mixdog 1.3.0 → 1.3.2

package/src/runtime/shared/user-cwd.mjs

@@ -20,9 +20,10 @@
  */
 
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { readFileSync, statSync, writeFileSync } from 'node:fs';
+import { readFileSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
+import { holdsNoData, writeFileAtomicSync } from './atomic-file.mjs';
 import { resolvePluginData, mixdogRoot } from './plugin-paths.mjs';
 
 const _cwdOverride = new AsyncLocalStorage();
@@ -112,7 +113,10 @@ export function explicitSessionCwd() {
     if (sessionDir) return sessionDir;
   }
   try {
-    const txt = readFileSync(_dataFile('user-cwd.txt'), 'utf8').trim();
+    const raw = readFileSync(_dataFile('user-cwd.txt'), 'utf8');
+    // A crash can leave NUL bytes in place of the path: that is no path.
+    if (holdsNoData(raw)) return null;
+    const txt = raw.trim();
     return (txt && _normalizePlatformCwd(txt)) || null;
   } catch {
     return null;
@@ -173,7 +177,7 @@ function _lastSessionCwdFile(keyPid) {
  */
 export function writeLastSessionCwd(cwd, keyPid) {
   try {
-    writeFileSync(_lastSessionCwdFile(keyPid), String(cwd));
+    writeFileAtomicSync(_lastSessionCwdFile(keyPid), String(cwd));
   } catch {
     /* best-effort */
   }
@@ -188,7 +192,8 @@ export function writeLastSessionCwd(cwd, keyPid) {
  */
 export function readLastSessionCwd(keyPid) {
   try {
-    return _existingDirectory(readFileSync(_lastSessionCwdFile(keyPid), 'utf8').trim());
+    const raw = readFileSync(_lastSessionCwdFile(keyPid), 'utf8');
+    return holdsNoData(raw) ? null : _existingDirectory(raw.trim());
   } catch {
     return null;
   }

package/src/runtime/shared/user-data-guard.mjs

@@ -1,23 +1,15 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
 import {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  rmSync,
-  statSync,
-  writeFileSync,
-} from 'node:fs';
-import {
-  copyFile as copyFileP,
   mkdir as mkdirP,
+  readFile as readFileP,
   readdir as readdirP,
   rm as rmP,
   stat as statP,
 } from 'node:fs/promises';
-import { basename, dirname, join, resolve } from 'node:path';
+import { basename, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { createHash, randomUUID } from 'node:crypto';
+import { writeFileAtomicAsync, writeFileAtomicSync, writeJsonAtomicSync } from './atomic-file.mjs';
 import { isPlainObject } from './object.mjs';
 import { mixdogHome } from './plugin-paths.mjs';
 
@@ -155,15 +147,27 @@ function safeReason(reason) {
   );
 }
 
-/** instanceId of this data dir's init marker; null when absent or unreadable. */
+/** instanceId of this data dir's init marker; null only when absent. */
 function readInitInstanceId(dataDir) {
   if (!dataDir) return null;
+  const path = join(dataDir, INIT_MARKER);
+  let raw;
   try {
-    const marker = JSON.parse(readFileSync(join(dataDir, INIT_MARKER), 'utf8'));
-    return typeof marker?.instanceId === 'string' && marker.instanceId ? marker.instanceId : null;
-  } catch {
-    return null;
+    raw = readFileSync(path, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+  let marker;
+  try {
+    marker = JSON.parse(raw);
+  } catch (error) {
+    throw new SyntaxError(`[user-data] invalid initialization marker at ${path}`, { cause: error });
+  }
+  if (typeof marker?.instanceId !== 'string' || !marker.instanceId) {
+    throw new SyntaxError(`[user-data] initialization marker at ${path} must have a non-empty instanceId`);
   }
+  return marker.instanceId;
 }
 
 export function hasUserDataInitMarker(dataDir) {
@@ -379,8 +383,9 @@ function copyTree(src, dst, copied) {
     return;
   }
   if (!st.isFile()) return;
-  mkdirSync(dirname(dst), { recursive: true });
-  copyFileSync(src, dst);
+  // A copy goes through an fsynced handle: a plain copy can leave a backup that
+  // is NUL exactly when a crash makes it needed.
+  writeFileAtomicSync(dst, readFileSync(src), { mode: st.mode & 0o777 });
   copied.push(dst);
 }
 
@@ -394,22 +399,20 @@ function pruneBackups(scopeDir, names, own) {
 }
 
 /**
- * Create the data dir's init marker unless one exists; returns its instanceId
- * (null when the data dir is gone or unwritable). Never creates the data dir.
+ * Create a missing init marker; return its instanceId, or null if the data dir
+ * is gone or the missing marker cannot be created. Never creates the data dir.
+ * Read/validation failures throw; an existing marker is never replaced.
  */
 export function markUserDataInitialized(dataDir) {
   const existing = readInitInstanceId(dataDir);
   if (existing || !dataDir || !existsSync(dataDir)) return existing;
   try {
-    writeFileSync(
-      join(dataDir, INIT_MARKER),
-      `${JSON.stringify(
-        { instanceId: randomUUID(), dataDir: resolve(dataDir), createdAt: new Date().toISOString() },
-        null,
-        2
-      )}\n`,
-      // An unreadable marker is replaced; a concurrent creator's valid one wins.
-      { encoding: 'utf8', flag: existsSync(join(dataDir, INIT_MARKER)) ? 'w' : 'wx' }
+    const marker = join(dataDir, INIT_MARKER);
+    writeJsonAtomicSync(
+      marker,
+      { instanceId: randomUUID(), dataDir: resolve(dataDir), createdAt: new Date().toISOString() },
+      // Another creator may have published since the absent read; it wins.
+      { createOnly: true }
     );
   } catch {}
   return readInitInstanceId(dataDir);
@@ -427,8 +430,8 @@ export function ensureUserDataInitialized(dataDir) {
   if (!dataDir) return;
   const key = normalizeDataDir(dataDir);
   if (ensuredDataDirs.has(key)) return;
-  ensuredDataDirs.add(key);
   if (!hasUserDataInitMarker(dataDir)) backupUserData(dataDir, 'initial-snapshot');
+  ensuredDataDirs.add(key);
 }
 
 function skipBackups() {
@@ -439,20 +442,20 @@ function skipBackups() {
 // manifest goes last, so an interrupted copy is never restorable.
 function finishBackup(dataDir, backupDir, reason) {
   const instanceId = markUserDataInitialized(dataDir);
-  writeFileSync(
-    join(backupDir, BACKUP_MANIFEST),
-    `${JSON.stringify(
-      { dataDir: resolve(dataDir), instanceId, reason, createdAt: new Date().toISOString() },
-      null,
-      2
-    )}\n`,
-    'utf8'
-  );
+  writeJsonAtomicSync(join(backupDir, BACKUP_MANIFEST), {
+    dataDir: resolve(dataDir),
+    instanceId,
+    reason,
+    createdAt: new Date().toISOString(),
+  });
   restoreLookupCache.delete(normalizeDataDir(dataDir));
   legacyEvidenceCache.delete(normalizeDataDir(dataDir));
 }
 
-export function backupUserData(dataDir, reason = 'snapshot') {
+/** `dirs`: more data-dir folders this one snapshot also carries (a one-time
+ *  migration's, e.g. agents/ and bots/); routine snapshots keep to
+ *  USER_DATA_DIRS so the ring stays small. */
+export function backupUserData(dataDir, reason = 'snapshot', { dirs = [] } = {}) {
   if (skipBackups()) return { dir: null, copied: [] };
   if (!dataDir || !existsSync(dataDir)) return { dir: null, copied: [] };
   const scopeDir = scopeDirFor(dataDir);
@@ -462,7 +465,7 @@ export function backupUserData(dataDir, reason = 'snapshot') {
     const src = join(dataDir, rel);
     if (existsSync(src)) copyTree(src, join(backupDir, rel), copied);
   }
-  for (const rel of USER_DATA_DIRS) {
+  for (const rel of [...USER_DATA_DIRS, ...dirs]) {
     const src = join(dataDir, rel);
     if (existsSync(src)) copyTree(src, join(backupDir, rel), copied);
   }
@@ -491,8 +494,7 @@ async function copyTreeAsync(src, dst, copied) {
     return;
   }
   if (!st.isFile()) return;
-  await mkdirP(dirname(dst), { recursive: true });
-  await copyFileP(src, dst);
+  await writeFileAtomicAsync(dst, await readFileP(src), { mode: st.mode & 0o777 });
   copied.push(dst);
 }
 

package/src/runtime/shared/utf8-cut.mjs

@@ -0,0 +1,10 @@
+/**
+ * `text` without its trailing U+FFFD characters: what a byte cut through a
+ * multi-byte sequence leaves behind. A loop, not `/\uFFFD+$/`, which is
+ * quadratic on a long run of them.
+ */
+export function stripTrailingReplacementChars(text) {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === '\uFFFD') end -= 1;
+  return end === text.length ? text : text.slice(0, end);
+}

package/src/runtime/shared/worktrees/activity-gate.mjs

@@ -1,13 +1,21 @@
 import { randomUUID } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
 import { setTimeout as delay } from 'node:timers/promises';
-import { readFileSync, renameSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
-import { withFileLockSync, writeJsonAtomicSync } from '../atomic-file.mjs';
+import {
+  parseJsonText,
+  quarantinePath,
+  readJsonStateSync,
+  unsupportedState,
+  updateJsonAtomicSync,
+  writeFileAtomicSync,
+  writeJsonAtomicSync,
+} from '../atomic-file.mjs';
 import { isPidAliveOrUnknown } from '../pid-liveness.mjs';
 import { findGitLayout } from './git-head.mjs';
 import { canonicalPath, isWithin, samePath } from './paths.mjs';
 import { worktreeError, worktreeRefusal } from './contract.mjs';
-import { registryPath } from './registry.mjs';
+import { readRegistrySync } from './registry.mjs';
 
 const FILE = 'mixdog-workspace-admission.json';
 const overlaps = (a, b) => isWithin(a, b) || isWithin(b, a);
@@ -24,91 +32,273 @@ export function isExternalCheckout(folder) {
   if (!layout || samePath(layout.gitDir, layout.commonDir)) return false;
   let entries;
   try {
-    entries = JSON.parse(readFileSync(registryPath(), 'utf8'))?.entries ?? {};
-  } catch (error) {
-    if (error?.code !== 'ENOENT') throw worktreeRefusal('workspace-admission-unreadable');
-    entries = {};
+    entries = readRegistrySync().entries;
+  } catch {
+    // A damaged registry is kept aside and reads as a restored or empty one;
+    // only a real I/O failure (access denied, in use) lands here.
+    throw worktreeRefusal('workspace-admission-unreadable');
   }
   return !Object.values(entries).some(
     (record) => typeof record?.path === 'string' && samePath(record.path, layout.topLevel)
   );
 }
 
+const VERSION = 1;
+const UNRECORDED = Symbol('unrecorded');
+const emptyLedger = () => ({ version: VERSION, leases: [] });
+const isNewer = (state) => Number.isSafeInteger(state?.version) && state.version > VERSION;
+const isLease = (lease) =>
+  !!lease &&
+  ['turn', 'command', 'management'].includes(lease.kind) &&
+  typeof lease.token === 'string' &&
+  Number.isSafeInteger(lease.pid) &&
+  lease.pid > 0 &&
+  typeof lease.path === 'string' &&
+  isAbsolute(lease.path);
+const hasLedgerShape = (state) => state?.version === VERSION && Array.isArray(state.leases);
+
+// The whole-file check: a newer build's ledger is intact data in a format this
+// build cannot honour (left in place), anything else off-shape is damage. One
+// bad lease record is not a damaged file; mutate() drops just that record.
+function validateLedger(state) {
+  if (isNewer(state)) throw unsupportedState('Workspace admission ledger was written by a newer build.');
+  if (!hasLedgerShape(state)) throw new TypeError('Workspace admission ledger is malformed.');
+  return state;
+}
+
+const refuseUnreadable = () => {
+  throw worktreeRefusal('workspace-admission-unreadable');
+};
+const envMs = (name, fallback) => {
+  const value = Number(process.env[name]);
+  return Number.isFinite(value) && value > 0 ? value : fallback;
+};
+// How long the leases of a recovered ledger stay unknown. Every process
+// holding a lease republishes it within one heal period, so after this window
+// the ledger is whole again and destructive operations resume on their own.
+const recoveryWindowMs = () => envMs('MIXDOG_ADMISSION_RECOVERY_MS', 15_000);
+const healIntervalMs = () => envMs('MIXDOG_ADMISSION_HEAL_MS', 2_000);
+
+// A path that cannot be read at all (access denied, in use, a directory) is an
+// I/O failure, not damage: it refuses everything and is never touched.
+function assertLedgerReadable(path) {
+  try {
+    readFileSync(path);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw worktreeRefusal('workspace-admission-unreadable');
+  }
+}
+
 /**
- * Reads the ledger under its lock. A missing ledger is empty. A ledger that is
- * not JSON is a torn write (a crash or power loss after the rename committed
- * the file's size but not its bytes leaves it NUL-filled on NTFS): nothing in
- * it can be recovered and every lease it held belongs to a process that died
- * with it, so refusing forever would only lock the project out. It is moved
- * aside as `<FILE>.corrupt-<time>` for inspection and admission starts over
- * empty. A ledger that cannot be read at all (permissions, I/O, a directory in
- * its place) is not an empty one and still refuses, as does one that moves
- * aside unsuccessfully: an unreadable file is never overwritten.
+ * A damaged ledger (NUL, truncated, malformed) must not block every prompt and
+ * shell command of the workspace, nor may it make a destructive operation fail
+ * open. Called under the ledger lock: its bytes are COPIED aside as
+ * `<ledger>.corrupt-<ts>` and the same locked update replaces it with a ledger
+ * carrying `recoveredAt`. The ledger is never moved away: a missing ledger
+ * reads as "no leases", so any gap between the move and the publish (another
+ * process taking the lock, or a crash) would admit management beside a live
+ * foreign turn. A crash before the publish leaves the damaged file in place,
+ * which the next writer recovers the same way. If the copy cannot be kept the
+ * ledger is left untouched and everything refuses.
  */
-function readLedger(path) {
-  let text;
+function keepDamagedAside(path) {
+  const aside = quarantinePath(path);
   try {
-    text = readFileSync(path, 'utf8');
-  } catch (error) {
-    if (error?.code === 'ENOENT') return { version: 1, leases: [] };
+    writeFileAtomicSync(aside, readFileSync(path));
+  } catch {
     throw worktreeRefusal('workspace-admission-unreadable');
   }
+  process.stderr.write(`[state] ${path} is damaged; kept as ${aside}\n`);
+}
+
+function keepAside(path, value) {
+  const aside = quarantinePath(path);
+  try {
+    writeFileAtomicSync(aside, JSON.stringify(value));
+    process.stderr.write(`[state] ${path} held invalid lease records; kept as ${aside}\n`);
+  } catch {
+    // Best effort: the valid records carry on either way.
+  }
+}
+
+const aliveLease = (lease) => isPidAliveOrUnknown(lease.pid);
+
+// Management leases live in a mirror file as well as the ledger: damage to
+// one never hides an operation in progress from the readers.
+function readMirror(mirror) {
   try {
-    return JSON.parse(text);
+    const state = readJsonStateSync(mirror, { validate: validateLedger, strictOwner: true });
+    return (state?.leases ?? []).filter((lease) => isLease(lease) && lease.kind === 'management' && aliveLease(lease));
   } catch {
+    return [];
+  }
+}
+
+function writeMirror(mirror, leases) {
+  try {
+    writeJsonAtomicSync(mirror, { version: VERSION, leases }, { compact: true });
+  } catch (error) {
+    process.stderr.write(`[state] ${mirror} could not be written (${error?.message})\n`);
+  }
+}
+
+// Leases this process holds, republished into any ledger that lost them.
+const held = new Map();
+let healTimer = null;
+
+// A management hold shares one token across its folders, so a lease is
+// identified by token and path.
+const leaseKey = (lease) => `${lease.token}\0${lease.path}`;
+
+function track(commonDir, lease) {
+  held.set(leaseKey(lease), { commonDir, lease });
+  healTimer ??= setInterval(healHeld, healIntervalMs());
+  healTimer.unref?.();
+}
+
+function untrack(token) {
+  for (const [key, { lease }] of held) if (lease.token === token) held.delete(key);
+  if (!held.size && healTimer) {
+    clearInterval(healTimer);
+    healTimer = null;
+  }
+}
+
+function ledgerLacks(commonDir, keys) {
+  let state;
+  try {
+    state = parseJsonText(readFileSync(join(commonDir, FILE), 'utf8'));
+  } catch (error) {
+    return error?.code === 'ENOENT' || error instanceof SyntaxError;
+  }
+  if (isNewer(state)) return false;
+  if (!hasLedgerShape(state)) return true;
+  const stored = new Set(state.leases.filter(Boolean).map(leaseKey));
+  return keys.some((key) => !stored.has(key));
+}
+
+function healHeld() {
+  const byDir = new Map();
+  for (const [key, { commonDir }] of held) byDir.set(commonDir, [...(byDir.get(commonDir) ?? []), key]);
+  for (const [commonDir, keys] of byDir) {
+    if (!ledgerLacks(commonDir, keys)) continue;
     try {
-      renameSync(path, `${path}.corrupt-${Date.now()}`);
+      mutate(
+        commonDir,
+        () => {},
+        () => {}
+      );
     } catch {
-      throw worktreeRefusal('workspace-admission-unreadable');
+      // Retried on the next tick.
     }
-    return { version: 1, leases: [] };
   }
 }
 
-function mutate(commonDir, update) {
+/**
+ * Runs `update(leases, { unknown })` under the ledger lock. `unknown`: the
+ * ledger was recovered recently and may be missing other processes' leases.
+ * `onNewer` answers for a ledger of a newer build, which is left untouched:
+ * it refuses by default; readers pass an answer that admits them unrecorded.
+ */
+function mutate(commonDir, update, onNewer = refuseUnreadable) {
   const path = join(commonDir, FILE);
-  return withFileLockSync(
-    `${path}.lock`,
-    () => {
-      const state = readLedger(path);
-      if (
-        state?.version !== 1 ||
-        !Array.isArray(state.leases) ||
-        state.leases.some(
-          (lease) =>
-            !lease ||
-            !['turn', 'command', 'management'].includes(lease.kind) ||
-            typeof lease.token !== 'string' ||
-            !Number.isSafeInteger(lease.pid) ||
-            lease.pid <= 0 ||
-            typeof lease.path !== 'string' ||
-            !isAbsolute(lease.path)
-        )
-      ) {
-        throw worktreeRefusal('workspace-admission-unreadable');
+  const mirror = `${path}.management`;
+  assertLedgerReadable(path);
+  let result;
+  let refusal = null;
+  updateJsonAtomicSync(
+    path,
+    (current) => {
+      if (isNewer(current)) {
+        result = onNewer();
+        return undefined;
+      }
+      const now = Date.now();
+      let state;
+      let recovered = false;
+      if (current === null) {
+        state = emptyLedger();
+        // `keepWithoutBackup` leaves a ledger whose text does not parse in
+        // place, so null with a file present is damage; no file is a new ledger.
+        if (existsSync(path)) {
+          keepDamagedAside(path);
+          recovered = true;
+        }
+      } else if (!hasLedgerShape(current)) {
+        keepAside(path, current);
+        state = emptyLedger();
+        recovered = true;
+      } else {
+        state = { ...current, leases: current.leases.filter(isLease) };
+        if (state.leases.length !== current.leases.length) {
+          keepAside(path, current);
+          recovered = true;
+        }
       }
+      if (recovered) state.recoveredAt = now;
       // Only a pid PROVEN dead (ESRCH) drops its lease, whatever its kind; an
       // unprobeable pid still counts as running. A live runtime keeps a command
       // whose tree it cannot verify reserved under its own (live) pid until the
       // tree is confirmed gone, so a lease that outlives every pid belongs to a
       // restarted runtime that can no longer release it.
-      state.leases = state.leases.filter((lease) => isPidAliveOrUnknown(lease.pid));
-      const result = update(state.leases);
-      writeJsonAtomicSync(path, state, { lock: false });
-      return result;
+      state.leases = state.leases.filter(aliveLease);
+      const present = new Set(state.leases.map(leaseKey));
+      const restore = [
+        ...(recovered ? readMirror(mirror) : []),
+        ...[...held.values()].filter((own) => own.commonDir === commonDir).map((own) => own.lease),
+      ];
+      for (const lease of restore) {
+        if (present.has(leaseKey(lease)) || !aliveLease(lease)) continue;
+        present.add(leaseKey(lease));
+        state.leases.push(lease);
+      }
+      const unknown = Number.isFinite(state.recoveredAt) && now - state.recoveredAt < recoveryWindowMs();
+      if (!unknown) delete state.recoveredAt;
+      const managementTokens = () =>
+        state.leases
+          .filter((lease) => lease.kind === 'management')
+          .map((lease) => lease.token)
+          .join();
+      const before = managementTokens();
+      const unchanged = [...state.leases];
+      try {
+        result = update(state.leases, { unknown });
+      } catch (error) {
+        // A refusal still publishes the recovery: dropping the write would
+        // leave the damaged file, and every retry would recover it again and
+        // restart the window, so management would never resume.
+        if (!recovered) throw error;
+        refusal = error;
+        state.leases = unchanged;
+      }
+      if (recovered || managementTokens() !== before) {
+        writeMirror(
+          mirror,
+          state.leases.filter((lease) => lease.kind === 'management')
+        );
+      }
+      return state;
     },
-    { strictOwner: true }
+    // No backup restore: an older ledger would resurrect leases long released.
+    { strictOwner: true, keepWithoutBackup: true, restoreBackup: false }
   );
+  if (refusal) throw refusal;
+  return result;
 }
 
 function release(commonDir, token) {
   let done = false;
   return () => {
     if (done) return;
-    mutate(commonDir, (leases) => {
-      for (let i = leases.length - 1; i >= 0; i--) if (leases[i].token === token) leases.splice(i, 1);
-    });
+    mutate(
+      commonDir,
+      (leases) => {
+        for (let i = leases.length - 1; i >= 0; i--) if (leases[i].token === token) leases.splice(i, 1);
+      },
+      () => {}
+    );
     done = true;
+    untrack(token);
   };
 }
 
@@ -123,12 +313,22 @@ export function tryAdmitWorkspaceActivity(sessionId, cwd, { pid = process.pid, k
   const external = isExternalCheckout(cwd);
   const path = canonicalPath(cwd);
   const token = randomUUID();
-  const admitted = mutate(layout.commonDir, (leases) => {
-    if (!external && leases.some((lease) => lease.kind === 'management' && overlaps(lease.path, path))) return false;
-    leases.push({ kind, sessionId, pid, token, path });
-    return true;
-  });
-  return admitted ? release(layout.commonDir, token) : null;
+  const lease = { kind, sessionId, pid, token, path };
+  const admitted = mutate(
+    layout.commonDir,
+    (leases) => {
+      if (!external && leases.some((other) => other.kind === 'management' && overlaps(other.path, path))) return false;
+      leases.push(lease);
+      return true;
+    },
+    // A newer build's ledger cannot be written: the reader goes unrecorded
+    // (prompts never wait on it) while management refuses on it.
+    () => UNRECORDED
+  );
+  if (admitted === UNRECORDED) return () => {};
+  if (!admitted) return null;
+  track(layout.commonDir, lease);
+  return release(layout.commonDir, token);
 }
 
 export async function admitWorkspaceActivity(sessionId, cwd, signal, options) {
@@ -166,17 +366,25 @@ export function holdWorkspaceActivity(folders, { sessionId = null } = {}) {
   try {
     for (const [commonDir, paths] of [...groups].sort(([a], [b]) => a.localeCompare(b))) {
       const token = randomUUID();
-      mutate(commonDir, (leases) => {
+      const taken = [];
+      mutate(commonDir, (leases, { unknown }) => {
         const conflicts = leases.filter(
           (lease) =>
             !(sessionId && lease.sessionId === sessionId && lease.pid === process.pid) &&
             paths.some(({ path }) => overlaps(path, lease.path))
         );
         if (conflicts.length) throw worktreeRefusal('folder-in-use');
+        // A recovered ledger may be missing a live foreign turn: wait for the
+        // holders to republish (bounded by the recovery window).
+        if (unknown) throw worktreeRefusal('workspace-admission-unreadable');
         for (const { path, external } of paths) {
-          if (!external) leases.push({ kind: 'management', pid: process.pid, token, path });
+          if (external) continue;
+          const lease = { kind: 'management', pid: process.pid, token, path };
+          leases.push(lease);
+          taken.push(lease);
         }
       });
+      for (const lease of taken) track(commonDir, lease);
       releases.push(release(commonDir, token));
     }
   } catch (error) {