById: new Map(tasks.map(task => [task.id, task.status])),
+            activeWorkspaceOwnerPaths: tasks.flatMap(task => [
+                ...reader.listRuns(task.id).filter(run => run.status === "active").flatMap(run => {
+                    const workspace = run.workspace ?? run.effective.workspace;
+                    return [workspace.root, ...workspace.entries.map(entry => entry.path)];
+                }),
+                ...reader.listDurableJobs(task.id).filter(job => job.status === "queued" || job.status === "running"
+                    || (job.status === "unknown-needs-attention" && job.acknowledgedAt === undefined))
+                    .map(job => job.workspace)
+            ])
+        };
+    });
+}
+function within(path, parent) {
+    const child = relative(resolve(parent), resolve(path));
+    return child === "" || (!isAbsolute(child) && child !== ".." && !child.startsWith("../"));
+}
+function currentDurableRefs(record, state) {
+    const refs = [];
+    if (record.owner.taskId === undefined || !state.taskStatusById.has(record.owner.taskId)) {
+        refs.push("owner-unproven");
+    }
+    else if (!isTerminalTaskStatus(state.taskStatusById.get(record.owner.taskId))) {
+        refs.push("owner-not-terminal");
+    }
+    const paths = [
+        ...state.managedWorkspaces.flatMap(workspace => [workspace.root, ...workspace.entries.map(entry => entry.path)]),
+        ...state.activeWorkspaceOwnerPaths
+    ];
+    if (paths.some(path => within(path, record.path) || within(record.path, path)))
+        refs.push("durable-owner");
+    const custody = readSessionOwnerClaims(state.sessionOwners);
+    if (custody.diagnostics.some(diagnostic => diagnostic.severity === "error"))
+        refs.push("session-owner-unproven");
+    if (custody.claims.some(claim => within(claim.path, record.path) || within(record.path, claim.path))) {
+        refs.push("live-session-owner");
+    }
+    return refs;
+}
 /**
  * Plan a GC pass: discover resources, scan live references, and classify each
  * record. Planning is strictly read-only — it never writes the registry,
@@ -34,7 +80,7 @@ export const DEFAULT_QUARANTINE_TTL_HOURS = 24;
  */
 export async function planResourceGc(input) {
     const home = resolve(input.home);
-    const registryStore = input.registryStore ?? createResourceRegistryStore(home);
+    const registry = withResourceRegistry(home, input.registryStore, store => store.load());
     const discovered = await discoverResources({
         home,
         projects: input.projects,
@@ -45,10 +91,10 @@ export async function planResourceGc(input) {
     const paths = discovered.map(({ record }) => record.path);
     // Also scan original paths of quarantined records so a new reference is
     // visible in the plan (restore itself happens in apply/purge/restore-all).
-    const registry = registryStore.load();
     appendRegistryScanPaths(registry, paths, home);
     const scan = await scanLiveReferences({
         home,
+        sessionOwners: input.sessionOwners,
         paths,
         environment: input.environment,
         tmuxServerName: input.tmuxServerName,
@@ -211,11 +257,11 @@ function dirtyWorktreeSuggestion(record) {
  * Apply a GC plan: quarantine every releasable resource. In `report` mode this
  * is a shadow pass — the plan is returned unchanged and nothing is mutated.
  *
- * Before each mutation the engine re-discovers and re-scans live references,
- * so a plan that went stale after generation cannot release a resource that
- * gained a reference.
+ * Physical discovery is refreshed, each subtree gets a live-reference scan,
+ * and current durable ownership is checked under the existing writer fence.
+ * No registry connection is held across an asynchronous scan.
  */
-export async function applyResourceGc(input, plan) {
+export async function applyResourceGc(input, plan, store) {
     if (plan.mode === "report") {
         return Object.freeze({
             planned: plan,
@@ -226,95 +272,113 @@ export async function applyResourceGc(input, plan) {
         });
     }
     const home = resolve(input.home);
+    if (resolve(store.rootDirectory()) !== home || resolve(plan.home) !== home) {
+        throw new Error("GC plan, ownership Store and resource Home must match.");
+    }
     const now = input.now;
-    const registryStore = input.registryStore ?? createResourceRegistryStore(home);
-    let registry = registryStore.load();
     const applied = [];
     const failed = [];
     const restored = [];
-    // Re-discover and re-scan with fresh state so the plan is validated against
-    // the world as it exists right now, not when the plan was generated.
-    const discovered = await discoverResources({
-        home,
-        projects: input.projects,
-        managedWorkspaces: input.managedWorkspaces,
-        taskStatusById: input.taskStatusById,
-        now
-    });
-    const freshPaths = discovered.map(({ record }) => record.path);
-    appendRegistryScanPaths(registry, freshPaths, home);
-    const freshScan = await scanLiveReferences({
-        home,
-        paths: freshPaths,
-        environment: input.environment,
-        tmuxServerName: input.tmuxServerName,
-        ports: {
-            ...input.liveReferencePorts,
-            managedWorkspaces: () => input.managedWorkspaces,
-            activeWorkspaceOwners: () => collectActiveWorkspaceOwners(input)
-        }
+    const fresh = await planResourceGc({ ...input, ...readResourceGcState(store) });
+    const freshById = new Map(fresh.records.map(record => [record.id, record]));
+    const retained = new Map(fresh.retained.map(record => [record.id, record]));
+    const retain = (record, reason) => retained.set(record.id, {
+        ...record, disposition: "retained-unproven", blocker: reason, updatedAt: now.toISOString()
     });
-    const freshClassified = classifyDiscoveredResources(discovered, registry, freshScan, input, home);
-    const freshById = new Map(freshClassified.map(({ record }) => [record.id, record]));
+    const inspectedRegistry = withResourceRegistry(home, input.registryStore, registry => registry.load());
+    const movedRoots = [];
     // Restore quarantined records whose owner is no longer terminal or that
     // gained a live reference. This is the apply-time counterpart of the old
     // planning-time restore: planning is read-only, so restore happens here.
-    for (const record of Object.values(registry.records)) {
+    for (const record of Object.values(inspectedRegistry.records)) {
         if (record.disposition !== "quarantined" || record.quarantine === undefined)
             continue;
-        const ownerTaskId = record.owner.taskId;
-        const ownerNoLongerTerminal = ownerTaskId !== undefined
-            && input.taskStatusById.has(ownerTaskId)
-            && !isTerminalTaskStatus(input.taskStatusById.get(ownerTaskId));
-        const originalRefs = freshScan.refsByPath.get(record.quarantine.originalPath) ?? [];
-        if (ownerNoLongerTerminal || originalRefs.length > 0) {
-            const restoredRecord = restoreQuarantinedRecord(record, originalRefs, now);
-            registry = upsertResourceRecord(registry, restoredRecord);
-            if (restoredRecord.disposition === "active") {
-                restored.push(restoredRecord);
-            }
-            else {
-                failed.push(restoredRecord);
-            }
-        }
+        withResourceRegistry(home, input.registryStore, registry => registry.transaction(() => {
+            const before = registry.load();
+            if (!isDeepStrictEqual(before.records[record.id], record))
+                throw new Error("Quarantine ownership changed; inspect and retry.");
+            const refs = [...(fresh.scan.refsByPath.get(record.quarantine.originalPath) ?? []),
+                ...currentDurableRefs(record, readResourceGcState(store)).filter(ref => ref !== "owner-unproven")];
+            if (refs.length === 0)
+                return;
+            const result = restoreQuarantinedRecord(record, refs, now);
+            registry.save(upsertResourceRecord(before, result), before);
+            (result.disposition === "active" ? restored : failed).push(result);
+        }));
     }
-    for (const planned of plan.records) {
+    // A physical parent owns one move. Its unreferenced runtime descendants are
+    // redundant registry receipts, not separately movable resources.
+    for (const planned of [...plan.records].sort((a, b) => a.path.length - b.path.length)) {
         if (!isReleasable(planned))
             continue;
-        // Re-validate against fresh state: the resource must still exist, still
-        // be clean, and still have zero live references.
-        const fresh = freshById.get(planned.id);
-        if (fresh === undefined) {
-            // Resource disappeared since planning; reconcile the stale record.
-            registry = removeResourceRecord(registry, planned.id);
+        if (movedRoots.some(root => within(planned.path, root)))
             continue;
-        }
-        if (!isReleasable(fresh)) {
-            // Fresh liveness, cleanliness, ownership, or diagnostic evidence changed
-            // since planning: retain the resource and reconcile its registry record.
-            registry = upsertResourceRecord(registry, fresh);
+        const candidate = freshById.get(planned.id);
+        if (!candidate || !isReleasable(candidate))
+            continue;
+        const descendants = fresh.records.filter(record => record.id !== candidate.id
+            && within(record.path, candidate.path) && existsSync(record.path));
+        // Do not move a directory around independent Git worktrees or retained
+        // descendants. Their own owner must release them first.
+        if (descendants.some(record => record.kind !== "runtime-artifact" || !isReleasable(record))) {
+            retain(candidate, "Directory contains independently owned or retained resources.");
             continue;
         }
-        const result = await quarantineResource(home, fresh, now);
-        registry = upsertResourceRecord(registry, result.record);
-        if (result.ok) {
-            applied.push(result.record);
-        }
-        else {
-            failed.push(result.record);
+        const scan = await scanLiveReferences({
+            home, sessionOwners: store.listSessionOwners(), paths: [candidate.path, ...descendants.map(record => record.path)],
+            environment: input.environment, tmuxServerName: input.tmuxServerName,
+            ports: input.liveReferencePorts
+        });
+        if (scan.diagnostics.some(d => d.severity === "error")
+            || [...scan.refsByPath.values()].some(refs => refs.length > 0)) {
+            retain(candidate, "Current physical references prevent this subtree move.");
+            continue;
         }
+        withResourceRegistry(home, input.registryStore, registry => registry.transaction(() => {
+            const before = registry.load();
+            const subtree = Object.values(before.records).filter(record => within(record.path, candidate.path)
+                && existsSync(record.path));
+            for (const record of [candidate, ...subtree]) {
+                if (!isDeepStrictEqual(before.records[record.id], inspectedRegistry.records[record.id])) {
+                    throw new Error(`Resource registry ownership changed: ${record.id}; inspect and retry.`);
+                }
+            }
+            const state = readResourceGcState(store);
+            if ([candidate, ...subtree].some(record => currentDurableRefs(record, state).length > 0)) {
+                retain(candidate, "Current Task or workspace ownership prevents this subtree move.");
+                return;
+            }
+            if (!existsSync(candidate.path))
+                return;
+            const result = quarantineResource(home, candidate, now);
+            let next = upsertResourceRecord(before, result.record);
+            if (result.ok) {
+                for (const record of subtree) {
+                    if (record.id !== candidate.id)
+                        next = removeResourceRecord(next, record.id);
+                }
+                movedRoots.push(candidate.path);
+                applied.push(result.record);
+            }
+            else
+                failed.push(result.record);
+            registry.save(next, before);
+        }));
     }
-    registryStore.save(registry);
-    registryStore.close();
     return Object.freeze({
-        planned: plan,
+        planned: {
+            ...fresh,
+            records: fresh.records.map(record => retained.get(record.id) ?? record),
+            retained: [...retained.values()],
+            releasable: fresh.releasable.filter(record => !retained.has(record.id))
+        },
         applied: Object.freeze(applied),
         failed: Object.freeze(failed),
         restored: Object.freeze(restored),
         purged: Object.freeze([])
     });
 }
-async function quarantineResource(home, record, now) {
+function quarantineResource(home, record, now) {
     const quarantineRoot = resourceQuarantineRoot(home);
     const quarantinePath = join(quarantineRoot, record.id);
     const receiptPath = `${quarantinePath}.receipt.json`;
@@ -324,7 +388,9 @@ async function quarantineResource(home, record, now) {
             // metadata, into the Home-local quarantine. Restore is the inverse
             // move, so the recorded HEAD cannot drift with a branch.
             mkdirSync(quarantineRoot, { recursive: true, mode: 0o700 });
-            await executeFile("git", ["-C", record.path, "worktree", "move", "--", record.path, quarantinePath], { timeout: 30_000 });
+            // Keep the existing SQLite writer fence through this bounded move, so a
+            // Task reopen or new durable owner cannot commit between check and move.
+            execFileSync("git", ["-C", record.path, "worktree", "move", "--", record.path, quarantinePath], { timeout: 30_000 });
             writeQuarantineReceipt(home, record, now, "move", receiptPath);
             return {
                 ok: true,
@@ -379,7 +445,7 @@ async function quarantineResource(home, record, now) {
         };
     }
 }
-function writeQuarantineReceipt(home, record, now, method, receiptPath) {
+function writeQuarantineReceipt(_home, record, now, method, receiptPath) {
     try {
         mkdirSync(dirname(receiptPath), { recursive: true, mode: 0o700 });
         writeFileSync(receiptPath, `${JSON.stringify({
@@ -403,58 +469,39 @@ function isGitWorktreePath(path) {
 /**
  * Restore a quarantined resource to its original path. Move-based Git
  * quarantine is reversed with `git worktree move`, preserving the exact
- * checkout. Legacy remove-based receipts rebuild a detached worktree at the
- * recorded HEAD; a branch tip is never used as a substitute.
+ * checkout. A different recorded method remains audit evidence and requires
+ * separate recovery; it is never reinterpreted as a move or a fresh checkout.
  */
 function restoreQuarantinedRecord(record, liveRefs, now) {
     const quarantine = record.quarantine;
     if (quarantine === undefined)
         return record;
     try {
-        if (quarantine.method === "git-worktree-remove" && quarantine.gitRestore !== undefined) {
-            const git = quarantine.gitRestore;
-            if (existsSync(quarantine.originalPath)) {
-                return {
-                    ...record,
-                    disposition: "cleanup-failed",
-                    blocker: `Restore failed: original path already exists: ${quarantine.originalPath}`,
-                    updatedAt: now.toISOString()
-                };
-            }
-            mkdirSync(dirname(quarantine.originalPath), { recursive: true });
-            if (git.head !== undefined) {
-                execFileSync("git", ["-C", git.repositoryPath, "worktree", "add", "--detach", "--", quarantine.originalPath, git.head]);
-            }
-            else {
-                throw new Error("no head recorded for Git worktree restore");
-            }
+        if (quarantine.method !== "move" || !["worktree", "runtime-artifact"].includes(record.kind)) {
+            throw new Error(`Unsupported quarantine provenance: ${record.kind}/${quarantine.method}; preserve its evidence for explicit recovery.`);
+        }
+        if (!existsSync(quarantine.path)) {
+            return {
+                ...record,
+                disposition: "cleanup-failed",
+                blocker: `Restore failed: quarantine path missing: ${quarantine.path}`,
+                updatedAt: now.toISOString()
+            };
+        }
+        if (existsSync(quarantine.originalPath)) {
+            return {
+                ...record,
+                disposition: "cleanup-failed",
+                blocker: `Restore failed: original path already exists: ${quarantine.originalPath}`,
+                updatedAt: now.toISOString()
+            };
+        }
+        mkdirSync(dirname(quarantine.originalPath), { recursive: true });
+        if (isGitWorktreePath(quarantine.path)) {
+            execFileSync("git", ["-C", quarantine.path, "worktree", "move", "--", quarantine.path, quarantine.originalPath], { timeout: 30_000 });
         }
         else {
-            // Move-based restore: rename the quarantine directory back.
-            if (!existsSync(quarantine.path)) {
-                return {
-                    ...record,
-                    disposition: "cleanup-failed",
-                    blocker: `Restore failed: quarantine path missing: ${quarantine.path}`,
-                    updatedAt: now.toISOString()
-                };
-            }
-            if (existsSync(quarantine.originalPath)) {
-                return {
-                    ...record,
-                    disposition: "cleanup-failed",
-                    blocker: `Restore failed: original path already exists: ${quarantine.originalPath}`,
-                    updatedAt: now.toISOString()
-                };
-            }
-            if (isGitWorktreePath(quarantine.path)) {
-                mkdirSync(dirname(quarantine.originalPath), { recursive: true });
-                execFileSync("git", ["-C", quarantine.path, "worktree", "move", "--", quarantine.path, quarantine.originalPath], { timeout: 30_000 });
-            }
-            else {
-                mkdirSync(dirname(quarantine.originalPath), { recursive: true });
-                renameSync(quarantine.path, quarantine.originalPath);
-            }
+            renameSync(quarantine.path, quarantine.originalPath);
         }
     }
     catch (error) {
@@ -479,12 +526,13 @@ function restoreQuarantinedRecord(record, liveRefs, now) {
  * elapsed. A resource with a new live reference — on either the original or
  * the quarantine path — is restored instead.
  */
-export async function purgeResourceQuarantine(home, options) {
+export async function purgeResourceQuarantine(home, options, store) {
     const resolvedHome = resolve(home);
+    if (resolve(store.rootDirectory()) !== resolvedHome)
+        throw new Error("GC ownership Store belongs to another Home.");
     const ttlHours = options.ttlHours ?? DEFAULT_QUARANTINE_TTL_HOURS;
     const ttlMs = ttlHours * 3_600_000;
-    const registryStore = createResourceRegistryStore(resolvedHome);
-    const registry = registryStore.load();
+    const registry = withResourceRegistry(resolvedHome, undefined, store => store.load());
     const quarantined = Object.values(registry.records)
         .filter((record) => record.quarantine !== undefined
         && (record.disposition === "quarantined" || record.disposition === "cleanup-failed"));
@@ -499,6 +547,7 @@ export async function purgeResourceQuarantine(home, options) {
     }
     const scan = await scanLiveReferences({
         home: resolvedHome,
+        sessionOwners: store.listSessionOwners(),
         paths,
         environment: options.environment,
         tmuxServerName: options.tmuxServerName,
@@ -508,7 +557,6 @@ export async function purgeResourceQuarantine(home, options) {
             activeWorkspaceOwners: () => []
         }
     });
-    let state = registry;
     const purged = [];
     const restored = [];
     const failed = [];
@@ -524,58 +572,64 @@ export async function purgeResourceQuarantine(home, options) {
         // resource quarantined instead of permanently deleting it.
         if (scanUntrusted)
             continue;
-        const originalRefs = scan.refsByPath.get(quarantine.originalPath) ?? [];
-        const quarantineRefs = scan.refsByPath.get(quarantine.path) ?? [];
-        const allRefs = [...originalRefs, ...quarantineRefs];
-        if (allRefs.length > 0) {
-            const restoredRecord = restoreQuarantinedRecord(record, allRefs, options.now);
-            state = upsertResourceRecord(state, restoredRecord);
-            if (restoredRecord.disposition === "active") {
-                restored.push(restoredRecord);
+        withResourceRegistry(resolvedHome, undefined, registryStore => registryStore.transaction(() => {
+            const before = registryStore.load();
+            if (!isDeepStrictEqual(before.records[record.id], record))
+                throw new Error("Quarantine ownership changed; inspect and retry.");
+            const save = (next) => registryStore.save(upsertResourceRecord(before, next), before);
+            if (quarantine.method !== "move" || !["worktree", "runtime-artifact"].includes(record.kind)) {
+                const retained = { ...record, disposition: "cleanup-failed",
+                    blocker: `Unsupported quarantine provenance: ${record.kind}/${quarantine.method}; preserve its evidence for explicit recovery.`,
+                    updatedAt: options.now.toISOString() };
+                save(retained);
+                failed.push(retained);
+                return;
             }
-            else {
-                failed.push(restoredRecord);
+            const state = readResourceGcState(store);
+            if (record.owner.taskId === undefined || !state.taskStatusById.has(record.owner.taskId)) {
+                save({ ...record, blocker: "Current Task ownership cannot be proven; quarantine retained.", updatedAt: options.now.toISOString() });
+                return;
             }
-            continue;
-        }
-        try {
-            if (existsSync(quarantine.path)) {
-                if (isGitWorktreePath(quarantine.path)) {
-                    await executeFile("git", ["-C", quarantine.path, "worktree", "remove", "--force", "--", quarantine.path], { timeout: 30_000 });
+            const allRefs = [
+                ...(scan.refsByPath.get(quarantine.originalPath) ?? []),
+                ...(scan.refsByPath.get(quarantine.path) ?? []),
+                ...currentDurableRefs(record, state)
+            ];
+            if (allRefs.length > 0) {
+                const result = restoreQuarantinedRecord(record, allRefs, options.now);
+                save(result);
+                (result.disposition === "active" ? restored : failed).push(result);
+                return;
+            }
+            try {
+                if (existsSync(quarantine.path)) {
+                    if (isGitWorktreePath(quarantine.path)) {
+                        execFileSync("git", ["-C", quarantine.path, "worktree", "remove", "--force", "--", quarantine.path], { timeout: 30_000 });
+                    }
+                    rmSync(quarantine.path, { recursive: true, force: true });
                 }
-                rmSync(quarantine.path, { recursive: true, force: true });
+                const receiptPath = `${quarantine.path}.receipt.json`;
+                if (existsSync(receiptPath))
+                    rmSync(receiptPath, { force: true });
+                const deleted = {
+                    ...record, disposition: "deleted", quarantine: undefined,
+                    cleanupReceipt: { removedAt: options.now.toISOString(), method: "quarantine-purge" },
+                    updatedAt: options.now.toISOString()
+                };
+                save(deleted);
+                purged.push(deleted);
             }
-            // Also remove the receipt sibling.
-            const receiptPath = `${quarantine.path}.receipt.json`;
-            if (existsSync(receiptPath)) {
-                rmSync(receiptPath, { force: true });
+            catch (error) {
+                const failedRecord = {
+                    ...record, disposition: "cleanup-failed",
+                    blocker: `Purge failed: ${error instanceof Error ? error.message : "unknown error"}`,
+                    updatedAt: options.now.toISOString()
+                };
+                save(failedRecord);
+                failed.push(failedRecord);
             }
-            const deleted = {
-                ...record,
-                disposition: "deleted",
-                quarantine: undefined,
-                cleanupReceipt: {
-                    removedAt: options.now.toISOString(),
-                    method: "quarantine-purge"
-                },
-                updatedAt: options.now.toISOString()
-            };
-            state = upsertResourceRecord(state, deleted);
-            purged.push(deleted);
-        }
-        catch (error) {
-            const failedRecord = {
-                ...record,
-                disposition: "cleanup-failed",
-                blocker: `Purge failed: ${error instanceof Error ? error.message : "unknown error"}`,
-                updatedAt: options.now.toISOString()
-            };
-            state = upsertResourceRecord(state, failedRecord);
-            failed.push(failedRecord);
-        }
+        }));
     }
-    registryStore.save(state);
-    registryStore.close();
     return Object.freeze({
         planned: Object.freeze({
             home: resolvedHome,
@@ -601,8 +655,7 @@ export async function purgeResourceQuarantine(home, options) {
  */
 export async function restoreAllResourceGc(home, options) {
     const resolvedHome = resolve(home);
-    const registryStore = createResourceRegistryStore(resolvedHome);
-    const registry = registryStore.load();
+    const registry = withResourceRegistry(resolvedHome, undefined, store => store.load());
     const quarantined = Object.values(registry.records)
         .filter((record) => record.quarantine !== undefined
         && (record.disposition === "quarantined" || record.disposition === "cleanup-failed"));
@@ -619,8 +672,7 @@ export async function restoreAllResourceGc(home, options) {
             failed.push(restoredRecord);
         }
     }
-    registryStore.save(state);
-    registryStore.close();
+    withResourceRegistry(resolvedHome, undefined, store => store.save(state, registry));
     return Object.freeze({
         planned: Object.freeze({
             home: resolvedHome,

package/dist/resources/resourceRegistrar.js

@@ -9,8 +9,8 @@
 import { execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
-import { createResourceRegistryStore } from "./resourceRegistryStore.js";
 import { upsertResourceRecord } from "./resourceRegistry.js";
+import { createResourceRegistryStore } from "./resourceRegistryStore.js";
 import { createResourceRecord, isReleaseNamespacePath, resourceId } from "./resourceTypes.js";
 export class ResourceRegistrar {
     #home;
@@ -142,7 +142,7 @@ export class ResourceRegistrar {
                 });
             }
             if (next !== state)
-                store.save(next);
+                store.save(next, state);
         }
         finally {
             store.close();
@@ -175,10 +175,11 @@ export class ResourceRegistrar {
             return;
         const store = createResourceRegistryStore(this.#home);
         try {
-            let state = store.load();
+            const previous = store.load();
+            let state = previous;
             for (const record of records)
                 state = upsertResourceRecord(state, record);
-            store.save(state);
+            store.save(state, previous);
         }
         finally {
             store.close();