dsh-mnemon 0.5.27 → 0.5.29

package/lib/index.js

@@ -7,7 +7,7 @@ import z from "@deepseek-ai/schemastery";
 import { basename, delimiter, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { resolveEmbedding, resolvePersistenceStrategy, resolveRecallQuality } from "dsh-mnemon-source-memory-spaces";
 import { createHash, randomUUID } from "node:crypto";
-import { accessSync, chmodSync, closeSync, constants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { accessSync, chmodSync, closeSync, constants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
 import { strToU8, unzipSync, zipSync } from "fflate";
 import { DOCUMENTS_ACTIVE_LIMIT_BYTES, DOCUMENTS_VERSION } from "dsh-mnemon-source-documents/contracts";
@@ -541,6 +541,7 @@ var MnemonAutoBackupScheduler = class {
 	lastAt;
 	lastAttemptAt;
 	lastError;
+	lastFailure;
 	lastCommit;
 	lastPushed;
 	constructor(runtime, now = () => /* @__PURE__ */ new Date()) {
@@ -574,6 +575,7 @@ var MnemonAutoBackupScheduler = class {
 			...this.lastAt === void 0 ? {} : { lastAt: this.lastAt },
 			...this.lastAttemptAt === void 0 || !available ? {} : { nextAt: new Date(this.lastAttemptAt + minutes * MINUTE_MS).toISOString() },
 			...this.lastError === void 0 ? {} : { lastError: this.lastError },
+			...this.lastError === void 0 || this.lastFailure === void 0 ? {} : { lastFailure: this.lastFailure },
 			...this.lastCommit === void 0 ? {} : { lastCommit: this.lastCommit },
 			...this.lastPushed === void 0 ? {} : { lastPushed: this.lastPushed }
 		};
@@ -619,19 +621,26 @@ var MnemonAutoBackupScheduler = class {
 		const controller = new AbortController();
 		this.controller = controller;
 		try {
-			if (sync.settings().read().repoUrl === void 0) this.lastError = void 0;
-			else if (!this.runtime.config.writeEnabled) this.lastError = "dsh-mnemon is configured read-only";
-			else {
+			if (sync.settings().read().repoUrl === void 0) {
+				this.lastError = void 0;
+				this.lastFailure = void 0;
+			} else if (!this.runtime.config.writeEnabled) {
+				this.lastError = "dsh-mnemon is configured read-only";
+				this.lastFailure = void 0;
+			} else {
 				const result = await sync.push({ signal: controller.signal });
 				this.lastAt = this.now().toISOString();
 				this.lastCommit = result.commit;
 				this.lastPushed = result.pushed;
 				this.lastError = result.pushed ? void 0 : result.committed ? result.reason : void 0;
+				this.lastFailure = this.lastError === void 0 ? void 0 : result.failure;
 			}
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			if (!this.stopped && !message.includes(BUSY_MESSAGE)) {
+			const reason = error instanceof Error ? error.reason : void 0;
+			if (!this.stopped && reason !== "busy" && !message.includes(BUSY_MESSAGE)) {
 				this.lastError = message;
+				this.lastFailure = typeof reason === "string" ? reason : void 0;
 				console.warn("dsh-mnemon: automatic Git backup failed", error);
 			}
 		} finally {
@@ -707,7 +716,7 @@ function createStorageRoot(config, workspaceRoot) {
 const MNEMON_MACHINE_DIRECTORY = "state";
 const MNEMON_MACHINE_FILE = "machine.json";
 const MNEMON_MACHINE_VERSION = 1;
-const MAX_LABEL_CHARACTERS = 120;
+const CONTROL = /[\p{Cc}\u2028\u2029]/u;
 function record$8(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
@@ -715,16 +724,26 @@ function record$8(value) {
 function defaultMachineLabel() {
 	const name = hostname().trim();
 	const label = name === "" ? "this machine" : name;
-	return label.length > MAX_LABEL_CHARACTERS ? label.slice(0, MAX_LABEL_CHARACTERS) : label;
+	return label.length > 120 ? label.slice(0, 120) : label;
+}
+/** A name a person gives this machine, as it is stored and shown. */
+function machineLabel(value) {
+	const label = typeof value === "string" ? value.trim() : "";
+	if (label === "" || label.length > 120 || CONTROL.test(label)) throw new Error("machine name must be 1 to " + String(120) + " characters on one line");
+	return label;
 }
 /**
 * The machine identity store. One file, one identity, created on first read and
 * then stable for the life of the data directory: an id that changed would
 * make every earlier entry look like it came from another machine.
+*
+* The name is not part of that promise. A host-name label follows the computer's
+* host name, and a person can name the machine instead. Every read goes to the
+* file, because the pack manager and the sync channel each hold a store and a
+* rename through one has to reach what the other stamps.
 */
 var MnemonMachineStore = class {
 	root;
-	cached;
 	constructor(runner) {
 		this.root = resolve(runner.effectiveDataDir());
 	}
@@ -736,10 +755,42 @@ var MnemonMachineStore = class {
 	}
 	/** This installation's identity, creating and persisting one when none exists yet. */
 	read() {
-		if (this.cached !== void 0) return this.cached;
+		return this.current().identity;
+	}
+	/** The identity with the source of its name, bringing the stored record up to date. */
+	current() {
 		const stored = this.stored();
-		this.cached = stored ?? this.create();
-		return this.cached;
+		if (stored === void 0) return this.write({
+			id: randomUUID(),
+			label: defaultMachineLabel(),
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}, "hostname");
+		if (stored.source === "hostname") {
+			const label = defaultMachineLabel();
+			if (stored.identity.label !== label || !stored.marked) return this.write({
+				...stored.identity,
+				label
+			}, "hostname");
+		} else if (!stored.marked) return this.write(stored.identity, "custom");
+		return {
+			identity: stored.identity,
+			source: stored.source
+		};
+	}
+	/**
+	* Name this machine. A typed name stays as given; null or an empty name goes back
+	* to the host name. The id never changes, so earlier entries keep pointing here.
+	*/
+	rename(value) {
+		const label = value === null || value === "" ? void 0 : machineLabel(value);
+		const identity = this.current().identity;
+		return label === void 0 ? this.write({
+			...identity,
+			label: defaultMachineLabel()
+		}, "hostname") : this.write({
+			...identity,
+			label
+		}, "custom");
 	}
 	stored() {
 		let value;
@@ -753,29 +804,351 @@ var MnemonMachineStore = class {
 		if (typeof parsed.id !== "string" || parsed.id.trim() === "") return void 0;
 		if (typeof parsed.label !== "string" || parsed.label.trim() === "") return void 0;
 		if (typeof parsed.createdAt !== "string") return void 0;
-		return {
+		const identity = {
 			id: parsed.id,
 			label: parsed.label,
 			createdAt: parsed.createdAt
 		};
-	}
-	create() {
-		const identity = {
-			id: randomUUID(),
-			label: defaultMachineLabel(),
-			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		if (parsed.labelSource === "hostname" || parsed.labelSource === "custom") return {
+			identity,
+			source: parsed.labelSource,
+			marked: true
 		};
+		return {
+			identity,
+			source: parsed.label === defaultMachineLabel() ? "hostname" : "custom",
+			marked: false
+		};
+	}
+	write(identity, source) {
 		mkdirSync(this.directory(), {
 			recursive: true,
 			mode: 448
 		});
 		const temporary = `${this.path()}.${randomUUID()}.tmp`;
-		writeFileSync(temporary, `${JSON.stringify({
-			version: MNEMON_MACHINE_VERSION,
-			...identity
-		}, null, 2)}\n`, { mode: 384 });
-		renameSync(temporary, this.path());
-		return identity;
+		try {
+			writeFileSync(temporary, `${JSON.stringify({
+				version: MNEMON_MACHINE_VERSION,
+				...identity,
+				labelSource: source
+			}, null, 2)}\n`, { mode: 384 });
+			renameSync(temporary, this.path());
+		} finally {
+			rmSync(temporary, { force: true });
+		}
+		return {
+			identity,
+			source
+		};
+	}
+};
+//#endregion
+//#region src/host/space-identity.ts
+/**
+* What a Memory Space holds, as opposed to how it was used, and the merge of two versions of one.
+*
+* Mnemon writes to a space whenever it is read: a recall, search or show raises
+* `access_count`, stamps `last_accessed_at` and logs the read in `oplog`. Two machines
+* that only read the same space therefore never hold the same `mnemon.db` bytes, and a
+* merge that compares bytes kept the other machine's space as a new one on every sync,
+* doubling the spaces each round (#370). Spaces are compared by their content instead:
+* every table, column and row, the edges included, except the usage columns, the read log
+* and the derived embedding and effective importance.
+*
+* Rows are compared by their columns in name order, so the order a table declares them in
+* does not matter. One version contains another when it holds every row of it. Two versions
+* of one space merge by adding to this machine's database the rows only the other holds:
+* this machine's rows, read counts, read log and schema stay as they are, and the result holds
+* the memories of both. A row both sides hold differently, a memory edited or forgotten on
+* one of them, refuses the merge, and the caller keeps a copy instead.
+*
+* It needs `node:sqlite` (Node 22.13, 23.4 and later). Without it, for bytes that are not a
+* readable database, for a database with a virtual table, or past the row limits, the identity
+* is the bytes' digest, which is what merges compared before, and such a space contains and
+* merges with no other: a copy is kept, never a memory lost.
+*/
+/** Written by reading a space: the read log. */
+const USAGE_TABLES = /* @__PURE__ */ new Set(["oplog"]);
+/** Written by reading a space, or derived from what it holds. */
+const USAGE_COLUMNS = /* @__PURE__ */ new Set([
+	"access_count",
+	"last_accessed_at",
+	"effective_importance",
+	"embedding"
+]);
+const SCRATCH_PREFIX = ".dsh-space-identity-";
+/**
+* Past this many rows a space is compared by its bytes, and past the second limit every space
+* a merge reads after it. A merge runs under the Pack lock, so a crafted database must not hold
+* the Host or the lock for long: 120,000 real rows read in about 0.4 s.
+*/
+const MEMORY_SPACE_IDENTITY_MAX_ROWS = 5e5;
+const MEMORY_SPACE_MERGE_MAX_ROWS = 2e6;
+function sqlite() {
+	try {
+		return process.getBuiltinModule?.("node:sqlite");
+	} catch {
+		return;
+	}
+}
+function quote(name) {
+	return "\"" + name.replaceAll("\"", "\"\"") + "\"";
+}
+/** A cell as JSON that keeps SQLite's types apart: 1, 1.0, '1', x'01' and NULL all differ. */
+function cell(value) {
+	if (value instanceof Uint8Array) return { blob: Buffer.from(value).toString("base64") };
+	if (typeof value === "bigint") return { integer: String(value) };
+	if (typeof value === "number") return { real: Object.is(value, -0) ? "-0" : String(value) };
+	return value;
+}
+/** 128 bits of a row's digest: enough to tell rows apart, half the memory of the whole digest. */
+function rowDigest(columns, row) {
+	return createHash("sha256").update(JSON.stringify(columns.map((column) => cell(row[column])))).digest("base64").slice(0, 22);
+}
+function digest(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+function sameBytes(left, right) {
+	return left === right || Buffer.from(left.buffer, left.byteOffset, left.byteLength).equals(right);
+}
+/** Cleanup never fails a merge: a copy another process holds open is swept by the next one. */
+function remove(path) {
+	try {
+		rmSync(path, {
+			recursive: true,
+			force: true,
+			maxRetries: 3
+		});
+	} catch {}
+}
+/**
+* Reads what each database holds once, and merges two of them. A merge holds one under the
+* Memory Spaces lock and disposes it at the end, so the copies a Host that stopped mid-merge
+* left behind are swept first.
+*/
+var MemorySpaceIdentity = class {
+	parent;
+	module;
+	maxRows;
+	scratch;
+	known = /* @__PURE__ */ new WeakMap();
+	projections = /* @__PURE__ */ new WeakMap();
+	remaining;
+	/** `parent` holds the short-lived copies a database is read from: the storage root. */
+	constructor(parent, module = sqlite, maxRows = MEMORY_SPACE_IDENTITY_MAX_ROWS, maxMergeRows = MEMORY_SPACE_MERGE_MAX_ROWS) {
+		this.parent = parent;
+		this.module = module;
+		this.maxRows = maxRows;
+		this.remaining = maxMergeRows;
+	}
+	of(bytes) {
+		return this.contents(bytes)?.identity ?? "bytes:" + digest(bytes);
+	}
+	/** Whether `outer` holds every row `inner` holds; `outer` may have columns `inner` lacks. */
+	contains(outer, inner) {
+		if (sameBytes(outer, inner)) return true;
+		const whole = this.contents(outer);
+		const part = this.contents(inner);
+		if (whole === void 0 || part === void 0) return false;
+		for (const [name, table] of part.tables) {
+			const present = this.rowsOn(outer, whole, name, table.columns);
+			if (present === void 0) return false;
+			for (const row of table.rows) if (!present.has(row)) return false;
+		}
+		return true;
+	}
+	/**
+	* `local` with the rows only `incoming` holds added to it, or undefined when the two cannot
+	* merge: a row both hold differently, a table or column `local` lacks, or a database that
+	* cannot be read. `local` itself comes back when it already holds everything.
+	*/
+	merge(local, incoming) {
+		if (sameBytes(local, incoming)) return local;
+		const mine = this.contents(local);
+		const theirs = this.contents(incoming);
+		if (mine === void 0 || theirs === void 0) return void 0;
+		const missing = /* @__PURE__ */ new Map();
+		for (const [name, table] of theirs.tables) {
+			const present = this.rowsOn(local, mine, name, table.columns);
+			if (present === void 0) return void 0;
+			const rows = new Set([...table.rows].filter((row) => !present.has(row)));
+			if (rows.size > 0) missing.set(name, rows);
+		}
+		if (missing.size === 0) return local;
+		const module = this.module();
+		const directory = this.directory();
+		if (module === void 0 || directory === void 0) return void 0;
+		const target = join(directory, randomUUID() + ".db");
+		const source = join(directory, randomUUID() + ".db");
+		let writer;
+		let reader;
+		try {
+			writeFileSync(target, local, { mode: 384 });
+			writeFileSync(source, incoming, { mode: 384 });
+			writer = this.open(module, target, false);
+			reader = this.open(module, source, true);
+			if (writer === void 0 || reader === void 0) return void 0;
+			writer.exec("BEGIN IMMEDIATE");
+			writer.exec("PRAGMA defer_foreign_keys = ON");
+			for (const [name, rows] of missing) {
+				const table = theirs.tables.get(name);
+				const own = mine.tables.get(name);
+				const written = table.all.filter((column) => own.all.includes(column));
+				const insert = writer.prepare(`INSERT INTO ${quote(name)} (${written.map(quote).join(", ")}) VALUES (${written.map(() => "?").join(", ")})`);
+				const statement = reader.prepare(`SELECT ${written.map(quote).join(", ")} FROM ${quote(name)}`);
+				statement.setReadBigInts(true);
+				for (const row of statement.iterate()) {
+					if (!this.spend()) throw new Error("the merge read limit was reached");
+					if (!rows.has(rowDigest(table.columns, row))) continue;
+					insert.run(...written.map((column) => row[column]));
+				}
+			}
+			writer.exec("COMMIT");
+			writer.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+			writer.close();
+			writer = void 0;
+			return readFileSync(target);
+		} catch {
+			return;
+		} finally {
+			for (const database of [writer, reader]) try {
+				database?.close();
+			} catch {}
+			for (const path of [target, source]) for (const suffix of [
+				"",
+				"-wal",
+				"-shm",
+				"-journal"
+			]) remove(path + suffix);
+		}
+	}
+	dispose() {
+		if (this.scratch !== void 0) remove(this.scratch);
+		this.scratch = void 0;
+	}
+	spend() {
+		this.remaining -= 1;
+		return this.remaining >= 0;
+	}
+	contents(bytes) {
+		const known = this.known.get(bytes);
+		if (known !== void 0) return known ?? void 0;
+		const contents = this.read(bytes);
+		this.known.set(bytes, contents ?? null);
+		return contents;
+	}
+	/** The digests of a table's rows over `columns`, which may leave out columns the table has. */
+	rowsOn(bytes, contents, name, columns) {
+		const table = contents.tables.get(name);
+		if (table === void 0 || !columns.every((column) => table.columns.includes(column))) return void 0;
+		if (columns.length === table.columns.length) return table.rows;
+		const key = JSON.stringify([name, columns]);
+		const cached = this.projections.get(bytes) ?? /* @__PURE__ */ new Map();
+		this.projections.set(bytes, cached);
+		if (!cached.has(key)) cached.set(key, this.withCopy(bytes, true, (database) => this.digests(database, name, columns) ?? null) ?? null);
+		return cached.get(key) ?? void 0;
+	}
+	digests(database, name, columns) {
+		const rows = /* @__PURE__ */ new Set();
+		if (columns.length === 0) return rows;
+		const statement = database.prepare(`SELECT ${columns.map(quote).join(", ")} FROM ${quote(name)}`);
+		statement.setReadBigInts(true);
+		let budget = this.maxRows;
+		for (const row of statement.iterate()) {
+			budget -= 1;
+			if (budget < 0 || !this.spend()) return void 0;
+			rows.add(rowDigest(columns, row));
+		}
+		return rows;
+	}
+	directory() {
+		try {
+			if (this.scratch === void 0) {
+				for (const name of readdirSync(this.parent)) if (name.startsWith(SCRATCH_PREFIX)) remove(join(this.parent, name));
+			}
+			if (this.scratch === void 0 || !existsSync(this.scratch)) this.scratch = mkdtempSync(join(this.parent, SCRATCH_PREFIX));
+		} catch {
+			return;
+		}
+		return this.scratch;
+	}
+	/** A connection to a private copy, refused when the copy is missing or empty rather than created. */
+	open(module, path, readOnly) {
+		if (!existsSync(path)) return void 0;
+		const database = new module.DatabaseSync(path, { readOnly });
+		database.exec("PRAGMA trusted_schema = OFF");
+		const pages = database.prepare("PRAGMA page_count").get();
+		if (Number(pages?.page_count ?? 0) <= 0) {
+			database.close();
+			return;
+		}
+		return database;
+	}
+	withCopy(bytes, readOnly, use) {
+		const module = this.module();
+		if (module === void 0) return void 0;
+		const directory = this.directory();
+		if (directory === void 0) return void 0;
+		const path = join(directory, randomUUID() + ".db");
+		let database;
+		try {
+			writeFileSync(path, bytes, { mode: 384 });
+			database = this.open(module, path, readOnly);
+			return database === void 0 ? void 0 : use(database);
+		} catch {
+			return;
+		} finally {
+			try {
+				database?.close();
+			} catch {}
+			for (const suffix of [
+				"",
+				"-wal",
+				"-shm",
+				"-journal"
+			]) remove(path + suffix);
+		}
+	}
+	read(bytes) {
+		return this.withCopy(bytes, true, (database) => {
+			const listed = database.prepare("SELECT name, type FROM pragma_table_list WHERE schema = 'main'").all();
+			if (listed.some((entry) => entry.type !== "table" && entry.type !== "view")) return void 0;
+			const names = listed.filter((entry) => entry.type === "table" && !entry.name.startsWith("sqlite_") && !USAGE_TABLES.has(entry.name)).map((entry) => entry.name).sort();
+			const hash = createHash("sha256");
+			const tables = /* @__PURE__ */ new Map();
+			let budget = this.maxRows;
+			for (const name of names) {
+				const all = database.prepare(`PRAGMA table_info(${quote(name)})`).all().map((column) => column.name);
+				const columns = all.filter((column) => !USAGE_COLUMNS.has(column)).sort();
+				const rows = [];
+				if (columns.length > 0) {
+					const statement = database.prepare(`SELECT ${columns.map(quote).join(", ")} FROM ${quote(name)}`);
+					statement.setReadBigInts(true);
+					for (const row of statement.iterate()) {
+						budget -= 1;
+						if (budget < 0 || !this.spend()) return void 0;
+						rows.push(rowDigest(columns, row));
+					}
+				}
+				rows.sort();
+				hash.update(JSON.stringify([
+					"table",
+					name,
+					columns,
+					rows.length
+				]));
+				for (const row of rows) hash.update(row);
+				tables.set(name, {
+					columns,
+					all,
+					rows: new Set(rows)
+				});
+			}
+			return {
+				identity: "content:" + hash.digest("hex"),
+				tables
+			};
+		});
 	}
 };
 //#endregion
@@ -906,9 +1279,19 @@ function parseEntryOrigin(value) {
 		at: origin.at
 	};
 }
+/**
+* Whole groups of four from the base64 alphabet, padded with at most two `=` at the end. The
+* length check and one character class keep this a flat loop at any size. A pattern that repeats
+* a four-character group keeps a backtracking entry per group, and V8 threw "Maximum call stack
+* size exceeded" once a payload passed about 4.5 MB (#368). The `u` flag stays off: under it,
+* V8 13 (Node 24) does the same for a class over a string holding a character above U+00FF.
+*/
+function isBase64(value) {
+	return value.length % 4 === 0 && /^[A-Za-z0-9+/]*={0,2}$/.test(value);
+}
 function decodeArchive(base64) {
 	if (typeof base64 !== "string" || base64 === "" || base64.length > Math.ceil(16777216) * 4 + 4) throw new Error("Mnemon Pack archive is empty or too large");
-	if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(base64)) throw new Error("Mnemon Pack payload is not valid base64");
+	if (!isBase64(base64)) throw new Error("Mnemon Pack payload is not valid base64");
 	const bytes = Buffer.from(base64, "base64");
 	if (bytes.length === 0 || bytes.length > 50331648) throw new Error("Mnemon Pack archive is empty or too large");
 	return bytes;
@@ -1566,23 +1949,86 @@ function mergeTombstoneFiles(current, incoming) {
 		tombstones: [...byKey.values()].sort((left, right) => left.deletedAt < right.deletedAt ? -1 : left.deletedAt > right.deletedAt ? 1 : 0)
 	};
 }
-function mergeDocuments(root, pack) {
+/**
+* One document's version as a sync agrees on it: every field but the time it was last read,
+* which a read moves without changing the document. A title, an archive or a link is as much
+* a part of it as the text.
+*/
+function documentVersion(document) {
+	const { lastAccessedAt: _read, ...fields } = document;
+	return sha256$1(canonicalJson(fields));
+}
+/** JSON with every object's keys in order and unset ones left out, so the same record always hashes the same. */
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const fields = value;
+		return `{${Object.keys(fields).filter((key) => fields[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(fields[key])}`).join(",")}}`;
+	}
+	return JSON.stringify(value) ?? "null";
+}
+/** Whether two records say the same thing to a reader: the text, the title, the description and the archive. */
+function sameDocument(left, right) {
+	return left.contentHash === right.contentHash && left.title === right.title && left.description === right.description && left.status === right.status && (left.archiveSummary ?? "") === (right.archiveSummary ?? "");
+}
+/** Each document's version in one payload, by id, or nothing when the payload holds no valid Documents index. */
+function documentVersions(files) {
+	const bytes = files["payload/documents/index.json"];
+	if (bytes === void 0) return void 0;
+	try {
+		return Object.fromEntries(parseDocumentIndex(json$1(bytes, "payload/documents/index.json")).documents.map((document) => [document.id, documentVersion(document)]));
+	} catch {
+		return;
+	}
+}
+/**
+* `base` is each document's version as this machine and the branch last agreed on it, which
+* only a sync channel knows, and it decides only for a document both hold. One the branch did
+* not change since then keeps this machine's version, edited or not. One only the branch
+* changed is the newer version of the same document and replaces the one here, unless its
+* revision is lower than this machine's, as an older dsh-mnemon can publish; that one is kept
+* beside it, as a merge without `base` keeps every document whose text differs.
+*/
+function mergeDocuments(root, pack, base) {
 	const current = readCurrentDocuments(root);
 	const incoming = archiveDocuments(pack);
 	const ids = new Map(current.index.documents.map((document) => [document.id, document]));
-	for (const source of incoming.index.documents) {
-		const existing = ids.get(source.id);
-		if (existing !== void 0 && existing.contentHash === source.contentHash) continue;
-		let document = source;
-		let bytes = incoming.files.get(source.id);
-		if (existing !== void 0) {
-			const remapped = remapDocument(source, bytes, randomUUID());
-			document = remapped.document;
-			bytes = remapped.bytes;
-		}
+	const add = (document, bytes) => {
 		current.index.documents.push(document);
 		current.files.set(document.id, bytes);
 		ids.set(document.id, document);
+	};
+	const copy = (source) => {
+		const remapped = remapDocument(source, incoming.files.get(source.id), randomUUID());
+		add(remapped.document, remapped.bytes);
+	};
+	for (const source of incoming.index.documents) {
+		const existing = ids.get(source.id);
+		const agreed = existing !== void 0 && base !== void 0 && Object.hasOwn(base, source.id) ? base[source.id] : void 0;
+		if (existing !== void 0 && agreed !== void 0) {
+			if (documentVersion(source) === agreed) continue;
+			const at = current.index.documents.indexOf(existing);
+			if (documentVersion(existing) !== agreed) {
+				const kept = {
+					...existing,
+					revision: Math.max(existing.revision, source.revision) + 1
+				};
+				current.index.documents[at] = kept;
+				ids.set(source.id, kept);
+				if (!current.index.documents.some((document) => sameDocument(document, source))) copy(source);
+				continue;
+			}
+			if (source.revision >= existing.revision) {
+				current.index.documents[at] = source;
+				current.files.set(source.id, incoming.files.get(source.id));
+				ids.set(source.id, source);
+				continue;
+			}
+		}
+		if (existing !== void 0 && existing.contentHash === source.contentHash) continue;
+		if (existing !== void 0 && current.index.documents.some((document) => document.contentHash === source.contentHash)) continue;
+		if (existing !== void 0) copy(source);
+		else add(source, incoming.files.get(source.id));
 	}
 	if (current.index.documents.filter((document) => document.status === "active").reduce((sum, document) => sum + document.sizeBytes, 0) > DOCUMENTS_ACTIVE_LIMIT_BYTES) throw new Error(`merged Documents exceed the ${DOCUMENTS_ACTIVE_LIMIT_BYTES} byte active limit`);
 	return current;
@@ -1591,23 +2037,43 @@ function mergeRegistry(root, pack) {
 	const current = readCurrentRegistry(root);
 	const incoming = archiveRegistry(pack);
 	const ids = new Set(current.registry.bodies.map((body) => body.id));
-	for (const source of incoming.registry.bodies) {
-		let body = source;
-		const sourceDb = incoming.databases.get(source.id);
-		if (ids.has(source.id)) {
-			if (sha256$1(current.databases.get(source.id)) === sha256$1(sourceDb)) continue;
-			const id = randomUUID();
-			body = {
-				...source,
-				id,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
-		}
-		ids.add(body.id);
-		current.registry.bodies.push(body);
-		current.databases.set(body.id, sourceDb);
+	const identity = new MemorySpaceIdentity(root);
+	try {
+		const covers = (outer, inner) => identity.of(outer) === identity.of(inner) || identity.contains(outer, inner);
+		const held = (database, accept) => current.registry.bodies.some((body) => accept(body) && covers(current.databases.get(body.id), database));
+		const add = (body, database) => {
+			ids.add(body.id);
+			current.registry.bodies.push(body);
+			current.databases.set(body.id, database);
+		};
+		for (const source of incoming.registry.bodies) {
+			const sourceDb = incoming.databases.get(source.id);
+			if (ids.has(source.id)) {
+				const localDb = current.databases.get(source.id);
+				if (covers(localDb, sourceDb)) continue;
+				const merged = identity.merge(localDb, sourceDb);
+				if (merged !== void 0) {
+					current.databases.set(source.id, merged);
+					continue;
+				}
+				if (held(sourceDb, (body) => body.id !== source.id)) continue;
+				const copy = current.registry.bodies.find((body) => body.id !== source.id && body.name === source.name && identity.contains(sourceDb, current.databases.get(body.id)));
+				const advanced = copy === void 0 ? void 0 : identity.merge(current.databases.get(copy.id), sourceDb);
+				if (copy !== void 0 && advanced !== void 0) {
+					current.databases.set(copy.id, advanced);
+					continue;
+				}
+				add({
+					...source,
+					id: randomUUID(),
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+				}, sourceDb);
+			} else if (!held(sourceDb, (body) => body.name === source.name)) add(source, sourceDb);
+		}
+		return current;
+	} finally {
+		identity.dispose();
 	}
-	return current;
 }
 function persistedStore(root) {
 	try {
@@ -1662,7 +2128,7 @@ function stageImport(root, pack, components, mode, runtimeLimits, options = {})
 			keepRuntimeArchive(root, join(staging, "runtime"));
 		}
 		if (components.includes("documents")) {
-			const documents = mode === "merge" ? mergeDocuments(root, pack) : archiveDocuments(pack);
+			const documents = mode === "merge" ? mergeDocuments(root, pack, options.documentsBase) : archiveDocuments(pack);
 			writeDocuments(join(staging, "documents"), documents.index, documents.files);
 		}
 		if (components.includes("memory-spaces")) {
@@ -1899,6 +2365,10 @@ var MnemonPackManager = class {
 			occupied: Object.fromEntries(COMPONENT_ORDER.map((component) => [component, occupied(this.root, component)]))
 		};
 	}
+	/**
+	* `documentsBase` is each document's version, by id, as a sync channel last agreed on it with
+	* the branch; a merge uses it to tell an older version from a divergent one. A ZIP import has none.
+	*/
 	async importPack(base64, options) {
 		const pack = parseArchive(base64, this.runtimeLimits);
 		if (options.mode !== "merge" && options.mode !== "replace") throw new Error("Pack import mode must be merge or replace");
@@ -2494,6 +2964,17 @@ function headerRecord(headers) {
 	if (typeof headers.entries === "function") return Object.fromEntries(headers.entries());
 	return { ...headers };
 }
+/**
+* What a tunnelled request read back, as a `fetch` answer: the status, the text and its
+* content type, which is all this channel uses. The type says how to read a body that
+* is not JSON, such as the form GitHub's sign-in answers with when no JSON was asked for.
+*/
+function tunnelAnswer(status, type, text) {
+	return new Response(status === 204 || status === 205 || status === 304 ? null : text, {
+		status,
+		...type === void 0 ? {} : { headers: { "content-type": type } }
+	});
+}
 /** The request one tunnel performs, as a `fetch`-shaped answer. */
 function tunnelRequest(agent, url, init) {
 	return new Promise((resolve, reject) => {
@@ -2511,9 +2992,8 @@ function tunnelRequest(agent, url, init) {
 			});
 			response.once("error", reject);
 			response.once("end", () => {
-				const status = response.statusCode ?? 502;
-				const text = Buffer.concat(chunks).toString("utf8");
-				resolve(new Response(status === 204 || status === 205 || status === 304 ? null : text, { status }));
+				const type = response.headers["content-type"];
+				resolve(tunnelAnswer(response.statusCode ?? 502, type, Buffer.concat(chunks).toString("utf8")));
 			});
 		});
 		if (typeof init.body === "string") request.write(init.body);
@@ -2591,6 +3071,20 @@ function createGitHubTransport(options = {}) {
 	});
 }
 //#endregion
+//#region src/host/sync-error.ts
+/**
+* A sync failure the settings page can name in its own language. The message
+* stays the Host's own words for logs and for anything the page cannot name.
+*/
+var MnemonSyncError = class extends Error {
+	reason;
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+		this.name = "MnemonSyncError";
+	}
+};
+//#endregion
 //#region src/host/github-auth.ts
 /**
 * GitHub sign-in for the repository sync channel: the OAuth device flow, the
@@ -2606,7 +3100,9 @@ function createGitHubTransport(options = {}) {
 * process-wide dispatcher, then one retry through a proxy discovered from the
 * environment or from this machine's own settings, so a network that reaches
 * GitHub only through a proxy still signs in. Failures report GitHub's error
-* code, the HTTP status and the transport reason only, never a response body.
+* code, the HTTP status and the transport reason, and a device code answer that
+* cannot be used adds its content type and field names; never a value from a
+* response body.
 */
 const MNEMON_GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 const MNEMON_GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -2621,7 +3117,6 @@ const MNEMON_GITHUB_SCOPE = "repo";
 */
 const MNEMON_SYNC_GITHUB_CREDENTIAL_KEY = "dsh-mnemon/github";
 const MNEMON_GITHUB_REQUEST_TIMEOUT_MS = 3e4;
-const MNEMON_GITHUB_DEFAULT_INTERVAL_MS = 5e3;
 const MNEMON_GITHUB_SLOW_DOWN_MS = 5e3;
 const MNEMON_GITHUB_MAX_INTERVAL_MS = 6e4;
 const MNEMON_GITHUB_FLOW_LIMIT_MS = 36e5;
@@ -2639,9 +3134,27 @@ function codeOf(body) {
 	const fields = record$5(body);
 	return text$1(fields?.error) ?? text$1(fields?.message);
 }
+/** A positive count GitHub sends as a JSON number, or as a string in a form-encoded answer. */
+function count(value) {
+	const number = typeof value === "string" && /^\d{1,9}$/u.test(value) ? Number(value) : value;
+	return typeof number === "number" && Number.isFinite(number) && number > 0 ? number : void 0;
+}
+/** A key that reads as a field name; anything else in a body that only claimed to be a form could hold a value. */
+const FIELD_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/u;
+/**
+* What an answer GitHub sent looked like, without any of its values: those can be a
+* device code or a token. Enough to tell a proxy's HTML page from a reply that lost a field.
+*/
+function shapeOf(answer) {
+	const keys = Object.keys(record$5(answer.body) ?? {});
+	const names = keys.filter((key) => FIELD_NAME.test(key)).slice(0, 8);
+	const listed = keys.length > names.length ? [...names, String(keys.length - names.length) + " other"] : names;
+	return "HTTP " + String(answer.status) + ", content-type " + (answer.type ?? "none") + ", fields: " + (listed.length === 0 ? "none" : listed.join(", "));
+}
 function failure$2(action, status, body) {
 	const code = codeOf(body);
-	return /* @__PURE__ */ new Error(code === void 0 ? action + " failed with HTTP " + String(status) : action + " failed: " + code);
+	const message = code === void 0 ? action + " failed with HTTP " + String(status) : action + " failed: " + code;
+	return status === 401 ? new MnemonSyncError("github-unauthorized", message) : new Error(message);
 }
 /** Read one grant out of a stored record, refusing anything else. */
 function githubGrantFromRecord(record_) {
@@ -2784,16 +3297,16 @@ var MnemonGitHubAuth = class {
 		const deviceCode = text$1(fields?.device_code);
 		const userCode = text$1(fields?.user_code);
 		const verificationUri = text$1(fields?.verification_uri);
-		if (deviceCode === void 0 || userCode === void 0 || verificationUri === void 0) throw new Error("the GitHub device code answer was incomplete");
-		const expiresIn = typeof fields?.expires_in === "number" ? fields.expires_in : 900;
-		const interval = typeof fields?.interval === "number" ? fields.interval : MNEMON_GITHUB_DEFAULT_INTERVAL_MS / 1e3;
+		if (deviceCode === void 0 || userCode === void 0 || verificationUri === void 0) throw new Error("the GitHub device code answer was incomplete (" + shapeOf(answer) + ")");
+		const expiresIn = count(fields?.expires_in) ?? 900;
+		const intervalMs = Math.min(Math.max((count(fields?.interval) ?? 5) * 1e3, 1e3), MNEMON_GITHUB_MAX_INTERVAL_MS);
 		this.flow = {
 			deviceCode,
 			userCode,
 			verificationUri,
 			expiresAt: this.now() + Math.min(expiresIn * 1e3, MNEMON_GITHUB_FLOW_LIMIT_MS),
-			intervalMs: Math.max(interval * 1e3, 1e3),
-			nextPollAt: this.now() + Math.max(interval * 1e3, 1e3)
+			intervalMs,
+			nextPollAt: this.now() + intervalMs
 		};
 		return this.status();
 	}
@@ -2920,17 +3433,20 @@ var MnemonGitHubAuth = class {
 	/** The repositories the account may write to, most recently pushed first. */
 	async repositories(signal) {
 		const token = await this.requireToken();
-		const url = "https://api.github.com/user/repos?per_page=" + String(100) + "&sort=updated&affiliation=owner%2Ccollaborator%2Corganization_member";
-		const { status, body } = await this.ask(url, {
-			headers: this.authorization(token),
-			...signal === void 0 ? {} : { signal }
-		}, "listing GitHub repositories");
-		if (status !== 200) throw failure$2("listing GitHub repositories", status, body);
-		if (!Array.isArray(body)) throw new Error("the GitHub repository answer was not a list");
 		const repositories = [];
-		for (const entry of body) {
-			const repository = repositoryOf(entry);
-			if (repository !== void 0) repositories.push(repository);
+		for (let page = 1; page <= 5; page += 1) {
+			const url = "https://api.github.com/user/repos?per_page=" + String(100) + "&page=" + String(page) + "&sort=updated&affiliation=owner%2Ccollaborator%2Corganization_member";
+			const { status, body } = await this.ask(url, {
+				headers: this.authorization(token),
+				...signal === void 0 ? {} : { signal }
+			}, "listing GitHub repositories");
+			if (status !== 200) throw failure$2("listing GitHub repositories", status, body);
+			if (!Array.isArray(body)) throw new Error("the GitHub repository answer was not a list");
+			for (const entry of body) {
+				const repository = repositoryOf(entry);
+				if (repository !== void 0 && !repositories.some((known) => known.fullName === repository.fullName)) repositories.push(repository);
+			}
+			if (body.length < 100) break;
 		}
 		return {
 			login: await this.account(token, signal) ?? "",
@@ -2990,14 +3506,16 @@ var MnemonGitHubAuth = class {
 				signal
 			});
 			const raw = await response.text();
+			const type = response.headers.get("content-type") ?? void 0;
 			let body;
 			try {
 				body = raw === "" ? void 0 : JSON.parse(raw);
 			} catch {
-				body = void 0;
+				body = /^application\/x-www-form-urlencoded\b/iu.test(type ?? "") ? Object.fromEntries(new URLSearchParams(raw)) : void 0;
 			}
 			return {
 				status: response.status,
+				...type === void 0 ? {} : { type },
 				body
 			};
 		} finally {
@@ -3234,7 +3752,31 @@ var MnemonSyncSettingsStore = class {
 //#region src/host/git-sync.ts
 /** The oldest Git the channel drives: `archive`, `ls-remote`, `-C`, and `credential` all predate it. */
 const MNEMON_SYNC_MINIMUM_GIT = "2.20";
-const MNEMON_SYNC_GIT_TIMEOUT_MS = 12e4;
+/**
+* How long the settings page waits to learn whether the remote answers. A page
+* that opens should not hang on a host that drops packets, and anything slower
+* than this is reported as a timeout rather than awaited.
+*/
+const MNEMON_SYNC_STATUS_TIMEOUT_MS = 2e4;
+/** A push Git refused because the branch moved is folded in and tried once more. */
+const PUSH_ATTEMPTS = 2;
+/**
+* No sync runs this long, so a lock older than this is abandoned whoever holds it.
+* It also covers a process id that a restart handed to an unrelated process.
+*/
+const STALE_LOCK_MS = 36e5;
+const LOCK_OWNER = "owner.json";
+/**
+* A lock without an owner record was taken by a version that kept none, and may
+* still be in use by it; it is taken over only once no such run could still last.
+*/
+const OWNERLESS_LOCK_MS = 9e5;
+/** The mirror's own Git config names the repository it was filled from. */
+const ORIGIN_KEY = "mnemon.origin";
+const LAST_RUN_FILE = "last-run.json";
+/** What this machine and the branch last agreed on: each document's version, by id, and the commit it was agreed at. */
+const BASE_FILE = "base.json";
+const AGREED_COMMIT = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u;
 const GIT_LABEL = "git";
 const MANIFEST = "manifest.json";
 const CHECKSUMS = "checksums.json";
@@ -3295,6 +3837,16 @@ function gitEnvironment(environment = process.env) {
 	sanitized.GCM_INTERACTIVE = "never";
 	return sanitized;
 }
+/** The host an HTTPS address hands a token to; any other address takes none. */
+function tokenHost(repoUrl) {
+	if (repoUrl === void 0) return void 0;
+	try {
+		const url = new URL(repoUrl);
+		return url.protocol === "https:" ? url.host.toLowerCase() : void 0;
+	} catch {
+		return;
+	}
+}
 /** Whether a repository address is HTTPS on github.com, the only host a GitHub grant is for. */
 function isGitHubHttps(repoUrl) {
 	try {
@@ -3304,6 +3856,37 @@ function isGitHubHttps(repoUrl) {
 		return false;
 	}
 }
+/**
+* What kind of failure one Git error describes. Git words these differently per
+* transport and per host, so the patterns are the phrases each transport uses:
+* a refused or missing credential, an address that leads nowhere (GitHub answers
+* "not found" for a private repository it will not show without credentials), a
+* network that does not reach the host, and a host that never answered.
+*/
+function remoteIssueOf(message) {
+	const text = message.toLowerCase();
+	if (/did not respond within|timed out|timeout was reached/u.test(text)) return "timeout";
+	if (/authentication failed|could not read (username|password)|terminal prompts disabled|permission denied|invalid username or password|bad credentials|returned error: 40[13]|host key verification failed|access denied|denied to /u.test(text)) return "auth";
+	if (/repository not found|not found|does not appear to be a git repository|no such file or directory|does not exist|returned error: 404/u.test(text)) return "not-found";
+	if (/could not resolve|failed to connect|couldn't connect|connection (refused|reset|closed|timed out)|network is unreachable|no route to host|unable to access|ssl|tls|proxy|empty reply/u.test(text)) return "network";
+	return "unknown";
+}
+const REMOTE_FAILURE = {
+	auth: "remote-auth",
+	"not-found": "remote-not-found",
+	network: "remote-network",
+	timeout: "remote-timeout",
+	unknown: void 0
+};
+/** One failed remote command as the error a caller reports: named when it can be. */
+function remoteFailure(message) {
+	const reason = REMOTE_FAILURE[remoteIssueOf(message)];
+	return reason === void 0 ? new Error(message) : new MnemonSyncError(reason, message);
+}
+/** Whether Git refused a push because the branch moved on since this run read it. */
+function rejectedPush(output) {
+	return /\[rejected\]|fetch first|non-fast-forward/iu.test(output);
+}
 function record$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
@@ -3450,9 +4033,9 @@ function objectCount(output) {
 	if (loose === null || bytes === null || packed === null || packedBytes === null) return void 0;
 	return {
 		loose: Number(loose[1]),
-		bytes: Number(bytes[1]),
+		bytes: Number(bytes[1]) * 1024,
 		packed: Number(packed[1]),
-		packedBytes: Number(packedBytes[1])
+		packedBytes: Number(packedBytes[1]) * 1024
 	};
 }
 /** How many commits one page asks for: the caller's window, clamped to what one listing should carry. */
@@ -3718,6 +4301,8 @@ var MnemonGitSync = class {
 		};
 		const commit = existsSync(this.store.mirror()) && git.available ? await this.lastCommit(signal) : void 0;
 		const autoBackup = this.autoBackupView?.();
+		const lastRun = repoUrl === void 0 ? void 0 : this.lastRun();
+		const machine = this.machine.current();
 		return {
 			enabled: true,
 			configured: repoUrl !== void 0,
@@ -3726,14 +4311,27 @@ var MnemonGitSync = class {
 			mirrorPath: this.store.mirror(),
 			git,
 			remote,
-			machine: this.machine.read(),
+			machine: machine.identity,
+			machineLabel: {
+				source: machine.source,
+				hostname: defaultMachineLabel()
+			},
 			...commit === void 0 ? {} : { lastCommit: commit },
+			...lastRun === void 0 ? {} : { lastRun },
 			...autoBackup === void 0 ? {} : { autoBackup }
 		};
 	}
 	async configure(patch) {
-		const next = this.store.patch(patch);
+		const previous = this.store.read();
+		const fields = record$3(patch);
+		const { machineLabel: name, ...settings } = fields ?? {};
+		const naming = fields !== void 0 && "machineLabel" in fields;
+		if (naming && name !== null && name !== "") machineLabel(name);
+		const next = this.store.patch(fields === void 0 ? patch : settings);
+		if (next.token !== void 0 && previous.repoUrl !== void 0 && fields !== void 0 && !("token" in fields) && tokenHost(previous.repoUrl) !== tokenHost(next.repoUrl)) delete next.token;
 		this.store.write(next);
+		if (naming) this.machine.rename(name);
+		if (previous.repoUrl !== next.repoUrl) rmSync(this.lastRunPath(), { force: true });
 		return this.credentialView(next);
 	}
 	/**
@@ -3747,106 +4345,270 @@ var MnemonGitSync = class {
 		await this.requireGit(input.signal);
 		const message = commitMessage(input.message, this.now());
 		return this.lock(async () => {
-			const prepared = await this.ensureMirror(settings, input.signal);
-			await this.packs.recordDeletions();
-			const remote = await this.readRemote(settings, input.signal);
-			let merged;
-			if (remote !== void 0) {
-				const imported = await this.packs.importPack(Buffer.from(remote.archive).toString("base64"), {
-					mode: "merge",
-					tombstones: {
-						version: 1,
-						tombstones: remote.tombstones
-					}
-				});
-				merged = {
-					commit: remote.commit,
-					...remote.machine === void 0 ? {} : { machine: {
-						id: remote.machine.id,
-						label: remote.machine.label
-					} },
-					components: imported.components,
-					summary: imported.summary,
-					tombstones: remote.tombstones.length
-				};
+			let result = await this.pushOnce(settings, message, input.signal);
+			let added = result.merged?.runtime?.added ?? 0;
+			let held = result.merged?.runtime?.held ?? 0;
+			for (let attempt = 1; attempt < PUSH_ATTEMPTS && result.failure === "push-rejected"; attempt += 1) {
+				result = await this.pushOnce(settings, message, input.signal);
+				added += result.merged?.runtime?.added ?? 0;
+				held = result.merged?.runtime?.held ?? held;
 			}
-			const exported = await this.packs.exportPack("full", { stamp: true });
-			const entries = unpack(Buffer.from(exported.base64, "base64"));
-			const extension = {
-				channel: "git",
-				branch: settings.branch,
-				subdir: settings.subdir,
-				pushedAt: exported.manifest.exportedAt,
-				machine: this.machine.read(),
-				tombstones: this.packs.tombstones().tombstones
+			if (result.merged !== void 0 && (added > 0 || result.merged.runtime !== void 0)) result = {
+				...result,
+				merged: {
+					...result.merged,
+					runtime: {
+						added,
+						held
+					}
+				}
 			};
-			entries[MANIFEST] = new TextEncoder().encode(JSON.stringify({
-				...exported.manifest,
-				[SYNC_EXTENSION]: extension
-			}, null, 2) + "\n");
-			const before = readFiles(this.payloadRoot(settings.subdir));
-			if (prepared.tip === void 0 || !holdsPayload(before, entries)) this.writePayload(settings.subdir, entries);
-			const staged = await this.git([
-				"add",
-				"--all",
-				"--",
-				settings.subdir
-			], {
-				cwd: this.store.mirror(),
-				signal: input.signal
+			if (result.pushed || !result.committed) this.recordRun({
+				kind: "sync",
+				commit: result.commit,
+				pushed: result.pushed,
+				...result.merged?.runtime === void 0 ? {} : { added: result.merged.runtime.added }
 			});
-			if (staged.exitCode !== 0) throw new Error("git add failed: " + tail(staged.stderr || staged.stdout));
-			const committed = (await this.git([
-				"status",
-				"--porcelain",
+			return result;
+		});
+	}
+	async pushOnce(settings, message, signal) {
+		const prepared = await this.ensureMirror(settings, signal);
+		await this.packs.recordDeletions();
+		const remote = await this.readPrepared(settings, prepared);
+		let merged;
+		if (remote !== void 0) {
+			const base = await this.agreedDocuments(settings, remote.commit, signal);
+			const imported = await this.packs.importPack(Buffer.from(remote.archive).toString("base64"), {
+				mode: "merge",
+				tombstones: {
+					version: 1,
+					tombstones: remote.tombstones
+				},
+				...base === void 0 ? {} : { documentsBase: base }
+			});
+			if (imported.components.includes("documents")) this.agree(settings, remote.files, remote.commit);
+			merged = {
+				commit: remote.commit,
+				...remote.machine === void 0 ? {} : { machine: {
+					id: remote.machine.id,
+					label: remote.machine.label
+				} },
+				components: imported.components,
+				summary: imported.summary,
+				tombstones: remote.tombstones.length,
+				...imported.runtime === void 0 ? {} : { runtime: imported.runtime }
+			};
+		}
+		const exported = await this.packs.exportPack("full", { stamp: true });
+		const entries = unpack(Buffer.from(exported.base64, "base64"));
+		const extension = {
+			channel: "git",
+			branch: settings.branch,
+			subdir: settings.subdir,
+			pushedAt: exported.manifest.exportedAt,
+			machine: this.machine.read(),
+			tombstones: this.packs.tombstones().tombstones
+		};
+		entries[MANIFEST] = new TextEncoder().encode(JSON.stringify({
+			...exported.manifest,
+			[SYNC_EXTENSION]: extension
+		}, null, 2) + "\n");
+		const before = readFiles(this.payloadRoot(settings.subdir));
+		if (prepared.tip === void 0 || !holdsPayload(before, entries)) this.writePayload(settings.subdir, entries);
+		const staged = await this.git([
+			"add",
+			"--all",
+			"--",
+			settings.subdir
+		], {
+			cwd: this.store.mirror(),
+			signal
+		});
+		if (staged.exitCode !== 0) throw new Error("git add failed: " + tail(staged.stderr || staged.stdout));
+		const committed = (await this.git([
+			"status",
+			"--porcelain",
+			"--",
+			settings.subdir
+		], {
+			cwd: this.store.mirror(),
+			signal
+		})).stdout.trim() !== "";
+		if (committed) {
+			const identity = await this.commitIdentity(settings, signal);
+			const result = await this.git([
+				...identity,
+				"commit",
+				"--quiet",
+				"-m",
+				message,
 				"--",
 				settings.subdir
 			], {
 				cwd: this.store.mirror(),
-				signal: input.signal
-			})).stdout.trim() !== "";
-			if (committed) {
-				const identity = [...settings.authorName === "" ? [] : ["-c", "user.name=" + settings.authorName], ...settings.authorEmail === "" ? [] : ["-c", "user.email=" + settings.authorEmail]];
-				const result = await this.git([
-					...identity,
-					"commit",
-					"--quiet",
-					"-m",
-					message,
-					"--",
-					settings.subdir
-				], {
-					cwd: this.store.mirror(),
-					signal: input.signal
-				});
-				if (result.exitCode !== 0) throw new Error("git commit failed: " + tail(result.stderr || result.stdout));
-			}
-			const head = await this.head(input.signal);
-			const published = committed ? await this.publish(settings, await this.credential(settings), input.signal) : {
-				pushed: false,
-				reason: prepared.tip === void 0 ? "nothing to publish" : "the branch already holds this payload"
-			};
-			const compaction = await this.compact(input.signal);
-			const summary = exported.manifest.summary.map((entry) => ({
-				...entry,
-				changed: componentChanged(before, entries, entry.component)
-			}));
+				signal
+			});
+			if (result.exitCode !== 0) throw new Error("git commit failed: " + tail(result.stderr || result.stdout));
+		}
+		const head = await this.head(signal);
+		const published = committed ? await this.publish(settings, await this.credential(settings), signal) : {
+			pushed: false,
+			reason: prepared.tip === void 0 ? "nothing to publish" : "the branch already holds this payload"
+		};
+		if (published.pushed || !committed && prepared.tip !== void 0) this.agree(settings, entries, head);
+		const compaction = await this.compact(signal);
+		const summary = exported.manifest.summary.map((entry) => ({
+			...entry,
+			changed: componentChanged(before, entries, entry.component)
+		}));
+		return {
+			repoUrl: settings.repoUrl,
+			branch: settings.branch,
+			subdir: settings.subdir,
+			commit: head,
+			committed,
+			message,
+			files: Object.keys(entries).length,
+			bytes: Object.values(entries).reduce((total, bytes) => total + bytes.byteLength, 0),
+			summary,
+			pushed: published.pushed,
+			...merged === void 0 ? {} : { merged },
+			...published.reason === void 0 ? {} : { reason: published.reason },
+			...published.failure === void 0 ? {} : { failure: published.failure },
+			...compaction === void 0 ? {} : { compaction }
+		};
+	}
+	/**
+	* The identity a sync commit is recorded under: the one configured here, else the
+	* Git identity this machine has. A machine without one gets the channel's own
+	* rather than a failed commit, and rather than the account and host names Git
+	* would otherwise guess and publish.
+	*/
+	async commitIdentity(settings, signal) {
+		const name = settings.authorName !== "" ? settings.authorName : await this.configured("user.name", signal) ?? "dsh-mnemon sync";
+		const email = settings.authorEmail !== "" ? settings.authorEmail : await this.configured("user.email", signal) ?? "mnemon@localhost";
+		return [
+			"-c",
+			"user.name=" + name,
+			"-c",
+			"user.email=" + email
+		];
+	}
+	/** One Git setting as this machine resolves it, or nothing when no config sets it. */
+	async configured(key, signal) {
+		const result = await this.git([
+			"config",
+			"--get",
+			key
+		], {
+			cwd: this.store.mirror(),
+			signal
+		});
+		const value = result.exitCode === 0 ? result.stdout.trim() : "";
+		return value === "" ? void 0 : value;
+	}
+	/** When memory last travelled through this channel, or nothing when it never did. */
+	lastRun() {
+		try {
+			const value = record$3(JSON.parse(readFileSync(this.lastRunPath(), "utf8")));
+			if (value === void 0 || typeof value.at !== "string" || typeof value.commit !== "string") return void 0;
+			if (value.kind !== "sync" && value.kind !== "merge") return void 0;
 			return {
-				repoUrl: settings.repoUrl,
-				branch: settings.branch,
-				subdir: settings.subdir,
-				commit: head,
-				committed,
-				message,
-				files: Object.keys(entries).length,
-				bytes: Object.values(entries).reduce((total, bytes) => total + bytes.byteLength, 0),
-				summary,
-				pushed: published.pushed,
-				...merged === void 0 ? {} : { merged },
-				...published.reason === void 0 ? {} : { reason: published.reason },
-				...compaction === void 0 ? {} : { compaction }
+				at: value.at,
+				kind: value.kind,
+				commit: value.commit,
+				pushed: value.pushed === true,
+				...typeof value.added === "number" && Number.isInteger(value.added) && value.added >= 0 ? { added: value.added } : {}
 			};
-		});
+		} catch {
+			return;
+		}
+	}
+	lastRunPath() {
+		return join(this.store.directory(), "sync", LAST_RUN_FILE);
+	}
+	basePath() {
+		return join(this.store.directory(), "sync", BASE_FILE);
+	}
+	/** The repository, branch and directory one agreement belongs to. */
+	agreementScope(settings) {
+		return sha256Hex(new TextEncoder().encode(JSON.stringify([
+			settings.repoUrl,
+			settings.branch,
+			settings.subdir
+		])));
+	}
+	/**
+	* Each document's version as this machine and the branch last agreed on it, after the last
+	* merge or publish, when that still describes the branch at `tip`: the same repository,
+	* branch and directory, agreed at a commit `tip` descends from. A branch deleted and published
+	* again from another history has none, nor has the first sync, and a merge then keeps a copy
+	* of every document that differs, as before.
+	*/
+	async agreedDocuments(settings, tip, signal) {
+		let value;
+		try {
+			value = record$3(JSON.parse(readFileSync(this.basePath(), "utf8")));
+		} catch {
+			return;
+		}
+		if (value?.version !== 1 || value.scope !== this.agreementScope(settings)) return void 0;
+		const documents = record$3(value.documents);
+		if (typeof value.commit !== "string" || !AGREED_COMMIT.test(value.commit) || documents === void 0) return void 0;
+		if ((await this.git([
+			"merge-base",
+			"--is-ancestor",
+			value.commit,
+			tip
+		], {
+			cwd: this.store.mirror(),
+			signal
+		})).exitCode !== 0) return void 0;
+		return Object.fromEntries(Object.entries(documents).filter(([, version]) => typeof version === "string" && /^[a-f0-9]{64}$/u.test(version)));
+	}
+	/** Remember what this machine and the branch at `commit` now agree on. Bookkeeping never fails the run it follows. */
+	agree(settings, files, commit) {
+		const path = this.basePath();
+		const temporary = path + "." + String(process.pid) + ".tmp";
+		try {
+			const documents = documentVersions(files);
+			if (documents === void 0 || !AGREED_COMMIT.test(commit)) {
+				rmSync(path, { force: true });
+				return;
+			}
+			mkdirSync(join(path, ".."), {
+				recursive: true,
+				mode: 448
+			});
+			writeFileSync(temporary, JSON.stringify({
+				version: 1,
+				scope: this.agreementScope(settings),
+				commit,
+				documents
+			}, null, 2) + "\n", { mode: 384 });
+			renameSync(temporary, path);
+		} catch {
+			rmSync(temporary, { force: true });
+		}
+	}
+	/** Remember one finished run. Bookkeeping never fails the run it describes. */
+	recordRun(run) {
+		const path = this.lastRunPath();
+		const temporary = path + "." + String(process.pid) + ".tmp";
+		try {
+			mkdirSync(join(path, ".."), {
+				recursive: true,
+				mode: 448
+			});
+			writeFileSync(temporary, JSON.stringify({
+				at: this.now().toISOString(),
+				...run
+			}, null, 2) + "\n", { mode: 384 });
+			renameSync(temporary, path);
+		} catch {
+			rmSync(temporary, { force: true });
+		}
 	}
 	/** Read the remote payload and report what it would change, without importing anything. */
 	async preview(signal) {
@@ -3855,7 +4617,7 @@ var MnemonGitSync = class {
 		const exported = await this.packs.exportPack("full");
 		return this.lock(async () => {
 			const remote = await this.readRemote(settings, signal);
-			if (remote === void 0) throw new Error(this.absentPayload(settings));
+			if (remote === void 0) throw this.absentPayload(settings);
 			const local = unpack(Buffer.from(exported.base64, "base64"));
 			const components = MNEMON_PACK_COMPONENTS.map((component) => {
 				const published = remote.manifest.summary.find((entry) => entry.component === component);
@@ -3930,7 +4692,7 @@ var MnemonGitSync = class {
 		const exported = await this.packs.exportPack("full");
 		return this.lock(async () => {
 			const remote = await this.readRemote(settings, signal);
-			if (remote === void 0) throw new Error(this.absentPayload(settings));
+			if (remote === void 0) throw this.absentPayload(settings);
 			const local = unpack(Buffer.from(exported.base64, "base64"));
 			const limits = this.runtimeLimits();
 			const mine = runtimeOf(local, limits, "the local");
@@ -4000,13 +4762,22 @@ var MnemonGitSync = class {
 		};
 		return this.lock(async () => {
 			const remote = await this.readRemote(settings, input.signal);
-			if (remote === void 0) throw new Error(this.absentPayload(settings));
+			if (remote === void 0) throw this.absentPayload(settings);
+			const base = await this.agreedDocuments(settings, remote.commit, input.signal);
 			const imported = await this.packs.importPack(Buffer.from(remote.archive).toString("base64"), {
 				...options,
 				tombstones: {
 					version: 1,
 					tombstones: remote.tombstones
-				}
+				},
+				...base === void 0 ? {} : { documentsBase: base }
+			});
+			if (imported.components.includes("documents")) this.agree(settings, remote.files, remote.commit);
+			this.recordRun({
+				kind: "merge",
+				commit: remote.commit,
+				pushed: false,
+				...imported.runtime === void 0 ? {} : { added: imported.runtime.added }
 			});
 			return {
 				imported: true,
@@ -4025,11 +4796,11 @@ var MnemonGitSync = class {
 		});
 	}
 	absentPayload(settings) {
-		return "the branch " + settings.branch + " holds no Mnemon payload at " + settings.subdir + " yet; push one first";
+		return new MnemonSyncError("remote-empty", "the branch " + settings.branch + " holds no Mnemon payload at " + settings.subdir + " yet; push one first");
 	}
 	requireRepository() {
 		const settings = this.store.read();
-		if (settings.repoUrl === void 0) throw new Error("no sync repository is configured; set repoUrl in " + this.store.path() + " first");
+		if (settings.repoUrl === void 0) throw new MnemonSyncError("no-repository", "no sync repository is configured; set repoUrl in " + this.store.path() + " first");
 		return {
 			...settings,
 			repoUrl: settings.repoUrl
@@ -4067,12 +4838,12 @@ var MnemonGitSync = class {
 	}
 	async requireGit(signal) {
 		const status = await this.gitStatus(signal);
-		if (!status.available) throw new Error("Git is not available on this Host: " + (status.issue ?? "unknown reason"));
+		if (!status.available) throw new MnemonSyncError("git-missing", "Git is not available on this Host: " + (status.issue ?? "unknown reason"));
 	}
 	async remoteStatus(settings, signal) {
 		const credential = await this.credential(settings);
 		try {
-			const tip = await this.lsRemote(settings, credential, signal);
+			const tip = await this.lsRemote(settings, credential, signal, MNEMON_SYNC_STATUS_TIMEOUT_MS);
 			return tip === void 0 ? {
 				reachable: true,
 				branchExists: false
@@ -4082,26 +4853,40 @@ var MnemonGitSync = class {
 				commit: tip
 			};
 		} catch (error) {
+			const message = this.mask(error instanceof Error ? error.message : String(error), credential);
 			return {
 				reachable: false,
 				branchExists: false,
-				error: this.mask(error instanceof Error ? error.message : String(error), credential)
+				error: message,
+				issue: remoteIssueOf(message)
 			};
 		}
 	}
-	async lsRemote(settings, credential, signal) {
+	/**
+	* The branch tip the remote holds, or nothing when it holds no such branch. A
+	* remote that cannot be read fails with the kind of failure it was, the token
+	* masked, so the page can say "sign in" rather than print Git's trace.
+	*/
+	async lsRemote(settings, credential, signal, timeoutMs) {
 		const reference = "refs/heads/" + settings.branch;
-		const result = await this.git([
-			"ls-remote",
-			"--heads",
-			settings.repoUrl,
-			reference
-		], {
-			signal,
-			token: credential.token,
-			authenticated: true
-		});
-		if (result.exitCode !== 0) throw new Error(tail(result.stderr || result.stdout) || "git ls-remote failed");
+		let result;
+		try {
+			result = await this.git([
+				"ls-remote",
+				"--heads",
+				settings.repoUrl,
+				reference
+			], {
+				signal,
+				token: credential.token,
+				authenticated: true,
+				...timeoutMs === void 0 ? {} : { timeoutMs }
+			});
+		} catch (error) {
+			if (signal?.aborted === true) throw error;
+			throw remoteFailure(this.mask(error instanceof Error ? error.message : String(error), credential));
+		}
+		if (result.exitCode !== 0) throw remoteFailure(this.mask(tail(result.stderr || result.stdout) || "git ls-remote failed", credential));
 		for (const line of result.stdout.split("\n")) {
 			const [commit, name] = line.trim().split(/\s+/u);
 			if (name === reference && commit !== void 0) return commit;
@@ -4218,6 +5003,20 @@ var MnemonGitSync = class {
 			recursive: true,
 			mode: 448
 		});
+		if (existsSync(join(mirror, ".git"))) {
+			const origin = await this.git([
+				"config",
+				"--get",
+				ORIGIN_KEY
+			], {
+				cwd: mirror,
+				signal
+			});
+			if (origin.exitCode !== 0 || origin.stdout.trim() !== settings.repoUrl) rmSync(mirror, {
+				recursive: true,
+				force: true
+			});
+		}
 		if (!existsSync(join(mirror, ".git"))) {
 			rmSync(mirror, {
 				recursive: true,
@@ -4226,10 +5025,18 @@ var MnemonGitSync = class {
 			const initialized = await this.git([
 				"init",
 				"--quiet",
-				"--initial-branch=" + settings.branch,
 				mirror
 			], { signal });
 			if (initialized.exitCode !== 0) throw new Error("git init failed: " + tail(initialized.stderr || initialized.stdout));
+			const marked = await this.git([
+				"config",
+				ORIGIN_KEY,
+				settings.repoUrl
+			], {
+				cwd: mirror,
+				signal
+			});
+			if (marked.exitCode !== 0) throw new Error("git config failed: " + tail(marked.stderr || marked.stdout));
 		}
 		const current = await this.git([
 			"symbolic-ref",
@@ -4250,8 +5057,10 @@ var MnemonGitSync = class {
 			});
 			if (renamed.exitCode !== 0) throw new Error("git symbolic-ref failed: " + tail(renamed.stderr || renamed.stdout));
 		}
-		const tip = await this.lsRemote(settings, credential, signal);
-		if (tip === void 0) return {};
+		if (await this.lsRemote(settings, credential, signal) === void 0) {
+			await this.startHistory(settings.branch, signal);
+			return {};
+		}
 		const fetched = await this.git([
 			"fetch",
 			"--no-tags",
@@ -4264,7 +5073,7 @@ var MnemonGitSync = class {
 			token: credential.token,
 			authenticated: true
 		});
-		if (fetched.exitCode !== 0) throw new Error("git fetch failed: " + this.mask(tail(fetched.stderr || fetched.stdout), credential));
+		if (fetched.exitCode !== 0) throw remoteFailure("git fetch failed: " + this.mask(tail(fetched.stderr || fetched.stdout), credential));
 		const reset = await this.git([
 			"reset",
 			"--hard",
@@ -4275,7 +5084,33 @@ var MnemonGitSync = class {
 			signal
 		});
 		if (reset.exitCode !== 0) throw new Error("git reset failed: " + tail(reset.stderr || reset.stdout));
-		return { tip };
+		return { tip: await this.head(signal) };
+	}
+	/**
+	* Point the mirror at a branch the remote does not hold. The next commit starts a
+	* history of its own: continuing the one this mirror kept, from a branch the remote
+	* has since deleted, would publish every earlier payload all over again.
+	*/
+	async startHistory(branch, signal) {
+		const mirror = this.store.mirror();
+		await this.git([
+			"update-ref",
+			"-d",
+			"refs/heads/" + branch
+		], {
+			cwd: mirror,
+			signal
+		});
+		const emptied = await this.git(["read-tree", "--empty"], {
+			cwd: mirror,
+			signal
+		});
+		if (emptied.exitCode !== 0) throw new Error("git read-tree failed: " + tail(emptied.stderr || emptied.stdout));
+		const cleaned = await this.git(["clean", "-fdxq"], {
+			cwd: mirror,
+			signal
+		});
+		if (cleaned.exitCode !== 0) throw new Error("git clean failed: " + tail(cleaned.stderr || cleaned.stdout));
 	}
 	/**
 	* The payload directory inside the mirror. A link where that directory or one of
@@ -4318,26 +5153,37 @@ var MnemonGitSync = class {
 	}
 	async publish(settings, credential, signal) {
 		const reference = "refs/heads/" + settings.branch + ":refs/heads/" + settings.branch;
-		const result = await this.git([
-			"push",
-			"--porcelain",
-			settings.repoUrl,
-			reference
-		], {
-			cwd: this.store.mirror(),
-			signal,
-			token: credential.token,
-			authenticated: true
-		});
+		let result;
+		try {
+			result = await this.git([
+				"push",
+				"--porcelain",
+				settings.repoUrl,
+				reference
+			], {
+				cwd: this.store.mirror(),
+				signal,
+				token: credential.token,
+				authenticated: true
+			});
+		} catch (error) {
+			if (signal?.aborted === true) throw error;
+			const reason = this.mask(error instanceof Error ? error.message : String(error), credential);
+			const failure = REMOTE_FAILURE[remoteIssueOf(reason)];
+			return {
+				pushed: false,
+				reason,
+				...failure === void 0 ? {} : { failure }
+			};
+		}
 		if (result.exitCode === 0) return { pushed: true };
-		const reason = this.mask(tail(result.stderr || result.stdout), credential);
-		if (credential.token === void 0) return {
-			pushed: false,
-			reason: "the commit stays local because no token is available: " + (reason || "git push failed")
-		};
+		const output = this.mask(result.stdout + "\n" + result.stderr, credential);
+		const reason = this.mask(tail(result.stderr || result.stdout), credential) || "git push failed";
+		const failure = rejectedPush(output) ? "push-rejected" : REMOTE_FAILURE[remoteIssueOf(output)];
 		return {
 			pushed: false,
-			reason: reason || "git push failed"
+			reason: credential.token === void 0 && failure !== "push-rejected" ? "the commit stays local because no token is available: " + reason : reason,
+			...failure === void 0 ? {} : { failure }
 		};
 	}
 	/**
@@ -4410,9 +5256,12 @@ var MnemonGitSync = class {
 			};
 		}
 	}
-	/** Validate the remote payload and rebuild the exact pack archive the ZIP path would have produced. */
+	/** Refresh the mirror, then read the payload the branch holds. */
 	async readRemote(settings, signal) {
-		const prepared = await this.ensureMirror(settings, signal);
+		return this.readPrepared(settings, await this.ensureMirror(settings, signal));
+	}
+	/** Validate the payload a refreshed mirror holds and rebuild the exact pack archive the ZIP path would have produced. */
+	async readPrepared(settings, prepared) {
 		if (prepared.tip === void 0) return void 0;
 		const files = readFiles(this.payloadRoot(settings.subdir));
 		const manifestBytes = files[MANIFEST];
@@ -4465,13 +5314,36 @@ var MnemonGitSync = class {
 			recursive: true,
 			mode: 448
 		});
-		return withDirectoryLock(join(this.store.directory(), ".sync.lock"), operation);
+		return withDirectoryLock(join(this.store.directory(), ".sync.lock"), async () => {
+			this.sweepCredentials();
+			return operation();
+		});
+	}
+	/**
+	* Remove the one-command credential files a Host that stopped mid-command left
+	* behind. Each holds a token, so one whose process is gone is deleted rather
+	* than kept until the next restart of that process id.
+	*/
+	sweepCredentials() {
+		let names;
+		try {
+			names = readdirSync(this.store.directory());
+		} catch {
+			return;
+		}
+		for (const name of names) {
+			const match = /^\.credentials\.(\d+)\.\d+\.tmp$/u.exec(name);
+			if (match === null) continue;
+			const pid = Number(match[1]);
+			if (pid === process.pid || processAlive(pid)) continue;
+			rmSync(join(this.store.directory(), name), { force: true });
+		}
 	}
 	async git(args, options) {
 		const prepared = this.credentials(args, options);
 		try {
 			return await this.run(GIT_LABEL, prepared.args, {
-				timeoutMs: MNEMON_SYNC_GIT_TIMEOUT_MS,
+				timeoutMs: options.timeoutMs ?? 12e4,
 				env: gitEnvironment(),
 				...options.cwd === void 0 ? {} : { cwd: options.cwd },
 				...options.signal === void 0 ? {} : { signal: options.signal },
@@ -4520,11 +5392,17 @@ var MnemonGitSync = class {
 		};
 	}
 };
+/**
+* How the payload files differ. The manifest and the checksum inventory describe a
+* payload rather than hold memory, and the manifest's export time differs on every
+* read, so counting them would report a difference where every component agrees.
+*/
 function compareFiles(published, local) {
 	let changed = 0;
 	let added = 0;
 	let removed = 0;
-	for (const path of /* @__PURE__ */ new Set([...Object.keys(published), ...Object.keys(local)])) {
+	const paths = new Set([...Object.keys(published), ...Object.keys(local)].filter((path) => path !== MANIFEST && path !== CHECKSUMS));
+	for (const path of paths) {
 		const remote = published[path];
 		const mine = local[path];
 		if (remote === void 0) added += 1;
@@ -4532,13 +5410,46 @@ function compareFiles(published, local) {
 		else if (sha256Hex(remote) !== sha256Hex(mine)) changed += 1;
 	}
 	return {
-		total: (/* @__PURE__ */ new Set([...Object.keys(published), ...Object.keys(local)])).size,
+		total: paths.size,
 		changed,
 		added,
 		removed
 	};
 }
-/** A single-writer lock for one storage root's sync work; the pack locks cover the shared data. */
+/** Whether a process of this machine still runs; one the Host may not signal is assumed alive. */
+function processAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+/**
+* Whether a lock was left by an operation that can no longer release it: its owner
+* process is gone, or it is older than any sync takes. The age also covers a
+* process id that a restart handed to an unrelated process.
+*/
+function abandoned(path, now) {
+	let age;
+	try {
+		age = now - statSync(path).mtimeMs;
+	} catch {
+		return false;
+	}
+	if (age > STALE_LOCK_MS) return true;
+	try {
+		const pid = record$3(JSON.parse(readFileSync(join(path, LOCK_OWNER), "utf8")))?.pid;
+		return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && pid !== process.pid && !processAlive(pid);
+	} catch {
+		return age > OWNERLESS_LOCK_MS;
+	}
+}
+/**
+* A single-writer lock for one storage root's sync work; the pack locks cover the
+* shared data. The lock records its owner, so a Host that stopped mid-operation
+* does not leave every later sync refused until someone deletes the directory.
+*/
 async function withDirectoryLock(path, operation) {
 	const deadline = Date.now() + LOCK_TIMEOUT_MS;
 	let held = false;
@@ -4549,9 +5460,28 @@ async function withDirectoryLock(path, operation) {
 		});
 		held = true;
 	} catch {
+		if (abandoned(path, Date.now())) {
+			const aside = path + ".abandoned." + String(process.pid) + "." + String(Date.now());
+			try {
+				if (abandoned(path, Date.now())) renameSync(path, aside);
+			} catch {
+				continue;
+			}
+			rmSync(aside, {
+				recursive: true,
+				force: true
+			});
+			continue;
+		}
 		await new Promise((resolveReady) => setTimeout(resolveReady, 25));
 	}
-	if (!held) throw new Error("another Mnemon sync operation is still running");
+	if (!held) throw new MnemonSyncError("busy", "another Mnemon sync operation is still running");
+	try {
+		writeFileSync(join(path, LOCK_OWNER), JSON.stringify({
+			pid: process.pid,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString()
+		}) + "\n", { mode: 384 });
+	} catch {}
 	try {
 		return await operation();
 	} finally {
@@ -5499,6 +6429,22 @@ function createRuntimeGraph(config, workspaceRoot, extensions) {
 		}
 	};
 }
+/**
+* When the Host asks a data directory's Providers again for namespaces they gained (#373): a
+* little after a runtime starts serving it, then, while a try cannot reach the Source, after
+* `retryDelayMs`, `attempts` tries in all. Tests shorten these.
+*/
+const PROVIDER_REDISCOVERY_TIMING = {
+	delayMs: 1e4,
+	retryDelayMs: 3e4,
+	attempts: 3
+};
+/** Data directories whose Provider namespaces this process has asked for again, or is asking now. */
+const rediscoveredDirectories = /* @__PURE__ */ new Set();
+/** An answer asking again cannot change: no Memory Spaces Source, or one older than this request. */
+function finalRediscoveryAnswer(error) {
+	return /unsupported Memory Spaces management mutation operation|is not installed/u.test(error instanceof Error ? error.message : String(error));
+}
 /** Resolve every property access against one generation, binding methods to it. */
 function liveProxy(resolve) {
 	return new Proxy({}, {
@@ -5537,6 +6483,8 @@ var LiveMnemonRuntime = class {
 	workspaceGraphs = /* @__PURE__ */ new Map();
 	agentGraphs = /* @__PURE__ */ new Map();
 	retiredGraphs = /* @__PURE__ */ new Set();
+	/** The start-up rediscovery each graph has waiting or running, to stop when the graph goes. */
+	rediscoveries = /* @__PURE__ */ new Map();
 	githubAuth;
 	autoBackupView;
 	closed = false;
@@ -5555,6 +6503,7 @@ var LiveMnemonRuntime = class {
 		this.packs = liveProxy(() => this.current.packs);
 		this.sync = liveProxy(() => this.current.sync);
 		this.reviews = liveProxy(() => this.current.reviews);
+		this.rediscoverProviders(initial);
 	}
 	/**
 	* Share one GitHub sign-in with every generation this runtime builds. The
@@ -5589,6 +6538,7 @@ var LiveMnemonRuntime = class {
 		this.current = next;
 		this.applyGitHubAuth(next);
 		this.applyAutoBackup(next);
+		this.rediscoverProviders(next);
 		this.retireGraph(previous);
 		for (const graph of this.workspaceGraphs.values()) this.retireGraph(graph);
 		this.workspaceGraphs.clear();
@@ -5626,6 +6576,8 @@ var LiveMnemonRuntime = class {
 		this.agentGraphs.clear();
 		this.workspaceGraphs.clear();
 		this.retiredGraphs.clear();
+		for (const stop of this.rediscoveries.values()) stop();
+		this.rediscoveries.clear();
 		for (const graph of graphs) graph.dispose();
 	}
 	/** Resolve the runtime that must serve one Agent execution. */
@@ -5674,11 +6626,64 @@ var LiveMnemonRuntime = class {
 			graph = createRuntimeGraph(this.current.config, key, this.extensions);
 			this.applyGitHubAuth(graph);
 			this.applyAutoBackup(graph);
+			this.rediscoverProviders(graph);
 			this.workspaceGraphs.set(key, graph);
 		}
 		return graph;
 	}
+	/**
+	* Ask the Providers of one data directory again for namespaces they gained, once per process,
+	* a little after a runtime this Host serves starts (#373); a graph built only to validate
+	* settings never asks. A read-only runtime asks nothing, and neither does one whose Memory
+	* Spaces layer is off or does not maintain itself automatically. A try that cannot reach the
+	* Source, before a generation serves for example, is made again a little later; one cut short
+	* because its runtime was replaced is left to the runtime that replaced it.
+	*/
+	rediscoverProviders(graph) {
+		if (!graph.config.writeEnabled || !allowsParticipation(graph.config, "memory-spaces", "maintain", "automatic")) return;
+		const directory = resolve(graph.directory);
+		const controller = new AbortController();
+		let timer;
+		let running = false;
+		const release = () => {
+			if (this.rediscoveries.get(graph) === stop) this.rediscoveries.delete(graph);
+		};
+		const schedule = (attempt, delayMs) => {
+			timer = setTimeout(() => void ask(attempt), delayMs);
+			timer.unref?.();
+		};
+		const ask = async (attempt) => {
+			timer = void 0;
+			if (rediscoveredDirectories.has(directory)) return release();
+			rediscoveredDirectories.add(directory);
+			running = true;
+			let again = false;
+			try {
+				await graph.source("memory-spaces").mutate("provider-rediscover", { trigger: "startup" }, controller.signal);
+			} catch (error) {
+				again = !finalRediscoveryAnswer(error);
+			} finally {
+				running = false;
+			}
+			if (controller.signal.aborted) return;
+			if (again) {
+				rediscoveredDirectories.delete(directory);
+				if (attempt < PROVIDER_REDISCOVERY_TIMING.attempts) return schedule(attempt + 1, PROVIDER_REDISCOVERY_TIMING.retryDelayMs);
+			}
+			release();
+		};
+		const stop = () => {
+			if (timer !== void 0) clearTimeout(timer);
+			if (running) rediscoveredDirectories.delete(directory);
+			controller.abort(/* @__PURE__ */ new Error("the Mnemon runtime was replaced"));
+		};
+		this.rediscoveries.get(graph)?.();
+		this.rediscoveries.set(graph, stop);
+		schedule(1, PROVIDER_REDISCOVERY_TIMING.delayMs);
+	}
 	retireGraph(graph) {
+		this.rediscoveries.get(graph)?.();
+		this.rediscoveries.delete(graph);
 		graph.retire();
 		if ([...this.agentGraphs.values()].some((binding) => binding.graph === graph)) this.retiredGraphs.add(graph);
 		else graph.dispose();
@@ -11056,12 +12061,13 @@ function success$1(value) {
 	};
 }
 function failure$1(error) {
+	const reason = error instanceof Error ? error.reason : void 0;
 	return {
 		ok: false,
 		error: {
 			code: "internal",
 			message: error instanceof Error ? error.message : String(error),
-			details: {}
+			details: typeof reason === "string" ? { reason } : {}
 		}
 	};
 }