chainlesschain 0.166.106 → 0.166.108

package/src/lib/context-memory-kernel/live-compaction.js

@@ -13,6 +13,11 @@ import {
 import { JsonlSessionContextPort } from "./jsonl-session-context-port.js";
 import { createCliContextMemoryRuntime } from "./runtime.js";
 import { projectRuntimeTokenUsage } from "../runtime-usage-ledger.js";
+import {
+  projectCanonicalResumeMessages,
+  getDurableSystemMessageProvenance,
+  isRuntimeOnlySessionMessage,
+} from "../session-message-provenance.js";
 
 const rejectedCompactionUsage = new WeakMap();
 
@@ -138,7 +143,7 @@ class CallbackSessionContextPort extends InMemorySessionContextPort {
   }
 }
 
-function kernelBudget(compressor) {
+function kernelBudget(compressor, ephemeralTokens = 0) {
   const inputBudget = Math.max(
     256,
     Math.trunc(Number(compressor?.maxTokens)) || 16_384,
@@ -150,7 +155,9 @@ function kernelBudget(compressor) {
   return {
     modelWindowTokens: inputBudget + reservedOutputTokens,
     reservedOutputTokens,
-    safetyMarginTokens: 0,
+    // Live host policy/retry text still consumes the provider window even
+    // though it is deliberately absent from the durable authority partition.
+    safetyMarginTokens: ephemeralTokens,
     recoveryReserveTokens: Math.min(
       256,
       Math.max(1, Math.floor(inputBudget * 0.05)),
@@ -202,7 +209,7 @@ export async function compactLiveMessagesCanonical(
   messagesInput,
   options = {},
 ) {
-  const messages = Array.isArray(messagesInput) ? [...messagesInput] : [];
+  const liveMessages = Array.isArray(messagesInput) ? [...messagesInput] : [];
   const sessionId = String(options.sessionId || `live-${randomUUID()}`);
   const operationId = String(options.operationId || `compact-${randomUUID()}`);
   const trigger = options.trigger || "auto";
@@ -224,6 +231,24 @@ export async function compactLiveMessagesCanonical(
     options.persist !== false &&
     Boolean(options.sessionId) &&
     sessionExists(sessionId);
+  // Host policy is live-only. Durable summary/lineage systems retain their
+  // private provenance and remain part of the exact authority comparison.
+  const messages = persistentSession
+    ? projectCanonicalResumeMessages(liveMessages, { strict: true })
+    : liveMessages;
+  const ephemeralMessages = [];
+  if (persistentSession) {
+    let sequence = 0;
+    for (const message of liveMessages) {
+      if (
+        isRuntimeOnlySessionMessage(message) ||
+        (message.role === "system" &&
+          !getDurableSystemMessageProvenance(message))
+      )
+        ephemeralMessages.push({ sequence, message });
+      else sequence += 1;
+    }
+  }
   if (typeof options.commit === "function") {
     const bootstrapRuntime = createCliContextMemoryRuntime({
       sessionId,
@@ -323,12 +348,29 @@ export async function compactLiveMessagesCanonical(
   const provider = options.provider || "provider.local";
   const model = options.model || "default";
   const memoryRevision = await runtime.memoryPort.getRevision();
+  let settledOutputItems = null;
+  if (ephemeralMessages.length) {
+    const appendCompaction = runtime.sessionPort.appendCompaction.bind(
+      runtime.sessionPort,
+    );
+    runtime.sessionPort.appendCompaction = async (event, expectedHead) => {
+      const result = await appendCompaction(event, expectedHead);
+      if (result?.ok === true) settledOutputItems = event.outputItems;
+      return result;
+    };
+  }
   let receipt;
   try {
     receipt = await runtime.kernel.compactContext({
       operationId,
       sessionId,
-      ...kernelBudget(compressor),
+      ...kernelBudget(
+        compressor,
+        messagesToContextItems(
+          ephemeralMessages.map(({ message }) => message),
+          { sessionId },
+        ).reduce((total, item) => total + item.tokenEstimate, 0),
+      ),
       sink: provider,
       scopeAdmissions: [{ scope: "session", scopeId: sessionId }],
       policyVersion: "cli-context-policy-v1",
@@ -421,7 +463,7 @@ export async function compactLiveMessagesCanonical(
   }
   if (!["committed", "degraded"].includes(receipt.status)) {
     return {
-      messages,
+      messages: liveMessages,
       stats: {
         ...(summaryStats || {}),
         strategy: "none",
@@ -433,20 +475,41 @@ export async function compactLiveMessagesCanonical(
     };
   }
   const snapshot = await runtime.sessionPort.readSnapshot(sessionId);
-  const outputMessages = contextItemsToMessages(snapshot.items);
+  // Reattach host policy and private retry nudges at their durable sequence
+  // boundaries. They remain live, never enter the receipt, and do not move a
+  // retry instruction behind tool exchanges that happened after that retry.
+  const restoredMessages = [];
+  let ephemeralIndex = 0;
+  for (const item of [...(settledOutputItems || snapshot.items)].sort(
+    (left, right) =>
+      (left.sourceRef.eventSequence ?? Number.MAX_SAFE_INTEGER) -
+        (right.sourceRef.eventSequence ?? Number.MAX_SAFE_INTEGER) ||
+      left.itemId.localeCompare(right.itemId, "en"),
+  )) {
+    const sequence = item.sourceRef.eventSequence ?? Number.MAX_SAFE_INTEGER;
+    while (
+      ephemeralIndex < ephemeralMessages.length &&
+      ephemeralMessages[ephemeralIndex].sequence <= sequence
+    )
+      restoredMessages.push(ephemeralMessages[ephemeralIndex++].message);
+    restoredMessages.push(...contextItemsToMessages([item]));
+  }
+  restoredMessages.push(
+    ...ephemeralMessages.slice(ephemeralIndex).map(({ message }) => message),
+  );
   return {
-    messages: outputMessages,
+    messages: restoredMessages,
     stats: {
       ...(summaryStats || {}),
       strategy:
         receipt.status === "degraded" ? "deterministic-fallback" : "canonical",
-      originalMessages: messages.length,
-      compressedMessages: outputMessages.length,
-      originalTokens: estimatedTokens(messages),
-      compressedTokens: estimatedTokens(outputMessages),
+      originalMessages: liveMessages.length,
+      compressedMessages: restoredMessages.length,
+      originalTokens: estimatedTokens(liveMessages),
+      compressedTokens: estimatedTokens(restoredMessages),
       saved: Math.max(
         0,
-        estimatedTokens(messages) - estimatedTokens(outputMessages),
+        estimatedTokens(liveMessages) - estimatedTokens(restoredMessages),
       ),
       canonicalAlreadySettled: true,
       canonicalReceipt: receipt,

package/src/lib/eval/stream-terminal.js

@@ -1,5 +1,5 @@
 /** Parse raw agent NDJSON. A declaration of success is never terminal evidence. */
-export function verifyAgentTerminal(output) {
+export function verifyAgentTerminal(output, { allowSessionEnd = false } = {}) {
   try {
     const events = output
       .split(/\r?\n/u)
@@ -7,6 +7,31 @@ export function verifyAgentTerminal(output) {
       .map((line) => JSON.parse(line));
     const results = events.filter((event) => event?.type === "result");
     const terminal = results[0];
+    const last = events.at(-1);
+    const init = events.find(
+      (event) => event?.type === "system" && event.subtype === "init",
+    );
+    const sessionEnded =
+      allowSessionEnd &&
+      events.at(-2) === terminal &&
+      last?.type === "system" &&
+      last.subtype === "end" &&
+      typeof terminal?.session_id === "string" &&
+      terminal.session_id.length > 0 &&
+      last.session_id === terminal.session_id &&
+      init?.session_id === terminal.session_id &&
+      typeof terminal.trace_id === "string" &&
+      terminal.trace_id.length > 0 &&
+      last.trace_id === terminal.trace_id &&
+      Number.isSafeInteger(terminal.seq) &&
+      terminal.seq > 0 &&
+      last.seq === terminal.seq + 1 &&
+      Number.isSafeInteger(terminal.turn) &&
+      terminal.turn > 0 &&
+      last.turns === terminal.turn &&
+      events.filter(
+        (event) => event?.type === "system" && event.subtype === "end",
+      ).length === 1;
     const usage = terminal?.usage;
     const normalizedUsage =
       usage &&
@@ -26,7 +51,7 @@ export function verifyAgentTerminal(output) {
     return {
       terminalVerified:
         results.length === 1 &&
-        events.at(-1) === terminal &&
+        (last === terminal || sessionEnded) &&
         terminal.subtype === "success" &&
         terminal.is_error === false &&
         !events.some((event) => event?.type === "error"),

package/src/lib/evolution/evolution-artifact-ports.js

@@ -23,6 +23,11 @@ import {
 } from "./evolution-ledger.js";
 
 const ARTIFACT_STORE_DIRECTORY_BOUNDARIES = new WeakMap();
+// Capture repository function identity before binding instance methods. Only
+// these exact defaults may skip legacy list/get I/O; overrides still execute
+// and must match the independently authenticated descriptor snapshots.
+const DEFAULT_STORE_LIST = ArtifactStore.prototype.list;
+const DEFAULT_STORE_GET = ArtifactStore.prototype.get;
 // Only the shared identity helper's directory opens use this adapter. A POSIX
 // directory/FIFO swap must fail before reaching a potentially blocking open.
 const INDEX_DIRECTORY_FS = Object.freeze({
@@ -1014,7 +1019,7 @@ function normalizeKeyId(value, label) {
   return value;
 }
 
-function captureMethod(port, method, label) {
+function captureDataMethod(port, method, label) {
   if (!port || (typeof port !== "object" && typeof port !== "function")) {
     throw new TypeError(`EvolutionArtifactPorts requires ${label}.${method}`);
   }
@@ -1029,13 +1034,17 @@ function captureMethod(port, method, label) {
           `EvolutionArtifactPorts requires ${label}.${method} as a data method`,
         );
       }
-      return Object.freeze(descriptor.value.bind(port));
+      return descriptor.value;
     }
     cursor = Object.getPrototypeOf(cursor);
   }
   throw new TypeError(`EvolutionArtifactPorts requires ${label}.${method}`);
 }
 
+function captureMethod(port, method, label) {
+  return Object.freeze(captureDataMethod(port, method, label).bind(port));
+}
+
 function captureArtifactStore(store) {
   rejectProxy(store, "artifactStore");
   if (!hasStablePrototype(store, ArtifactStore.prototype, "artifactStore")) {
@@ -1049,19 +1058,21 @@ function captureArtifactStore(store) {
   }
   const resolvedDir = path.resolve(dir);
   const layout = establishStoreLayout(resolvedDir);
+  const list = captureDataMethod(store, "list", "artifactStore");
+  const get = captureDataMethod(store, "get", "artifactStore");
   const captured = Object.freeze({
     dir: resolvedDir,
-    get: captureMethod(store, "get", "artifactStore"),
+    get: get === DEFAULT_STORE_GET ? null : Object.freeze(get.bind(store)),
     layout,
-    list: captureMethod(store, "list", "artifactStore"),
+    list: list === DEFAULT_STORE_LIST ? null : Object.freeze(list.bind(store)),
     publishDataOnce: captureMethod(store, "publishDataOnce", "artifactStore"),
     storedPath: captureMethod(store, "storedPath", "artifactStore"),
     verifyIntegrity: captureMethod(store, "verifyIntegrity", "artifactStore"),
   });
   // ArtifactStore methods consult public instance fields such as `dir` on
   // every call. Freeze the trusted instance after capturing its methods so a
-  // later collaborator cannot redirect a bound get/list/integrity call to a
-  // different store root.
+  // later collaborator cannot redirect a bound custom get/list/integrity call
+  // to a different store root. Null index methods select trusted snapshots.
   Object.freeze(store);
   return captured;
 }
@@ -2164,7 +2175,7 @@ export class EvolutionArtifactPorts {
     let entries;
     try {
       entries = rejectPromise(
-        this.#store.list(),
+        this.#store.list ? this.#store.list() : trustedBefore.entries,
         "ArtifactStore.list",
         EVOLUTION_ARTIFACT_STORE_FAILED_CODE,
       );
@@ -2187,9 +2198,9 @@ export class EvolutionArtifactPorts {
         "ArtifactStore.list did not return an array",
       );
     }
-    // ArtifactStore currently materializes its whole JSONL index before this
-    // adapter can enforce a limit. Reject immediately after return; this is an
-    // explicit scalability boundary, not a claim of bounded store-side query.
+    // Default entries already came from a bounded descriptor read. Custom
+    // list hooks retain their original execution and exact cross-check; their
+    // own I/O cannot be constrained by this adapter's snapshot byte limit.
     if (entries.length > EVOLUTION_ARTIFACT_MAX_INDEX_ENTRIES) {
       throw artifactError(
         EVOLUTION_ARTIFACT_STORE_FAILED_CODE,
@@ -2280,7 +2291,7 @@ export class EvolutionArtifactPorts {
     let current;
     try {
       current = rejectPromise(
-        this.#store.get(artifactId),
+        this.#store.get ? this.#store.get(artifactId) : listed[0],
         "ArtifactStore.get",
         EVOLUTION_ARTIFACT_STORE_FAILED_CODE,
       );

package/src/lib/evolution/evolution-file-witness.js

@@ -4,8 +4,7 @@ import path from "node:path";
 import { types } from "node:util";
 import { ensurePrivateDirectory, ensurePrivateFile } from "../secure-fs.js";
 import { withFileLock } from "../with-file-lock.js";
-import { readBoundedDescriptor } from "./bounded-descriptor-read.js";
-import { withEvolutionFileIdentity } from "./evolution-file-identity.js";
+import { createEvolutionPhysicalStateReader } from "./evolution-physical-state-reader.js";
 import {
   createEvolutionWitnessSegments,
   EVOLUTION_SEGMENTED_WITNESS_SCHEMA,
@@ -17,6 +16,8 @@ import {
 
 export const EVOLUTION_FILE_WITNESS_STORE_SCHEMA =
   "chainlesschain.evolution-file-witness-store/v1";
+export const EVOLUTION_WITNESS_STATE_READ_FAILED_CODE =
+  "CC_EVOLUTION_WITNESS_STATE_READ_FAILED";
 
 const WITNESS_DOMAIN = `${EVOLUTION_LEDGER_WITNESS_SCHEMA}\0`;
 const ANCESTRY_DOMAIN = `${EVOLUTION_LEDGER_WITNESS_ANCESTRY_SCHEMA}\0`;
@@ -247,6 +248,63 @@ export function createEvolutionFileWitness({
   }
   const secureOptions = { deps: { fs: fsImpl }, failIfUnavailable: true };
   ensurePrivateDirectory(directory, secureOptions);
+  const readerOptions = {
+    fsImpl,
+    maximumBytes,
+    minimumBytes: 2,
+    directoryMode: process.platform === "win32" ? null : 0o700n,
+    sizeError: "store size is invalid",
+    label: "witness",
+    errorCode: EVOLUTION_WITNESS_STATE_READ_FAILED_CODE,
+    readFailureMessage: "witness bounded read failed",
+  };
+  const rootReader = createEvolutionPhysicalStateReader({
+    ...readerOptions,
+    directoryPath: directory,
+  });
+  const segmentDirectory = `${target}.segments-v2`;
+  let segmentReader = null;
+  const captureSegments = () => {
+    rootReader.recheck();
+    segmentReader = createEvolutionPhysicalStateReader({
+      ...readerOptions,
+      label: "witness segment",
+      readFailureMessage: "witness segment bounded read failed",
+      directoryPath: segmentDirectory,
+    });
+    rootReader.recheck();
+    return segmentReader;
+  };
+  // A constructor may secure existing local storage. Read paths never create
+  // or repair a missing segment directory; first publication retains that job.
+  let existingSegments = false;
+  try {
+    fsImpl.lstatSync(segmentDirectory, { bigint: true });
+    existingSegments = true;
+  } catch (cause) {
+    if (cause?.code !== "ENOENT") throw cause;
+  }
+  if (existingSegments) {
+    ensurePrivateDirectory(segmentDirectory, secureOptions);
+    captureSegments();
+  }
+  const checkSegments = () => {
+    const reader = segmentReader ?? captureSegments();
+    rootReader.recheck();
+    reader.recheck();
+    return reader;
+  };
+  const prepareSegments = () => {
+    rootReader.recheck();
+    if (segmentReader !== null) return segmentReader.recheck();
+    ensurePrivateDirectory(segmentDirectory, secureOptions);
+    captureSegments();
+  };
+  const recheckStorage = () => {
+    rootReader.recheck();
+    segmentReader?.recheck();
+    rootReader.recheck();
+  };
   // Cache immutable encodings, never an authority decision. Keep the earliest
   // entries when full so full-history scans cannot churn the bounded cache.
   const recordEncodings = new Map();
@@ -587,67 +645,25 @@ export function createEvolutionFileWitness({
     return store;
   };
 
-  const readBytes = (file, byteLimit = maximumBytes) =>
-    withEvolutionFileIdentity(fsImpl, file, (samePathHandle) =>
-      readBytesWithIdentity(
-        file,
-        Math.min(maximumBytes, byteLimit),
-        samePathHandle,
-      ),
-    );
-
-  const readBytesWithIdentity = (file, byteLimit, samePathHandle) => {
-    ensurePrivateFile(file, secureOptions);
-    const stat = fsImpl.lstatSync(file);
-    if (
-      !stat.isFile() ||
-      stat.isSymbolicLink() ||
-      stat.nlink !== 1 ||
-      stat.size < 2 ||
-      stat.size > byteLimit
-    ) {
-      throw new Error("witness store size is invalid");
-    }
-    let descriptor;
-    const sameFile = (observed) =>
-      observed.isFile() &&
-      observed.nlink === 1 &&
-      observed.dev === stat.dev &&
-      observed.ino === stat.ino &&
-      observed.size === stat.size &&
-      observed.mtimeMs === stat.mtimeMs &&
-      observed.ctimeMs === stat.ctimeMs;
-    try {
-      descriptor = fsImpl.openSync(
-        file,
-        fsImpl.constants.O_RDONLY | (fsImpl.constants.O_NOFOLLOW || 0),
-      );
-      if (!samePathHandle(stat, fsImpl.fstatSync(descriptor))) {
-        throw new Error("witness store changed while opening");
-      }
-      const bytes = readBoundedDescriptor(
-        fsImpl,
-        descriptor,
-        stat.size,
-        byteLimit,
-      );
-      const afterPath = fsImpl.lstatSync(file);
-      if (
-        !samePathHandle(stat, fsImpl.fstatSync(descriptor)) ||
-        afterPath.isSymbolicLink() ||
-        !sameFile(afterPath)
-      ) {
-        throw new Error("witness store changed while reading");
-      }
-      return bytes;
-    } finally {
-      if (descriptor !== undefined) fsImpl.closeSync(descriptor);
-    }
+  const readBytes = (file, byteLimit = maximumBytes, allowAbsent = false) => {
+    recheckStorage();
+    const reader = file === target ? rootReader : checkSegments();
+    const bytes = reader.read(file, {
+      maximumBytes: byteLimit,
+      allowAbsent,
+      prepareFile: (name) => ensurePrivateFile(name, secureOptions),
+    });
+    recheckStorage();
+    return bytes;
   };
 
   const readStore = (options = {}) => {
-    if (!fsImpl.existsSync(target)) return emptyStore();
-    const bytes = readBytes(target, maximumHistoryBytes);
+    const bytes = readBytes(target, maximumHistoryBytes, true);
+    if (bytes === null) {
+      const store = emptyStore();
+      recheckStorage();
+      return store;
+    }
     const parsed = JSON.parse(
       new TextDecoder("utf-8", { fatal: true }).decode(bytes),
     );
@@ -660,7 +676,10 @@ export function createEvolutionFileWitness({
               headBytes: bytes.length,
             })
           : validateStore(parsed, trustEpoch);
-      if (trustEpoch === currentTrustEpoch()) return store;
+      if (trustEpoch === currentTrustEpoch()) {
+        recheckStorage();
+        return store;
+      }
     }
     throw new Error("witness verifier trust epoch changed while reading");
   };
@@ -716,6 +735,8 @@ export function createEvolutionFileWitness({
   const segments = createEvolutionWitnessSegments({
     filePath: target,
     fsImpl,
+    checkDirectory: checkSegments,
+    prepareDirectory: prepareSegments,
     readBytes,
     writeBytes,
     validateStore,
@@ -760,8 +781,10 @@ export function createEvolutionFileWitness({
     return store.current;
   };
 
-  const underLock = (operation) =>
-    lock(target, operation, { failIfUnavailable: true, _fs: fsImpl });
+  const underLock = (operation) => {
+    recheckStorage();
+    return lock(target, operation, { failIfUnavailable: true, _fs: fsImpl });
+  };
   const discarded = (store, snapshot) =>
     segments.isDiscarded(store, snapshot) ||
     store.discardedAnchors.some(

package/src/lib/evolution/evolution-ledger-file-backend.js

@@ -4,6 +4,7 @@ import { createEvolutionFileWitness } from "./evolution-file-witness.js";
 import {
   EvolutionLedger,
   captureEvolutionLedgerMigrationSource,
+  captureEvolutionLedgerDirectoryBoundary,
 } from "./evolution-ledger.js";
 import { createEvolutionLedgerV2JournalFromFactory } from "./evolution-ledger-v2-journal.js";
 
@@ -12,6 +13,7 @@ export const EVOLUTION_LEDGER_FILE_BACKEND_SCHEMA =
 
 const BACKENDS = new WeakSet();
 const BACKEND_BINDINGS = new WeakMap();
+const SOURCE_DIRECTORY_BOUNDARIES = new WeakMap();
 
 function requiredString(value, label) {
   if (typeof value !== "string" || value.trim() === "") {
@@ -205,7 +207,10 @@ export function createEvolutionLedgerFileBackend({
     ledger,
     witness,
   });
+  const sourceDirectoryBoundary =
+    captureEvolutionLedgerDirectoryBoundary(sourceLedger);
   BACKENDS.add(backend);
+  SOURCE_DIRECTORY_BOUNDARIES.set(backend, sourceDirectoryBoundary);
   BACKEND_BINDINGS.set(
     backend,
     Object.freeze({
@@ -234,3 +239,20 @@ export function captureEvolutionLedgerFileBackendBinding(value) {
     );
   return binding;
 }
+
+/** Captured private v1 source even when the public journal is a v2 wrapper. */
+export function captureEvolutionLedgerFileBackendSourceDirectoryBoundary(
+  value,
+) {
+  if (arguments.length !== 1)
+    throw new TypeError(
+      "source directory boundary capture takes exactly one original backend",
+    );
+  const boundary = SOURCE_DIRECTORY_BOUNDARIES.get(value);
+  if (!boundary)
+    throw new TypeError(
+      "a branded file backend source directory boundary is required",
+    );
+  boundary.recheck();
+  return boundary;
+}

package/src/lib/evolution/evolution-ledger-file-manifest-catalog.js

@@ -5,7 +5,10 @@ import { types as utilTypes } from "node:util";
 
 import { ensurePrivateDirectory, ensurePrivateFile } from "../secure-fs.js";
 import { withFileLock } from "../with-file-lock.js";
-import { readBoundedDescriptor } from "./bounded-descriptor-read.js";
+import {
+  createEvolutionManifestStateReader,
+  captureEvolutionManifestStateReaderDirectoryBoundary,
+} from "./evolution-manifest-state-reader.js";
 import { EVOLUTION_LEDGER_MANIFEST_CATALOG_APPEND_RESULT_SCHEMA } from "./evolution-ledger-manifest-catalog.js";
 
 export const EVOLUTION_LEDGER_FILE_MANIFEST_CATALOG_SCHEMA =
@@ -15,6 +18,7 @@ const STATE_SCHEMA =
   "chainlesschain.evolution-ledger-file-manifest-catalog-state/v2";
 const STATE_KEYS = new Set(["manifests", "schema"]);
 const DEFAULT_MAXIMUM_BYTES = 64 * 1024 * 1024;
+const DIRECTORY_BOUNDARIES = new WeakMap();
 
 function exactRecord(value, keys, label) {
   if (
@@ -75,39 +79,13 @@ export function createEvolutionLedgerFileManifestCatalogBackend({
   const secureOptions = { deps: { fs: fsImpl }, failIfUnavailable: true };
   ensurePrivateDirectory(directory, secureOptions);
 
-  const readBytes = () => {
-    if (!fsImpl.existsSync(file)) return null;
-    const stat = fsImpl.lstatSync(file);
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
-      throw new Error("manifest catalog file identity is invalid");
-    }
-    if (stat.size > maximumBytes)
-      throw new Error("manifest catalog exceeds maximumBytes");
-    let descriptor;
-    try {
-      descriptor = fsImpl.openSync(
-        file,
-        fsImpl.constants.O_RDONLY | (fsImpl.constants.O_NOFOLLOW || 0),
-      );
-      const opened = fsImpl.fstatSync(descriptor);
-      if (!opened.isFile() || opened.nlink !== 1 || opened.size !== stat.size) {
-        throw new Error("manifest catalog changed while opening");
-      }
-      const bytes = readBoundedDescriptor(
-        fsImpl,
-        descriptor,
-        stat.size,
-        maximumBytes,
-      );
-      const after = fsImpl.lstatSync(file);
-      if (after.isSymbolicLink() || after.size !== stat.size) {
-        throw new Error("manifest catalog changed while reading");
-      }
-      return bytes;
-    } finally {
-      if (descriptor !== undefined) fsImpl.closeSync(descriptor);
-    }
-  };
+  const stateReader = createEvolutionManifestStateReader({
+    file,
+    fsImpl,
+    maximumBytes,
+    label: "manifest catalog",
+  });
+  const readBytes = stateReader.read;
 
   const readState = () => {
     const bytes = readBytes();
@@ -173,13 +151,14 @@ export function createEvolutionLedgerFileManifestCatalogBackend({
     }
   };
 
-  return Object.freeze({
+  const backend = Object.freeze({
     descriptor: Object.freeze({
       file,
       localOnly: true,
       schema: EVOLUTION_LEDGER_FILE_MANIFEST_CATALOG_SCHEMA,
     }),
     compareAndAppend(request) {
+      stateReader.recheck();
       return lock(
         file,
         () => {
@@ -215,4 +194,24 @@ export function createEvolutionLedgerFileManifestCatalogBackend({
       return structuredClone(readState().manifests.at(-1) ?? null);
     },
   });
+  DIRECTORY_BOUNDARIES.set(
+    backend,
+    captureEvolutionManifestStateReaderDirectoryBoundary(stateReader),
+  );
+  return backend;
+}
+
+/** Original local catalog directory only; structural wrappers are not owners. */
+export function captureEvolutionLedgerFileManifestCatalogDirectoryBoundary(
+  backend,
+) {
+  if (arguments.length !== 1)
+    throw new TypeError("catalog directory capture takes one original backend");
+  const boundary = DIRECTORY_BOUNDARIES.get(backend);
+  if (!boundary)
+    throw new TypeError(
+      "an original file manifest catalog backend is required",
+    );
+  boundary.recheck();
+  return boundary;
 }