dsh-hashline-edit 0.2.0 → 0.2.2

package/src/mutation-engine/pipeline.ts

@@ -85,16 +85,12 @@ import { saveCutIntent, dropCutIntent } from "../undo-store.js";
 import { repairCutIntents } from "../cut-repair.js";
 import { withSortedMutationQueues } from "../mutation-queue.js";
 import { resolveTarget, writeAtomic, readBytes } from "../fs-write.js";
-import {
-  missingAncestorDirs,
-  pathKind,
-  pruneEmptyDirs,
-  removeFile,
-  renameFile,
-  assertPathWithinWorkspace,
-} from "../fs-lifecycle.js";
 import { toCwd } from "../paths.js";
-import type { DesiredContent, NormalizedEditItem, NormalizedEditRequest } from "./edit-request.js";
+import type {
+  DesiredContent,
+  NormalizedEditItem,
+  NormalizedEditRequest,
+} from "../payload-contract.js";
 import {
   batchAbortFor,
   batchAbortForMany,
@@ -103,13 +99,7 @@ import {
   wrapParseFailure,
 } from "../edit-response.js";
 import { DEFERRED_STORE_SYNC_WARNING } from "../constants.js";
-import type {
-  PipelineOptions,
-  ProcessedEditFile,
-  ForeignCutRecord,
-  MemberLifecycle,
-  TransactionRecoveryReport,
-} from "./types.js";
+import type { PipelineOptions, ProcessedEditFile, ForeignCutRecord } from "./types.js";
 import {
   loadEditFile,
   loadForeignServedView,
@@ -1318,108 +1308,6 @@ async function runCutTransaction(
  *   (those are reported and never committed).
  * @returns the batch outcome, anchored on the primary file.
  */
-function memberLifecycleOf(plan: ProcessedEditFile): MemberLifecycle {
-  return plan.lifecycle ?? { kind: "keep" };
-}
-
-function memberPostBytes(plan: ProcessedEditFile): Buffer {
-  return Buffer.from(plan.bom + restoreEndings(plan.result, plan.originalEnding), "utf-8");
-}
-
-/**
- * Publish one already-validated member. This is the only place a lifecycle action reaches the
- * filesystem: content writes keep using writeAtomic (one serializer); add/delete/move use the
- * fs-lifecycle primitives that writeAtomic deliberately does not express.
- */
-async function commitMember(
-  plan: ProcessedEditFile,
-  rawPreBytes: ReadonlyMap<string, Buffer>,
-  onPublished: (plan: ProcessedEditFile) => void,
-  workspaceRoot: string | undefined,
-  onAfterMoveRename?: (toAbsolutePath: string) => void | Promise<void>,
-): Promise<void> {
-  const lifecycle = memberLifecycleOf(plan);
-  switch (lifecycle.kind) {
-    case "keep":
-    case "add":
-      if (workspaceRoot !== undefined) {
-        await assertPathWithinWorkspace(workspaceRoot, plan.absolutePath);
-      }
-      await writeAtomic(plan.absolutePath, memberPostBytes(plan));
-      onPublished(plan);
-      return;
-    case "delete":
-      await removeFile(plan.absolutePath);
-      onPublished(plan);
-      return;
-    case "move": {
-      // WHY: rename first, then (only for an edited move) rewrite the destination. A pure move
-      // WHY: must stay a rename: re-serializing would launder the file's raw line endings.
-      await renameFile(
-        lifecycle.fromAbsolutePath,
-        lifecycle.toAbsolutePath,
-        undefined,
-        workspaceRoot,
-      );
-      // WHY: the rename is already a publication: a later content-write failure must roll this
-      // WHY: member back or the source disappears while the failure claims nothing changed.
-      onPublished(plan);
-      if (onAfterMoveRename !== undefined) await onAfterMoveRename(lifecycle.toAbsolutePath);
-      const post = memberPostBytes(plan);
-      // WHY: a pure rename must not re-serialize: the normalized text equals the baseline text,
-      // WHY: so the destination keeps the exact bytes the OS rename carried.
-      if (
-        plan.originalNormalized !== plan.result &&
-        !post.equals(rawPreBytes.get(plan.absolutePath)!)
-      ) {
-        await writeAtomic(lifecycle.toAbsolutePath, post);
-      }
-      return;
-    }
-  }
-}
-
-/**
- * Restore one member that the commit had already published. A rollback is a BYTE restore, never
- * a re-serialization: keep/delete write the captured pre-image buffer back; add removes what it
- * created (and the empty directories it made); move renames back first, then restores the bytes.
- */
-async function rollbackMember(
-  plan: ProcessedEditFile,
-  rawPreBytes: ReadonlyMap<string, Buffer>,
-  workspaceRoot: string | undefined,
-): Promise<void> {
-  const lifecycle = memberLifecycleOf(plan);
-  const pre = rawPreBytes.get(plan.absolutePath)!;
-  switch (lifecycle.kind) {
-    case "add":
-      if ((await pathKind(plan.absolutePath)) !== "absent") await removeFile(plan.absolutePath);
-      await pruneEmptyDirs(lifecycle.createdDirs);
-      return;
-    case "delete":
-      await writeAtomic(plan.absolutePath, pre);
-      return;
-    case "move": {
-      if ((await pathKind(lifecycle.toAbsolutePath)) !== "absent") {
-        await renameFile(
-          lifecycle.toAbsolutePath,
-          lifecycle.fromAbsolutePath,
-          undefined,
-          workspaceRoot,
-        );
-      }
-      // WHY: the rename carries the pre bytes for a pure move and for a failed content write; only
-      // WHY: rewrite when the destination really holds different bytes (a completed edit rolled back).
-      if (!(await readBytes(lifecycle.fromAbsolutePath)).equals(pre)) {
-        await writeAtomic(lifecycle.fromAbsolutePath, pre);
-      }
-      await pruneEmptyDirs(lifecycle.createdDirs);
-      return;
-    }
-    case "keep":
-      await writeAtomic(plan.absolutePath, pre);
-  }
-}
 async function runCorrelatedTransaction(
   writePlans: ProcessedEditFile[],
   sectionPlans: ProcessedEditFile[],
@@ -1439,60 +1327,18 @@ async function runCorrelatedTransaction(
   // WHY: (ticket-04b §11: after an abort EVERY file is byte-identical to its pre bytes).
   const rawPreBytes = new Map<string, Buffer>();
   for (const plan of writePlans) {
-    const lifecycle = plan.lifecycle;
-    if (lifecycle?.kind === "add") {
-      // WHY: an add has no pre-image by construction. A dry buffer keeps every consumer of the
-      // WHY: map total (rollback reads it, undo carries it as NULL through its lifecycle arm).
-      rawPreBytes.set(plan.absolutePath, Buffer.alloc(0));
-      plan.lifecycle = { ...lifecycle, createdDirs: await missingAncestorDirs(plan.absolutePath) };
-      continue;
-    }
-    if (lifecycle?.kind === "move") {
-      rawPreBytes.set(plan.absolutePath, await readBytes(lifecycle.fromAbsolutePath));
-      plan.lifecycle = {
-        ...lifecycle,
-        createdDirs: await missingAncestorDirs(lifecycle.toAbsolutePath),
-      };
-      continue;
-    }
     rawPreBytes.set(plan.absolutePath, await readBytes(plan.absolutePath));
   }
   const saved: { restore: () => Promise<void> }[] = [];
   for (const plan of writePlans) {
-    const lifecycle = plan.lifecycle;
-    const isAdd = lifecycle?.kind === "add";
-    const isDelete = lifecycle?.kind === "delete";
-    const isMove = lifecycle?.kind === "move";
-    const rawPost = Buffer.from(
-      plan.bom + restoreEndings(plan.result, plan.originalEnding),
-      "utf-8",
-    );
-    // WHY: a pure move carries the raw pre bytes to the destination; recording the canonical
-    // WHY: fold as its post image would make undo's byte oracle reject a legal mixed-ending file.
-    const storedRawPost =
-      isMove && plan.originalNormalized === plan.result
-        ? rawPreBytes.get(plan.absolutePath)!
-        : rawPost;
     const undo = await saveUndo(plan.absolutePath, {
-      content: isAdd ? "" : plan.originalNormalized,
+      content: plan.originalNormalized,
       bom: plan.bom,
       originalEnding: plan.originalEnding,
       hashes: plan.originalHashes,
-      resultContent: isDelete ? "" : plan.result,
+      resultContent: plan.result,
       transactionId: txnId,
-      rawPre: isAdd ? null : rawPreBytes.get(plan.absolutePath)!.toString("utf-8"),
-      ...(isMove
-        ? {
-            lifecycle: "move" as const,
-            fromPath: lifecycle.fromAbsolutePath,
-            toPath: lifecycle.toAbsolutePath,
-            rawPost: storedRawPost.toString("utf-8"),
-          }
-        : isAdd
-          ? { lifecycle: "add" as const, createdDirs: lifecycle.createdDirs }
-          : isDelete
-            ? { lifecycle: "delete" as const }
-            : { lifecycle: "edit" as const }),
+      rawPre: rawPreBytes.get(plan.absolutePath)!.toString("utf-8"),
     });
     if (!undo.persisted) {
       for (const prior of saved) await prior.restore();
@@ -1520,45 +1366,38 @@ async function runCorrelatedTransaction(
       await options.onBeforeFirstCutWrite();
     }
     abortIf(options?.signal);
-    for (let index = 0; index < writePlans.length; index++) {
-      const plan = writePlans[index]!;
-      if (index > 0 && options?.onCutBetweenWrites) {
+    await writeAtomic(
+      primary.absolutePath,
+      primary.bom + restoreEndings(primary.result, primary.originalEnding),
+    );
+    written.push(primary);
+    for (const plan of writePlans.slice(1)) {
+      if (options?.onCutBetweenWrites) {
         // WHY: test-only fault-injection seam (ticket-04b §3): fires INSIDE the two-rename
         // WHY: window, after the previous file's rename is durable.
         await options.onCutBetweenWrites(written[written.length - 1]!.absolutePath);
       }
       abortIf(options?.signal);
-      const publish = (member: ProcessedEditFile): void => {
-        written.push(member);
-      };
-      await commitMember(
-        plan,
-        rawPreBytes,
-        publish,
-        options?.workspaceRoot,
-        options?.onAfterMoveRename,
+      await writeAtomic(
+        plan.absolutePath,
+        plan.bom + restoreEndings(plan.result, plan.originalEnding),
       );
+      written.push(plan);
     }
   } catch (error) {
-    // WHY: the recovery report is the honest three-way split the contract requires: restored =
-    // WHY: proven back at its pre-image, remaining = rollback did not run / did not hold,
-    // WHY: uncertain = the rollback attempt itself threw (we cannot claim either state).
-    const report: TransactionRecoveryReport = { restored: [], remaining: [], uncertain: [] };
+    let rolledBack = true;
     for (const plan of written) {
       try {
-        await rollbackMember(plan, rawPreBytes, options?.workspaceRoot);
-        report.restored.push(plan.path);
+        await writeAtomic(plan.absolutePath, rawPreBytes.get(plan.absolutePath)!);
       } catch (rollbackError) {
-        report.remaining.push(plan.path);
-        report.uncertain.push(plan.path);
+        rolledBack = false;
         reportDiagnostic(
           "mutation-engine",
-          "Failed to roll back a transaction member:",
+          "Failed to roll back a cut-transaction file:",
           rollbackError,
         );
       }
     }
-    const rolledBack = report.remaining.length === 0;
     if (rolledBack) {
       for (const prior of saved) await prior.restore();
       try {
@@ -1572,8 +1411,8 @@ async function runCorrelatedTransaction(
       }
     }
     // WHY: a rollback that did not hold LEAVES the intent row and the transaction-tagged undo
-    // WHY: rows: next-run repair resolves to complete-the-transaction or restore-from-rows.
-    (error as Error & { recovery?: TransactionRecoveryReport }).recovery = report;
+    // WHY: rows: next-run repair resolves to complete-the-cut or restore-both from the stored
+    // WHY: pre/post bytes (ADR-0028) — never a silent loss, never a fake atomicity claim.
     throw error;
   }
 
@@ -1590,13 +1429,10 @@ async function runCorrelatedTransaction(
   // WHY: is REPORTED but never committed: its bytes did not move, so it owns no store write.
   const sections = [];
   for (const plan of sectionPlans) {
-    // WHY: a deleted file has no post-image to snapshot or serve; every other member commits its
-    // WHY: new anchors through the same finishCommittedFile the single-file edit uses.
-    const materializes = plan.appliedCount > 0 && memberLifecycleOf(plan).kind !== "delete";
     sections.push(
       toSection(
         plan,
-        materializes ? await finishCommittedFile(plan, options, sessionKey) : undefined,
+        plan.appliedCount > 0 ? await finishCommittedFile(plan, options, sessionKey) : undefined,
       ),
     );
   }
@@ -1981,10 +1817,3 @@ export async function execEdits(
 ): Promise<ProcessedEditFile> {
   return runMutations(request, cwd, options);
 }
-
-/**
- * Visibility-only export of the correlated transaction for apply_patch's commit seam. The
- * function body is the one the cut path already uses; apply_patch members carry an optional
- * lifecycle action read by that body. No engine semantics change.
- */
-export { runCorrelatedTransaction as commitTransaction };

package/src/mutation-engine/types.ts

@@ -8,12 +8,13 @@
 import type { LineEnding } from "../edit-diff.js";
 import type { ResolvedRange } from "../served-session/serve-render.js";
 import type { HashStore } from "../hash-store.js";
+import type { EditDetails, RMetrics } from "../edit-response.js";
+import type { DomainErrorCode, RangeCause } from "../domain-errors.js";
+import type { ServedRow } from "../domain-errors.js";
 
 // WHY: Re-export pipeline-facing options — validated once at admission (edit.ts),
 // WHY: trusted inside the engine. No `any`.
 export interface PipelineOptions {
-  /** Workspace root used to re-assert lifecycle path boundaries at commit time. */
-  workspaceRoot?: string;
   accessMode?: number;
   signal?: AbortSignal;
   store?: HashStore;
@@ -35,22 +36,6 @@ export interface PipelineOptions {
    * window cannot show that.
    */
   onBeforeFirstCutWrite?: () => void | Promise<void>;
-  /**
-   * TEST-ONLY mid-member fault seam: called after a move's rename is durable and before its
-   * destination content is rewritten, so the rollback of that in-flight member is exercised.
-   */
-  onAfterMoveRename?: (toAbsolutePath: string) => void | Promise<void>;
-}
-
-/**
- * The honest outcome of a failed multi-member commit's rollback attempt. `restored` members are
- * proven back at their pre-images; `remaining` members were not rolled back; `uncertain` members
- * are those whose rollback attempt itself threw, so neither state can be claimed for them.
- */
-export interface TransactionRecoveryReport {
-  restored: string[];
-  remaining: string[];
-  uncertain: string[];
 }
 
 /**
@@ -66,24 +51,6 @@ export interface ForeignCutRecord {
   spanTo: string;
 }
 
-/**
- * The file-lifecycle action one transaction member carries.
- *
- * This is the engine-local vocabulary: apply_patch's plan IR maps onto it in
- * `src/apply-patch/commit.ts` so the mutation engine never imports the apply-patch layer.
- * Absent is an ordinary in-place edit.
- */
-export type MemberLifecycle =
-  | { kind: "keep" }
-  | { kind: "add"; createdDirs: readonly string[] }
-  | { kind: "delete" }
-  | {
-      kind: "move";
-      fromAbsolutePath: string;
-      toAbsolutePath: string;
-      createdDirs: readonly string[];
-    };
-
 // WHY: Internal: the engine's view of one file's mutation outcome.
 // WHY: Mirrors `ProcessedEditFile` from the old pipeline — kept here as the engine's owned fact.
 export interface ProcessedEditFile {
@@ -129,9 +96,60 @@ export interface ProcessedEditFile {
    * correlated two-file transaction; the in-memory buffer itself never touches these files.
    */
   foreignCuts: ForeignCutRecord[];
+}
+
+// WHY: Discriminated success/failure for the deep seam.
+// WHY: Callers use exhaustive switch on `ok` — no `isError` flag checks,
+// WHY: no `any` threading.
+export interface MutationSuccess {
+  ok: true;
+  /** SAFETY: Normalized result content (LF). */
+  result: string;
+  /** SAFETY: Unified diff (hash-anchored) for model consumption. */
+  diff: string;
+  /** SAFETY: User-facing drift notice, if any (details only, not model content). */
+  drift: string | undefined;
+  /** SAFETY: Metrics for telemetry. */
+  metrics: RMetrics;
+  raw: ProcessedEditFile;
+  /** SAFETY: Full tool result (content + details) for pi's tool_result hook. */
+  toolResult: {
+    content: Array<{ type: "text"; text: string }>;
+    details: EditDetails;
+  };
+}
+
+export interface MutationFailure {
+  ok: false;
+  /**
+   * SAFETY: Machine code — a registry member (`DomainErrorCode`). `toFailure` validates every
+   * caught code through the envelope reader (`src/error-envelope.ts`): non-registry strings
+   * (errno pass-through included) route to `E_UNKNOWN`, so the union is honest.
+   */
+  code: DomainErrorCode;
+  /** SAFETY: Human message — model-facing signal when applicable. */
+  message: string;
+  /** SAFETY: Fresh served block for retry when available (reject-and-serve). */
+  servedBlock?: string;
+  servedRows?: ServedRow[];
   /**
-   * apply_patch lifecycle action for this member; absent is an ordinary edit. The correlated
-   * transaction reads it for pre-image capture, commit ordering, rollback and undo-row shape.
+   * SAFETY: the RAW `E_BAD_PAYLOAD` message behind a rendered refusal, when the route is one, so
+   * SAFETY: the tool seam can name the invoking tool instead of falling back to the neutral
+   * SAFETY: wording. Present only for `code: "E_BAD_PAYLOAD"`.
    */
-  lifecycle?: MemberLifecycle;
+  payloadMessage?: string;
+  /** SAFETY: User-facing diagnosis, never a model remedy — a GLOSSARY.md glossary term. */
+  cause?: RangeCause;
+  details?: { code: DomainErrorCode; cause: RangeCause };
+}
+
+export type MutationResult = MutationSuccess | MutationFailure;
+
+// WHY: Narrowing helpers — keep call sites exhaustive.
+export function isMutationSuccess(r: MutationResult): r is MutationSuccess {
+  return r.ok === true;
+}
+
+export function isMutationFailure(r: MutationResult): r is MutationFailure {
+  return r.ok === false;
 }

package/src/mutation-queue.ts

@@ -1,4 +1,4 @@
-import { withFileMutationQueue } from "./host-utils.js";
+import { withFileMutationQueue } from "@earendil-works/pi-coding-agent";
 
 /**
  * Enter pi's per-path mutation queues for SEVERAL paths in one deterministic, sorted nesting.