chainlesschain 0.166.106 → 0.166.108

package/src/lib/evolution/evolution-manifest-state-reader.js

@@ -0,0 +1,58 @@
+/** Stable manifest windows; no retention, installation or graph grant. */
+import path from "node:path";
+import {
+  createEvolutionPhysicalStateReader,
+  captureEvolutionPhysicalStateReaderDirectoryBoundary,
+} from "./evolution-physical-state-reader.js";
+
+const DIRECTORY_BOUNDARIES = new WeakMap();
+
+export const EVOLUTION_MANIFEST_STATE_READ_FAILED_CODE =
+  "CC_EVOLUTION_MANIFEST_STATE_READ_FAILED";
+
+export function createEvolutionManifestStateReader({
+  file,
+  fsImpl,
+  maximumBytes,
+  label,
+}) {
+  if (
+    typeof file !== "string" ||
+    !path.isAbsolute(file) ||
+    path.resolve(file) !== file ||
+    !Number.isSafeInteger(maximumBytes) ||
+    maximumBytes < 1 ||
+    typeof label !== "string" ||
+    !label ||
+    !fsImpl
+  )
+    throw new TypeError(
+      "manifest state reader requires a canonical file, filesystem and byte limit",
+    );
+  const reader = createEvolutionPhysicalStateReader({
+    directoryPath: path.dirname(file),
+    fsImpl,
+    maximumBytes,
+    label,
+    errorCode: EVOLUTION_MANIFEST_STATE_READ_FAILED_CODE,
+  });
+  const stateReader = Object.freeze({
+    read: () => reader.read(file, { allowAbsent: true }),
+    recheck: reader.recheck,
+  });
+  DIRECTORY_BOUNDARIES.set(
+    stateReader,
+    captureEvolutionPhysicalStateReaderDirectoryBoundary(reader),
+  );
+  return stateReader;
+}
+
+export function captureEvolutionManifestStateReaderDirectoryBoundary(reader) {
+  if (arguments.length !== 1)
+    throw new TypeError("manifest directory capture takes one original reader");
+  const boundary = DIRECTORY_BOUNDARIES.get(reader);
+  if (!boundary)
+    throw new TypeError("an original manifest state reader is required");
+  boundary.recheck();
+  return boundary;
+}

package/src/lib/evolution/evolution-physical-state-reader.js

@@ -0,0 +1,308 @@
+/** Stable local state windows, never a retention, installation or graph grant. */
+import path from "node:path";
+import { artifactPhysicalIdentity } from "./evolution-artifact-identity.js";
+import { withEvolutionFileIdentity } from "./evolution-file-identity.js";
+import { readBoundedDescriptor } from "./bounded-descriptor-read.js";
+
+const DIRECTORY_BOUNDARIES = new WeakMap();
+
+const FILE_FIELDS = Object.freeze([
+  "dev",
+  "ino",
+  "mode",
+  "uid",
+  "gid",
+  "nlink",
+  "size",
+  "mtimeNs",
+  "ctimeNs",
+]);
+const DIRECTORY_FIELDS = Object.freeze(["dev", "ino", "mode", "uid", "gid"]);
+const MUTATION_FIELDS = FILE_FIELDS.filter(
+  (field) => field !== "dev" && field !== "ino",
+);
+const samePath = (left, right) =>
+  process.platform === "win32"
+    ? left.toLowerCase() === right.toLowerCase()
+    : left === right;
+const birthtime = (stat) => artifactPhysicalIdentity(stat).birthtimeMs;
+const sameMetadata = (left, right) =>
+  MUTATION_FIELDS.every((field) => left[field] === right[field]) &&
+  birthtime(left) === birthtime(right);
+const sameStat = (left, right) =>
+  left.dev === right.dev && left.ino === right.ino && sameMetadata(left, right);
+
+export function createEvolutionPhysicalStateReader({
+  directoryPath: directory,
+  fsImpl,
+  maximumBytes,
+  minimumBytes = 0,
+  directoryMode = null,
+  sizeError = "exceeds maximumBytes",
+  label,
+  errorCode,
+  readFailureMessage = `${label} bounded state read failed`,
+}) {
+  if (
+    typeof directory !== "string" ||
+    !path.isAbsolute(directory) ||
+    path.resolve(directory) !== directory ||
+    !Number.isSafeInteger(maximumBytes) ||
+    maximumBytes < 1 ||
+    !Number.isSafeInteger(minimumBytes) ||
+    minimumBytes < 0 ||
+    minimumBytes > maximumBytes ||
+    (directoryMode !== null && typeof directoryMode !== "bigint") ||
+    typeof sizeError !== "string" ||
+    !sizeError ||
+    typeof errorCode !== "string" ||
+    !errorCode ||
+    typeof readFailureMessage !== "string" ||
+    !readFailureMessage ||
+    typeof label !== "string" ||
+    !label ||
+    !fsImpl
+  )
+    throw new TypeError(
+      "physical state reader requires a canonical directory, filesystem, code and byte bounds",
+    );
+  const physicalPath = (target) => {
+    const realpath = fsImpl.realpathSync;
+    return typeof realpath.native === "function"
+      ? realpath.native(target)
+      : realpath.call(fsImpl, target);
+  };
+  const fail = (message, cause) => {
+    throw Object.assign(new Error(message, cause ? { cause } : undefined), {
+      code: errorCode,
+    });
+  };
+  const guard = (operation) => {
+    try {
+      return operation();
+    } catch (cause) {
+      if (cause?.code === errorCode) throw cause;
+      fail(readFailureMessage, cause);
+    }
+  };
+  const inspectDirectory = () => {
+    const stat = fsImpl.lstatSync(directory, { bigint: true });
+    if (DIRECTORY_FIELDS.some((field) => typeof stat?.[field] !== "bigint"))
+      fail(`${label} directory requires full-precision stat fields`);
+    if (
+      !stat.isDirectory() ||
+      stat.isSymbolicLink() ||
+      !samePath(physicalPath(directory), directory)
+    )
+      fail(`${label} directory must be physically canonical`);
+    if (directoryMode !== null && (stat.mode & 0o7777n) !== directoryMode)
+      fail(`${label} directory permissions are invalid`);
+    return stat;
+  };
+  // Contents, link count and mutation times may change during legitimate locks
+  // and temporary+rename writes. Only the original directory identity/owner is
+  // retained; mutable leaf files acquire a new identity on every read.
+  const originalDirectory = guard(() => {
+    const stat = inspectDirectory();
+    return Object.freeze({
+      ...Object.fromEntries(
+        DIRECTORY_FIELDS.map((field) => [field, stat[field]]),
+      ),
+      birthtimeMs: birthtime(stat),
+    });
+  });
+  const recheck = () => {
+    const current = inspectDirectory();
+    if (
+      !DIRECTORY_FIELDS.every(
+        (field) => originalDirectory[field] === current[field],
+      ) ||
+      originalDirectory.birthtimeMs !== birthtime(current)
+    )
+      fail(`${label} directory physical identity changed`);
+  };
+  const safeStat = (stat, source, byteLimit) => {
+    if (FILE_FIELDS.some((field) => typeof stat?.[field] !== "bigint"))
+      fail(`${label} ${source} requires full-precision stat fields`);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1n)
+      fail(`${label} file identity is invalid`);
+    if (stat.size < BigInt(minimumBytes) || stat.size > BigInt(byteLimit))
+      fail(`${label} ${sizeError}`);
+  };
+  // Only identity-helper directory opens use this adapter. All operations,
+  // including Windows path/handle bridging, retain the caller's original fsImpl.
+  const directoryFs = Object.freeze({
+    constants: fsImpl.constants,
+    realpathSync: Object.assign(
+      (...args) => fsImpl.realpathSync(...args),
+      typeof fsImpl.realpathSync.native === "function"
+        ? { native: (...args) => fsImpl.realpathSync.native(...args) }
+        : {},
+    ),
+    lstatSync: (...args) => fsImpl.lstatSync(...args),
+    fstatSync: (...args) => fsImpl.fstatSync(...args),
+    closeSync: (...args) => fsImpl.closeSync(...args),
+    openSync: (target, flags) =>
+      fsImpl.openSync(
+        target,
+        flags |
+          (fsImpl.constants.O_NONBLOCK || 0) |
+          (fsImpl.constants.O_DIRECTORY || 0),
+      ),
+  });
+  const read = (file, byteLimit, allowAbsent, prepareFile) => {
+    if (
+      typeof file !== "string" ||
+      !path.isAbsolute(file) ||
+      path.resolve(file) !== file ||
+      path.dirname(file) !== directory ||
+      !Number.isSafeInteger(byteLimit) ||
+      byteLimit < 0 ||
+      typeof allowAbsent !== "boolean" ||
+      (prepareFile !== null && typeof prepareFile !== "function")
+    )
+      throw new TypeError(
+        "physical state read requires a direct canonical child and finite byte bound",
+      );
+    byteLimit = Math.min(maximumBytes, byteLimit);
+    recheck();
+    let before;
+    try {
+      before = fsImpl.lstatSync(file, { bigint: true });
+    } catch (cause) {
+      // Preserve the backend's absent-state contract, without treating access
+      // errors, dangling links or a disappearance during open/read as absence.
+      if (cause?.code !== "ENOENT" || !allowAbsent) throw cause;
+      recheck();
+      return null;
+    }
+    safeStat(before, "path", byteLimit);
+    if (prepareFile !== null) {
+      // Preserve existing private-file preparation without treating a repaired
+      // ctime/mode as mutation inside the later stable content window.
+      const identity = {
+        dev: before.dev,
+        ino: before.ino,
+        birthtimeMs: birthtime(before),
+      };
+      prepareFile(file);
+      recheck();
+      before = fsImpl.lstatSync(file, { bigint: true });
+      safeStat(before, "path", byteLimit);
+      if (
+        before.dev !== identity.dev ||
+        before.ino !== identity.ino ||
+        birthtime(before) !== identity.birthtimeMs
+      )
+        fail(`${label} file changed during private-file preparation`);
+    }
+    if (!samePath(physicalPath(file), file))
+      fail(`${label} file must be physically canonical`);
+    return withEvolutionFileIdentity(directoryFs, file, (samePathHandle) => {
+      recheck();
+      let descriptor = null;
+      try {
+        descriptor = fsImpl.openSync(
+          file,
+          fsImpl.constants.O_RDONLY |
+            (fsImpl.constants.O_NOFOLLOW || 0) |
+            (fsImpl.constants.O_NONBLOCK || 0),
+        );
+        const opened = fsImpl.fstatSync(descriptor, { bigint: true });
+        safeStat(opened, "descriptor", byteLimit);
+        if (!samePathHandle(before, opened) || !sameMetadata(before, opened))
+          fail(`${label} path and descriptor identities differ`);
+        const bytes = readBoundedDescriptor(
+          fsImpl,
+          descriptor,
+          Number(opened.size),
+          byteLimit,
+        );
+        const afterDescriptor = fsImpl.fstatSync(descriptor, { bigint: true });
+        const afterPath = fsImpl.lstatSync(file, { bigint: true });
+        safeStat(afterDescriptor, "descriptor", byteLimit);
+        safeStat(afterPath, "path", byteLimit);
+        if (!sameStat(opened, afterDescriptor))
+          fail(`${label} descriptor changed during bounded read`);
+        if (
+          !sameStat(before, afterPath) ||
+          !samePathHandle(afterPath, afterDescriptor) ||
+          !sameMetadata(afterPath, afterDescriptor) ||
+          !samePath(physicalPath(file), file)
+        )
+          fail(`${label} pathname changed during bounded read`);
+        recheck();
+        return bytes;
+      } finally {
+        if (descriptor !== null) fsImpl.closeSync(descriptor);
+      }
+    });
+  };
+  const reader = Object.freeze({
+    read: (
+      file,
+      {
+        maximumBytes: byteLimit = maximumBytes,
+        allowAbsent = false,
+        prepareFile = null,
+      } = {},
+    ) => guard(() => read(file, byteLimit, allowAbsent, prepareFile)),
+    recheck: () => guard(recheck),
+  });
+  // Project the original construction pin; later capture never claims a new
+  // pathname. The brand identifies this factory/its original ports, not native
+  // filesystem trust, installation authority, or any leaf inventory.
+  const descriptor = Object.freeze({
+    schema: "chainlesschain.evolution-physical-state-directory-boundary/v1",
+    scope: "single-original-state-directory",
+    directory: Object.freeze({
+      path: directory,
+      identity: Object.freeze({
+        ...Object.fromEntries(
+          DIRECTORY_FIELDS.map((field) => [
+            field,
+            String(originalDirectory[field]),
+          ]),
+        ),
+        birthtimeMs: originalDirectory.birthtimeMs,
+      }),
+    }),
+    fileIdentityVerified: false,
+    fileContentsVerified: false,
+    storageInventoryVerified: false,
+    retentionStorageVerified: false,
+    fullPhysicalStorageGraphVerified: false,
+    rootAuthorityVerified: false,
+    routingPinVerified: false,
+    crossProcessRollbackProtectionVerified: false,
+    grantsMutationOrPromotionAuthority: false,
+  });
+  const recheckDirectory = (...args) => {
+    if (args.length)
+      throw new TypeError("directory boundary takes no replacement context");
+    return guard(() => {
+      recheck();
+      return descriptor;
+    });
+  };
+  recheckDirectory();
+  DIRECTORY_BOUNDARIES.set(
+    reader,
+    Object.freeze({
+      descriptor,
+      recheck: Object.freeze(recheckDirectory),
+    }),
+  );
+  return reader;
+}
+
+/** Metadata-only original directory of a genuine physical state reader. */
+export function captureEvolutionPhysicalStateReaderDirectoryBoundary(reader) {
+  if (arguments.length !== 1)
+    throw new TypeError("directory capture takes one original reader");
+  const boundary = DIRECTORY_BOUNDARIES.get(reader);
+  if (!boundary)
+    throw new TypeError("an original physical state reader is required");
+  boundary.recheck();
+  return boundary;
+}

package/src/lib/evolution/evolution-witness-segments.js

@@ -1,5 +1,4 @@
 import path from "node:path";
-import { ensurePrivateDirectory } from "../secure-fs.js";
 
 export const EVOLUTION_SEGMENTED_WITNESS_SCHEMA =
   "chainlesschain.evolution-file-witness-store/v2";
@@ -43,6 +42,8 @@ function matchesDiscard(entry, snapshot) {
 export function createEvolutionWitnessSegments({
   filePath,
   fsImpl,
+  checkDirectory,
+  prepareDirectory,
   readBytes,
   writeBytes,
   confirmDurable,
@@ -54,7 +55,6 @@ export function createEvolutionWitnessSegments({
   maximumHistoryBytes,
 }) {
   const segmentDirectory = `${filePath}.segments-v2`;
-  const secureOptions = { deps: { fs: fsImpl }, failIfUnavailable: true };
   const metadata = new WeakMap();
   const cache = new Map();
   let cacheBytes = 0;
@@ -65,14 +65,6 @@ export function createEvolutionWitnessSegments({
     return path.join(segmentDirectory, `${digest.slice(7)}.json`);
   };
 
-  const assertDirectory = () => {
-    ensurePrivateDirectory(segmentDirectory, secureOptions);
-    const observed = fsImpl.lstatSync(segmentDirectory);
-    if (!observed.isDirectory() || observed.isSymbolicLink()) {
-      throw new Error("witness segment directory is invalid");
-    }
-  };
-
   const validateSegment = (segment, previous, trustEpoch) => {
     exact(segment, SEGMENT_KEYS, "witness segment");
     if (
@@ -150,7 +142,7 @@ export function createEvolutionWitnessSegments({
     ) {
       throw new Error("segmented witness store capacity or schema is invalid");
     }
-    assertDirectory();
+    checkDirectory();
     const seen = new Set();
     const observations = {
       discards: (options.discards || [])
@@ -254,7 +246,7 @@ export function createEvolutionWitnessSegments({
     ) {
       throw new Error("witness history exceeds its configured record capacity");
     }
-    assertDirectory();
+    prepareDirectory();
     let history = store.history;
     let discardedAnchors = store.discardedAnchors;
     let segmentBytes = existing?.segmentBytes ?? 0;
@@ -282,7 +274,14 @@ export function createEvolutionWitnessSegments({
       }
       const digest = hash(bytes);
       const destination = segmentPath(digest);
-      if (fsImpl.existsSync(destination)) {
+      let exists = false;
+      try {
+        fsImpl.lstatSync(destination, { bigint: true });
+        exists = true;
+      } catch (cause) {
+        if (cause?.code !== "ENOENT") throw cause;
+      }
+      if (exists) {
         if (!readBytes(destination).equals(bytes)) {
           throw new Error(
             "existing witness segment differs from its content address",

package/src/lib/evolution/governed-wiki-pruning-ledger-adapter.js

@@ -1,6 +1,7 @@
 import {
   EVOLUTION_DURABLE_ARTIFACT_RECORD_SCHEMA,
   isEvolutionLedgerArtifactResolver,
+  captureEvolutionLedgerBatchResolver,
 } from "./evolution-artifact-ports.js";
 import {
   EVOLUTION_ARTIFACT_RESOLUTION_SCHEMA,
@@ -17,6 +18,7 @@ import {
 
 export const WIKI_PRUNING_JOURNAL_EVENT_TYPE = "wiki.pruning.journal-committed";
 export const WIKI_PRUNING_JOURNAL_ARTIFACT_TYPE = "wiki-pruning-journal";
+const JOURNAL_ARTIFACT_RESOLVE_BATCH_SIZE = 4;
 const STORES = new WeakMap();
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 function currentContext(head) {
@@ -98,7 +100,7 @@ export class GovernedWikiPruningLedgerAdapter {
   #read;
   #verifyLedger;
   #append;
-  #resolve;
+  #resolveBatch;
   #verifyPlan;
   #verifyOperation;
   #verifyOperations;
@@ -122,7 +124,9 @@ export class GovernedWikiPruningLedgerAdapter {
     this.#read = capture(ledger, "read");
     this.#verifyLedger = capture(ledger, "verify");
     this.#append = capture(ledger, "appendDomainEvent");
-    this.#resolve = ledgerArtifactResolver;
+    this.#resolveBatch = captureEvolutionLedgerBatchResolver(
+      ledgerArtifactResolver,
+    );
     this.#verifyPlan = capture(planVerifier, "verify");
     this.#verifyOperation = capture(operationReceiptVerifier, "verify");
     this.#verifyOperations =
@@ -215,74 +219,96 @@ export class GovernedWikiPruningLedgerAdapter {
         event.tenantId === this.descriptor.tenantId &&
         event.correlationId === this.descriptor.streamId,
     );
-    const history = [];
-    const plans = new Set();
+    let previousEvent = null;
     for (const event of events) {
-      const previous = history.at(-1) ?? null;
       if (
         event.artifactTenantId !== this.descriptor.artifactTenantId ||
         event.decision !== "committed" ||
         event.skillName !== null ||
         !Array.isArray(event.sourceRefs) ||
-        event.sourceRefs.length !== (previous ? 1 : 0) ||
-        (previous &&
+        event.sourceRefs.length !== (previousEvent ? 1 : 0) ||
+        (previousEvent &&
           pruningCanonical(event.sourceRefs[0]) !==
-            pruningCanonical(previous.event.subjectRef))
+            pruningCanonical(previousEvent.subjectRef))
       )
         fail("pruning journal event lineage is invalid");
-      const resolution = this.#resolve({
-        epoch: head.epoch,
-        ledgerId: head.ledgerId,
-        ref: event.subjectRef,
-        tenantId: this.descriptor.artifactTenantId,
-      });
-      if (
-        resolution?.schema !== EVOLUTION_ARTIFACT_RESOLUTION_SCHEMA ||
-        resolution.authenticated !== true ||
-        resolution.found !== true ||
-        resolution.ref !== event.subjectRef.ref ||
-        resolution.digest !== event.subjectRef.digest ||
-        !DIGEST.test(resolution.receiptDigest) ||
-        !Buffer.isBuffer(resolution.bytes) ||
-        resolution.bytes.length > WIKI_PRUNING_JOURNAL_MAX_BYTES
-      )
-        fail("pruning journal artifact resolution is invalid");
-      const record = JSON.parse(
-        new TextDecoder("utf-8", { fatal: true }).decode(resolution.bytes),
+      previousEvent = event;
+    }
+    const history = [];
+    const plans = new Set();
+    for (
+      let offset = 0;
+      offset < events.length;
+      offset += JOURNAL_ARTIFACT_RESOLVE_BATCH_SIZE
+    ) {
+      const batchEvents = events.slice(
+        offset,
+        offset + JOURNAL_ARTIFACT_RESOLVE_BATCH_SIZE,
       );
-      if (
-        record?.schema !== EVOLUTION_DURABLE_ARTIFACT_RECORD_SCHEMA ||
-        record.tenantId !== this.descriptor.artifactTenantId ||
-        record.audience !== this.descriptor.audience ||
-        record.purpose !== this.descriptor.purpose ||
-        record.retention !== "ledger" ||
-        record.type !== WIKI_PRUNING_JOURNAL_ARTIFACT_TYPE
-      )
-        fail("pruning journal durable artifact binding is invalid");
-      const state = verifyWikiPruningJournal(
-        record.value,
-        this.descriptor.tenantId,
+      const resolutions = this.#resolveBatch(
+        batchEvents.map((event) => ({
+          epoch: head.epoch,
+          ledgerId: head.ledgerId,
+          ref: event.subjectRef,
+          tenantId: this.descriptor.artifactTenantId,
+        })),
       );
       if (
-        event.eventId !==
-        `${WIKI_PRUNING_JOURNAL_EVENT_TYPE}.${state.journalDigest.slice(7)}`
+        !Array.isArray(resolutions) ||
+        resolutions.length !== batchEvents.length
       )
-        fail("pruning journal event identity is invalid");
-      assertPruningJournalTransition(previous?.state ?? null, state);
-      if (previous?.state.plan.planDigest !== state.plan.planDigest) {
-        if (plans.has(state.plan.planDigest))
-          fail("pruning journal restarted a historical plan");
-        plans.add(state.plan.planDigest);
+        fail("pruning journal artifact batch resolution is incomplete");
+      for (const [batchIndex, event] of batchEvents.entries()) {
+        const previous = history.at(-1) ?? null;
+        const resolution = resolutions[batchIndex];
+        if (
+          resolution?.schema !== EVOLUTION_ARTIFACT_RESOLUTION_SCHEMA ||
+          resolution.authenticated !== true ||
+          resolution.found !== true ||
+          resolution.ref !== event.subjectRef.ref ||
+          resolution.digest !== event.subjectRef.digest ||
+          !DIGEST.test(resolution.receiptDigest) ||
+          !Buffer.isBuffer(resolution.bytes) ||
+          resolution.bytes.length > WIKI_PRUNING_JOURNAL_MAX_BYTES
+        )
+          fail("pruning journal artifact resolution is invalid");
+        const record = JSON.parse(
+          new TextDecoder("utf-8", { fatal: true }).decode(resolution.bytes),
+        );
+        if (
+          record?.schema !== EVOLUTION_DURABLE_ARTIFACT_RECORD_SCHEMA ||
+          record.tenantId !== this.descriptor.artifactTenantId ||
+          record.audience !== this.descriptor.audience ||
+          record.purpose !== this.descriptor.purpose ||
+          record.retention !== "ledger" ||
+          record.type !== WIKI_PRUNING_JOURNAL_ARTIFACT_TYPE
+        )
+          fail("pruning journal durable artifact binding is invalid");
+        const state = verifyWikiPruningJournal(
+          record.value,
+          this.descriptor.tenantId,
+        );
+        if (
+          event.eventId !==
+          `${WIKI_PRUNING_JOURNAL_EVENT_TYPE}.${state.journalDigest.slice(7)}`
+        )
+          fail("pruning journal event identity is invalid");
+        assertPruningJournalTransition(previous?.state ?? null, state);
+        if (previous?.state.plan.planDigest !== state.plan.planDigest) {
+          if (plans.has(state.plan.planDigest))
+            fail("pruning journal restarted a historical plan");
+          plans.add(state.plan.planDigest);
+        }
+        const samePlan =
+          previous?.state.plan.planDigest === state.plan.planDigest;
+        const entry = {
+          event,
+          state,
+          prepared: samePlan ? previous.prepared : { event, state },
+        };
+        if (samePlan) history[history.length - 1] = entry;
+        else history.push(entry);
       }
-      const samePlan =
-        previous?.state.plan.planDigest === state.plan.planDigest;
-      const entry = {
-        event,
-        state,
-        prepared: samePlan ? previous.prepared : { event, state },
-      };
-      if (samePlan) history[history.length - 1] = entry;
-      else history.push(entry);
     }
     // Every immutable event/transition above is checked. Per plan, authenticate
     // its source at preparation and its full retained receipt prefix at the

package/src/lib/evolution/rrsi-observed-text-index.js

@@ -2,7 +2,10 @@
 import { createHash } from "node:crypto";
 import { isProxy } from "node:util/types";
 import { captureRrsiRegistryStorePolicy } from "./rrsi-registry-store-policy.js";
-import { captureEvolutionLedgerFileBackend } from "./evolution-ledger-file-backend.js";
+import {
+  captureEvolutionLedgerFileBackend,
+  captureEvolutionLedgerFileBackendSourceDirectoryBoundary,
+} from "./evolution-ledger-file-backend.js";
 import {
   EvolutionArtifactPorts,
   EVOLUTION_DURABLE_ARTIFACT_RECORD_SCHEMA,
@@ -172,6 +175,12 @@ export function createRrsiObservedTextIndex(input) {
   )
     hold("text index requires the original policy storage graph");
   const ledger = backend.ledger;
+  const sourceJournalBoundary =
+    captureEvolutionLedgerFileBackendSourceDirectoryBoundary(backend);
+  const sourceJournalDirectoryBoundaryDigest = rrsiHash(
+    "chainlesschain.rrsi-source-journal-directory-boundary/v1",
+    sourceJournalBoundary.descriptor,
+  );
   const artifactBoundary = captureEvolutionArtifactStoreDirectoryBoundary(
     options.artifactPorts,
   );
@@ -597,6 +606,7 @@ export function createRrsiObservedTextIndex(input) {
       hold("preparation declaration reference differs");
   }
   function load() {
+    sourceJournalBoundary.recheck();
     artifactBoundary.recheck();
     const before = head(methods.verify());
     if (!same(identity(before), originalIdentity))
@@ -683,6 +693,7 @@ export function createRrsiObservedTextIndex(input) {
     if (!same(before, head(methods.verify())))
       hold("text index journal changed during authenticated readback");
     artifactBoundary.recheck();
+    sourceJournalBoundary.recheck();
     return { head: before, events, records, entries, operations };
   }
   function historyPrefix(state, checkpoint) {
@@ -778,6 +789,9 @@ export function createRrsiObservedTextIndex(input) {
         artifactStoreDirectoryBoundaryDigest,
         artifactStoreDirectoryBoundaryRechecked: true,
         artifactStoreBoundaryScope: "root-and-files-directories",
+        sourceJournalDirectoryBoundaryDigest,
+        sourceJournalDirectoryBoundaryRechecked: true,
+        sourceJournalBoundaryScope: "source-journal-four-directories",
         fullPhysicalStorageGraphVerified: false,
         tenantWideIndexAuthorityVerified: false,
         generationProvenanceVerified: false,
@@ -787,10 +801,12 @@ export function createRrsiObservedTextIndex(input) {
     );
     const recheck = () =>
       guarded(() => {
+        sourceJournalBoundary.recheck();
         artifactBoundary.recheck();
         if (!same(state.head, head(methods.verify())))
           hold("observed history head changed after prefix capture");
         artifactBoundary.recheck();
+        sourceJournalBoundary.recheck();
         return true;
       });
     recheck();