agents-can-communicate 0.8.5 → 0.9.1

package/node_modules/@agents-can-communicate/storage-filesystem/src/atomic-json.mjs

@@ -1,22 +1,14 @@
 import { createHash, randomUUID } from "node:crypto";
-import { link, open, readdir, rename } from "node:fs/promises";
+import { link, open, readdir } from "node:fs/promises";
 import path from "node:path";
 
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
 
 import { assertPublicationDeadline } from "./deadline.mjs";
+import { isWindows, renameReplacing, syncEntry } from "./portable-fs.mjs";
 import { assertManagedDirectory, ensureManagedDirectory } from "./safe-directory.mjs";
 import { readRegularNoFollow } from "./safe-file.mjs";
 
-async function syncDirectory(directory) {
-  const handle = await open(directory, "r");
-  try {
-    await handle.sync();
-  } finally {
-    await handle.close();
-  }
-}
-
 export function encode(value) {
   const serialised = JSON.stringify(value, null, 2);
   if (serialised === undefined) {
@@ -41,6 +33,20 @@ function retainedStage(destination, root, stageDir) {
   return path.join(stageDir, `${identity}.published`);
 }
 
+const DURABILITY = new Set(["full", "bytes", "none"]);
+
+/**
+ * The durability of a publication that another flush follows.
+ *
+ * On Windows flushing a file commits NTFS's metadata journal up to that file's
+ * last change, and that journal is one sequence: the next flush commits this
+ * rename too, so only the bytes are flushed here. A crash before that flush
+ * leaves the previous version, or nothing, and nothing written after it can be
+ * durable without it (docs/design/2026-09-30-native-windows-support.md, "What
+ * is flushed"). POSIX syncs the name's own directory.
+ */
+export const nameCommittedLater = platform => (isWindows(platform) ? "bytes" : "full");
+
 async function replaceHandleBytes(handle, bytes) {
   await handle.truncate(0);
   let offset = 0;
@@ -61,11 +67,22 @@ async function replaceHandleBytes(handle, bytes) {
  * state is mutable by design, which is what generations exist for, so it is
  * published by rename(). Conflating the two makes every state update fail.
  *
+ * `durability` is what a crash of the machine may cost the record, since every
+ * flush waits for the whole disk - on windows-latest from 15 ms to 5.8 s:
+ * - "full" (the default): nothing; its bytes are flushed before they take the
+ *   name, and the name is flushed before this returns;
+ * - "bytes": the name, so a reader finds the previous version and never torn
+ *   bytes - for a record whose loss its owner recovers from;
+ * - "none": everything - for a record whose reader treats damage as absence.
+ *
  * @returns {Promise<"published" | "already_published">}
  */
 export async function publishAtomic(destination, bytes,
-  { root, tmpDir, stageDir, replace = false, deadlineAt, afterAccepted, afterStageEnsured,
-    afterStageRenamed }) {
+  { root, tmpDir, stageDir, replace = false, durability = "full", deadlineAt, afterAccepted,
+    afterStageEnsured, afterStageRenamed, sync = syncEntry }) {
+  if (!DURABILITY.has(durability)) {
+    throw new AccError(EXIT.USAGE, "unknown publication durability", { durability });
+  }
   assertPublicationDeadline(deadlineAt);
   // The accepted stage lives apart from the partial a failed publication
   // leaves, so what a file is follows from the directory it was created in
@@ -101,13 +118,16 @@ export async function publishAtomic(destination, bytes,
   let stageAcceptedBytes = false;
   try {
     await handle.writeFile(bytes);
-    await handle.sync();
+    if (durability !== "none") await handle.sync();
     if (replace) {
       await handle.close();
       handle = null;
       assertPublicationDeadline(deadlineAt);
-      await rename(temporary, destination);
-      await syncDirectory(destinationDir);
+      await renameReplacing(temporary, destination, { deadlineAt });
+      // The bytes are at their name now: the write is decided and visible, and
+      // its flush is bounded by its own wait, never by the caller's deadline,
+      // which would report a published record as failed.
+      if (durability === "full") await sync(destinationDir, destination);
       return "published";
     }
 
@@ -115,7 +135,7 @@ export async function publishAtomic(destination, bytes,
       assertPublicationDeadline(deadlineAt);
       await link(temporary, destination);
       stageAcceptedBytes = true;
-      await syncDirectory(destinationDir);
+      if (durability === "full") await sync(destinationDir, destination);
       return "published";
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
@@ -160,9 +180,10 @@ export async function publishAtomic(destination, bytes,
 // The sweep can take `stage` between any two of these steps: it renames the
 // directory aside, and a store still opening publishes here without the writer
 // mutex the sweep holds (CI on #217). The bytes are already published, so the
-// retained copy goes to whichever directory carries the name when it moves, and
-// a copy the sweep took along with the directory needs no sync here - the sweep
-// discards that directory. The two callbacks are seams for the race tests.
+// retained copy goes to whichever directory carries the name when it moves. The
+// copy is never flushed: it is never read, and the sweep discards it. A crash
+// that loses its move leaves the temporary in tmp, which is what tmp holds. The
+// two callbacks are seams for the race tests.
 const STAGE_RETRIES = 4;
 
 async function retainAcceptedStage({ root, stageDir, temporary, stage, afterStageEnsured,
@@ -171,16 +192,13 @@ async function retainAcceptedStage({ root, stageDir, temporary, stage, afterStag
     await ensureManagedDirectory(root, stageDir);
     await afterStageEnsured?.();
     try {
-      await rename(temporary, stage);
+      await renameReplacing(temporary, stage);
       break;
     } catch (error) {
       if (error.code !== "ENOENT" || attempt >= STAGE_RETRIES) throw error;
     }
   }
   await afterStageRenamed?.();
-  await syncDirectory(stageDir).catch(error => {
-    if (error.code !== "ENOENT") throw error;
-  });
 }
 
 // The opener is the seam the race tests use, and stays last so callers that do

package/node_modules/@agents-can-communicate/storage-filesystem/src/doomed-directory.mjs

@@ -1,8 +1,9 @@
 import { randomUUID } from "node:crypto";
-import { open, rename, rm, rmdir } from "node:fs/promises";
+import { rmdir } from "node:fs/promises";
 import path from "node:path";
 
 import { listDirectoryEntries } from "./atomic-json.mjs";
+import { removeTree, renameEntry } from "./portable-fs.mjs";
 import { assertManagedDirectory, ensureManagedDirectory } from "./safe-directory.mjs";
 
 // The store never unlinks a live name: Node exposes unlink only by pathname, so
@@ -21,15 +22,6 @@ const DOOMED = "stage.sweeping-";
 // is reported as remaining, and the next pass adopts it.
 export const expired = deadlineAt => deadlineAt !== undefined && Date.now() >= deadlineAt;
 
-export async function syncDirectory(directory) {
-  const handle = await open(directory, "r");
-  try {
-    await handle.sync();
-  } finally {
-    await handle.close();
-  }
-}
-
 export async function doomedDirectories(root) {
   return (await listDirectoryEntries(root, { root }))
     .filter(entry => entry.isDirectory() && entry.name.startsWith(DOOMED))
@@ -56,7 +48,7 @@ export async function detachDoomed(root) {
  * discarded whole, so the names inside it carry no meaning.
  */
 export async function condemn(filePath, doomed) {
-  await rename(filePath, path.join(doomed, `${randomUUID()}.doomed`));
+  await renameEntry(filePath, path.join(doomed, `${randomUUID()}.doomed`));
 }
 
 /**
@@ -69,7 +61,7 @@ export async function discard(directory, root, budget, deadlineAt) {
   await assertManagedDirectory(root, directory);
   for (const entry of await listDirectoryEntries(directory, { root })) {
     if (spent >= budget || expired(deadlineAt)) return { spent, drained: false };
-    await rm(path.join(directory, entry.name), { recursive: true, force: true });
+    await removeTree(path.join(directory, entry.name));
     spent += 1;
   }
   await rmdir(directory).catch(error => {

package/node_modules/@agents-can-communicate/storage-filesystem/src/identity.mjs

@@ -2,7 +2,7 @@ import path from "node:path";
 
 import { AccError, EXIT, assertPortableId } from "@agents-can-communicate/protocol";
 
-import { encode, publishAtomic, readJsonIfPresent } from "./atomic-json.mjs";
+import { encode, nameCommittedLater, publishAtomic, readJsonIfPresent } from "./atomic-json.mjs";
 
 export const STORE_VERSION = 6;
 
@@ -29,7 +29,8 @@ function assertIdentity(record, workspaceId, filePath) {
  * foreign store is the failure the reconciled prototype fails closed on, and
  * the same rule applies here.
  */
-export async function requireStoreIdentity(paths, { workspaceId, clock, create = true }) {
+export async function requireStoreIdentity(paths, { workspaceId, clock, create = true,
+  platform }) {
   assertPortableId(workspaceId, "workspace id");
   const filePath = identityPath(paths);
   const found = await readJsonIfPresent(filePath, paths.root);
@@ -39,7 +40,10 @@ export async function requireStoreIdentity(paths, { workspaceId, clock, create =
   }
   const record = { storeVersion: STORE_VERSION, workspaceId, initialisedAt: clock.now() };
   try {
-    await publishAtomic(filePath, encode(record), { root: paths.root, tmpDir: paths.tmp });
+    // The journal's first pointer, published next, commits this name on
+    // Windows; a crash before it leaves a directory the next open initialises.
+    await publishAtomic(filePath, encode(record), { root: paths.root, tmpDir: paths.tmp,
+      durability: nameCommittedLater(platform) });
   } catch (error) {
     // Losing this race is not a failure. Two agents starting together in a
     // workspace neither has opened before is the ordinary case, and the two

package/node_modules/@agents-can-communicate/storage-filesystem/src/index.mjs

@@ -4,3 +4,4 @@ export { diagnoseFilesystemStore, repairFilesystemStore } from "./recovery.mjs";
 export { readStoreIdentity, requireStoreIdentity, STORE_VERSION } from "./identity.mjs";
 export { withWriterMutex } from "./writer-mutex.mjs";
 export { readSessionRecord } from "./session-read.mjs";
+export { openNoFollow } from "./portable-fs.mjs";

package/node_modules/@agents-can-communicate/storage-filesystem/src/journal.mjs

@@ -3,12 +3,27 @@ import path from "node:path";
 import { AccError, EXIT, assertPortableId } from "@agents-can-communicate/protocol";
 
 import { activateJournal, idleJournal, readActiveJournal } from "./active-journal.mjs";
-import { encode, publishAtomic, readJsonIfPresent, retainFile }
+import { encode, nameCommittedLater, publishAtomic, readJsonIfPresent, retainFile }
   from "./atomic-json.mjs";
-import { completeJournal } from "./retention.mjs";
 
 export const JOURNAL_VERSION = 2;
 
+// What a publication inside a transaction leaves to the flush after it.
+//
+// The entry's name is made durable by the pointer that opens it, which is
+// published beside it in journal/: POSIX syncs that directory, and on Windows
+// flushing a file commits NTFS's metadata journal up to that file's last change
+// (docs/design/2026-09-30-native-windows-support.md, "What is flushed"). That
+// journal is one sequence, so on Windows every rename logged before a flush is
+// committed with it: each record's own flush commits the rename before it, and
+// the pointer going idle commits the last record's. Only bytes are flushed
+// there. A crash that loses the idle pointer's rename leaves the transaction
+// open, and nothing written after it can be durable without that rename, so
+// rolling it forward again changes nothing. A flush took 15 ms at the median and
+// up to 5.8 s on windows-latest beside the suite (2026-10-01).
+const ENTRY = "bytes";
+const linked = nameCommittedLater;
+
 // A journal entry is prepared only after the transaction callback has
 // succeeded and every byte is known. The subsequent synced active-log record
 // is the commit point: an orphan prepared journal is not a decided
@@ -62,17 +77,19 @@ export function journalEntry(transactionId, firstSequence, publications, started
 }
 
 export async function writeJournalEntry(paths, options, entry) {
-  await publishAtomic(journalPath(paths, entry.transactionId), encode(entry), options);
+  await publishAtomic(journalPath(paths, entry.transactionId), encode(entry),
+    { ...options, durability: ENTRY });
   await options.failAt?.("after-journal-prepared");
-  await activateJournal(paths, options, entry);
+  await activateJournal(paths, { ...options, durability: linked(options.platform) }, entry);
   return entry;
 }
 
+// The entry stays where it is; the reclaimer retires every entry the pointer
+// does not name.
 export async function retireJournalEntry(paths, options, transactionId) {
   await retainFile(journalPath(paths, transactionId), { root: paths.root });
-  await completeJournal(paths, options, transactionId);
   await options.failAt?.("before-journal-idle");
-  await idleJournal(paths, options, transactionId);
+  await idleJournal(paths, { ...options, durability: linked(options.platform) }, transactionId);
 }
 
 export async function readOpenJournals(paths, root) {
@@ -124,7 +141,7 @@ export async function rollForward(paths, options, entry) {
     }
     const bytes = Buffer.from(publication.bytes, "base64");
     const outcome = await publishAtomic(destination, bytes,
-      { ...options, replace: publication.replace === true });
+      { ...options, replace: publication.replace === true, durability: linked(options.platform) });
     if (outcome === "published") published.push(publication.path);
     // Seam for the crash-window tests: abort between two publications of the
     // same decided transaction.

package/node_modules/@agents-can-communicate/storage-filesystem/src/portable-fs.mjs

@@ -0,0 +1,165 @@
+// Filesystem calls whose meaning differs on Windows, each measured on a
+// windows-latest runner (docs/design/2026-09-30-native-windows-support.md).
+// POSIX keeps the single call it always made; the Windows branch keeps the rule
+// the caller relies on. Node built-ins only: the managed runtime's launchers
+// carry a byte-identical copy of this file, and they may import nothing else.
+import { constants } from "node:fs";
+import * as fs from "node:fs/promises";
+
+const BUSY = new Set(["EPERM", "EACCES", "EBUSY"]);
+// Long enough for a reader, an antivirus scan or an indexer to let go; short
+// enough that a hook's budget is spent on the write, not on waiting.
+const DEFAULT_WAIT_MS = 2_000;
+const BACKOFF_MS = [5, 10, 20, 40, 80];
+const STEADY_MS = 100;
+
+const sleepFor = duration => new Promise(resolve => { setTimeout(resolve, duration); });
+
+export const isWindows = (platform = process.platform) => platform === "win32";
+
+async function retrying(operation, retry, { deadlineAt, sleep = sleepFor }) {
+  const deadline = deadlineAt ?? Date.now() + DEFAULT_WAIT_MS;
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return await operation();
+    } catch (error) {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0 || !await retry(error)) throw error;
+      await sleep(Math.min(BACKOFF_MS[attempt] ?? STEADY_MS, remaining));
+    }
+  }
+}
+
+/**
+ * Rename a file over an existing one.
+ *
+ * Windows refuses the rename while any handle is open on the target - an ACC
+ * reader, an antivirus scan, an indexer - whatever sharing that handle allows.
+ * The handle is always short-lived, so the rename is retried until the caller's
+ * deadline rather than failing a write whose bytes are ready.
+ */
+export async function renameReplacing(from, to, { platform = process.platform,
+  rename = fs.rename, deadlineAt, sleep } = {}) {
+  if (!isWindows(platform)) return rename(from, to);
+  return retrying(() => rename(from, to), error => BUSY.has(error.code), { deadlineAt, sleep });
+}
+
+/**
+ * Rename a directory, or move any entry to a name nobody else uses.
+ *
+ * POSIX reports an occupied name as EEXIST or ENOTEMPTY, and callers treat that
+ * as "somebody else got there first". Windows reports it as EPERM, the same code
+ * it uses when a file inside the source is open. The target tells them apart:
+ * if it exists the answer is EEXIST, as on POSIX; if not, the source was busy
+ * and the rename is retried.
+ */
+export async function renameEntry(from, to, { platform = process.platform,
+  rename = fs.rename, lstat = fs.lstat, deadlineAt, sleep } = {}) {
+  if (!isWindows(platform)) return rename(from, to);
+  return retrying(async () => {
+    try {
+      return await rename(from, to);
+    } catch (error) {
+      if (!BUSY.has(error.code)) throw error;
+      const occupied = await lstat(to).then(() => true, missing => {
+        if (missing.code === "ENOENT") return false;
+        throw missing;
+      });
+      if (occupied) {
+        throw Object.assign(new Error(`EEXIST: file already exists, rename '${from}' -> '${to}'`),
+          { code: "EEXIST", syscall: "rename", path: from, dest: to });
+      }
+      throw error;
+    }
+  }, error => BUSY.has(error.code), { deadlineAt, sleep });
+}
+
+const gone = (file, lstat) => lstat(file).then(() => false,
+  error => error.code === "ENOENT");
+
+const refusedLink = file => Object.assign(
+  new Error(`ELOOP: too many symbolic links encountered, open '${file}'`),
+  { code: "ELOOP", syscall: "open", path: file });
+
+// How many times a name that keeps changing hands is opened afresh.
+const SWAPS = 3;
+
+/**
+ * Open a file without following a symlink at its final component.
+ *
+ * Windows has no O_NOFOLLOW: the flag is undefined there and an open through a
+ * file symlink succeeds. The rule is kept by checking the name first, refusing a
+ * symlink or junction (Node reports both as symbolic links), and after the open
+ * checking the name again: it must be no link, and name the very file the handle
+ * holds. A name another process replaced in between - a lock changing hands, a
+ * record renamed over - then names what was opened, as POSIX's O_NOFOLLOW open
+ * would have taken it; a name that moved on again is opened afresh, a few times.
+ */
+export async function openNoFollow(file, flags, { mode, platform = process.platform,
+  open = fs.open, lstat = fs.lstat, deadlineAt, sleep } = {}) {
+  if (!isWindows(platform)) return open(file, flags | constants.O_NOFOLLOW, mode);
+  for (let attempt = 1; ; attempt += 1) {
+    const before = await lstat(file, { bigint: true }).catch(error => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (before?.isSymbolicLink()) throw refusedLink(file);
+    // A scanner that opened the file without read sharing refuses every reader
+    // with EBUSY until it lets go.
+    const handle = await retrying(() => open(file, flags, mode), error => error.code === "EBUSY",
+      { deadlineAt, sleep }).catch(async error => {
+      // A name another process is deleting, or a lock changing hands around
+      // it, refuses the open with EPERM, and the name is gone right after
+      // (measured on windows-latest, for a name present before the open and
+      // for one absent before it): that is ENOENT, as Linux says it. A name
+      // that is still there keeps its EPERM, and so does a create on a name
+      // that was free, which is a refused create.
+      const refusedCreate = before === null && (flags & constants.O_CREAT) !== 0;
+      if (error.code !== "EPERM" || refusedCreate || !await gone(file, lstat)) throw error;
+      throw Object.assign(new Error(`ENOENT: no such file or directory, open '${file}'`,
+        { cause: error }), { code: "ENOENT", syscall: "open", path: file });
+    });
+    try {
+      const opened = await handle.stat({ bigint: true });
+      const named = await lstat(file, { bigint: true }).catch(error => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      if (named?.isSymbolicLink()) throw refusedLink(file);
+      if (named !== null && named.dev === opened.dev && named.ino === opened.ino) return handle;
+      if (attempt >= SWAPS) throw refusedLink(file);
+    } catch (error) {
+      await handle.close();
+      throw error;
+    }
+    await handle.close();
+  }
+}
+
+/**
+ * Make a rename or link that produced `entry` inside `directory` durable.
+ *
+ * POSIX syncs the directory. Windows refuses a flush on a directory handle, and
+ * NTFS journals the rename as metadata: flushing the renamed file commits that
+ * journal up to the file's last change, which includes the rename. A directory
+ * entry (a lock taken by renaming a directory) guards live processes only and is
+ * not flushed.
+ */
+export async function syncEntry(directory, entry, { platform = process.platform,
+  open = fs.open, lstat = fs.lstat, deadlineAt, sleep } = {}) {
+  if (!isWindows(platform)) {
+    const handle = await open(directory, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try { await handle.sync(); } finally { await handle.close(); }
+    return;
+  }
+  if ((await lstat(entry)).isDirectory()) return;
+  const handle = await retrying(() => open(entry, "r+"), error => error.code === "EBUSY",
+    { deadlineAt, sleep });
+  try { await handle.sync(); } finally { await handle.close(); }
+}
+
+/** Remove a tree; Windows retries a file another process still holds. */
+export async function removeTree(target, { platform = process.platform, rm = fs.rm } = {}) {
+  await rm(target, { recursive: true, force: true,
+    maxRetries: isWindows(platform) ? 10 : 0, retryDelay: 50 });
+}

package/node_modules/@agents-can-communicate/storage-filesystem/src/publication-path.mjs

@@ -0,0 +1,8 @@
+import path from "node:path";
+
+// A journal entry names each file it publishes relative to the store root, with
+// forward slashes on every platform. path.relative gives backslashes on Windows,
+// and an entry would then read differently depending on where it was written.
+export function publicationPath(root, file, pathApi = path) {
+  return pathApi.relative(root, file).split(pathApi.sep).join("/");
+}

package/node_modules/@agents-can-communicate/storage-filesystem/src/reclaim.mjs

@@ -17,6 +17,13 @@ const jsonNames = async (directory, root) =>
     .filter(entry => entry.isFile() && entry.name.endsWith(".json"))
     .map(entry => entry.name);
 
+// A store that never had an older ACC write a completion marker has no
+// directory for them.
+const jsonNamesIfPresent = (directory, root) => jsonNames(directory, root).catch(error => {
+  if (error.code === "ENOENT") return [];
+  throw error;
+});
+
 /**
  * Which transaction the store is in the middle of, or null when it cannot tell.
  *
@@ -40,16 +47,19 @@ async function activeTransaction(paths, root) {
 }
 
 /**
- * Condemn every journal entry that has been retired, with its completion marker.
+ * Condemn every journal entry but the one the pointer names open.
  *
- * `retireJournalEntry` calls `retainFile`, which by construction never unlinks,
- * so a completed entry was kept forever; `completeJournal` then wrote a marker
- * that nothing reads. Both halves go together: a marker outliving its entry
- * records the completion of a file nothing can find.
+ * Every pass runs under the writer lock, as every transaction does, so none is
+ * between preparing its entry and opening it: an entry the pointer does not
+ * name either finished or was never decided, and recovery reads only the one it
+ * names. That entry stays even when a marker says it completed - an older ACC
+ * wrote its marker before the pointer went idle, and a crash between the two
+ * leaves exactly that. A completion marker is all an older ACC knew to judge
+ * by; this one writes none, and the old ones leave with or without their entry.
  *
- * The marker directory is listed once rather than read per entry. A workspace
- * in daily use reaches thousands of retired transactions, and one open each
- * would be the cost this pass exists to remove.
+ * Both directories are listed once rather than read per entry. A workspace in
+ * daily use reaches thousands of retired transactions, and one open each would
+ * be the cost this pass exists to remove.
  */
 async function condemnRetiredJournals(paths, root, doomed, budget, deadlineAt) {
   let spent = 0;
@@ -57,16 +67,15 @@ async function condemnRetiredJournals(paths, root, doomed, budget, deadlineAt) {
   if (!active.known) return { spent, drained: true };
 
   const markerDirectory = path.join(paths.retained, "journal");
-  const completed = new Set(await jsonNames(markerDirectory, root));
-  for (const name of await jsonNames(paths.journal, root)) {
-    if (spent + 2 > budget || expired(deadlineAt)) return { spent, drained: false };
-    if (!completed.has(name)) continue;
-    // The marker is written before the pointer goes idle, so a crash between
-    // the two leaves a completed marker on the entry recovery still owns.
+  const markers = new Set(await jsonNamesIfPresent(markerDirectory, root));
+  const entries = new Set(await jsonNames(paths.journal, root));
+  for (const name of new Set([...entries, ...markers])) {
     if (path.basename(name, ".json") === active.transactionId) continue;
-    await condemn(path.join(paths.journal, name), doomed);
-    await condemn(path.join(markerDirectory, name), doomed);
-    spent += 2;
+    const found = [...entries.has(name) ? [path.join(paths.journal, name)] : [],
+      ...markers.has(name) ? [path.join(markerDirectory, name)] : []];
+    if (spent + found.length > budget || expired(deadlineAt)) return { spent, drained: false };
+    for (const file of found) await condemn(file, doomed);
+    spent += found.length;
   }
   return { spent, drained: true };
 }

package/node_modules/@agents-can-communicate/storage-filesystem/src/recovery.mjs

@@ -5,6 +5,7 @@ import { AccError, EXIT, validateRecord } from "@agents-can-communicate/protocol
 import { listDirectoryEntries, listJsonFiles, readJsonIfPresent } from "./atomic-json.mjs";
 import { readEventFloor } from "./event-floor.mjs";
 import { readStoreIdentity } from "./identity.mjs";
+import { readActiveJournal } from "./active-journal.mjs";
 import { readOpenJournals, rollForward } from "./journal.mjs";
 import { assertEventBinding, assertStateBinding } from "./record-id.mjs";
 import { reclaimRetired } from "./reclaim.mjs";
@@ -45,12 +46,13 @@ async function countStaging(paths, root) {
   const staged = (await entries(paths.stage)).filter(entry => entry.isFile()
     && accepted(entry.name)).length;
   const inTmp = await entries(paths.tmp);
-  // A retired journal entry is one the store keeps and never reads again, so
-  // counting them is what tells an operator the automatic pass has work left.
-  const completed = new Set((await entries(path.join(paths.retained, "journal")))
-    .filter(entry => entry.isFile()).map(entry => entry.name));
+  // A retired journal entry is one the store keeps and never reads again - any
+  // the pointer does not name open - so counting them is what tells an operator
+  // the automatic pass has work left.
+  const open = await readActiveJournal(paths, root)
+    .then(active => (active.state === "open" ? `${active.transactionId}.json` : null), () => null);
   const retired = (await entries(paths.journal))
-    .filter(entry => entry.isFile() && completed.has(entry.name)).length;
+    .filter(entry => entry.isFile() && entry.name.endsWith(".json") && entry.name !== open).length;
   return {
     staged: staged + inTmp.filter(entry => accepted(entry.name)).length,
     partials: inTmp.filter(entry => entry.name.endsWith(".tmp")).length,

package/node_modules/@agents-can-communicate/storage-filesystem/src/retention.mjs

@@ -3,6 +3,7 @@ import path from "node:path";
 import { AccError, EXIT, assertPortableId } from "@agents-can-communicate/protocol";
 
 import { encode, listJsonFiles, publishAtomic, readJsonIfPresent } from "./atomic-json.mjs";
+import { publicationPath } from "./publication-path.mjs";
 
 const RETENTION_VERSION = 1;
 const SEQUENCE_WIDTH = 16;
@@ -40,8 +41,8 @@ function stateMarker(paths, kind, id, generation) {
 
 export function stateDeletionPublication(paths, root, kind, id, generation, retainedPath) {
   const marker = stateMarker(paths, kind, id, generation);
-  return { path: path.relative(root, marker.filePath), bytes: encode(marker.record),
-    replace: false, retainedPath: path.relative(root, retainedPath) };
+  return { path: publicationPath(root, marker.filePath), bytes: encode(marker.record),
+    replace: false, retainedPath: publicationPath(root, retainedPath) };
 }
 
 export async function stateGenerationIsDeleted(paths, root, kind, id, generation) {
@@ -99,8 +100,10 @@ export async function markEphemeral(paths, options, kind, id, state) {
   const previous = await latestEphemeralMarker(paths, options.root, kind, id);
   // A marker that repeats the current state changes nothing, and every renewal
   // of a live record used to append one. History now grows only with a real
-  // change: published after a deletion, or deleted.
-  if (previous?.state === state) return previous;
+  // change: published after a deletion, or deleted. A record with no marker is
+  // present, so its first publication is no change either - it cost every new
+  // session an atomic write, three flushes on Windows, per ephemeral record.
+  if (previous?.state === state || (previous === null && state === "present")) return previous;
   const sequence = pad(previous === null ? 1n : BigInt(previous.sequence) + 1n);
   const record = { retentionVersion: RETENTION_VERSION, area: "ephemeral", kind, id,
     sequence, state };
@@ -108,15 +111,3 @@ export async function markEphemeral(paths, options, kind, id, state) {
   await publishAtomic(filePath, encode(record), options);
   return record;
 }
-
-function completionMarker(paths, transactionId) {
-  assertPortableId(transactionId, "transaction id");
-  const record = { retentionVersion: RETENTION_VERSION, transactionId };
-  return { record, filePath: path.join(paths.retained, "journal", `${transactionId}.json`) };
-}
-
-export async function completeJournal(paths, options, transactionId) {
-  const marker = completionMarker(paths, transactionId);
-  await publishAtomic(marker.filePath, encode(marker.record), options);
-  return marker.record;
-}