agents-can-communicate 0.9.1 → 0.10.1

package/node_modules/@agents-can-communicate/storage-filesystem/src/portable-fs.mjs

@@ -74,8 +74,22 @@ export async function renameEntry(from, to, { platform = process.platform,
   }, error => BUSY.has(error.code), { deadlineAt, sleep });
 }
 
-const gone = (file, lstat) => lstat(file).then(() => false,
-  error => error.code === "ENOENT");
+// A name inside a directory another process is deleting - a waiting writer's
+// rmdir of a lock its owner emptied - answers lstat with EPERM until the
+// deletion is done (measured on windows-latest: lstat of writer.lock\owner.json
+// while eight writers elected one, 2026-10-06, and the waiting writer failed
+// instead of looking again). The name is asked again within the caller's
+// deadline: what it settles to is the answer, and an EPERM that outlasts the
+// deadline is kept.
+async function lstatSettled(file, lstat, { deadlineAt, sleep }) {
+  try {
+    return await retrying(() => lstat(file, { bigint: true }), error => error.code === "EPERM",
+      { deadlineAt, sleep });
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
 
 const refusedLink = file => Object.assign(
   new Error(`ELOOP: too many symbolic links encountered, open '${file}'`),
@@ -99,32 +113,39 @@ export async function openNoFollow(file, flags, { mode, platform = process.platf
   open = fs.open, lstat = fs.lstat, deadlineAt, sleep } = {}) {
   if (!isWindows(platform)) return open(file, flags | constants.O_NOFOLLOW, mode);
   for (let attempt = 1; ; attempt += 1) {
-    const before = await lstat(file, { bigint: true }).catch(error => {
-      if (error.code === "ENOENT") return null;
-      throw error;
-    });
+    const before = await lstatSettled(file, lstat, { deadlineAt, sleep });
     if (before?.isSymbolicLink()) throw refusedLink(file);
-    // A scanner that opened the file without read sharing refuses every reader
-    // with EBUSY until it lets go.
-    const handle = await retrying(() => open(file, flags, mode), error => error.code === "EBUSY",
-      { deadlineAt, sleep }).catch(async error => {
+    let handle;
+    try {
+      // A scanner that opened the file without read sharing refuses every
+      // reader with EBUSY until it lets go.
+      handle = await retrying(() => open(file, flags, mode), error => error.code === "EBUSY",
+        { deadlineAt, sleep });
+    } catch (error) {
       // A name another process is deleting, or a lock changing hands around
       // it, refuses the open with EPERM, and the name is gone right after
       // (measured on windows-latest, for a name present before the open and
       // for one absent before it): that is ENOENT, as Linux says it. A name
-      // that is still there keeps its EPERM, and so does a create on a name
-      // that was free, which is a refused create.
+      // that names another file by then changed hands - a lock released and
+      // taken again while the open was refused (measured on windows-latest,
+      // 2026-10-06) - and is opened afresh, as a swap after the open is. A
+      // name still naming what it named keeps its EPERM, and so does a create
+      // on a name that was free, which is a refused create.
       const refusedCreate = before === null && (flags & constants.O_CREAT) !== 0;
-      if (error.code !== "EPERM" || refusedCreate || !await gone(file, lstat)) throw error;
-      throw Object.assign(new Error(`ENOENT: no such file or directory, open '${file}'`,
-        { cause: error }), { code: "ENOENT", syscall: "open", path: file });
-    });
+      if (error.code !== "EPERM" || refusedCreate) throw error;
+      const now = await lstatSettled(file, lstat, { deadlineAt, sleep }).catch(() => undefined);
+      if (now === null) {
+        throw Object.assign(new Error(`ENOENT: no such file or directory, open '${file}'`,
+          { cause: error }), { code: "ENOENT", syscall: "open", path: file });
+      }
+      const changedHands = now !== undefined
+        && (before === null || now.dev !== before.dev || now.ino !== before.ino);
+      if (changedHands && attempt < SWAPS) continue;
+      throw error;
+    }
     try {
       const opened = await handle.stat({ bigint: true });
-      const named = await lstat(file, { bigint: true }).catch(error => {
-        if (error.code === "ENOENT") return null;
-        throw error;
-      });
+      const named = await lstatSettled(file, lstat, { deadlineAt, sleep });
       if (named?.isSymbolicLink()) throw refusedLink(file);
       if (named !== null && named.dev === opened.dev && named.ino === opened.ino) return handle;
       if (attempt >= SWAPS) throw refusedLink(file);

package/node_modules/@agents-can-communicate/storage-filesystem/src/prune-durability.mjs

@@ -0,0 +1,29 @@
+import path from "node:path";
+import { doomedDirectories } from "./doomed-directory.mjs";
+import { isWindows, syncEntry } from "./portable-fs.mjs";
+import { assertManagedDirectory } from "./safe-directory.mjs";
+
+// A decided prune finishes its applied prefix even after its deadline. On
+// Windows the final idle-journal file flush commits earlier NTFS renames.
+export async function syncPruneDirectories(root, directories, { platform } = {}) {
+  if (isWindows(platform)) return;
+  for (const directory of directories) {
+    try { await assertManagedDirectory(root, directory); }
+    catch (error) { if (error.code === "ENOENT") continue; throw error; }
+    await syncEntry(directory, directory, { platform });
+  }
+}
+
+// Empty-publication journals are physical indexed prunes. Process death loses
+// their in-memory affected-directory set; conservatively fence every possible
+// primary/marker parent before idle permits a current negative cache. No new
+// journal format or per-record publication is needed.
+export async function recoverPruneDurability(paths, { root, platform } = {}) {
+  if (isWindows(platform)) return;
+  const directories = [
+    ...["message", "receipt"].flatMap(kind => [path.join(paths.state, kind),
+      path.join(paths.retained, "state", kind)]),
+    ...await doomedDirectories(root), root,
+  ];
+  await syncPruneDirectories(root, directories, { platform });
+}

package/node_modules/@agents-can-communicate/storage-filesystem/src/reclaim.mjs

@@ -7,6 +7,7 @@ import { listDirectoryEntries, readJsonIfPresent } from "./atomic-json.mjs";
 import { condemn, detachDoomed, discard, discardLeftovers, expired } from "./doomed-directory.mjs";
 import { assertSequence, raiseEventFloor, readEventFloor } from "./event-floor.mjs";
 import { statePath } from "./record-id.mjs";
+import { reclaimIndexPages } from "./index-reclaim.mjs";
 
 // Shared with the stage sweep that calls this, so one pass cannot spend two
 // budgets. Exported for the caller that wants to reclaim without a bound.
@@ -148,8 +149,14 @@ export async function reclaimRetired(paths,
 
   const removed = await discard(doomed, root, limit - spent, deadlineAt);
   reclaimed += removed.spent;
+  spent += removed.spent;
+  const indexes = journals.drained && markers.drained && removed.drained
+    ? await reclaimIndexPages(paths, { root, limit: limit - spent, deadlineAt })
+    : { reclaimed: 0, remaining: false };
+  reclaimed += indexes.reclaimed;
   return { reclaimed,
-    remaining: !journals.drained || !markers.drained || !removed.drained };
+    remaining: !journals.drained || !markers.drained || !removed.drained
+      || (indexes.remaining && !indexes.deferred) };
 }
 
 /**
@@ -172,7 +179,7 @@ export async function reclaimRetired(paths,
  * @returns {Promise<{ reclaimed: number, skipped: number, remaining: boolean }>}
  */
 export async function reclaimStateRecords(paths, entries,
-  { root, limit = RECLAIM_BUDGET, deadlineAt } = {}) {
+  { root, limit = RECLAIM_BUDGET, deadlineAt, onCondemned } = {}) {
   if (expired(deadlineAt)) return { reclaimed: 0, skipped: 0, remaining: entries.length > 0 };
   let spent = 0;
   let skipped = 0;
@@ -202,10 +209,13 @@ export async function reclaimStateRecords(paths, entries,
       continue;
     }
     await condemn(filePath, doomed);
+    await onCondemned?.(filePath, doomed);
     spent += 1;
     condemned += 1;
     try {
-      await condemn(path.join(paths.retained, "state", entry.kind, entry.id), doomed);
+      const markers = path.join(paths.retained, "state", entry.kind, entry.id);
+      await condemn(markers, doomed);
+      await onCondemned?.(markers, doomed);
       spent += 1;
       // Counted only when it moved. Most records own no marker directory at
       // all, and counting one anyway made `remaining` compare what was

package/node_modules/@agents-can-communicate/storage-filesystem/src/recovery.mjs

@@ -18,8 +18,11 @@ import { withWriterMutex } from "./writer-mutex.mjs";
  * trimmedThrough: string|null }} RepairReport */
 
 const report = ({ repaired = [], blocked = [], corrupt = [], swept = 0, staged = 0,
-  partials = 0, retired = 0, trimmedThrough = null }) => ({
+  partials = 0, retired = 0, trimmedThrough = null, migrationRequired = false }) => ({
   healthy: blocked.length === 0 && corrupt.length === 0,
+  // An older contract, not an unreadable file: the identity read and named its
+  // version. The reader names the migration rather than calling it ambiguous.
+  ...(migrationRequired ? { migrationRequired: true } : {}),
   repaired: [...repaired].sort(),
   blocked: [...blocked].sort(),
   corrupt: [...corrupt].sort(),
@@ -75,7 +78,8 @@ async function inspect(root) {
     identity = await readStoreIdentity(paths);
   } catch (error) {
     blocked.push(path.join(root, "protocol.json"));
-    return { paths, identity: null, pending, blocked, corrupt, reason: error.message };
+    return { paths, identity: null, pending, blocked, corrupt, reason: error.message,
+      migrationRequired: error?.details?.reasonCode === "store_migration_required" };
   }
   if (identity === null) blocked.push(path.join(root, "protocol.json"));
 
@@ -123,6 +127,7 @@ export async function diagnoseFilesystemStore({ root }) {
   return report({
     blocked: state.blocked,
     corrupt: state.corrupt,
+    migrationRequired: state.migrationRequired === true,
     repaired: state.pending.map(entry => entry.transactionId),
     ...await countStaging(state.paths, root),
   });
@@ -133,7 +138,8 @@ export async function repairFilesystemStore({ root, clock }) {
   if (state.blocked.length > 0 || state.corrupt.length > 0) {
     // Fail closed. Completing a journal on top of state we cannot even read
     // would turn an ambiguous store into a confidently wrong one.
-    return report({ blocked: state.blocked, corrupt: state.corrupt });
+    return report({ blocked: state.blocked, corrupt: state.corrupt,
+      migrationRequired: state.migrationRequired === true });
   }
   // No early return for an empty journal any more: a store with nothing to roll
   // forward is exactly the store whose staging directory needs reclaiming.

package/node_modules/@agents-can-communicate/storage-filesystem/src/session-read.mjs

@@ -1,16 +1,18 @@
 import path from "node:path";
 import { assertPortableId, validateRecord } from "@agents-can-communicate/protocol";
 import { readJsonIfPresent } from "./atomic-json.mjs";
-import { requireStoreIdentity } from "./identity.mjs";
+import { readMigrationIdentity, requireStoreIdentity } from "./identity.mjs";
 import { assertStateBinding, statePath } from "./record-id.mjs";
 import { ephemeralIsDeleted, stateGenerationIsDeleted } from "./retention.mjs";
 import { storePaths } from "./store.mjs";
 
-/** Inspect ownership without opening, creating, recovering, or locking the store. */
-export async function readSessionRecord({ root, workspaceId, sessionId }) {
+/** Inspect ownership without opening, creating, recovering, or locking the store.
+ * Legacy identity inspection is read-only metadata for runtime hold classification. */
+export async function readSessionRecord({ root, workspaceId, sessionId, allowLegacyIdentity = false }) {
   assertPortableId(sessionId, "session id");
   const paths = storePaths(root);
-  await requireStoreIdentity(paths, { workspaceId, create: false });
+  if (allowLegacyIdentity === true) await readMigrationIdentity(paths, workspaceId);
+  else await requireStoreIdentity(paths, { workspaceId, create: false });
   const file = statePath(paths, "session", sessionId);
   const durable = await readJsonIfPresent(file, root);
   if (durable !== null) {

package/node_modules/@agents-can-communicate/storage-filesystem/src/state-reads.mjs

@@ -0,0 +1,43 @@
+import path from "node:path";
+import { AccError, EXIT, validateRecord } from "@agents-can-communicate/protocol";
+import { listDirectoryEntries, listJsonFiles, readJsonIfPresent } from "./atomic-json.mjs";
+import { assertStateBinding, statePath } from "./record-id.mjs";
+import { stateGenerationIsDeleted } from "./retention.mjs";
+import { assertPublicationDeadline } from "./deadline.mjs";
+
+export async function readStateEnvelope(paths, { root, workspaceId }, kind, id) {
+  const filePath = statePath(paths, kind, id);
+  const found = await readJsonIfPresent(filePath, root);
+  if (found === null) return null;
+  const envelope = assertStateBinding(found.value, kind, id, filePath);
+  if (await stateGenerationIsDeleted(paths, root, kind, id, envelope.generation)) return null;
+  validateRecord(kind, envelope.record);
+  if (workspaceId !== undefined && envelope.record.workspaceId !== workspaceId) {
+    throw new AccError(EXIT.DATA, "state record belongs to a different workspace",
+      { filePath, expected: workspaceId, actual: envelope.record.workspaceId });
+  }
+  return envelope;
+}
+
+export async function listState(paths, root, kind, deadlineAt) {
+  const envelopes = [];
+  for (const filePath of await listJsonFiles(path.join(paths.state, kind), { root })) {
+    assertPublicationDeadline(deadlineAt);
+    const envelope = await readStateEnvelope(paths, { root }, kind, path.basename(filePath, ".json"));
+    if (envelope !== null) envelopes.push(envelope);
+  }
+  return envelopes;
+}
+
+export async function loadStateEnvelopes(paths, { root, deadlineAt }, wanted = null) {
+  const loaded = new Map();
+  const kinds = (await listDirectoryEntries(paths.state, { root }))
+    .filter(entry => entry.isDirectory()).map(entry => entry.name)
+    .filter(kind => wanted === null || wanted.has(kind));
+  for (const kind of kinds) {
+    for (const envelope of await listState(paths, root, kind, deadlineAt)) {
+      loaded.set(`${envelope.kind}:${envelope.id}`, envelope);
+    }
+  }
+  return loaded;
+}

package/node_modules/@agents-can-communicate/storage-filesystem/src/store-migration.mjs

@@ -0,0 +1,56 @@
+import { AccError, EXIT, validateRecord } from "@agents-can-communicate/protocol";
+import { encode, listJsonFiles, publishAtomic, readJsonIfPresent } from "./atomic-json.mjs";
+import { initialiseActiveJournal, readActiveJournal } from "./active-journal.mjs";
+import { assertPublicationDeadline } from "./deadline.mjs";
+import { identityPath, readMigrationIdentity, STORE_VERSION } from "./identity.mjs";
+import { createIndexCache } from "./index-cache.mjs";
+import { IndexCacheUnavailable } from "./index-pages.mjs";
+import { readOpenJournals, rollForward } from "./journal.mjs";
+import { assertEventBinding } from "./record-id.mjs";
+import { ensureManagedDirectory } from "./safe-directory.mjs";
+import { loadStateEnvelopes } from "./state-reads.mjs";
+import { storePaths } from "./store.mjs";
+import { withWriterMutex } from "./writer-mutex.mjs";
+
+/** Explicit library migration; the operator must quiesce unmanaged users first. */
+export async function migrateFilesystemStore({ root, workspaceId, clock, ids,
+  allowMigration = false, platform = process.platform, deadlineAt, failAt }) {
+  if (allowMigration !== true) {
+    throw new AccError(EXIT.USAGE, "store migration requires explicit opt-in after quiescing other users");
+  }
+  assertPublicationDeadline(deadlineAt);
+  const paths = storePaths(root), publishOptions = { root, tmpDir: paths.tmp, clock, platform, failAt };
+  await readMigrationIdentity(paths, workspaceId);
+  return withWriterMutex(paths, { ...publishOptions, deadlineAt }, async () => {
+    const identity = await readMigrationIdentity(paths, workspaceId), fromVersion = identity.storeVersion;
+    for (const directory of Object.values(paths)) await ensureManagedDirectory(root, directory);
+    await initialiseActiveJournal(paths, { ...publishOptions, deadlineAt });
+    for (const entry of await readOpenJournals(paths, root)) {
+      // A decided journal finishes even if the migration's pre-switch budget lapses.
+      await rollForward(paths, publishOptions, entry);
+    }
+    assertPublicationDeadline(deadlineAt);
+    const primaries = await loadStateEnvelopes(paths, { root, deadlineAt });
+    for (const file of await listJsonFiles(paths.events, { root })) {
+      assertPublicationDeadline(deadlineAt);
+      const found = await readJsonIfPresent(file, root);
+      if (found === null) continue;
+      const event = validateRecord("event", assertEventBinding(found.value, file));
+      if (event.workspaceId !== workspaceId) throw new AccError(EXIT.DATA, "event belongs to a different workspace");
+    }
+    const cache = createIndexCache({ paths, root, workspaceId, publishOptions, loadPrimary: async () => primaries });
+    try { await cache.rebuild(await readActiveJournal(paths, root), deadlineAt, { required: true }); }
+    catch (error) {
+      if (!(error instanceof IndexCacheUnavailable)) throw error;
+      throw new AccError(EXIT.DATA, "store migration could not publish its complete index", { reason: error.reason });
+    }
+    if (fromVersion !== STORE_VERSION) {
+      await failAt?.("before-store-version-switch");
+      assertPublicationDeadline(deadlineAt);
+      await publishAtomic(identityPath(paths), encode({ ...identity, storeVersion: STORE_VERSION }),
+        { ...publishOptions, deadlineAt, replace: true, durability: "full" });
+      await failAt?.("after-store-version-switch");
+    }
+    return { fromVersion, toVersion: STORE_VERSION, migrated: fromVersion !== STORE_VERSION };
+  });
+}

package/node_modules/@agents-can-communicate/storage-filesystem/src/store.mjs

@@ -1,10 +1,10 @@
 import { mkdir } from "node:fs/promises";
 import path from "node:path";
 
-import { AccError, EXIT, assertPortableId, validateRecord }
+import { AccError, EXIT, TRANSACTION_INDEXES, assertIndexTuple, assertPortableId, indexKeysFor, validateRecord }
   from "@agents-can-communicate/protocol";
 
-import { encode, listDirectoryEntries, listJsonFiles, publishAtomic, readJsonIfPresent,
+import { encode, listJsonFiles, publishAtomic, readJsonIfPresent,
   retainFile } from "./atomic-json.mjs";
 import { initialiseActiveJournal, readActiveJournal } from "./active-journal.mjs";
 import { publicationPath } from "./publication-path.mjs";
@@ -12,15 +12,19 @@ import { assertPublicationDeadline } from "./deadline.mjs";
 import { requireStoreIdentity } from "./identity.mjs";
 import { journalEntry, readJournalCeiling, readOpenJournals, rollForward, writeJournalEntry }
   from "./journal.mjs";
-import { assertEventBinding, assertStateBinding, eventPath, stateEnvelope, statePath }
+import { assertEventBinding, eventPath, stateEnvelope, statePath }
   from "./record-id.mjs";
-import { ephemeralIsDeleted, markEphemeral, stateDeletionPublication,
-  stateGenerationIsDeleted } from "./retention.mjs";
+import { ephemeralIsDeleted, markEphemeral, stateDeletionPublication } from "./retention.mjs";
 import { ensureManagedDirectory } from "./safe-directory.mjs";
 import { readEventFloor } from "./event-floor.mjs";
 import { reclaimStateRecords, trimEventLog } from "./reclaim.mjs";
 import { sweepIfDue } from "./stage-sweep.mjs";
 import { withWriterMutex } from "./writer-mutex.mjs";
+import { listState, loadStateEnvelopes, readStateEnvelope } from "./state-reads.mjs";
+import { createTransactionView, transactionKinds } from "./transaction-view.mjs";
+import { createIndexCache } from "./index-cache.mjs";
+import { IndexCacheUnavailable } from "./index-pages.mjs";
+import { withIndexedPrune } from "./index-reclaim.mjs";
 
 // Kept cohesive above 300 lines because durable transactions and ephemeral
 // mutations must share this exact writer mutex. Splitting the two stores would
@@ -55,34 +59,6 @@ export function storePaths(root) {
     ...DIRECTORIES.map(name => [name, path.join(root, name)])]));
 }
 
-async function listState(paths, root, kind) {
-  const envelopes = [];
-  for (const filePath of await listJsonFiles(path.join(paths.state, kind), { root })) {
-    const found = await readJsonIfPresent(filePath, root);
-    if (found === null) continue;
-    const envelope = assertStateBinding(found.value, kind,
-      path.basename(filePath, ".json"), filePath);
-    if (await stateGenerationIsDeleted(paths, root, kind, envelope.id,
-      envelope.generation)) continue;
-    validateRecord(kind, envelope.record);
-    envelopes.push(envelope);
-  }
-  return envelopes;
-}
-
-async function loadAllState(paths, root, wanted = null) {
-  const loaded = new Map();
-  const kinds = (await listDirectoryEntries(paths.state, { root }))
-    .filter(entry => entry.isDirectory()).map(entry => entry.name)
-    .filter(kind => wanted === null || wanted.has(kind));
-  for (const kind of kinds) {
-    for (const envelope of await listState(paths, root, kind)) {
-      loaded.set(`${envelope.kind}:${envelope.id}`, envelope);
-    }
-  }
-  return loaded;
-}
-
 async function nextSequence(paths, root) {
   const last = (await listJsonFiles(paths.events, { root })).at(-1);
   // Only an empty directory consults the floor, so the path every transaction
@@ -118,6 +94,8 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
   await requireStoreIdentity(paths, { workspaceId, clock, platform });
   for (const name of DIRECTORIES) await ensureManagedDirectory(root, paths[name]);
   const publishOptions = { root, tmpDir: paths.tmp, clock, failAt, platform };
+  const indexCache = createIndexCache({ paths, root, workspaceId, publishOptions,
+    loadPrimary: options => loadStateEnvelopes(paths, { root, ...options }, new Set(["message", "receipt"])) });
   await initialiseActiveJournal(paths, publishOptions);
 
   // Any journal left behind by a crashed writer is completed before the store
@@ -149,7 +127,7 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
     return withWriterMutex(paths, { root, tmpDir: paths.tmp, clock, deadlineAt: storeDeadline }, async () => {
       const completed = [];
       for (const entry of await readOpenJournals(paths, root)) {
-        completed.push(...await rollForward(paths, { root, tmpDir: paths.tmp, clock }, entry));
+        completed.push(...await rollForward(paths, { root, tmpDir: paths.tmp, clock, platform }, entry));
       }
       return completed;
     });
@@ -170,87 +148,58 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
    * these transactions make reads as "nothing conflicts" when it finds nothing.
    * Declaring nothing reads everything, which is what this always did.
    */
-  async function transaction(callback, { kinds, deadlineAt } = {}) {
+  async function transaction(callback, { kinds, exactKinds = [], deadlineAt } = {}) {
     // A caller may tighten this invocation's budget, never extend it.
     deadlineAt = Math.min(deadlineAt ?? Infinity, storeDeadline ?? Infinity);
-    const wanted = kinds === undefined ? null : new Set(kinds);
-    const declared = kind => {
-      if (wanted !== null && !wanted.has(kind)) {
-        throw new AccError(EXIT.DATA,
-          `this transaction did not declare ${kind}, so it was never read`,
-          { kind, declared: [...wanted] });
-      }
-      return kind;
-    };
+    const { eager } = transactionKinds(kinds, exactKinds);
     return withWriterMutex(paths, { ...publishOptions, deadlineAt }, async () => {
       assertPublicationDeadline(deadlineAt);
+      // An already-open handle may follow a writer that died after deciding.
+      // Recovery here holds this mutex directly, never trying to acquire it twice.
+      for (const entry of await readOpenJournals(paths, root)) await rollForward(paths, publishOptions, entry);
+      const before = await readActiveJournal(paths, root);
       // Reads are loaded once per transaction so get, list, and the generation
       // that put() compares against all describe the same instant.
-      const loaded = await loadAllState(paths, root, wanted);
-      const staged = new Map();
+      const loaded = await loadStateEnvelopes(paths, { root }, eager);
       const events = [];
       let sequence = await nextSequence(paths, root);
       const firstSequence = pad(sequence);
-      const entryFor = key => {
-        const entry = staged.get(key) ?? loaded.get(key) ?? null;
-        return entry?.removed === true ? null : entry;
-      };
-
-      const tx = Object.freeze({
-        get(kind, id) {
-          declared(kind);
-          return entryFor(`${kind}:${id}`)?.record ?? null;
-        },
-        generationOf(kind, id) {
-          declared(kind);
-          return entryFor(`${kind}:${id}`)?.generation ?? null;
-        },
-        list(kind, predicate = () => true) {
-          declared(kind);
-          const merged = new Map();
-          for (const source of [loaded, staged]) {
-            for (const [key, entry] of source) {
-              if (entry.kind === kind) merged.set(key, entry);
-            }
-          }
-          return [...merged.values()].filter(entry => entry.removed !== true)
-            .map(entry => entry.record).filter(predicate);
-        },
-        put(kind, id, record, expectedGeneration = null) {
-          declared(kind);
-          const key = `${kind}:${id}`;
-          const actual = entryFor(key)?.generation ?? null;
-          if (actual !== expectedGeneration) {
-            throw new AccError(EXIT.CONFLICT, `${kind} ${id} changed under this transaction`,
-              { kind, id, expectedGeneration, actualGeneration: actual });
-          }
-          validateRecord(kind, record);
-          const generation = ids.next("generation");
-          staged.set(key, { kind, id, record, generation });
-          return generation;
+      const view = createTransactionView({ kinds, exactKinds, loaded, ids,
+        loadEnvelope: (kind, id) => {
+          assertPublicationDeadline(deadlineAt);
+          return readStateEnvelope(paths, { root, workspaceId }, kind, id);
         },
-        remove(kind, id, expectedGeneration = null) {
-          declared(kind);
-          const key = `${kind}:${id}`;
-          const actual = entryFor(key)?.generation ?? null;
-          if (actual !== expectedGeneration) {
-            throw new AccError(EXIT.CONFLICT, `${kind} ${id} changed under this transaction`,
-              { kind, id, expectedGeneration, actualGeneration: actual });
-          }
-          const persisted = loaded.get(key);
-          if (persisted === undefined) staged.delete(key);
-          else staged.set(key, { kind, id, generation: persisted.generation, removed: true });
+        lookupIndex(index, tuple, context) {
+          assertIndexTuple(index, tuple);
+          const kind = TRANSACTION_INDEXES[index].kind;
+          context.declared(kind);
+          return indexCache.lookup(index, tuple, { active: before, staged: context.staged, deadlineAt,
+            verify: async id => {
+              const envelope = await context.read(kind, id);
+              if (envelope === null) return false;
+              if (!indexKeysFor(kind, envelope.record).some(key => key.index === index
+                && JSON.stringify(key.tuple) === JSON.stringify(tuple))) {
+                throw new IndexCacheUnavailable("invalid_source_reference");
+              }
+              return true;
+            } });
         },
-        append(event) {
+        appendEvent(event) {
           const stamped = { ...event, sequence: pad(sequence) };
           sequence += 1;
           validateRecord("event", stamped);
           events.push(stamped);
           return stamped;
-        },
-      });
-
-      const result = await callback(tx);
+        } });
+      const { tx, staged } = view;
+      let result;
+      try { result = await callback(tx); }
+      catch (error) {
+        await view.finish().catch(() => {});
+        throw error;
+      }
+      await view.finish();
+      const deltas = indexCache.prepareDeltas(loaded, staged);
 
       // Events are published before state records on purpose: the event log is
       // the authority, and a crash between the two is the window the journal
@@ -281,7 +230,7 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
       // journalled write too, which the path below keeps.
       const [only] = staged.values();
       if (events.length === 0 && staged.size === 1 && only.removed !== true
-        && (await readActiveJournal(paths, root)).state === "idle") {
+        && !["message", "receipt"].includes(only.kind) && before.state === "idle") {
         assertPublicationDeadline(deadlineAt);
         await publishAtomic(statePath(paths, only.kind, only.id), publications[0].bytes,
           { ...publishOptions, replace: true, deadlineAt });
@@ -297,6 +246,7 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
       await writeJournalEntry(paths, { ...publishOptions, deadlineAt }, entry);
       await failAt?.("after-journal");
       await rollForward(paths, publishOptions, entry);
+      await indexCache.commit({ before, after: await readActiveJournal(paths, root), deltas, deadlineAt });
       return result;
     });
   }
@@ -343,13 +293,8 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
    * pass over every session the workspace ever had, several times a hook.
    */
   async function stateRecord(workspace, kind, id) {
-    const filePath = statePath(paths, kind, id);
-    const found = await readJsonIfPresent(filePath, root);
-    if (found === null) return null;
-    const envelope = assertStateBinding(found.value, kind, id, filePath);
-    if (await stateGenerationIsDeleted(paths, root, kind, envelope.id, envelope.generation)) return null;
-    validateRecord(kind, envelope.record);
-    return envelope.record.workspaceId === workspace ? envelope.record : null;
+    const envelope = await readStateEnvelope(paths, { root }, kind, id);
+    return envelope?.record.workspaceId === workspace ? envelope.record : null;
   }
 
   async function snapshot(workspace, { kinds } = {}) {
@@ -446,7 +391,7 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
    */
   async function stateEnvelopes(workspace, { kinds } = {}) {
     const wanted = kinds === undefined ? null : new Set(kinds);
-    return [...(await loadAllState(paths, root, wanted)).values()]
+    return [...(await loadStateEnvelopes(paths, { root }, wanted)).values()]
       .filter(envelope => envelope.record.workspaceId === workspace);
   }
 
@@ -460,13 +405,18 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
   async function reclaimRecords(plan, { limit, deadlineAt } = {}) {
     const bounded = Math.min(deadlineAt ?? Infinity, storeDeadline ?? Infinity);
     return withWriterMutex(paths, { ...publishOptions, deadlineAt: bounded }, async () => {
+      for (const entry of await readOpenJournals(paths, root)) await rollForward(paths, publishOptions, entry);
       // A function is decided here, holding the mutex, because eligibility is a
       // statement about relationships between records and not only about each
       // record. The generation on an entry proves that record did not change;
       // it says nothing about a session opening for a participant this was
       // about to remove. Deciding inside the lock is what closes that.
       const entries = typeof plan === "function" ? await plan() : plan;
-      return reclaimStateRecords(paths, entries, { root, limit, deadlineAt: bounded });
+      const reclaim = onCondemned => reclaimStateRecords(paths, entries,
+        { root, limit, deadlineAt: bounded, onCondemned });
+      if (!entries.some(entry => ["message", "receipt"].includes(entry.kind))) return reclaim();
+      return withIndexedPrune(paths, { ...publishOptions, ids,
+        firstSequence: pad(await nextSequence(paths, root)), deadlineAt: bounded }, reclaim);
     });
   }
 
@@ -484,5 +434,6 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
   }
 
   return Object.freeze({ transaction, eventsSince, snapshot, stateRecord, stateEnvelopes,
-    reclaimRecords, trimHistory, ephemeral, paths, root, workspaceId });
+    reclaimRecords, trimHistory, ephemeral, paths, root, workspaceId,
+    indexDiagnostics: indexCache.diagnostics });
 }