arcane-os 0.88.0 → 0.88.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.88.1
+
+- Recover an ordinary workspace-operation lock when its recorded runner is
+  confirmed absent, including before the six-hour expiry. Retrying the public
+  operation uses the shared lock owner; existing published records stay readable.
+- Preserve live or indeterminate owners and complete process-probe errors.
+  Recheck cancellation, nonce, PID and owner presence after asynchronous recovery
+  observation so an observed replacement remains owned by its actual writer.
+  The existing cooperative read/remove protocol is not an atomic cross-process
+  compare-and-delete.
+
 ## 0.88.0
 
 - Add optional `signal` and `startLanguageModel` controls to `AI.setAI`,

package/README.md

@@ -25,7 +25,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.88.0` SDK contract. Development applications declare
+This checkout defines the `0.88.1` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/docs/reference/cli.md

@@ -405,6 +405,16 @@ not package the app or produce `dist` output. With PWA enabled, the server
 generates the installation and offline manifests directly; see
 [PWA development and versioning](pwa.md#development-and-hosting).
 
+Ordinary operation acquisition can recover a workspace-operation lock whose
+recorded process is confirmed absent, including before its six-hour expiry.
+Retry the intended command through its usual public entrypoint; no separate
+unlock command or caller-created lease is needed. A live or indeterminate owner
+remains `ARCANE_WORKSPACE_BUSY`, with an indeterminate process-probe error
+retained as the cause. Recovery rechecks cancellation, nonce, PID and owner
+presence after asynchronous observation, preserving a replacement detected
+there. This cooperative read-then-remove protocol does not provide an
+atomic compare-and-delete across competing processes.
+
 The startup URL remains the selected app entry. At `/`, the server serves an
 existing authored host-root `index.html` and suppresses the app-entry redirect
 and PWA alias. A root outside the selected app mapping is served unchanged only

package/docs/reference/sdk-api.md

@@ -1868,6 +1868,17 @@ whole-tree replacement. The mutable result includes the installed-package
 location, materialized workspace runtime paths, and `workspaceLock` path and
 document. It does not install dependencies or merge application source.
 
+Ordinary acquisition automatically recovers a workspace-operation lock when
+the recorded owner process is confirmed absent, without waiting solely for its
+six-hour expiry. Retry this public operation normally; `workspaceOperationLease`
+is for active nested SDK work and cannot be reconstructed from the lock JSON.
+Live or indeterminate owners remain `ARCANE_WORKSPACE_BUSY`; an indeterminate
+process-probe error is retained as the cause. Existing published lock documents
+remain readable. Recovery rechecks cancellation, the captured nonce and PID,
+and owner presence after asynchronous observation, preserving a replacement
+detected there. This cooperative read-then-remove protocol does not provide an
+atomic compare-and-delete across competing processes.
+
 Replacement removes files absent from the selected runtime content and restores
 the prior tree if commit fails. `signal` and
 `onEvent` remain caller-owned before commit. Once the atomic replacement starts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.88.0",
+  "version": "0.88.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/workspace-operation-lock.mjs

@@ -98,17 +98,20 @@ async function ensureLockDirectory(workspace){
     return physicalDirectory(directory,'Workspace operation-lock directory',{create:true});
 }
 
-function ownerIsAlive(pid){
+function ownerIsAbsent(pid){
     if(!is.safeInteger(pid)||pid<1)return false;
     try{
         process.kill(pid,0);
-        return true;
+        return false;
     }catch(error){
-        return error?.code==='EPERM';
+        if(error?.code==='ESRCH')return true;
+        const busyError=workspaceBusy('The recorded Arcane workspace operation owner could not be determined.');
+        busyError.cause=error;
+        throw busyError;
     }
 }
 
-function lockDocument(value,{workspaceRoot,now=Date.now()}={}){
+function lockDocument(value,{workspaceRoot}={}){
     if(!value||!is.object(value)||is.array(value)
         ||value.schemaVersion!==1
         ||value.kind!=='arcane-workspace-operation-lock'
@@ -124,7 +127,7 @@ function lockDocument(value,{workspaceRoot,now=Date.now()}={}){
     }
     const expiresAt=Date.parse(value.expiresAt);
     if(!is.finite(expiresAt))return null;
-    return {...value,expired:expiresAt<=now};
+    return value;
 }
 
 async function readLock(lockPath,workspaceRoot){
@@ -145,16 +148,24 @@ async function readLock(lockPath,workspaceRoot){
     return lockDocument(value,{workspaceRoot});
 }
 
-async function recoverExpiredLock(lockPath,workspaceRoot,onEvent){
+async function recoverAbsentOwnerLock(lockPath,workspaceRoot,onEvent,signal){
+    throwIfAborted(signal);
     const document=await readLock(lockPath,workspaceRoot);
-    if(!document?.expired||ownerIsAlive(document.owner.pid))return false;
+    throwIfAborted(signal);
+    if(!document||!ownerIsAbsent(document.owner.pid))return false;
     await onEvent?.({
         type:'workspace.operation.stale-recovered',
         workspaceRoot,
         lockPath,
-        previousOwner:document.owner,
+        previousOwner:{...document.owner},
         previousOperation:document.operation
     });
+    throwIfAborted(signal);
+    const current=await readLock(lockPath,workspaceRoot);
+    throwIfAborted(signal);
+    // Observers may replace the record; their completion does not retain ownership.
+    if(current?.nonce!==document.nonce||current?.owner.pid!==document.owner.pid
+        ||!ownerIsAbsent(current.owner.pid))return false;
     await rm(lockPath);
     return true;
 }
@@ -254,15 +265,17 @@ async function acquire({
         lockPath=path.join(directory.canonical,LOCK_NAME);
         let recovered=false;
         for(;;){
+            throwIfAborted(signal);
             try{
                 handle=await open(lockPath,OPEN_EXCLUSIVE,0o600);
                 break;
             }catch(error){
                 if(error?.code!=='EEXIST')throw error;
-                if(recovered||!(await recoverExpiredLock(
+                if(recovered||!(await recoverAbsentOwnerLock(
                     lockPath,
                     workspace.canonical,
-                    onEvent
+                    onEvent,
+                    signal
                 ))){
                     fail(
                         `Workspace is locked by another Arcane operation: ${lockPath}. `